12c0bd5452abb30a1fcc19f35c7acc1d9589fc01055b50cfdf9f838b2d1f1c06

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260807-sxpmla1thz
SHA256 12c0bd5452abb30a1fcc19f35c7acc1d9589fc01055b50cfdf9f838b2d1f1c06
MD5 b12ebfd453d8310ea0918161680d8dc8
SHA1 9b7a793836c444d5637fa3b7d5e8e12e0a2652b7
SHA512 17e8d0a59d2ca0ca738ba178800df503f0b0e34e101815b5d1c61ed5102a71018138eaedde7aac27d2ab9bf08dbc9be04d93e504a9873b8b69cd201cef6930cd
SSDEEP 12288:uUYJ9bi+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:fYJ9bTnQ/tbw/2Mkjy6Fr7g0os
TLSH
T12E65013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
7096	elevation_service.exe
6160	elevation_service.exe
6228	maintenanceservice.exe
5036	OSE.EXE
4296	PerceptionSimulationService.exe
6136	perfhost.exe
6964	ReFsDedupSvc.exe
6432	SensorDataService.exe
7040	ssh-agent.exe
6920	AgentService.exe
4220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c7226fc957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001062faba8126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043f0d2fc8126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000026af0fc8126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d299abc8126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000822b9ffc8126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
7096	elevation_service.exe
7096	elevation_service.exe
7096	elevation_service.exe
7096	elevation_service.exe
7096	elevation_service.exe
7096	elevation_service.exe
7096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	6964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6964	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6920	AgentService.exe
Token: 33	4220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeDebugPrivilege	4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4324	2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	7096	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 6936	4220	SearchIndexer.exe	101
PID 4220 wrote to memory of 6892	4220	SearchIndexer.exe	102
PID 4220 wrote to memory of 3068	4220	SearchIndexer.exe	103
PID 4220 wrote to memory of 4664	4220	SearchIndexer.exe	104
PID 4220 wrote to memory of 5344	4220	SearchIndexer.exe	106
PID 4220 wrote to memory of 5248	4220	SearchIndexer.exe	107
PID 4220 wrote to memory of 6120	4220	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_b12ebfd453d8310ea0918161680d8dc8_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6228

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6964

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:7040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ca58aa9affde912c6a6c54633601de6eb5efa66748545fc4cc58f96f7a20f453
MD5 49a286d0a4e2095d0c58c35c605c46ee
SHA1 19afa53681498df8dffa0b40bf554a259ee1c279
SHA512 033e836ae55174008a8a05d87ed1cda3eae1993ea7986503daa9d7873fecab33f4dd92eade7fd96a8f76906c89c276473931416c886c119260c3bc6f1c67af3f
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzQ/lFTjN4:t3q6HjBXLm
TLSH
T14ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ea8f3939e01c8cc1c35a7607ed88ee390c00e1281fe0d0fd96deabd224efb7ca
MD5 0893dd72feb300e72794d958f2c39a2c
SHA1 4df46bad09cda67b3c04d9dc2497043e7a20ad0a
SHA512 6540911216d12f05ebae8783dadade4ef124b68c0c0b9727a8cee88c02b8df4f473b0e48198a3f047599104e8c1b515081d8a5d55de3afacf195dc74789b5ca9
SSDEEP 12288:f1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:dXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T11D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d514fd8fd274ef435b30da4dc9d8eac6ed3d03a918e0f2cfad00aced20d4d2b9
MD5 0dd48284500df694e105846d3ae74d3a
SHA1 0c891f5cb43e8e9ab3985259ed138dbdbb8d8084
SHA512 e0bb6a1ebd71a670501f36c3ccdcb7cf4820ecd99f9631d9694f5fbd53928918693170405ae5fa0ec0a7f30baf7d71bab618eb9d45b17b32899bfec6233f418e
SSDEEP 24576:60Le5ji0hmxLrMLnQ/tbw/2Mkjy6Fr7g0oK:6Pji0Al+Q/lFTjN4
TLSH
T144859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 398e2309fadab565d3f4cb2e8fe85835a368d37b0236e4af27f57c72ef2381bc
MD5 b9dbfe366c46c6ab38f26c99c6beb106
SHA1 665993d7ac69766de98e70ef52030e80f7136b37
SHA512 580b10285d304bcb3e1cae35b889331d3363e8a6d7430f4a059988ee52f32ef9effc82826afb4503abfd73d27a88cff6561e51c8f2bf78e79290e0d97714ba6e
