6b9f8080d16360a5260fce7b6b6f427c1318383104b560daa4cb45ee8f6a0455

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.5MB
Sample260808-dn8lsayfrf
SHA256 6b9f8080d16360a5260fce7b6b6f427c1318383104b560daa4cb45ee8f6a0455
MD5 8efda628e40c7a9ddc9a390d571d300b
SHA1 59f6fd894f23136ab3b8c293513b9b0bfa1018a3
SHA512 863a9cb5d35cad364e92bea9959797ad54d3b52a54d6919c9212aacd0d475ddb625ad356a91a6acf10c01de6f7afc195a7041064160fd5d074ae3a18840597b9
SSDEEP 12288:EogZ4KS2L0q5UPcU1ODtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:E/ZY2L0MVdZjHhQ6giafmvJW5
TLSH
T1E1658BB6F9CC88A8DEA00AF9273CCDD0656ABA70CEB044DB534465B51D2B2B0D571CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5796	elevation_service.exe
3516	elevation_service.exe
3336	maintenanceservice.exe
5872	OSE.EXE
3144	PerceptionSimulationService.exe
124	perfhost.exe
1908	ReFsDedupSvc.exe
4532	SensorDataService.exe
2412	ssh-agent.exe
3820	AgentService.exe
5936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4f21ca08e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000043def682e326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081198ec3e326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005310d2c3e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023936482e326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027a4b383e326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
5796	elevation_service.exe
5796	elevation_service.exe
5796	elevation_service.exe
5796	elevation_service.exe
5796	elevation_service.exe
5796	elevation_service.exe
5796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	1908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1908	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3820	AgentService.exe
Token: 33	5936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5936	SearchIndexer.exe
Token: SeDebugPrivilege	1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1152	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5796	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 5524	5936	SearchIndexer.exe	100
PID 5936 wrote to memory of 2768	5936	SearchIndexer.exe	101
PID 5936 wrote to memory of 1472	5936	SearchIndexer.exe	102
PID 5936 wrote to memory of 5700	5936	SearchIndexer.exe	103
PID 5936 wrote to memory of 4820	5936	SearchIndexer.exe	105
PID 5936 wrote to memory of 1664	5936	SearchIndexer.exe	106
PID 5936 wrote to memory of 1988	5936	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f7793ce5e66c8e90defdeeaba5e316e043bbc7b4a621c51d037e2711f2bb9270
MD5 99d7825af82de2eefc5110aebd18ce8f
SHA1 cd3f7005c731850d5f61b5615355238d17a88c47
SHA512 1fd792a4840205ffe0cb332d2bafb986db8eda628efcc628e14fc3c1024b36f4ed4e25cd65cf8f1467abca276ab75798902252d75fc32de08afe58fa28ee1cdf
SSDEEP 49152:ab+632BuPkFKRrdE6ohrstBhuXjfS4LWxn83rtgiomvJi:M3q60jBLxjNi
TLSH
T105D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 df8544f41034095ba69e7ee7ed3a3f6638eb8a5f11708fae4787095124bc1368
MD5 f4e3c3e42822ef6ff37055f1f10a1313
SHA1 5604ba6c4fa197de39f452c59d7e84838a33fd78
SHA512 594420615f15514e2d7089d3269f5a93d8c38a50698d62d776200714d50542c98377475b6594616c39a9f7d3d978626852f70c20b4f6ef5080876e11a65d6e09
SSDEEP 12288:61XLsswWkxy2lRq2czATDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:QXYfDtczAvdZjHhQ6giafmvJW5
TLSH
T1EB65F129A3D508F9ED67813CC9A2C516E773BC914760E78B03E499651F332D82E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 42b07c572ab7c13683bb4e398effa3c8b9cbbd8d1f2c6f387522ad41141cdebc
MD5 14a3aa9b46d31a8b0321135461e442ea
SHA1 eb3f588c4cf1a872e118892fb718f3335ca08e86
SHA512 f77942e4f45e0193b34f9b57eb4d38512dfc8e9df4f6cf56712724ee471c6a7e8377aef377310c10725be6bf6d20be0fac79e4643cb959eca84a2a53f6c97751
SSDEEP 12288:5XZNYVLeyUji0h90ZD0wxpGZIVuqrHsiDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoo:P0Le5ji0hmxNrMkdZjHhQ6giafmvJW5
TLSH
T17185AF16F5748335D073C0B9C5D2A69EEA7230825B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6536d006590f491449aa9a577093c0660c71dc4460f6e04ad1eb704745094512
MD5 6ddf81cbe0c8dea4231c35eff3264fee
SHA1 227659e0e6ea1f4d51e33e689e8e20b964f6a5ca
SHA512 aa4ed06e5e3f791215975541aa815cbedc266a2ad3a0b2a3d1e2ff06d4c6fc577412dcfee4340a7aa5b797a0c60cc92ded0e9a3d3b9a823ab65acc5b357578a9
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWr6q8wyuidZjHhQ6giafmvJW5:U/ezSC6vUzPviHjyd3rtgiomvJi
TLSH
