6a2755c204a42fabe91a46b3f6ce2f02dd23750bbf977e42bc6e0a587d2c1f6b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260805-bb1passvg1
SHA256 6a2755c204a42fabe91a46b3f6ce2f02dd23750bbf977e42bc6e0a587d2c1f6b
MD5 4e361dc739551c68761cd3b91947a546
SHA1 ed5954b26fd918aab4edb62dc6c5ad9f7b635518
SHA512 3b38016b1d026e518e265f88ce60d012668a4635f7aebd898b702e4e004b60d323ee0ac979c0c1149b6fc960dee2e98b4bf24d9a06a73aa4af9c0b3174ca402d
SSDEEP 12288:JUYJ9biFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:SYJ9bAnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T15D65013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3160	elevation_service.exe
1404	elevation_service.exe
2920	maintenanceservice.exe
256	OSE.EXE
2896	PerceptionSimulationService.exe
3700	perfhost.exe
5420	ReFsDedupSvc.exe
1232	SensorDataService.exe
3484	ssh-agent.exe
4440	AgentService.exe
2764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\350736d383806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce9634a37524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f25fbce57524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005121f5a27524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aba091e57524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed367ba37524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000aac880a37524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f745ea27524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3160	elevation_service.exe
3160	elevation_service.exe
3160	elevation_service.exe
3160	elevation_service.exe
3160	elevation_service.exe
3160	elevation_service.exe
3160	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	4440	AgentService.exe
Token: 33	2764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2764	SearchIndexer.exe
Token: SeBackupPrivilege	5420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5420	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3728	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3160	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 5124	2764	SearchIndexer.exe	100
PID 2764 wrote to memory of 1556	2764	SearchIndexer.exe	101
PID 2764 wrote to memory of 5676	2764	SearchIndexer.exe	102
PID 2764 wrote to memory of 3632	2764	SearchIndexer.exe	103
PID 2764 wrote to memory of 3132	2764	SearchIndexer.exe	106
PID 2764 wrote to memory of 620	2764	SearchIndexer.exe	107
PID 2764 wrote to memory of 5180	2764	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2920

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ce5f75fd93409421203bd73e60579008271d521f8b1ae6cb3889f2a91faffdb9
MD5 471d80fdaf1d5b90b2f83192c24228a0
SHA1 2fec551d8c3a8477c91b7e6c84881c6a68c3d8eb
SHA512 f115835ce16da67cc44e47ec5e3f47c38cb867a24ebbfa1c5c1baca941eea6d5e8d50118226529de9c4af3ecb1bed9d51fbe3ff6c5fecd79312afc8f9643c60a
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6Q/lFTjN4:93q6HjBmLm
TLSH
T171D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 73f87a9a2bb840e973d2e09cb67f9baf5b170efa0ef7d3fc2343d987891fe14f
MD5 8b54ff8031374cbe9769f56bf9a56897
SHA1 f3b48b48957d8cc5a00883123dc57712f0708c4c
SHA512 e340115c6f0265d9beb45849439cbbad47503da7d99db6dad2683a603241f34eb2d7fbbc7a51ca9b75616f10ac275a6a8b5c5bd6f1dfa2ed07ec89399e3d6c64
SSDEEP 12288:q1XLsswWkxy2lRq2czAtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:gXYfDtczANnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T12565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f493162ba8b5f521151681782bc5a77026bfbbd1eb630ac273cb4628a28fd2ee
MD5 59342e53d1e82d1e6524f03b81b56e5a
SHA1 573837346314dd7f707111d85fc8d48059252458
SHA512 850940891d0748b07e355e5f02b8cefccbac1025c8a085e3d64d700c2d03266bad120cf42690eeac15e4c9e5405cc29a7b3aa277799ba585b7467d264b940984
SSDEEP 24576:L0Le5ji0hmxLrMynQ/tbw/2Mkjy6Fr7g0om:LPji0AlvQ/lFTjN4
TLSH
T19A859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cb6fafb24e3aba1f6e633e1dc6083b8de8925336eaee969d9eb0610c1f1d4a2
MD5 51bcb19772ebf37ec60b0b08120f64dc
SHA1 81ef77b3a78bdb24a1207817db38bd189a9b845e
SHA512 1c6d457d89819c110ee5be52b267dde08a58eb0af7229995b8ba11913ef294d19d347cd750eb0d2b77e39cfce622f0dd528113d9aa57106d34d0f20262b322f9