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuVnQ/tbw/2Mkjy6Fr7g0oq:N/ezSC6vUzPvxHjyaQ/lFTjN4
TLSH
T1B0755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8b52937fddb81cc092422cbf0a4e5e4f4bebd797749a5899be4276773d48bf3
MD5 a41355cfc6065406aa0c8abfabb347b7
SHA1 6a52795795d6f389eb4f3cfcf477608a8262a6dd
SHA512 1da1dc18631392a199af2b0e2d91ccb7553a7b85fe1fc5a251f3da9936ddf6bacd84981caeeb3cccc0a85fa12f7358a201f5d82cffa193e35d5a674c8e2469bb
SSDEEP 24576:jVbqPb88hv/l+6UnQ/tbw/2Mkjy6Fr7g0ob:jVO88hXl+XQ/lFTjN4
TLSH
T1A7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 372fdf9351dae11dad1f22be64647d25e81aa83d6d714fa88569d35cb11c3314
MD5 e311aa86aa24ad30ae8c3b7501fd873f
SHA1 6780b57e6a60fc05b4c1ba5c00b2eea43a9b523b
SHA512 a59b866d36525a2876b7434f5d0b2608a3ee2bf66f00489dce38bbac6465b086f41e560a2112e4f485105116e3b7d5b1f2e19ed7b1dd2d66041de6a4ba479b04
SSDEEP 12288:2zfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:2z/nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1F35523796A24F887FF2B06B15CC285826B3B0EC1BFD4A74E6B44362D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3950675b91bfa555c16d4d54f07a8600b73bf48792a167174813c4918708b034
MD5 18e4ae7e7fcc22d57d1f5492395beac8
SHA1 8099e22c5e7fe55cda9b1fb506dfac58db46726f
SHA512 fec5362bd45ee650b24103a47f7666fb2bcca878e6cc296b485cea8f70aa540d8f78fb766444bd6df74124e5bee5edd459cf54ca5a6a4ed899e46f1b24f4d9c7
SSDEEP 12288:eeBNUbTVO86UMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:eJIUMnQ/tbw/2Mkjy6Fr7g0og
TLSH
T13775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f0c7625e42032f17b6b1eb42bf7e25576556d84fa6a4c398a84d9b4275965857
MD5 c28e9d34cb082e9bbf8e20e47ab47e98
SHA1 dfd4aca22ee1a23eff841277dd0d17b6f11d86ff
SHA512 03f95774c61071ef102ee862368482a22bc232f9d01ee01c8b8d562eb1a2b30ba05d993e3770d94bd0d133f56fb61ec432e95ebedbe39870e3e11935438f9104
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:5QvGAdlCEL8c/yRNw5CqLm
TLSH
T1AE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b3208c01f2ae797a876bf4447b9ffb46c13d13f6aa7cbe6a77d6a4882fd62a70
MD5 786e48290aea2bc067e04665d6870f4d
SHA1 0e4d3c4b2f09bc9ed24bd16b3c8122f305f0a81a
SHA512 4cf31fe0c924fdf142d6b50871948b6a87d79b79f664194cf799a1c9610a67dd903f74c7306190d6d51f678a45520b4b5d03d26bb1b494144f74f1265cd030a1
SSDEEP 12288:YAwSfxL/2Dc39DLLmt0LDQewsAjuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgQ:9QewsAjunQ/tbw/2Mkjy6Fr7g0o2
TLSH
T10F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ed15bc980bf5eb98cce5b97954cffdf07159731126b0585a3638d7a06503584
MD5 b0fc2d2e8cf60364643005ab3fadf256
SHA1 d3ebd5d8df6ab01747dc0d88daa39a82cfc4e6b7
SHA512 b6d1408ddca3f8d9f8444b0d6c00538172615c1d85c68ac5126ad80ce5fc01f9fea604a4c2fa1b3124af8c02ee2b5dec6dbbfc7138dd0b3ebcedfdecc4c8f85f
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBL:cUEtQevvqc2W1cpV2EI32
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d52eaddbe3c9cd84c3772177c9ae5a45de4c105de6b135a331181cc1fa781e0
MD5 ad2f8e0c79c43cd833db43350897835a
SHA1 bfe94954af21a70ecee31364df8373ecc7469a83
SHA512 0c3c74ffa239b88fb6eba01252b563c772e1cc1916b70878a8797c7eb708b0502e44be2a5994cfb16c09e8eef89fd8f91fa20ac29e348a648d9229a3f6fc3ad2
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zOQ/lFTjN4:AoqtVjnmmLm
TLSH
T192D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8702c697e204215a0026c6582b6e3c4d883bf9542ed0484c16da49983cbfc127
MD5 21b8c257f9c344565b7e1d0e380ecdc0
SHA1 b5f813c059e1f314ea5b805ff1b3620d97fe43a0
SHA512 1dd70bc1f01347de15cd42d2a274688a6ba218e6572de962c79e9e28d145f20679aa2a305f9327786abe7c00b9c2c823246997afe8a59de316d76891970220f3
SSDEEP 24576:NAhGLJIFoiwtA5l7S53hnQ/tbw/2Mkjy6Fr7g0oT:NAMyFoiq5xQ/lFTjN4
TLSH
T1AA35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a0aa3b9c1f3152add37d99f32c81d3b4b7c15433347c93354a3e4da73b6bd5b5
MD5 fbd6df0f253d9d9a036f8df87355b02d
SHA1 12749c4f0d66a701789140f9562ef7a99c77a39c
SHA512 acc91454fad92abd0cea0d772b4ece6082bf00d5e28ed0c8d2181f2ea0f4147a8ffd9d9087325c6a6616f5282ec9a8ff35600d3a127b33e2c05651d054b4cbac