T175755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f4789ec7de2e4681072c48c6b6aaac0537098a73a0918084be562a312a2644a
MD5 09f6a1be84794704bc72ad19dcac30f6
SHA1 c3fc73367afa221d1e3305cd3ee291166dfe6dfb
SHA512 3990ac9e8252c0105b076c92483f078e3aa6eef2cf4a4889268851ddcde604355738b81d5155e89cd5a237e93abbb6551e77636a4921fad1105c50d73221b7ef
SSDEEP 12288:YVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98vDtm1aUiPrfUQhQ67sv7mfYTpKo:YVbqPb88hv/l+bbdZjHhQ6giafmvJW5
TLSH
T1AF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 41cdfd21fd7e222a81eb04b7f0c70b4e2e496247c20133a7f440a9945e6e9a1f
MD5 c7e049e34ec546900039c5a6d8d63cc3
SHA1 2f43fe27dcf8659d0951d44506ad0a776566b367
SHA512 673d0b9416821d1b57bd53ab38b213aefa00a1af5e8f7e5fcd374a2ac3fd04086fb7836b9bc56cdbf885394f7f49c27ab605cc061401f11cd09017ee55b16599
SSDEEP 12288:ujODtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:ujgdZjHhQ6giafmvJW5
TLSH
T16645234BD616A0FCE3A261384636F5EE43BAECD49D800F079FB57DC154BE0A87986847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3094dc9acaa96bd92e523ea07542ddffe122a08d26bfb115ca873594238806ec
MD5 30ea643337bf752bdc969c529e3abedf
SHA1 f447118d07108dfed22b0de3bda43a32ea1db39d
SHA512 9b7fae23d31455fe22005d4a1ac817d4f9ecd2f68615473ed25148509ac95fb85262247186a2a9dbce0d614c5011f97a4e25adcbfbccd5dbb08b7ad604737c52
SSDEEP 12288:4eBNUbTVO86UnDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:4JIUDdZjHhQ6giafmvJW5
TLSH
T14B65CF2BEE28FCE2C27A9D785A51C640D77278704F6293CBD175824EDE235E01E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ea13de7e13875794412450c3f087a80a280602c12b513ea9e64733a556bb1823
MD5 8b0d1149e73651373c7923cf13209800
SHA1 3e7dca7f85df3e3a577971026323fcf58830b4be
SHA512 084d58f158b2d480c363c973b3386342f2cbf79ef5f647de3b6da36743385a0474d3d76b80aaacebafbbb48db6c8f98a91c9b1d8f8590c6db5d3a947073664da
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THK:HQvGAdlCEL8c/RRNw5CyxjNi
TLSH
T144266D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 86d0da7217e0e412ee0b649da304585b463da6244bf336c11aaa2bdc352eeaf1
MD5 8dc4a35547264a1e493fcb7c2a02c175
SHA1 631cf9daa350ee6778b182eff42745adebc74f1e
SHA512 3844e74d3a6348609ac57d48f7bbaeed6fee44b204c2d3f2e99c5c9c92e1ea39ebfbd5ae3c49c27df47c095b7a7d9c7fd28cb717df9f1ccf91fb8b26f6405549
SSDEEP 12288:gAwSfxL/2Dc3DDLLmt0LDQewsAjdDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:1SewsAjpdZjHhQ6giafmvJW5
TLSH
T19D75E031FA74E036C3BB0DB61B36D716147DB9604F911AC3E3A89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 648e65f497a9a7e443d4e1671b5f183f616824745b68b35006071eaba62a6665
MD5 95ecc29f0337e1fef21b14b50c8beed5
SHA1 b0024104287db795ad4fbdc3b79ba0880293324a
SHA512 6b7db4a2514d2508bf527214a4033afc3a471b0b7cd7832f1ed9212dd7a0f6de6dbd98f324d752d65771782aee96537516210581e8aea0cd1a8c9bf271be9f70
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHzj:GUEtQevvqc2W1cpV2RI32z
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bbc0734781118aae918a4d680ca4d44f2d431891d01cca54b5463d04f2cf6584
MD5 ffc93eaa00bc6314f5cb62aecb7708b0
SHA1 107039d750f2a97e76e1ecedd7a6bace8069194a
SHA512 374eb794ec0006051349e3c50c51863e572962241f5e30f6f3eeb30ed5320c0e775678d133b777137ff2659cbf46804a82ca2eac7c200d7d4cc6add76f3a9540
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zJ3rtgiomvJi:poquVjnmmxjNi
TLSH
T106D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b292a294deea3e18dbc449d62fe0da73d324016cd33d5ea3d99e8565b092ea14
MD5 a93a44c56692323672b62f5acfd67215
SHA1 4d0af8dfa51780b86063e2cfac224b28581ff266
SHA512 00887df7e23a7dc15924846d031745a81a07f90d0dd22a7faf6fc7734c8efeb54435266ee3670ce29c3957eacecf8baf5b44d92fe8de14dbbf78db033e54fb2d
SSDEEP 24576:RAhGL2IFoiwtA5l7S53GdZjHhQ6giafmvJW5:RAM1Foiq523rtgiomvJi
TLSH
T17D35AE81E7F955D4F5F3AA7899B69171EA76BCA65E31C20F2260D10F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 60974a2fc405fe9623e7bf5cd1375ad7e29a6655e5cfd933c8214ad49060beed
MD5 e90089304d80b2177aed75bdbc5c11cf
SHA1 945a87da836b4b3ba6e1a317d196c2aa1db0e0ef
SHA512 a6942607b8d0e9f6b3188cddbb1ceda0e4d4895b680f6914288c30a3a762a768965ca3800358a3b719c52476385084a6c54374c8e0e08ea512bbae6f20052a28
SSDEEP 12288:Pmw5HEjsChNSBFgl0WDm+CYDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:uwuXOW9dZjHhQ6giafmvJW5
TLSH
T1F165F14A72A51CF9E6A781388657D136F7F2BC412A21CB1F1760CA5B5F372607D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7450485fd92273311ef7025dd253c27798f0e5a402dd305c89111891243a83e7