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuInQ/tbw/2Mkjy6Fr7g0oi:h/ezSC6vUzPvxHjyrQ/lFTjN4
TLSH
T137755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 00eef0bbb2ae775d7151bb5e4c6f723e2889335c3d0fb9fc62c23f0d084db447
MD5 890b7d071ffaceb5b399e75ac87da1f6
SHA1 97bd9324a574fb3e7e78c2343242ae53f1b08b7f
SHA512 b271d80ab68e242fe40a69606ca67cb5d688bbd191c197aeb34037ca88ee28bd48f231c9b11a1d49131745c95bf1fb987af131cbe8599551a83235d03c17a7e0
SSDEEP 24576:TVbqPb88hv/l+6xnQ/tbw/2Mkjy6Fr7g0ow:TVO88hXl+uQ/lFTjN4
TLSH
T1B6559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 68397af668370ad98aada973bf0954f6ccb47a829b7ff74ec1ee99e3adfa1ad2
MD5 89f1e245f25ef76ba81364eb36e1cee9
SHA1 0f25ac04ee552f6283682801c32f10d5b28381be
SHA512 9da3483bd591d250a776a735c451ee657aaebffdec5e421a663fd46ccc93a1dd7e749a3a2936dde68b7ae894e59a64834bd8ad75a72be41ac8da420595e8a60e
SSDEEP 12288:gzWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:gz2nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1685523796A24F887FF2B06B15CC284826B7B0EC1BFD5A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c4fd56b266fd2d31dcda8d031f679f5789ff5baba0e1233774872fd48d088a2e
MD5 3fbb4e4047a54d375d5c26fb89931578
SHA1 53bfa17794c85f571960915bf6cd815cfabd224b
SHA512 cf27623c5e3fccfbcade869565a356650df36a704ad174a89bd05e95d49bb52139fe6ddac8f6d1e16b07fd3347e9fc8438dce455e814dd8926671cc2dfa7f98b
SSDEEP 12288:MeBNUbTVO86U5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:MJIUJnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1BF75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 55cefc741a2569260ebe0c18b1e232a667bd5b63de38a5a3a2f9caba8ace4408
MD5 e4e0bdb04b660b30aacab5ef658350f1
SHA1 a00b1d0c67007be9bd09a120639dd0ac6ea7c73a
SHA512 a0dbb7e11e2e78f26ae203b13db98e185f48eeec638e072a24a8b6e433d984fdeb978a5fb46857a60b556520ce4d23309902914cfd9525b0bfb30f8ad91a4aff
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:tQvGAdlCEL8c/yRNw5CbLm
TLSH
T1D2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 302b350d0a4108aade8efa57a6263b87f3dab3f5f38c2d8ab84f5b92e2635935
MD5 1c354b554be44edfba3a62d52c4770db
SHA1 3ea77ee01d31bb301b7a71e0904560c224cc9d49
SHA512 63cb4ad6a733a66307239bde62e02f616e3ab6ae89cfefad52076dda5ab8b74c2e3c6aa3b7c2922ec21ab790b21fe9320c7a12185c60956148b0f56a8868aad6
SSDEEP 12288:lAwSfxL/2Dc39DLLmt0LDQewsAj/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgU:GQewsAjfnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1B375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 019807d9520ce042336dca00f711a00b17b5646672b3a99729f8eb78a4f24d89
MD5 720004490b923560b690aa79f5d5f297
SHA1 2aebed9b643fb2073d26af15c46aeec1d2f6614b
SHA512 fcbc820ea52e0de13952689de2082d7a07df5bd6b2a34327e005e0c84d27e45ac899fef65fed9299bff01f12e67cbe51ae6626ffc020c5b6e9313117ffc2edd6
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHML:2UEtQevvqc2W1cpV2EI32
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0a9da8794ef0d160f797d79397ef7d1acd90d1d7080270f12a9301506a25ca72
MD5 181837aedb7114ad4ded950e0320f15a
SHA1 8cab321184c2c2f586c3fdd029f10e22fe75bb61
SHA512 b1300737fe23782853bb57a70817b8f2263f84f54beb571c82ed63764dea0f0199ef87a90ac20679917cc0b8bb78e64d83bc8b783c52dcd6b10b5ee8176bec0c
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/z/Q/lFTjN4:GoqtVjnmXLm
TLSH
T145D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dcb9fb8c2205d6fb89e7eac8de30242c57552260c68d522abee4073c1b30b986
MD5 f8f489a9b9a710302aa98ec072d7bf7e
SHA1 982dbf6e7db690da0912a9e0b0f618efe59ed61b
SHA512 1353ed406b4b3b2a41645a890f92cda4ad3a984f1c48c78b5e0c2129e58c740ba5aee8f5fc264beea859382854efc857d2b15db9b5b0a22fee70781c6d8b6d37
SSDEEP 24576:aAhGLJIFoiwtA5l7S53EnQ/tbw/2Mkjy6Fr7g0oj:aAMyFoiq5UQ/lFTjN4
TLSH
T1E635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cb86bd798c99db5b747dee360ffc2127e49fe8b75d0c87b3600e042c805acccb
MD5 5ccd77c43d847f57087f560f31f155cb
SHA1 3d3f30b025533a8f0f343331b6aecdfd7a88bf98
SHA512 180dbf6206a861a64e83a01a601fa453e128968cdfea0b70a7accb59348e5d3b4af30409e01bccec364b086f8b370a56053346f654f9d1ced72478af09ffae0f