SSDEEP 12288:Wmw5HEjsChN2BFgl0WDm+CVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:PwuHOW6nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T11E65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4ba6ae27e13b6bd19d61916885c82c7642ba1960a007b868e935684389d248b7
MD5 9d38ca62cdfcc51c00ad498a30fec456
SHA1 efcc2ade584a2eea713cff1985ea38bb577cea32
SHA512 120e259997833513c045053b3823c24a417daa32eedd7cbedf3f4655f1d9c1958f75015d58a3a22305e1d481d15fa17ea0bda0c9928d7a7449826a0c26466f79
SSDEEP 12288:+XZ1IyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:OZujnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T12555126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 489512354b69e92bc7d6216ea0a423e021fc3512d69a01a6af9730cdb083f6d1
MD5 feca97927db88a264bc2c468d78f7822
SHA1 2399eba2638570deace7fda68e2cb97772a69c72
SHA512 f128feb9fdce2338b6bc1518312002edec56f27780d96b6235c67fac1794ea22f3d8ca0e7f02f4c942345e96df51a2cdab0a5bf9e91567bcd8b25ce96b46bf7a
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:9QRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T127667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 497e73ce1442854bd34d88c5b095231d603d08737003ba22efaaff34d4674b45
MD5 fb2a2dd80394fb04aa27d51294b3b93e
SHA1 5cf269b2abeda5df52e7eba4c562579f36d2bae1
SHA512 ec16084825c0c69203e0a92b212dee2eb5eb7032a977bb6a6b195598212e1d39ba6c4c5df767250afaa0628931ca2ced21cf9169ac0eef983c7af55f69cc1cd0
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:cQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T17E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f64b016c464a2aeea6e1b1b13ee5b7bebd1f564d6fcbec5b29fb426c0ce3272d
MD5 613405a98973bb9e5f596d03202928c4
SHA1 398d6e2482b368d5124b6885dbc328a9883d2fd5
SHA512 53274a54f20dbb67271e5a05a0f0e21df0fe3d1a1beaa881d702f2fd278cb507528719292ed2f9a36f3223012efcfbe9cdf977822191d4dd55371ed070a7ce95
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0znQ/tbw/2Mkjy6M:z68Qg55nhheWu7PNU3/+Q/lFTjN4
TLSH
T13DB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be5b64b3bc38d2992697048dfa2c88c7b585581d859bf931c25b0ef2a9bfe9c9
MD5 e07cd525e0ab3bcd41a7de8a548f02a7
SHA1 8486f7ff5c953e1acd8077d1f6dd96d432ea92f7
SHA512 50d54c0c1b2587d12047afb3ece91e5b7b97aad68c861279f4c67df3c965ba221daf3b63f45591a16dfe93022b5c405a406af1184a7d0b95786cf0b91c662880
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:Ty5112gYy5azzVvL69nLKnhZ0Lm
TLSH
T158167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 61ab12f3d1e5ce78233af57330ed4147874210d937636d419d785fedf15df4b3
MD5 f3c786ee9692fe9ea8547f9e6d4ce4a1
SHA1 49d5f5fe54b47659f950633e19128d5d17f8c2a2
SHA512 a9086fa581080eab0331dce87524cc9fef8c3c3f060c65247421ed0e2997e321db0578eb650ed606252c2ec2231da95b77e003e89e74b04ff3608f7d9753c772
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:Bu6JmVxd2dzLm
TLSH
T1CDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6ce0fe7baaa507450d6b9629e0d6303bff837cac39f60f0d08fbc290ce14d48d
MD5 9bafa36bbee5037bc9cc45acdd21d5e4
SHA1 530920dfa33a7b8c984b6b8617b2df8dc97e694e
SHA512 bac18cf92708421be238bd8101318d9f331402039f155e2486c3eaa16591d3e15f7a360bc00397c53fb07b2b1202358cd3d7e06453018f1669621d880bec7b18
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xsQ/lFTjN4:kmifPbRmLm
TLSH
T100B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da5ca517e5c022361abb3ec11c4b5be35a06f3ecc8fb2e08c8668ddb3d109b85
MD5 dd030a00da45a80d1e2dd6312266a326
SHA1 6a13885db59adfd105332861b517be6902854fce
SHA512 1d2b3c42853dcac78ebfe4d9bac18eeb6d86741d942f4c77c38f7ae2bf66256175c0fd0dc6ef82f339dcc79ccba04712a38f0c3cff9edd64ac6e8844db497917
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqjQ/lFTjN4:n5dKTi61ILm
TLSH
T10BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27f3f1f982106b7a508b3e2cc2975720dee2118acb56baf25768ecf6112453fc
MD5 0434527426ed8606d50e97c2b0290d63
SHA1 ca594223b2b7f616798a35480748fed04e755bef
SHA512 c0ce31f0b14d96b10ce8db77850f6245b77cb4529c8dd8d93739c889826e0c8b3a73a81b0664f077f7c2b9f7537f8569e3c3fe02fce1c078eae85044f543a9fe
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wQQ/lFTjN4:RX2iyphCLm
TLSH
T17B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4cd230fa04e3556a437cf6ca1c49230129f7bbeb560ce052ef632e5823cd6818
MD5 e2e2933c69fe4866c1d0bdf9378c4fce
SHA1 1c74d20343330b913aed5ca0ec4eeddbefe01821