MD5 16d785b00ee863edaf2b1288acc3565e
SHA1 b3ffe78de8f4b7a0df38bff979f2e84470c2330b
SHA512 f74865443e8cd67ce0a500d827715538c714a6a0b45534cf5b9a7a5469542efdb08548ab50728a4929a3ce71453b3d530a2e1e6faff7c951f03a0762a59d11e0
SSDEEP 12288:e/Z1IytDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:yZuMdZjHhQ6giafmvJW5
TLSH
T12555124A32A570FCD2A3523CC9B1A649D3B2BC916B7103CF1B655E961F772D02D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dce7b79243c668733698d70f23c43114c71b722a75b445c2c45db8ce92f223a8
MD5 aab117d9815678e9994a68a02fad8633
SHA1 7b3bbc2e584d0736b7f01f27e65549f2f50cb4eb
SHA512 92f300ee433276f67d2cc1597d99abf80a975f976b171f07056405c53d63b9b9cbc2f80fc995432e466a7289657a134233714078a79474b70d257107c3da7b9f
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uu:WQRQyi36YOcPhLvw2gAf+PN3XxjNi
TLSH
T1AE666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5e31b56ea10073240bb7cfcb18110f6e1ac907eeb7738a7ad78b746de3fe6142
MD5 4c139b9b6605c1766fea2d9ad829a3f4
SHA1 5d14c568bf170a7ba955c1c464ce46a31c7eebc2
SHA512 69c62ff2b838e2a43e5911f961019fa19545db56fefcdc8739bb330f56d77e459ad587d825c023a23293e1e33e916a290bc405f51e806407b71c9bf365530d17
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uu:4QRQyi36YOcPhLvw2gAf+PN3XxjNi
TLSH
T1A3666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 821cc135cc5f2407cdc6805ccb96983f74409d95eba5e8feb3d1afccfc430135
MD5 afd18343f1ff948bd9761dd843ff1be2
SHA1 4717e70a53f968552200879f1134f81432a4724a
SHA512 0aeb9094b85acd1398a91dfbea70b8c4e4b296d89394d8c86ef97ec44f895260f73152b89ff119e82832d42f212a8968c1d5a80798fd408b935bf6ff483417d1
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL08dZjHhQ6giafmvo:W68Qg55nhceWu7PNU3/Z3rtgiomvJi
TLSH
T1E6B55A33B2F600A9C44DE1769F4A973196E27C758FE0D3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 87db96fb93e639a80a98b4366d631f7f3fb87db9d1a67fe75a96912e84475802
MD5 771a6f2c512af3fb5f41ca1a998e75fb
SHA1 ea16aae7051dd338a40491333eec40a7d7c35833
SHA512 bc1f375470d479621a14f317828926053e3506d8fd0f48720a9e46abe829dd4975fbe992d21b73bf0be95db51c1d49e8f6ca9b7d759e590800531ea8c15e1542
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99M:Zy5112gYy5azzVva69nLKnhZgxjNi
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d2ba342200130d5d49166657767c84dc41177ec7d5d229578218d052a346fc0
MD5 28e936c62601ee7c7d9a898eeb80b336
SHA1 18945fcff5c57f02140ccf27924ab0323f530580
SHA512 b6a94e64b1140b163887a968d8980121ab9fddab7bdd6f3b459067fdc67b53d29305dbda60517269b7560aba4b9d14e20ad9e8cf589ec6ec5139445bb7d9990d
SSDEEP 49152:AB+taZ3usBWOBr4tEG20bqx0z+n217aau1glf3rtgiomvJi:au6JmUxd2dfxjNi
TLSH
T192D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9077562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f1a1b3ffb2f698f188c96c2f28ec991a002ef8cddeefa9978a19de85019f184b
MD5 a0e11489bb58661573fe819cfb839184
SHA1 69772926f4fa8d8b514ba6677a7e5913554a4764
SHA512 9fcf8d76449454ff772c7049310fa73181d091b2ee5793a19842d69d3bf71a2b7e695f6969b4988933de218b9559f8dfe73d9d95d467e60800f78edfc373596a
SSDEEP 49152:Z1hpsNoJpF1A6BU44CwH7R4xj3rtgiomvJi:ZmifPkRmxjNi
TLSH
T1F3B5BE13F2D900E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BAE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ae7fd23675d0c957b19da55932422900f97f0a403166800fc9d06b2322399357
MD5 f703f3c84b151b5b2093d7d0254598fa
SHA1 5a0456ddb993781c0146acf380713dc686ca5ddb
SHA512 2d7db0ea3a195b44e4136709ef0b5552f45160d51c1b106d9445dd3e4b960415fd02e38b01d7fe4bfdf99e869c37d8747b4f48355c298f0d53a77382e74f8e89
SSDEEP 49152:fSuZQIY0Be2KNRVtOnks6NMHqM3rtgiomvJi:l5dKvi61MxjNi
TLSH
T100C5BE03F2E940E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b0bef88d3c8adc9450ef06ea9c2860ca3093616ec87e55e5583a33322cadd4dd
MD5 40a0c26c06a339345dc7a577caf5b40f
SHA1 13564e30135794890785aa65ef3c5b41da4b11d7
SHA512 32c79632f5100c9dd9919d8e82e4732f89f254430dfff51639f930e735571ceeaeb29345d0344c54a9ebc782d572825ce0185d97a10c340ef36184f0a2ffd200
SSDEEP 49152:JhtSn8EApI0figXgiDn0AP5wv3rtgiomvJi:4X2iyphKxjNi
TLSH
T10695BE13F2D900E8D05ED178C7568632EA72BC150B35AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7779e771d8c5aac7fe628f86f5d5866e3d6fb808c87cb66be755147cd63383c7
MD5 bffc385fa6d00813616a4a6ebb22d010
SHA1 6a78857f0a608eaf4a75c6c1550e76371418e55d