SSDEEP 12288:Hmw5HEjsChN2BFgl0WDm+CoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMO:GwuHOWLnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1EE65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6e1c312641a562a43d9d0c2a53ecaa0bc83574a5bfef658941e9f8039f0ea003
MD5 20ad3841ec6c10c664e36aa7df0b669c
SHA1 da2143a97ffff15955587894ef4ba1eab4249802
SHA512 ac3f4f08e43e3636c22a22f1f064b8fd03ff79712e4e1020efd3873e5f33bd7b72f17464cea06958881300f468051828921a8ff0713706a3b946abacf0c4d888
SSDEEP 12288:TXZ1IyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:rZuqnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1C155126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b2088d3e24d35d500f6674522b70db594c538ba160bd3f4306f2c8ff63dacf12
MD5 f1f26ed9c5e00b198a5ce0b568521420
SHA1 ec49377021e1a6b10577affc4d08312fee92b385
SHA512 246dbe7149541a677ed4bcb9ba03041d55091721c26a5ecf10b9da553b60c0d1af16b7149f8fb4cc1efcf2b08f8c202e0729c357541e8a0d08f831c259eae50e
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:rQRQyi36YOcPQLvw2gAf+PN3qLm
TLSH
T1AC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c011c708d5dddbdf7895c9ce284a36afbbac5bd55ac9eeeb0d8c74b55d284d8c
MD5 7f95ffa7b460f029d92dba1beb891cb3
SHA1 c35ce1880e1a28820be3efc42340b8359f8cc3f0
SHA512 1ca40b35be26cb368891c548b0591ceda5483cd53b771a54c48b13cb153b8c47272586b7ba03560ce1e9abed05688c7c492fb30975196d6e2acacf9feea03574
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:uQRQyi36YOcPQLvw2gAf+PN3qLm
TLSH
T14C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f142af4d4ffe0349700a90f3b285dd9038ef6d9cdff1e07a9671aa15955166a7
MD5 35d323ddcfbf4f107d4b2b535ef714d2
SHA1 48ab8da30393d8a82237a42c02f9810485cd34d3
SHA512 dcfe8db08f621d773147ff272b9f59c208180e00c7dd06a00d20bbfbc2e131607f1027493dd24ac063cf8c38fcd4fa92e31b5b26503874809b2fb28775b20b9f
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06nQ/tbw/2Mkjy6:k68Qg55nhheWu7PNU3/vQ/lFTjN4
TLSH
T1CFB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5f069dd4cb88ca009db73aeb284991ac2482d70f7a356b2bcb9190b9820a7d62
MD5 4ae06dccc0b1edb41bb092111d4fed33
SHA1 dd72acdc99fc50b15380a0a54c4351e9b7e8d2a1
SHA512 f54a0321a5571454528b17a626c15e33062cf36a80edf1d45676bdf0d7de81ff86df070cae9fdd357e85df30b02cc7bbb523c4ef95a2886aad74e1bc8e9379fe
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:0y5112gYy5azzVvL69nLKnhZBLm
TLSH
T14A167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68aa189e946e3b939c9d9bbb58529885daebe0cd6183c468c5dfba624ae0a8b7
MD5 e96298ce8bfc084ec89db8ffba6edb79
SHA1 d6d2e87f9c705c59dea9af364300b493d238d9ce
SHA512 a557cfc38a6187df9f9dd6e30853cb182671110ebdc81f9927b38c1f1cd750df6221593dc25b124fafd7ca2c6a7bc783ccf57c684a22ef21bf88c62bf4bcee8d
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldQ/lFTjN4:8u6JmVxd2dSLm
TLSH
T11DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ec7352d39e0e024b5ca529666197b17470a55595ea1acb9d844297a0ddcfd3c3
MD5 0b58e48ab0cfacfba0f614cc229381ad
SHA1 f31b8642a5c4b454cf427de00d2e6e5db7ed7aa5
SHA512 919483c29cae3b4c904a4f5edc6647395ba3014e2d5dded7f198a621a672294e9e815618e524865f81192d22bf1d7e08978b551645b76e72323983848b0bcdd1
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xpQ/lFTjN4:rmifPbRXLm
TLSH
T1B5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c8dd38b504d84226708391b25a13be9d955c51076bc549f7c02a4de8e30f08f7
MD5 22ae396d2f2336049a5f1e18f4c7af08
SHA1 b3a11e3e8340f2f1188e3228508429bb6a7dab47
SHA512 083cdc21fdad3ba382c0814fa86d5b38d404b23ba5f87c9e155cc123a7f486aa80adf2b55ae09d4fc41a170048c1d64e9fa030a4c25c04ccf17f6cd2a80f142e
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHqqQ/lFTjN4:h5dKTi61lLm
TLSH
T1F1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c3f682e1e5d5bd54a27b6c01670ece9db8fe607adf049d56b889e0f252e803dd
MD5 6b44c55eca1b11f53aa9aa7f78c7faa2
SHA1 a20468e4e1ed273493e7e3892fd7703f31627f0c
SHA512 0bf20ff2445c9b3c730748f6db27f4fa302433c950b4d643a79d739c02af8d222ebe1cffc3f56d2fd857958811fe734dbaecc1369c7335155115e5c753183a38
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wNQ/lFTjN4:8X2iyphzLm
TLSH