SHA512 13038f0f2ba10c9551f1936ef4a97586385902b05a3add039fe912163aca5c5d0e92cc61f71862e1883a2aae31545d4525308577a313742869de3df270548de7
SSDEEP 12288:83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:8XnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1705523697965F98BFA1706F18C828182A73B0EC6BFD1938F77481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cc9db465d11c91589ac4fee8e0df622e500a9618c6b4becbcdc066f404bea49b
MD5 dce154416ccc4ebf7c1d6d4d6fb5ac0f
SHA1 a565ba51f62cef1b112c6939842f6d9e01c23794
SHA512 20df86174aaa57ddc1c71cc5361bca427fe5b7234a235298921d80a85f92339bfac6fa868f5d834edcf360395bffb1d071544d86aec496b81403bfbd9c858029
SSDEEP 12288:wiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:winQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18B5523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e7ff18b9bb0242461aabb719d533db4e4d5ad5c8f962fe558a68e4525db3efa6
MD5 a8e06f4a0620c9992d43a6dd738f3f4d
SHA1 0d841e7a491c5385e4f7c6508b200fa9fddf7876
SHA512 29aa9d1741da228aaac9331a060a13e098983c9b956158f8bd48ebc8cc940700f1011842d52f4214ba8dbf9fa35b86ca4089c4379a8b0235c3ccfeb18242d1a6
SSDEEP 12288:BEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:BknQ/tbw/2Mkjy6Fr7g0or
TLSH
T1915523687925F98BFA1706F1488381829B7B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 04a5edfdea82fd2b35f7a7d40ffc3339c21735b7a398da86aa33f274428d890d
MD5 14470d5df641c57354f1f07ae00d359e
SHA1 6048c45b3cc2f840c9ffabc0b7a5284618129780
SHA512 94404f8414be8b663caf64054bbf9c1a6ada201173ba4e4111c7669c9afae52bca1947e54ed511c7c463b33e9f44b1ca4e331e78938992db3c5dde6b4928250a
SSDEEP 12288:cVxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:wnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1B65523693A69F4C7FD2742B4CC928142E77B3DC2BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b0d42b54750eff1fcbe9d9df26d6f20a5442fbb7d94b0cdae461e00767a5ba48
MD5 723e42202112ebbfc7b6df19d68e729c
SHA1 c3778398eb72dc25fc28c03867ea07422ef59acc
SHA512 00b4d8e61d1c6b1e0c11d55af0db3319f16c25eb664a5bfde146cfc8430f72606b61208cd0c8ff643fd45bb4efb650c69f9145fd361b1621395fc1530e4022b1
SSDEEP 12288:H5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:HJnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T10C5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e19b0bfa50814503c0c3f8b89f5630ea36ec963fbd14fa57147a54953a77e6c1
MD5 0b64bb7ed6c31d391009839dede8c22c
SHA1 3c90de784120d80f63640d3df43af2f41bb5c807
SHA512 fb79453fc8c25ed1f95b2cb154cb6d22cd2b0a968630decffb8bbb03c7927e0484c20bdbe754c67048678c56d635b1ef81fc4edadb8f5deb64d6ee7dc7319548
SSDEEP 12288:kGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:kmnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1EB5523697965F98BFB1706F14C828182A73B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c7ed28d79cba8616d552065ff6522c3e83ac607da33328371eaa2e23a40b2fd4
MD5 b063019cadca19352a8a4c587fb63a69
SHA1 5fd214ca92dae8ba2babaa90427e8b4f500f0b2b
SHA512 76aaab20bebd577111ac7e32411be8a6985143a5d591457e5b1aaa2ffd256f6efe0f8b3f3258da0284d2e523b5f1f700a128e1ef6633390391cc154ef1e3281f
SSDEEP 12288:IKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:IKnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T11E5523797925F98BFB1702F14C8281829B3B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b7f5776d7d6a7ae7df06f5abd5f89efb70a6636c10d3fc48dc396cca76b503dc
MD5 79742cfd3101324a3d5810ffdf501cf4
SHA1 1209251fd2f6adc979787884acb36858ae434077
SHA512 1800e08f72556cab0227caf54f8f6b33deef407b575ac4d8d98ee7029a0160037ed062217f037f3b550bbd7e693f9ae5ac4595668eecde4106e7a38fdcb66cb2
SSDEEP 12288:riZwbDzzFEoS2cPvyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:WZM3zFVSOCnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1C97501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9a734df0a8885d226e20eb229ec71ba40f2a0fefdaa84fc22d780afc696c1182
MD5 373ccce4ce101c7df38910e0acb6dcbd
SHA1 1e86d28cd7081e89dc8567b1c25191ea3c8cb3d1
SHA512 b32d0be7853aa477ff02840f4e51e8ad00f57a86f3c253377ef44d1ea30a3c208468d4c6ba41a305790648a89987014f3cc8b353209bacba4444c8799dd91aff