SHA512 6888ab2035aa449b8910eed4447060f509a5103fa5a23391daa845a21493799671d85ad5ea3f9f44fa243addace9287cbb742c3bbd5da9fbecc6bb83a7d32ea7
SSDEEP 12288:HmDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5T:HIdZjHhQ6giafmvJW5T
TLSH
T1BF45234BE45790FCD35191784226F1DE83BAECD5AE810B076FBE7C8155BB0A4394688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5da267e9d7dee1c00bc5e5995bad3c8de1fae59e36c641ec1d0477afde28ee05
MD5 1f2d11994c958886c5edfc84c60a9455
SHA1 036d8c359eab1442e089187d8b1ac2e55421ea6a
SHA512 c5a8237dcd89ca91e918f82c97be0d3d3d76b13d2f1d9b50930ba838f4344a996b83ad0526db38836c5e5d355bc4cae811ccd42352e5cb8ce6d3e51207177799
SSDEEP 12288:8JDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:81dZjHhQ6giafmvJW5
TLSH
T19945234BE45790FCD35191384226F1DE83BAEDD5AE810B076FBE7C8155BB0A83D46C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 26121c7c7f9137aa0e69ef2e10628a302dcc36d0afba8006ead2b9617c5e490e
MD5 6faccca39537c265b57c70e70d340182
SHA1 be11a691c85dceec8b976f83227d72318f30e79d
SHA512 310f9a4f1fa7bf7e092e57997b324ee5cf96904d2ec3382e1b1e0d430e5010203e7dfa929355801aaac496387c096962f1df071eaaa4925f5f8d0bc65573a990
SSDEEP 12288:ofDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:oLdZjHhQ6giafmvJW5
TLSH
T14D45234BD45790FCD39191784227F1DE83BADCD5AE810B07AFAE7C8155BF0A83D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9c3414e52fe92f298848589b184ffd8392ba2ac331c20017ae46f9d6f46123dd
MD5 aa11ba7ebca20bc65d3d49e412b4a55d
SHA1 a5c45493d351f45f2608307f673adfb623052357
SHA512 5481aef463519b0ba43ee5d74311df760690fa2266315c7df65490e7fb40ac07e8bf29b97dc86a9136e7422d988e85f0eba41e2217f0bf5a81aa5f045f3d56b6
SSDEEP 12288:9V8Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:udZjHhQ6giafmvJW5
TLSH
T1BF45234BA66750E8D2A2D238C632F19AD3F6FCD4AF610B0F9F653C810DB62A43D45D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b4a4c8b7b5979e79a6c757e61633e03cc4c80ca767c6e689c6ae98f5b54d8943
MD5 30f468583bd998ff1486c8e986d9d70d
SHA1 5eaaaea8f494624553a36612bc8060f2582c95fe
SHA512 4d00e8eb4d7a96c69191fb6d077f3e3b4341b19dbc4159efb4da1fe39279213da30013bc1dd07227337602c151d910d71cff1f251325fcf7ec9f4ffacb557ea4
SSDEEP 12288:FEDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR51:F+dZjHhQ6giafmvJW5
TLSH
T14C45234BE45790FCD35191784627F1DE83BAECD5AE810B07AFAE7C8115BF0A43D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a6d6b4026267a2bc7b23ff41661ae10a269f99ef83c27954e1078ff3ac6533ad
MD5 9761df4d5030608997e10ea38bc0c4ec
SHA1 f216d3d822e0d184a8755e701f2eb6e929aef606
SHA512 3a32d90d0d4184c74b9fd718488897b1c7009be25ff89dbb3cd761abc53d12f2d3f8773c7d4d4fccd2740d431c540a7f45003180ec6ac7100ff6c72d87d24618
SSDEEP 12288:R1Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:RRdZjHhQ6giafmvJW5
TLSH
T18B45234BE45790FCD35191384626F1DE83BAEDD5AE810B076FBE7C8115BB0A43D4AC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b904781acbc169e48b6db1bc0037317bc5e2b82e5af2eb8814b79fa07bc1630a
MD5 37d2d2ac8c14efa732ee57ae52ca1dc0
SHA1 a7cd669cff4bc3cbe1d812775149ba3709fd2e09
SHA512 cff8c36b668e380bb163c4dd38ad0f473975a68d4ceef6cbe0a8edc0b4e327d2248ae6c80d28a89785c721109d7aead1881ff7d3495b32ea1da0c6426b23dea7
SSDEEP 12288:fxDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:ftdZjHhQ6giafmvJW5
TLSH
T19545234BE45790FCD35191384226F1DD83BAECD5AE810B07AFBE7C8125BB0A43946C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f283413a13026ee38dda15352e03921f411b719413f0dea50062b51c85cdc42e
MD5 6d0f9c595e09433503e6f05fb90a85b7
SHA1 76b92aa39c6b813fef1529ed337f1c0a2df725d6
SHA512 1ce111c908f9cf6147db17f971690e9ab8c8e49e2b6be554f641053f61a5a6ec9c0e2790092729076719c2ff5bef270697523038debc8da892ac492cd734f8f9
SSDEEP 12288:/iZwbczzFEoS2cPvypDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:aZMMzFVSOVdZjHhQ6giafmvJW5
TLSH
T19F650295B35018F8ED63813EC9259906D2B2BC590B60C61F17F83A675F733A01D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fc14a083ea25fd594d3cb8a27d2f60581003e943e551647704c8d7be0c101753
MD5 90551a296433d6270da18674ac866d2c
SHA1 ef63ab99d5b0248410e28a0b058fbf2e2d67ea17
SHA512 aad129cc4b276c7ac8e31d4c80e2bab8e9afa23fdbae86db742fb7030be4feb39263a7bb87945b30cf98ca830266b8da5490fe1e09e306ab8e6c1d77d4eabd56
SSDEEP 12288:KKDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:KcdZjHhQ6giafmvJW5
TLSH