T17995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8b2e4008646f5296a3c1bc31f4003274e7a568f313ffbd8c8174d906f09aeaf5
MD5 71c1d1aad1e86d56cd34acea2a94118e
SHA1 f5a144e6337795e67d14f14e9e10b62f5a5c6947
SHA512 bd00c536d2cba102e9e3934f467c7efc9dfe59f798e7e8c8d97ee92b07292530cd4bba1d58a7bf7b5200e397fdd68d1f302cb54cba95074338d4afdc1969ace7
SSDEEP 12288:AuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:AunQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1FD5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ffa97a477d76a33be51690a1dea1b092e20a07abc7ce01ba8d5db936218f84b3
MD5 063b780f34ced9f02297e1eb2eb39b9a
SHA1 f24b5243794d9e509b1fcb3023fd199c9e9a8be2
SHA512 ae340a96f7606bd3a1f4926f8b3260720032b74012f1ae73d14864fc0d6bf73c08aee92113ce1a5adb4b13e315bb8c1e437e935ae8af75998f6400ac7c1e7661
SSDEEP 12288:GDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:GznQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1BD5523797965F98BFA1706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7a7b1903ae0595d82ca525c3153c8567cf28401d1345bf8b036d40579bb58d31
MD5 9ff7970ec0d45ffda70ebab4e36d1869
SHA1 83ed54c4114c53fd07c0eb7b608854ec1dcb3a5c
SHA512 3b4d1435f4faf142d528d01d8314ba4edb927b7f362eb5cf7852d35fb41083bc82e04ceea1bbaf371ef2a7c5ea09ed094cc731c52f7c0c932545b1d563130961
SSDEEP 12288:OxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:OBnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1F75523697965F98BFA1706F1488381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bef93ed5fc66c16846912900f6fe750545ee9ac542d1c661b70ca4a0b0e4a232
MD5 7ded7cd58b532888a5db1c24a00a4bc2
SHA1 0c521b1869baa6ffdfdbf56f48dc565332586b5d
SHA512 57ec5171af1f60c6b3f3616e31307f8655b43943348fe1cb3da14f94010479dd9e7c382fabfb9024698b4679587df6c79eee687dd8573a0b5b3fcdc2b2214654
SSDEEP 12288:GVEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:3nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1DF5523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5949d54f72d1ce93ec68ea04233423375920b099aee3ddaa8a8a1d80cb2c3aa5
MD5 4cff6a7dc33f6a685e90101a05e1a82f
SHA1 45e3ea1f6777d3103d767776012c0ed00a75ebef
SHA512 522c523bfc41735394c0a5b0eec85cab91989aac7967309d6b68f7904f75899a830ab37f0d32f119910df567399606c9aa1ec3ac743e8850c491afd2103b938c
SSDEEP 12288:IsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:IsnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1ED5523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d6230961e7b2f019d3557acf1486c24877ff0529a5855ae5b32ef5e5f5d6d6e0
MD5 a34b71193bc6ed2a35c476d193a5a350
SHA1 013669862efebc69016915ed8c011b03ab553c5d
SHA512 dacd96f98f20bd5fc4cd443b5e61a441294f2fa7871d78b362fb334d902fde770b6c8dc0cb84965a4d7a7e75e1e99832243c618692ab9bf2c9bda59c75eb4811
SSDEEP 12288:93GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:9XnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1C15523697965F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 82eee24dd64f5b35f3bd8fe82238221f727093d6b5bcb2430c0578e8f04615b5
MD5 b2abc3721d65a9ce6efac910fdf89f32
SHA1 b39d8ae72f29f0314b05238b19559ebf89e35665
SHA512 b225d6d61ba20ff2b669ac616d455acaa630e31fa58adb0f971ae0a1215340be319a6725b06b74a9568a3f2e46eef143bdf31c93ed5116a050e8deb12b358e61
SSDEEP 12288:qrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:qbnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15A5523797965F98BFB2706F1488281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9e282a5637440de83452d052ae4cf0472e3e3ad350383fce1b6241c7e7609167
MD5 a5729f1996070de4998cbe88914b1e04
SHA1 cac7ea52e6c25f348c188bb13de9d9aee2be084b
SHA512 764c39ae36e674f496e2c4c61f2da0066686812343f7064ad3072fe92ea5a9d7c25b9665b96b54462655806954e8a01940267dc4c16edc6c68cbbc1b960c5ebb
SSDEEP 12288:qiZwbDzzFEoS2cPvyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:NZM3zFVSOTnQ/tbw/2Mkjy6Fr7g0on
TLSH
T13C7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cc50542148145152210c8d42fd83c260826ff51c8d65dc18d40e81aba3d3de74
MD5 9a53ff84f9874b34b8a28867a1d99f67
SHA1 931d895af5fe23b3f0cf7edfa3f1c6fd729f6e3a
SHA512 6bbdf2607081d3dde49d66d623da3c84a7f72f23569ecb7e3bc50657cb0f7704e2734630c7cde53fd4bdd1a7da1393ecec146a455b4ee6679d1e3ddcad690ce8