SSDEEP 12288:gjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:gTnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1E05523697925F98BFB1706F5488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 30e3e73b680f9516cb64375e09a9e326b953e2b0e74b3206dcd68b5e1c2b306f
MD5 eeeee09edb9ca24d7d37b197b7f7c528
SHA1 911f88295eebdadd08355c864ccea5597ad1ac30
SHA512 6b11e3cfb633ec64bc20b7fc9184c45d33ecb2072ccb1c28a2658da58f38fa29d8d674d162a40dfa38a863dae4fecf57d35dff497c87a30e76cfa32f527a6f77
SSDEEP 12288:CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:CvnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1E25523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1141ed591b3b4a3ba5fb99cb309ec39cb15ab5153981e92ba4bfcb328e2783cb
MD5 1de085905c39623a7988733e98a0ecb0
SHA1 53ba3aa0f2dc5a8d4bfd26f9ebdae605969acd14
SHA512 0de856da846b5ebc5de8cd4000b4430fd0289ee141c7c6e44b36069f61d87bc86a5402ee67080034d2baad574141d338b4e88bd43198a2ff65b942ccedc539f9
SSDEEP 12288:lyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:szyenQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19565021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2f70027f0344b3e90ee387b5e46e06deb87c46632f3dcb451e989b786541a69d
MD5 624255ad521c5b5f1b6159a08ee959c1
SHA1 20a85aba543284fc30866e6c25ffc95dbf5dd13f
SHA512 1004a4c765e0ff32d6953a45c66161ba6d8c60ca72198f30252ccf389ec49a49abaafe7a717c94fe379481b9eac55bc8a7b59c038889355facfdcd99cf92f402
SSDEEP 12288:8jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:8TnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1C15523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 11f1841c95904f32ca94d6d510ffefe7056f86b13d4dd729dfc4aad4337efad9
MD5 99941245ff79cbdbfc07d86477d08a26
SHA1 2b48a1779a364496fec86a088a4a50df0f120d66
SHA512 fe0db87a95cc6299898a6d2c77c0231da902d7991d154a03408a70fd104bd2206c8ea7b37809e042ed6b344ac4a29e265bc42e3324f4e0754229b403ea219b2a
SSDEEP 12288:xjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:xTnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T11B5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 91a98f315506933ac04e7211ec839428202f0e52be76c2b5857ba3345ea925ec
MD5 576577082de454dfc97d7e3a310a1756
SHA1 11a02606381377e270c9ede5a0efccf94120957b
SHA512 d7c5f2181f6a21999eeef3357a7bfe4a07e74c2fdbfe7ee17be0fe701adc46f7d5cccecfd29bcb4f7182e5d01e2b4482f0ba80676fbca3aed0c05e5708b0b237
SSDEEP 12288:ryPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:GzyenQ/tbw/2Mkjy6Fr7g0o+
TLSH
T18C65021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 94a5b60097d2a52ff03cad4aab79e21d776f2eefc3da645a66bf77efb9b3c47e
MD5 1d03d1bbbd5ddeae47cc23fcf19ccb44
SHA1 52a15811f1d0f75a432183cd92dcaa5718226f83
SHA512 f058721dff8e1c97cc360bc6f9f1dd5a3c316f38bb95d688243b5af8965e8dd20323efa57428534b072ea97c6cd8b96cbcb0c50ba3aa0fb4bc9293b57c7e7c27
SSDEEP 24576:1T0aLl3z0zD0nQ/tbw/2Mkjy6Fr7g0o0:1TDLljVQ/lFTjN4
TLSH
T1E67501A4B3505CF9ED67427ECC528906D7B27C5A0BA0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8c9d339325e17cb30ca966827c12ae088fca1c4fe906ca2528a1a5ed248ad01e
MD5 cabe5a6815bed9c2bffb9023e9713e46
SHA1 5a157595827af020d8d2c45d1d43c376da59958e
SHA512 b62ad3744f4ba8b80c638e30c860cd4432d3d71f3fd94ca5a272f638b987590b37dc1fc1cfb3834611945e6b0a551dde86efcc2b10a6fcc10b6651587501cf47
SSDEEP 24576:n31d9CHKy7GZonQ/tbw/2Mkjy6Fr7g0oh:31d9CHKyaWQ/lFTjN4
TLSH
T14E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d9338615d491259e800ef0cbe6d142ef71786354719d3589be90c229e067158c
MD5 e07c9546541a07548931e08958234450
SHA1 8f989801b2bd53174f789163cc4ef3453845a3de
SHA512 bc6f9e97e131e1306ff8bfb59852caec31e6b3145ca7b54f6f2d4c044779bb7485e26ff22e298c74e1fdc0328c8048544ff124f5dceb4ee46401cb31c9120e64
SSDEEP 12288:5kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:5EnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1615523697925F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1e12bbaffd42208c63f044e19a64e8c9f72ee8808edc7470948ad98898895663
MD5 bfb2f82c8d64505efe404c087c6e6210
SHA1 295341ec51e2c5d7894a0e9cb4681ef25d6222cc
SHA512 e442bd4389beac945ddc839dcaaeebf234b39ee4a1f81b981e7a3ec811b9aad97c39b30f7697c9f9a9eb44696b50f58d31de382bcda4b8798cbdae12152c7506