T1DA45234BE45790FCD35151384227F5DE83B9EDD5AE810B07AFAE7C8115BF0A4394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7dd91780e6e31eda54919a75740e57cec27cedbd78a6d9094629ac8b8f6ff01d
MD5 9c3dddb801adbeac49ffdcf27fafcd82
SHA1 bceeb593af83f7a29f2cbfb23560e86f2b5660d0
SHA512 05d75344766c8d7f12acb0e18700921bb10b24cc8e4a9b8509ce986b19bbd0c11820056c0f9092dd6f0996c08ce902cd1376a3abc6d314baf2710308e29e1983
SSDEEP 12288:leDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:lwdZjHhQ6giafmvJW5
TLSH
T1CC45234BE45790FCD35191384226F5DE83B9EDD5AE810B07AFBE7C8115BF0A4394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4bdcf2fd5e1bc510d24fe0221ae2bcee24615909e4d37392ab0f12ceb05c7f8a
MD5 87a839e21ae1bdd5b209778c158bb80f
SHA1 3a3077a7db2f6218a85786cede97775e03a0cbad
SHA512 96ca94a8062d6cd43a28e42419b26db51bc831b5f305cb49a0bc2633f241b363272b7e4a1484c9084e01dfba1712b7c50952887676cdd808318aa5bb81769e16
SSDEEP 12288:WyPz5L8tDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:rzy5dZjHhQ6giafmvJW5
TLSH
T1F755120773A230FCD1769238C9626A46F376BC714B604F5F17A41A761E372E06E2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 861fec5a90741ed7a93617719239d1d37ce3f7d4891206b25aeff8379e7ef6a0
MD5 4c5b58781d313f3c0fe5fd599f771042
SHA1 ff02ab96fa408521e9f72248fff955c63b1741e9
SHA512 a31e1620528f4e90765fe48b83fb8cf3b24450a8a9a066ecda256dbbb8cb122d868c77339461f04f0f8ef42d2917d060b75bcd352c8ad29bdc302920c92673dc
SSDEEP 12288:wKDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:wcdZjHhQ6giafmvJW5
TLSH
T13A45234FE45790FCD35191384227F5DE83B9ECD5AE810B07AFAE7C8155BF0A4394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e647f824a122fbaf5922c1b3b15c6cd21395cee18dd17a4b189cf100b3838f62
MD5 2626ff8151df1aad8062ae8b654edfb5
SHA1 c40f428d9b2188fde6efe2f75462658709839de9
SHA512 558b3af99cff5fd09849b13b597a63ded0fcce3137d2571d7c6a1ad7f953d23ae0d59da3de69ba00fee307c20af2c57467cdea6ceb331d2b0a69777805c9782f
SSDEEP 12288:dKDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:dcdZjHhQ6giafmvJW5
TLSH
T1CC45234BE45790FCD35151384226F5DE83B9EDD5AE810B07AFBE7C8115BF0A4394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 87050505261afc381a9da2b0c7aa0e8184da71bfd45e25eeb29d9bad815329dd
MD5 ba6ba484e5a5448edcf1c841e74781ce
SHA1 c5db2e4e23c5dea083d6092c9f1c4f763a42543d
SHA512 9b7f5b5b7e8624e97be4a7791b243d27660e62072ab436a7e38175f3110beaec5f1a60a8f8bc56622d0c0c288af312cc9efcbc7a1a1032be0186ba6c2e177c6c
SSDEEP 12288:7yPz5L8tDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:2zy5dZjHhQ6giafmvJW5
TLSH
T11C55020773A230FCD1769238C9626A46F376BC714B604F5F17A41A761E372E06E2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 482d1ea5ebe16fe4fd7b933c5aa59c451f2873fc70d9bc5ce5732ff59931e0ae
MD5 ed2284f0977d96c7acce05044e984f67
SHA1 20adaae201a33326dfb9b4d0329f3c7fa6fbbc0d
SHA512 ab19b160f1ce9ff98839cb2519bcf16ee841bd763fb3aa7ade39dbc93235d96afc2cd430a35bf532564812cc1ef77aff75bc9475818f2a8e8edf99817f8f3bff
SSDEEP 12288:bCd9MWYoaLHF3z0z04PDvhPDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:WT9aLl3z0zD7dZjHhQ6giafmvJW5
TLSH
T105650295B35018F8DD67813EC9269916D2B2BC5A0B60C61F07F83A575F333A01D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9722a945d11e7b317117ee932d1723d5b61062cf10adeaa1d7ef522da6c706a9
MD5 6582d0f14e2df9837e961fc863959886
SHA1 d4f077402ebce89555c2a52e5c424c584a5fcaca
SHA512 f40dbf3cf20a1a4bb147d823405f211b8b345ac085ed416316116ff0382ed2dad05e95d808f542fe265dfafb1e08d57fa775c2f3d1e24619b6b8a16cadea9016
SSDEEP 12288:/i4e7oRdTfgwCHKy7GLbbdIvgDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:/3td9CHKy7GZ3dZjHhQ6giafmvJW5
TLSH
T10475CF90F3E410E8F1B3DA3589769512DAB67C991B31CE8F03A8255A1F336D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b9007dad78949bbfcd58a0bf7b9a45fa0acd344ad69fbc2eda8abf095d3fce69
MD5 2afccba2981d1d98fa8708dd8e308761
SHA1 dd111de674e2bc0e061f4deabb530f03b3768847
SHA512 3a238f5933168c39f8a4c78bc04b44d4176fa4c22e354ba12a2479e5d5bdc8c01c948134dca985d436e023ac8d05386084dae797625579325ac2304847b26b1a
SSDEEP 12288:E/Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:ErdZjHhQ6giafmvJW5
TLSH
T16945234BE45790FCD35191784227F1DE83BAECD5AE810B07AFAE7C8155BF0A43D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 21c56286e5fbca68647747e70e55e3165458e63f33f93f7751b14a908ca1ba90
MD5 a98c15205ed0c86a228da2418996977a
SHA1 4c7d56318fbd9c2a4ca3f0f9ca0d61c22816caa1