SSDEEP 12288:KaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:KanQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1F35523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 92980f00f86dedf0ebaa33261c957d8eb936ecc0ceb95bb50b4b2ade5a50c935
MD5 89d991e11c7eb5d33d44981e4c563aff
SHA1 2dcfd3bef9772086271370723cc1d1c15bdd0af5
SHA512 8eccc0964067d4987629743f81f9b24a8bb4abdc93e13ddfec976013d75aa3c18440f6a042643333997e577d14e2af3f0821cf777eb12fa42fd8ee617ed6fcd9
SSDEEP 12288:QGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:QmnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1A25523797965F98BFB1706F1488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0be6193be79d14798d6bf6ca5f9b915106d2e9f4b23fe8d37eccd29a5681e6c5
MD5 24215fb54bcf8ed28a41fa8b8b9810e6
SHA1 6b85122d30c849cfdc7ed9397e240dc09e2e74d8
SHA512 b60bfca40863bbd2cf358ab80ae8f984fefb272df5365cfe50c729d50b7d929cb3b9105d9102186316f248fcb5e513a72196697b5b34af5e9ac12a88e903d948
SSDEEP 12288:KyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:XzyPnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T15065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d443f293bfbcc42c33cc679a5fdf8f09105b2f9c05ab58e89bab1b7ab916d956
MD5 9b0327ff4876a99dcf66f76246221ffe
SHA1 78007681614e2f78c48d61a855fed9308ea5785d
SHA512 47d965f00669227709c26e0686fe3c41b4e808d7be08add3286a8ba8636a73b30c4a8ddf95a0e46b9d15dc6ab1411141b6f2b2b7df008de5f7ea4a615be94e0e
SSDEEP 12288:oaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:oanQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E75523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a566e3f36cbb3ccdac0745f9e6d8e524d365ced5bd71b66dcfa1c50947935a19
MD5 7204d1f0d5863892b50ab6f27a42558f
SHA1 a7a724cdd5f9f22b0bcf38d9c760baf1941b3f43
SHA512 a5c6e05aa81765b75643179f3d3983ff7ab6ad039f5765a6d94d1f5b6a5e3e6bd8f99b6c844395224055a4ca087e7dd0e06332be6f775850c769c234f4ee2cd0
SSDEEP 12288:8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:8anQ/tbw/2Mkjy6Fr7g0oA
TLSH
T12B5523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0c01fd1dda4c4b5cfe9a7c227c8c2968879e97ff03460c874e65c46782339cd8
MD5 0fcadfcb5d2fba0de0eaf83d13983c9a
SHA1 ce56f9f00423c9f0936235da1851c08a780a774c
SHA512 fea6e302fbab012890e084b94f7e3560c91efd85780d02f91a3d061fdbce22d83df21bccdb17a4f2f7495c76d8c49222c831eb7820d3de1c0d5076d1a358f320
SSDEEP 12288:IyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:JzyPnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18D65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e037d5082ea29163301ca26925fd6b293df7050ccaf21eb409406ffe6236ef01
MD5 f3ee810b0d600522f210a04e5c96593d
SHA1 feea059bd3946ce6370fa60c4ea801a0a05a6a36
SHA512 ad98d76e855ec4b94b89bd01c64b2fc8f406918c8511a848b1454d3757c8d8adf2686dc763948a4848aaecc74b9a0430609667bb881ac55d090402f81a4a301e
SSDEEP 24576:yT0aLl3z0zDRnQ/tbw/2Mkjy6Fr7g0op:yTDLljIQ/lFTjN4
TLSH
T1CA7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 98d2f55821e76acf09c41db6a931dc8f047c598ce2250a15e89dedcfa6ac2ef9
MD5 65653d67961dee02b941ef8cd8accc34
SHA1 8ea354ba773d9823e0c0e43429da79e73de16a86
SHA512 a8f508ec3364053f4daaede64e6807082e94d7a3b21352086ed8de62ff580c68b1d59e23ff9b05e8354b0aa1e6bd3c0aa713d5b9ec9fe8e60a28ef083d42e0eb
SSDEEP 24576:G31d9CHKy7GZlnQ/tbw/2Mkjy6Fr7g0oL:o1d9CHKyaHQ/lFTjN4
TLSH
T18685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a2b5efb634453f38446545f96ee878ad147cf1104076ad720aa5159ba487deef
MD5 4d7f240bfc0f4c41edf0272afe49c3b2
SHA1 e61c15061f010ec9afad299f1e433d5f078a7935
SHA512 c7db69e3e533052c870e9dcc1f10dfe236b32eab0799f466b80340f27c49b1f6536ec8b0c1a9615ffae164b119dbf88455ef72a6eca7ba5344d711d82e76a29b
SSDEEP 12288:kRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:khnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T10E5523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2d9fc6bc90fda58f9283d4c96ce21efc849b9665f45c73f22b2c367145d15af0
MD5 6df89be1ec1937c20ac56d8cc0c36477
SHA1 59d57ca44d4cfb1cd158600d306931d1c71794cb
SHA512 5d93a63c494bb8d0a09f2c36712e241c2344240bcd7a49fe26b96a1d6608c8c8be67d571bb0703db6dfbdfda1c48097c9b36d52ed9310e8014758a6384710ba8