SSDEEP 12288:h+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:h+nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E15523787964F99BFA1B06F14C838182AB3B0EC6BFD1938F7B481129967D39406D7784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d0dedd742d17598fad939e026609251e131e949e4cd921266d6eb17c1bced19f
MD5 c862b90de496fbd6624827216cf6b3d9
SHA1 189cd82189a5828b7920ed52978a59b85796b917
SHA512 87f33e259c9a817ad19bb82bc88041c846e1b1ac722002a2df38f31c12861a2ef790269f9079b7931251a447ae74228c47f1d6138c2c5906f0215202364860c3
SSDEEP 12288:fdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:f9nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1615523697925F98BFB1706F1488281829B7B0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 18a78def20a38a894179daca1b149afe31bbba14961e19bcd9859f559e2b9f22
MD5 c71ccaa331914c5f141548a38d5275f3
SHA1 964cc4d20960173b1d4a70811f6ffed942e862d9
SHA512 95ed581da222e075bec011d37c844a7f8fdcc3ef17c6c40612ada8ab9295a059fb90500ddfe6e25fd385c6206fab333d089073d12e892eb39f1994b06b9a3032
SSDEEP 12288:ajGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:aTnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1B95523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b0aaa4c44a1c0858e4e753a35a0c26050be400db41c48d04d3c7879fa3ec8624
MD5 4531dbc005f93e71168dc497ffe11571
SHA1 9e7315fb305f9b60de4fee9182e7cac5ea3fcac5
SHA512 3dcd18df4431ff99af34e8a50f04f8070d6bf53ef571bd580e409d9eb2246538bca1c33d69504ebdadacc20fac4b1ad0ee5b9a5b4aa8c409bbf2187f5ebd531a
SSDEEP 12288:8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:8EnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1DF5523697925F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7e5976bd49ebaf1142dee14215ebc400683ff55bc470ec4aa16c2cc61eff9629
MD5 5c04276f1a342b9dd6603e616f023ffd
SHA1 6694a3f53e57e4d0c9d81b70c3ff4aa8ff58f776
SHA512 bc53b861da98a6082aca054a22c042ffa290af26fd35e470e0f8d90448d19b8abf5ffea80fbcd58caaf11431a126b0e34e049966fec4589bd7977444a165d9a9
SSDEEP 12288:MrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:MbnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1D75523687925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5534752b9844ba48268f1a351f3cd4876fe20ba79453804dc76bb7a4eb892f57
MD5 22bef608a67f85020ab9a88c2abbc470
SHA1 ed6673e309fbf75073ec42575717cd6f1bd7a68b
SHA512 8b68158c0ef17ea30d2c12b7f449975896b35c648f0474d57003406fe5a39bbf2c36e6d20c1246a2ae317bb3da1144a2191007323c340989979053841edcc12b
SSDEEP 12288:/5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:/JnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1635523697925F98BFA1706F14C8281829B3B0EC7BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2fdbc069daf649a3214195fec9e55313c842f743556ed5eb76cf49ca8d5ceb10
MD5 3a5026e4491c529c1d23444547d3606f
SHA1 d6f4532393ea1f8616f68567b7ffc553cb3d3b9a
SHA512 cbe052528690dc907728796e8257f368c0e62d112b081da4965376d3b2f38c939e05484ea0a65c315a797ea570958b7d23e7108a6f4b35794a9c450d4ffc5940
SSDEEP 24576:wfwv/k9RX6wkyAIfnQ/tbw/2Mkjy6Fr7g0oX:PMnYIfQ/lFTjN4
TLSH
T1FB85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 af28be62e343febf19e6bf006920f60caa4284437dfe1a6f889e54b40274cd47
MD5 4bf77c0e502393127dd456d24e674f06
SHA1 fcdd19337a0af87cafd5eb56fe2b1c2e9dad6b78
SHA512 5bafaba87002865479b7c806dc4247eaf6bcb5cff835d2525d600012895792e6eeee1db664749273338c1f839e1087df4723e7684afea984c75ddd441a680b0d
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:HySzPLLm
TLSH
T122066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 23db17c3e941f2f16cd62ca6ac3b7c43cc45e50d438e6f0a3854eca07132678a
MD5 1bee56b1e451f64f94f12a6ff83c562c
SHA1 07ea6622e33e699cef8adf3f5c1e98d298af23b6
SHA512 8362db4963592deac9f43a83bd6522190915cdea2aa434c9d15c5f185154acd89802e602b1315dcd907bfb1f88207598ab67aad5ea3c86991ced29a6afe90a39
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYynQ/tbw/2Mkjy6Fr7g0o4:w47JUQj1irIhCnDHUPfF/gQ/lFTjN4
TLSH
T1AA65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3abad80d969a0f6c0c5f7f372fe09cac31335a6b549309f22dbd03d5d4284dd5
MD5 51a450a69488f943fe665009cd920681
SHA1 7f5a111bc754e826c0f4942dff51d729607fc5f9
SHA512 39977255a6fb414de402d01b52f965e6d5d8feb8d5e6048f2069e04240b1c6d35c172adf33128707f2a809b57da0cdd6cf94a211b0145b6549be36a38c800783