SHA512 6aaa0717584f7d6433b15bdcf1204f73dffe0d89e41ab1db74aefdaff1019b25cefa402bde8c730acc1055b6ef57b11ef554bc0999c8851f4adb76f1e8fe2b24
SSDEEP 12288:TNDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:TZdZjHhQ6giafmvJW5
TLSH
T17645234BE45790FCE35191784227F5DE83B9EDD4AE810B07AFAA7C8115BF0A43D4688B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 99c0a3868d5f461d865cde4d20c22aa0c75e5fa26fe65cd857431d65bd79ef1f
MD5 ff0edc5fbc4cc2cedd10ffd651814144
SHA1 9841e26f62a728ee908cc0f7c37595fbc5cfeb7b
SHA512 5b2dbd4395107c0f11ea041364719da7b6582282b949b87560d68cb7cbcd7a75dca9efaa6ce30f662da47d1d3022f9fa5db173539487ea6d7beb99b49542b95f
SSDEEP 12288:EgDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:EadZjHhQ6giafmvJW5
TLSH
T1A445234BE45790FCD35191384227F5DE83B9EDD5AE810B07AFBE7C8115BF0A8394688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fac134c7a0f7b12fdae40e9274ad414bdac3d877bc74b3a81a20886a0b028a30
MD5 c747eda805387fae2ad1023d15903db2
SHA1 c7105894e0feca71ff59e01769fe19c696c5bb9a
SHA512 31eb8eaecc635379d75ea16b034f580bc30df877130da8ebf14b36c99e6a81690ff4d19f09e310368aa50c8e7328a1ac2bb2c5b01951873716f9ed0b3d0cb21b
SSDEEP 12288:+KDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:+cdZjHhQ6giafmvJW5
TLSH
T10F45234BE45790FCD35191784226F5DE83B9ECD5AE810B07AFBE7C8115BF0A8394688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b8cd944a564125d1188e4b5622cfad1ad21d3f0fa766c8b917512c6614006974
MD5 0de9462505ece5472b025b34580739d7
SHA1 afdb85a4c3f04a797b81ec61a0c4736733aa0d53
SHA512 02533ecdd2ee903d3fbd42b8065e2c23538b7f14c27ec063a4cd2b3e13d957592fba03795481c1a0b6d4cb4b62893871e18fef03b0461211d04db4d0344970a2
SSDEEP 12288:B/Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:BrdZjHhQ6giafmvJW5
TLSH
T18345234BE45790FCD35191784227F1DE83BAECD5AE810B07AFBE7C8155BB0A43D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8f2746381bcd253ca7391193c66e3befac92455ba285d5c1bddb35202c0848f4
MD5 8c6063500eb992c8b8bfdb91d0dc2b85
SHA1 1fec6df8a9b29fa7891a6f377f53e580dc530380
SHA512 cca98af83bebb34539dbb9b29156edd67415adc40315468c3dc15ffd88238ecab515b10daaa8081c730472061fc6d3f615b2b98fa0793c3327ba9676efe9a771
SSDEEP 12288:DSDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:DUdZjHhQ6giafmvJW5
TLSH
T1DE45234BE45790FCD35191784226F5DE83BEEDD4AE810B07AFBE7C8115BF0A8394684A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9b3a20168d66e9da7c483bf274196bb6eac0a9544188a8d9900596afe8458cdd
MD5 f76786d7444ddc7f64220455e128a5ef
SHA1 25103520f1e95471acb4824867949f61002d5de6
SHA512 7de7ef7698a2a0aaf19bf5cdd1dfb153addd38d3094cb374d90c8e6770086ebe514fd354e080df9c37cabffcd5839ba5eb780f7b3008c4abe53dce391b75b567
SSDEEP 12288:OEDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:O+dZjHhQ6giafmvJW5
TLSH
T11545234BE45790FCD35191784627F1DE83BAECD5AE810B07AFBE7C8115BF0A4394688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 85cabc5ccf34e301c6531a132c3e85c02f2cc222979162028b584f641c2be46d
MD5 275db82b16439d3edecffd451cc1d631
SHA1 554460f7a925d2728fc8180ef095534d091a6a30
SHA512 00393252fb605c199a3b59eb94752a0c1b17bf010c9c6c0444b3f392d3b95be92d1f7e48a30cdd4da5a3220eccc9ee5af38fb0abfce158772201439801ef90dd
SSDEEP 24576:Ofwvok9RX6wkyAIAdZjHhQ6giafmvJW5:aMnYIA3rtgiomvJi
TLSH
T10F85D029EBDC44E5E1B7923C89B7460AF2B178591B31C6CF029A53AD0E37ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ddf425dd32dde4a96c65bc6397b809bd22a98a79ec427d204894d308aba3876c
MD5 855f9242259163df2376179315d47415
SHA1 6eb60a1ace59b6d684b447ab03065797a2f46669
SHA512 ce02a16c96b52714077c25393e28913be6e60be945f9a6b7ed30bc54565d86ae235248a948faa9044684efde932ac018d9ae378ae7d986c7a687f93ad6809dac
SSDEEP 49152:2YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0P3rtgiomvJi:yySzP3xjNi
TLSH
T159067C56A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1e89d3aaaff4f01d1e2ea33dff109471446ab52671aef723a1e856bbff48657a
MD5 9eac8e805004b85eea1e37c0bd850e6b
SHA1 78f44cdb3f2fad2e7fde4e75210fd3db8c97a971
SHA512 b08ab74898521248c8e0ba4df162d6fb64747a71c333c5016c0e9ed47e3cab93a06ff058a71bbb0e0df9f85e109dcd45dc2057bc404d8ec1e1beeceb486800d8
SSDEEP 24576:447Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYldZjHhQ6giafmvJW5:447JUQj4irIhCnDHUPfF/f3rtgiomvJi
TLSH
T17365AE1EA3EC01E5E1BA927885158A5AEA71782D1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0a5715c2b1094b3086c0585795b78445f67190998b5b1d4463c385321ccb18c3