SSDEEP 12288:DPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:DvnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1C85523797964F99BFA2B06F14C8381429B3F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5d174ddb092aa28452608edbf22f2bda59be2a940ad04fd1da13d7349bc517a2
MD5 11154df603d928bed5eb5a18925a801f
SHA1 07708b8cc460b6b030e8c85991ac0281e8fad575
SHA512 a8fca18185c6e548c5f43d966472601196312bbe5495e9c418b8550613e53d29c775b6a0be072163f62ba8d19e6a222aa9d4d5ed4234b46cf11367d6012a7ff3
SSDEEP 12288:YwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:YQnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F35523797965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9bf56d668653d9ce58e37a83b9a001fd84267923893e62b44421f01b9d76e839
MD5 3263c9ef953afc4ef4fde048f4cfc033
SHA1 4135cd80f228ee5dd4bb34304f3800f2d98ff7fc
SHA512 3429bab21d76c2d1afb7f01b9b2125f06e023c4e1a778cbe7b3e11f62faf343706015d2e32ac5e562fd3cafe04f94454d0183e9142aafa4581771ba7fb511dc5
SSDEEP 12288:FaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:FanQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1C75523797965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7cab85c4d99888cc53d167ffaf40c680540963357a4b48e66fe21ccfe2f3d66a
MD5 891406b8a8b7b748746447cd8ce39614
SHA1 0d30c9aa49ea83a31c212f9f2c47632163f91288
SHA512 7cab10d542beac6e0d31aa7d4c7bfe945ff160e9e0b6d3e5504ca582a0e91940efb7d3f10c32fe826f8636ed0fd57515416ceec0bb40d575704d9c4d6a5ced60
SSDEEP 12288:vRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:vhnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T12F5523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7566f120f6ebf8baf5584a586cda74abe5796fd4d5922ddc16fb72dde8bb5ea7
MD5 ba7de852241f1ed450b788209ac21650
SHA1 e1caa9e400897df7d5ab4140ca5b9e7c9d5f2c8b
SHA512 e3e827d7537544b42417ddd57ee51eaec05616582ddfa8b83b4365988d202cebf3df0f856df386f87f7ec2df7d75eded443983c7ef06768d8727e06e13ba9194
SSDEEP 12288:dCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:dCnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1815523797964F98BFB1706F14C8281829B7F0EC6BFD2A38F7B481129967D39405CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4e59c2c9833624f4214bf78181168d659791bc45644907917a422c7b8cba7aab
MD5 801fcb0ad88feccc9c2579dd2d8c79f1
SHA1 f8578f91bb111563eebabee6ddc55781a54d711d
SHA512 8d24c07b4551defd4d8ec2ac6fbb1179df44154e4441779ca3164343a0d69613ffdde6f240d5bb25dc423b45165e621e70a4482e87b7019704dca11a30a5c099
SSDEEP 12288:SsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:SsnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1305523697925F98BFA1706F14C8381829B7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 949c056fe3d4b89343285af9058868e20e22bedbb89f7afb7efc7eaf68661bcf
MD5 bd285339eff2cd310897564c907c84e4
SHA1 a2173ba064869f439297031ac5ef4c127d3741f5
SHA512 5dc958a5730eea3664c8db1568c52afe96a411fb0889f4683466cbdb8c8d4efdb7d5e8219d0ab96729ec88fe8c84138f62f4f63931fd0d71df64444659cee8e1
SSDEEP 24576:Hfwv/k9RX6wkyAIWnQ/tbw/2Mkjy6Fr7g0oG:2MnYIWQ/lFTjN4
TLSH
T1E385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8a52727a7f8e0039567d42dc20aa5d91cbbaecd9af442f074ca3917d6555272c
MD5 1e40afe47bad2d02bf45f35e4de16e8c
SHA1 13f7390a19de6d76e66eed95f65e22e6b079d83c
SHA512 f51286457af70c613b6d5dfd2555937e12d128b196a99a2aeb9d7033114350a9a969a0bf4eb0f1eff8c93a3f1685f068a8fd674a582856fe9e0e26d27eb56749
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tQ/lFTjN4:bySzPKLm
TLSH
T1C6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8d62d5509c5940ae335aebda74d2773252bd018853f34929a8e53ea98b8400b0
MD5 347569cf6ce284bb292d16ab49a4873a
SHA1 67fb1c0a58d77546dd59eacf3875a5d7e9c3e7a6
SHA512 15c06fb20158a69e003097352b23f2a9e0ed93267017f4f1ccb924e5547ab10434e3173adddba5f1040e9b90dd20af1586846208c3c542b0f614f58a14f08707
SSDEEP 24576:Q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDnQ/tbw/2Mkjy6Fr7g0o/:Q47JUQj1irIhCnDHUPfF/dQ/lFTjN4
TLSH
T11365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1dab123c30025ff162379f6b0d36ad6b76ae1d55d1d5188c137c838658f2981a
MD5 56ef329eb68a0cc267c479d95963525b