SSDEEP 12288:kssfzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:KjnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T11065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 eb62bc025074c32a0dc60f739bfa22405568faa43c604549407435c3b172cc2a
MD5 01b075e603000d3e9fb775dc37d2fb45
SHA1 0f809a040eb12cd92d066a287f6711b007aad95c
SHA512 03f1782ece5e0f557d606cb5ce7a3533c7fa7c456d0f485b1a62d3728198a58b74031dbb1336633ba92f1cc2834006b438b7bdf332746c07ba589787536d4662
SSDEEP 12288:2A9BOZU3fp0Ic/13+Yekz9e5kA/t3sCBmwJmu:2qoZUPvYOF3sCs4m
TLSH
T1B0352901766BD75FC6A940321E32D1CCA7707D41EE45AB0772C98B3FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 17da0206fd208b7e0033d20ed216481c45ac7de0375a37440f0de405620119e4
MD5 3f231b80ea2b3d71d34e36e09810ccf6
SHA1 1515edd2253203f6267935c2a37869e4c19c6e24
SHA512 f1d5cff0ea57f41f4997566e5e533ccc8811d6c7c559c2106452259fc843683f068405942dddcf9e36446de2e0fefb6b29a058b36ab17322260a0479adaa3ac5
SSDEEP 12288:imzoPTLEuicGG80lJT+SwNnP/HLpRL51/j:/oPricGG80lJT+SwNP/Lj/j
TLSH
T1EE65E8819537E38FC1FB2031072A5B4CA764EC42B7096F26B3C5453AD86AB25B4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 147b95806014845c83c0c9511fc09af1efdbb905b34df5e9e29c0c7802e6e2c1
MD5 e53158c7f6e1b5699061670cefaaaa21
SHA1 68f0423bd542345edcad3970f277837a06af4931
SHA512 8e7eedf74288c9b7cc56916d18522a3ff562f106cadf5f8731b62e1ed5bad3fae8b97c3191e877f915d3d605c3bb91de23966ab989f99da93ef2c4d565d1e018
SSDEEP 12288:b677GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:CrnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1CB5523696668FD4BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c99d3bb0c6c4bb3244f7effbb190f742ccb11d39bbc802fa192e25b3de55b276
MD5 c5e3a582aad716a01fc597d579470d16
SHA1 fa2b2b14036e34a40b961aedb74613846c920cd9
SHA512 0f7a9384fa06cf4f256c35399a20805be4430673c86a7354511466261b0d915f63f45f2db760deab31fb16963eca9f115233d14496784b52511cc49b872405e3
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYVnQ/tbw/2Mkjy6Fr7g0oQ:tgb4mBIBhGFyQ/lFTjN4
TLSH
T1E065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7211e33caa811f675fce0732712654cc13bfb095e3b3e9cec7473293921c1d99
MD5 a4f57748022c0bcc0c6e53fd2d25609c
SHA1 ce81b44499a00c82e1885586728b805bb92d1231
SHA512 0f219ea56cafb9255aef8bf63a5275de297d1f2cc701b34d2563ed5c1de2ecd87a3d7a2c11e75191a14a8f3a90b9890e9b4d64af862b44c2d16d4f2c200673c9
SSDEEP 24576:AG88u8FpJqH1Qzria7/mCnQ/tbw/2Mkjy6Fr7g0oZ:T7ZFPqVva7/dQ/lFTjN4
TLSH
T11085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d92b357f5dc41a440e464d9e8eec2fe0ab03e9413ffa609e85aca5212760ef96
MD5 1fec07f5b6a764aa1e616753e7983219
SHA1 fdefeef82ad01ed80eb890144e7c3671caffcf92
SHA512 d08a6176d54686dbacbf216b1a6e7bf8f0d56abdf1c6fae8ad65c5e5d737711eb1c61514ef60a821af09b8347265e67f27702b86bb1433ef0a03e65948a3b3e4
SSDEEP 12288:CHvUrBFrEjwaQ2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:CPUr+NQWnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T14A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 16ba116632ea777acad1df5b5ae9f47ef7563019b2852143d07bdbcd63c249b9
MD5 a087151b8a8b516f4482ccf48c4f8560
SHA1 51a4062572d5525c73e61897599a4dca84e4e93d
SHA512 3662933e1f729a1f1fb742e87023438b099141ec2f8218e227334bbc8d64da9fc482d368a3fe1d79b054253b6cc3e48ed3629903ea24ee1d3b03d06443ed7633
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmQ/lFTjN4:wG05lO43bsLm
TLSH
T115D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 45c5b4e9f987ac29b943bc2b33f42e967def4d423692d30dea8d6ae009d18472
MD5 072b5cdc3adffd7a2a72d859957218d0
SHA1 ef73a23ab4af6f3f1472766a53f9f91dba248494
SHA512 54c39b437f360e1154227ac4ea19ef463ce902c3db6359fbd50e4ca70ec413f97e47ce39add8a03461522d8d8d15713606fb68721737774fbfae1a1c24f780e1
SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0ok:ra5POZ3+Jt2pasx2+m+Q/lFTjN4
TLSH
T19A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6ddc8dbc968097a101971d820346e48aace77c0769eb049976390ef8dab1c611
MD5 6cc68668cc242f84707d483d90e25218
SHA1 af1d723a4b8d8210cc5b47d37e4330e44b5e98d3
SHA512 e6158895123aec7a8c9b36e5f996e2831314341dd96682245c25f77f9ca1a7bc8ee0d9dbc7fa169470a71866b8a0a7da5461468f47cdb619eaab75ca7d7573d4