MD5 e98142444736b7d66e994f27181b4d58
SHA1 f32aaf9e73007ff25b3d0ec777834fac9f82c6f8
SHA512 3c7ddd2e28f4a01833a63751958a56cece3cf1d406228dae9977b0fab4012fc629c44eea3f837b15225cf540a3037a589b9eeac675ed6669ccdcdcbe427e32b2
SSDEEP 12288:1Gsf6Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:PMdZjHhQ6giafmvJW5
TLSH
T1DA55010AD29801E8C16E6139C7169645F3737CA58BE183CB57D0F97E1F7A2D06DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 764d14864ae1d7e973869e8914eecb3d346286cb8c06dabbe8913135ae1d9373
MD5 9113edcc58dafacde32992445091c6d8
SHA1 b58e8385638cbe15663ec90c8dde586b041f9e32
SHA512 fadc41d892923a02ee8b3393a551d27725822848999f80ad06e9fbf5be269978a0d27e78963ee6d6d9f572421300d8930ff75eac58f0814bd44e1a5dadcf8570
SSDEEP 12288:IV5K+GU3foRDPNTvJ8Yz8FZ21iPvriGb4GmJRMtbsrDO:IV4ZUP8pvJXzMZ2QPTZb4XJRM6r
TLSH
T114352850766AC75FC6A940321E32D1CCA7703D41EE05AF0773C89B3F957666DBAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1fd47febe875833f2daf6f16e00aff3b8ca1c220817c7e61bfc67beed39d30b8
MD5 9619807fd4ee7a4e946e1df97231dbc7
SHA1 cac3c0ca06f9eface3223aa8ee5065fd28e1cefb
SHA512 b4d464a7d74d0cc88ee7632b785a1c6bd9aefe8340c0ec0cd9bab2ea131a1474083f80bd14eedab7ce105a9ceeb1c8da32683d09828ade6ec5cb8f59512a581a
SSDEEP 6144:/9DCUULVthWE6rFUmvTAqPtNvB2bcmHNhBDL+VZBoMxgTwR0+OOB6q4I3qU22P7L:/VkAXvKcCBX5Gh4lwp8c
TLSH
T1F5650981A537A38FD1FB603107265B4CA7B4EC07B7495F26B3C8553AD82A721B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ab08d371049343dd043ab75cf9de665d3a4d378a051727adf0d02eb04bb0b0eb
MD5 f17bf7f1a04fd2346fb3fdd37526fc89
SHA1 720879487436152a1721a171ca1e218d1e8e9380
SHA512 fc6e3c69a2c6cc78e780b3736880102f4085f3410068f4fbefbdc626bb6d752c077e421bf2633533f00da8d8ca7b1c53069b2d7904e62ff0b86946b30a6dca55
SSDEEP 12288:407CDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:VEdZjHhQ6giafmvJW5
TLSH
T156452347D25B94ACE2B2A138022BF179537EFDE49F400A87BF693DC164BA0D43D5684B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 917cbcf23eb70e5181831a4bd2a86110686a3a70f31ac3d665a6e4440240fc24
MD5 084a75f3d61fc020824029ff7efa01c2
SHA1 4e9b6a1eb85c2f2b95bfeda812a20036eef418f1
SHA512 124e5c75e456a04c53ac60663d600f47c510c6875a828248669cf88ae9a2517b81f2af7738c89abd2ba28562b6ed3c3da8e52b1162dc35f5561b2fc4f01cbc30
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYidZjHhQ6giafmvJW5:Mgb4mBIBhGFl3rtgiomvJi
TLSH
T1DD65AE1E22EC02F5E1F6D2B8CDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f0092553a57dfc02a14049e9a2b2eba92b39a266e7c5c6fa5a18db0c76557078
MD5 234b96fd589927f2b36f8cb5798a59e4
SHA1 f48986d0f10ee3a842faee4e3b981cf24e3bacce
SHA512 e9e604a33211451bb963defdc1821c28c971c241b40753fdc5b1228d7a8d8c4bb74ed26030a12d3743eadb932621d3d6c5639d146aa2fef3d393c69171f73258
SSDEEP 24576:gG88u8FpJqH1Wzria7/mVdZjHhQ6giafmvJW5:z7ZFPqVha7/63rtgiomvJi
TLSH
T10E85F166B6E101F4D477D1388A464667F6B2B8250360EFDF0BA88E511F236E41B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e4e8af72f12e77bd9a673b61b979600aaeb7f6e5af65d7f37f77d1d84ca87037
MD5 21c1f9e9d2a6f7c06eee5094d577769e
SHA1 79366e17c093a6ea96569da91b9e16bf0d45d891
SHA512 446ad6763ebdf95f7c83322c84ad8edd90f204b5a36531eb521a8c9bfcc9413b54375cdbb8f166954d815a9e8e2a7054bd4c38024f9b3ed70c99221b7d38728e
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjR3rtgiomvJi:eG05lO43bYxjNi
TLSH
T1C8D5CF6E62EC11F9D1BBD17CCAC6460BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 287d22ba1d5599061b13a49aa690e1176bcdc775f52f16df906ec98627b140d2
MD5 c6deef44903cb0612e8cec7a81ef808d
SHA1 56d0b5f4fe226f756d4a69edc3d8fa046e288492
SHA512 979fcb7a248c2d76f30a9b405db9162a1be51f185e49e37971300ef9369935718bfcd0e160880f746d16c527ab0a0f1fa22d325c91fa09c04457e8de7c6c515f
SSDEEP 24576:ifa5POZ3dpqWVM50JicR2hG0lasx2+47eidnPdZjHhQ6giafmvJW5:qa5POZ39Jt2pasx2+mZ3rtgiomvJi
TLSH
T1A265BF5EA6FC00D5D1B9D17DC583861AE5B1346153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55e227c9ac452ebec6537421129ea68af7669a180952e84c044e5c564d4226ea
MD5 640ac753e0935668afcb26c98f0ffd67
SHA1 6b2b435a3a5396c9d2dca98fcc2578e55efb2a94
SHA512 615cc8aa143ec26fa88095f363ac002b863dc4f16f5ce8fa142e837c09d1e9aaa151e37ecbaa26a4477b8e6b4015fdd4270e12871599cd3d320ac243df912c74
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkddZjHhQ6giafmvJW5:3Nc/zEOVHFa3rtgiomvJi
TLSH
T1A0858C1623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e92905f2737611c86cc1795744e63d4817f0f5622507036389127ab4df5a89b