SHA1 f79ef5a46a9767e55bbfdabc7ec876e16dd54913
SHA512 518e2bee67b2db467a545f43ef01fc2354a0baf089cb57ea1619f4aa8434a2d9d6d1f208bd4e6e31e1587ce2e007446037c5c3cd01c5a8e313bd020069b9c166
SSDEEP 12288:kssfqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:KqnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T19365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 302a7c1debb040c3df18eb5e53d0e32e2702f03c2e13571285cd1fa1feb12053
MD5 df15564e418fe2d5c6a9acc7e88059cf
SHA1 1895d52312d9aa81814932e7e1a33524c8b16f20
SHA512 eca76482db5f9baaa40ed79bc1534a517064ad5c767f072c84643544a239e8cd3a8800976561f28ef85a83f835329c9992de9ef4324f94044dad53b6e064549d
SSDEEP 6144:usBC2naihDxR9yIfcbPotMxvMvVU3fUkjp7maD6HMzq45IR6UiZ6c3E8xs4O29ck:7fqAU3fjp7meOgNUizU8xs4O29/sO
TLSH
T134252710766BD75FC6A940321E73C5CCAB707D41EE05AB0372C8972FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3a844a2c38754a2397d13e03120798403160b45394b11fea1a975177297f74c7
MD5 334f25b329692c82eab06985e66c9f7d
SHA1 cc5a8703f66dff1d2371600d85348f2eb73d4c1e
SHA512 98d50f1d0ad35917c4a63ca130e00fbf09ab23a4b4b48d402723fc90e5fa14754709e877b9486f8a1b51093d23d87d42a1f7ed89cf6fc009e28f34864bfb2106
SSDEEP 12288:SZNkBMkTrp3c8nuoSrjTm4aij3WmeYcYQZb:SgTmeY3kb
TLSH
T1F365C7816537A38FD1FB6031076A9B4CAB64EC06B3095F2667C4053ED86BB65A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cef4f554b537ba38751e80c378440dd002278ed77b9adf72796f58d0f0e668ba
MD5 6093ead3c651da7e8c9c879f8ead0bb2
SHA1 251e23dc4c99c1fd35024dd96011ef33a868ecd1
SHA512 fa64e269c25f9c48c66a0a009382e99ede133e9d96a76c9d17b430d56b8fe9aa3a7a970d4e27ff8242e2ed84ef1ac97dd3118f9b04a4d0aeaa70bb777a18871c
SSDEEP 12288:Q67SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:7SnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1705523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 60d4720ce5c22da382668c6230f680e76275f05a7b3eff9b301dd9fe7dd3cde3
MD5 dbef8b6ddcafcc142143718e83b7774a
SHA1 63462f950f1af811bb3e4acaedbfda7394c95a76
SHA512 2d6c0653a93e3d5f45859a6b8bc7b05129a25a30915196dc3d91e52af29895f009f822352db6b10ecbe4733c0f844f3b0071b1aef64398db308ad60f7abede01
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYInQ/tbw/2Mkjy6Fr7g0oT:wgb4mBIBhGFDQ/lFTjN4
TLSH
T19265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 927089faf7f3346abbed47f7659cb75debcdd7f74fe0cf336fd0f23a3234ac23
MD5 44e28c89a1caeec9d7af1f5203a9dc1d
SHA1 0a17567f04ba620bad2c76e3d4dcdf8649af929c
SHA512 2eacbe07d7dd9bc9cb60d52bfc06ccb7b31cf5da45116e1bed52d8045f750c5045a40589ead963e6145cd1e9bc3bbc318b89400aa7ab2602c7b681b774fa851c
SSDEEP 24576:LG88u8FpJqH1Qzria7/mTnQ/tbw/2Mkjy6Fr7g0o2:K7ZFPqVva7/wQ/lFTjN4
TLSH
T1F185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f1de6da3d5865b369a17cdcc938e2d6f1a973ec6c45ce9222c7e87649386ee63
MD5 34a4be4af2ad1e135848ea3636b4813a
SHA1 48d1450a88347d9f03907a6ccb85459b6bd1607a
SHA512 347b6a3a1672b8950367308a9e2095277ec83ae8da1f4efc6721cdc0f84522efb34e9259e8e01307b537b281d68484ba2acf8c07b18f36b3ef693b7ff77cfa43
SSDEEP 12288:SHvUrBFrEjwaQnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:SPUr+NQHnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T18D65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 072f8e39916ac61ebabcf90135534cf8539703ecb4a4c846e69bb56e004cf5e1
MD5 91609c377d52431f365efcfd601546d2
SHA1 61679c72d29fca859c28e3c49ed8ce9b27a195c7
SHA512 3258301a1eb75a640f61498692fb62007a9859aedfb85acb5a8e5c72e2087108d022c6a7388e55157e09206913e3e9018bd2056b0077c7260f79bfde1787f39a
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXQ/lFTjN4:XG05lO43b5Lm
TLSH
T1DDD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d5e79ce458a66a7d09c1891f9cd747f6d1fefd70a9e1f29f99bbdf3feca50ff
MD5 cac9f68edfb4ea36694a619ba81240c4
SHA1 25dd1c5ec810a2a12695b8b9583a41526408fa1d
SHA512 1acfbdf3d4f931080421f62ef9646bd3bb9e962bda3908ca473652913a90ee709047d41962164969c38872c03a1d215718ac2999d3b24993ef24a275ff2d0481
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidntnQ/tbw/2Mkjy6Fr7g0of:sa5POZ3+Jt2pasx2+mvQ/lFTjN4
TLSH
T10565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a37b86997812fae4b89cad75197ea815f7b0c4aee6261a48e2602f40a140d1a2