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkanQ/tbw/2Mkjy6Fr7g0o2:bNc/zEOVHF9Q/lFTjN4
TLSH
T11C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c6cef9d011239490fd5d11e7cd3668efcc9e2dd6b226ea8d191133e277fe258d
MD5 25b24fcca4d2d9edb80cdd2f7fa9641e
SHA1 86a13beaa79a889b1857e47a8e64a2d78ca03181
SHA512 57bfedaafc76f55e539d1a0f1b8d0b0b91a789cbdd5a5d73cc5f5ce281107a51b8a60a99aa423e1efd2baa721e47a6989299efb0c4b9df00c7333ff485d6730b
SSDEEP 24576:c8kNvNnaFeYhJNtmZBm8nQ/tbw/2Mkjy6Fr7g0oi:c8MwBtOm8Q/lFTjN4
TLSH
T16F55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 937aa8a94c327bfc55aed954d821e54be258684fff1170cdbe56ef934a006b42
MD5 f8864f564d5affafcb730365fda25436
SHA1 7ce0b9c231ab12f941b47b946fba3859301cc241
SHA512 4a52b902da9b68dbaa08c9ca525ede0559e4dc3c3cc847f1ea0bf5563338ac66055d51c981a3c294bc8df830804b0d16f9114e646b6847260dc2fc8c236bdf82
SSDEEP 24576:6D3FHshBIYQgA3nQ/tbw/2Mkjy6Fr7g0oL:6DVHeBIAA3Q/lFTjN4
TLSH
T11675E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4220-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4220-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4220-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4296-267-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4296-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4296-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4296-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4324-64-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4324-7-0x0000000002450000-0x00000000024B6000-memory.dmp

Download

memory/4324-2-0x0000000002450000-0x00000000024B6000-memory.dmp

Download

memory/4324-6-0x0000000002450000-0x00000000024B6000-memory.dmp

Download

memory/5036-214-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5036-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5036-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5036-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6136-79-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/6136-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6136-281-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6136-84-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/6160-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6160-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6160-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6160-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6228-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6228-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6228-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6228-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6228-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6432-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6432-312-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6432-101-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6432-107-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6432-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6432-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6920-133-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6920-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6920-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6920-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6920-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6964-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6964-326-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6964-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6964-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6964-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6964-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/7040-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/7040-121-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/7040-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/7040-115-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/7096-77-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/7096-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/7096-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/7096-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download