MD5 93dd2fd3eaa59c0cdb59659c5619f7d8
SHA1 ff0e288a2099389d9f4716e147500658fe0b3bd8
SHA512 6116a06f08853f1ab264146bcce5e8b27d5a5115aadded23384e0020507984916bf81d66b90b5de1b182c2ae394e780d378e24131b3836dee9ec9f8a8202b8c2
SSDEEP 24576:/tkNvNnaFeYhJNtmZBmTdZjHhQ6giafmvJW5:/tMwBtOmT3rtgiomvJi
TLSH
T19855AF6EBAB845E4D1FAC6B4CD238512E6727861073253CB5390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 59c6113969944313e30e5258a50addc6ca2309b34cc0de24067f7526d1ea4eaf
MD5 5a266354a5e7da836ae51ed8ef334485
SHA1 82f62a021eeaf3662bc98a3d72e03e7145f3c35f
SHA512 57c3ded218f52f42eaeefd15002d496ece0df2c4847d28b5ac5f5eb898353b80b76e610f772df7fc516ee56ff4f98e460470f8b2f9949a2422b28a9fa978b9a5
SSDEEP 12288:oHvUrBFrEjwaQFDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:oPUr+NQhdZjHhQ6giafmvJW5
TLSH
T13E65F11F62AD18E8E676E17C8542971DF372B8A2171292CF02E0817E4F679E87D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dbdf279e101c0c5247da978ec1d27ff888c358ce5a37ba93a0ca81ac117d2f60
MD5 b9f2700b759e955f2a03e4aecf5c8065
SHA1 54bda0644078ca748be04208de36f1d7287eb92c
SHA512 1171d2cdc9263c15810c617a10a36d8de9616d929a72119b6cdec7656ee97bc44487c3bcc5f00e7ba6877eb1075ee0d2b6aa1b650638f9e4634e47a5bcc5e428
SSDEEP 12288:cQcMxWDXN1Dp/fshBItT1IQgAGDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:mD3FHshBIYQgAodZjHhQ6giafmvJW5
TLSH
T18175E17EE69D00E4E57BD1BCC6638A06E37178A9072256CB06D491B61F6BEE43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-104-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1152-7-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/1152-6-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/1152-103-0x0000000000400000-0x000000000061D000-memory.dmp

Download

memory/1152-2-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/1152-0-0x0000000000400000-0x000000000061D000-memory.dmp

Download

memory/1908-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1908-319-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1908-274-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1908-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1908-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1908-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-306-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2412-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2412-110-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2412-116-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3144-73-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3144-99-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3144-67-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3336-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3336-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3516-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3516-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3516-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3820-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3820-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3820-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3820-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3820-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4532-303-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4532-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-96-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4532-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-90-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5796-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5796-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5796-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5796-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5796-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5872-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5872-258-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5872-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5872-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5936-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5936-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5936-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5936-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download