MD5 f0cbdfe30c3e4618a7c401f88a204553
SHA1 0e37fba9fac50a0cc7780731c30725e492385284
SHA512 1a8b2d9308384803aa7dbe333f3a73e8d2cbfc5b98f299f0069fce9edb067d09759cf5932e9543b07e4cba3619bac5d96fd551e4e2f489d606149ff55f8c4fb7
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkrnQ/tbw/2Mkjy6Fr7g0oU:pNc/zEOVHFQQ/lFTjN4
TLSH
T15F858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3ec23614ab0d31fe255b4d01569a83010ea3921f063b4048829a7ceadc3d7bd8
MD5 b39f767f6677302eadf62c9b666678e5
SHA1 d67dfd78847a9bfd59b28dd6320cc22abee1d548
SHA512 9b77c1826007ff731d3e508e505f1abbfb32d89f24b5af3ab57207acb03fcc624611ef5fa268d3246c4cccd11e7ca173d15f99def790215345310b2ddead9aec
SSDEEP 24576:88kNvNnaFeYhJNtmZBm5nQ/tbw/2Mkjy6Fr7g0ox:88MwBtOm5Q/lFTjN4
TLSH
T1D955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f82278fcee2a02f38dd7afe700fc9688396884e21105f4874db34a5936b6e0d7
MD5 a1aa513e3d942e25d5b69abc8109fa5d
SHA1 0797dcff186521a5c53bde4f83471badff9234f8
SHA512 c65d57ed803956db910da71115c204e15749d2673773341b554ee39510fadb969d74cf1eec04ef2c2b89b28e39d88014dc90859c4269aa58e29eda019417a7e9
SSDEEP 24576:HD3FHshBIYQgAOnQ/tbw/2Mkjy6Fr7g0oN:HDVHeBIAAOQ/lFTjN4
TLSH
T1A375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/256-245-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/256-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/256-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1232-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1232-314-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1232-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1232-102-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1232-108-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1232-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1404-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2764-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2764-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2896-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2896-280-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2896-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2896-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2920-47-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2920-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2920-50-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2920-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2920-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3160-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3160-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3160-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3160-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3484-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3484-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3484-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3700-295-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3700-79-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3700-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3700-84-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3728-77-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/3728-7-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/3728-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/3728-1-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/3728-6-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/4440-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4440-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4440-127-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4440-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4440-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5420-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5420-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5420-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5420-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5420-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5420-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download