511d33fbaec9789479412523ee5ff107729ed397ddde30d6b4769ebf37772a88

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260816-lejkascd83
SHA256 511d33fbaec9789479412523ee5ff107729ed397ddde30d6b4769ebf37772a88
MD5 f6aeb5e57009465212f1861b4700a54a
SHA1 8f1b3a0258556ec464fa22ef0ec51703d2d08004
SHA512 0a3c3fc1bf316a5a96ab1c502f58e5ba29091e30a845d6dcd22711146bcb53e07566a9dfc6ba3bd878128a210508144dbebaf603307e3aeebfdca8a5408ec6de
SSDEEP 24576:2YJ9bW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2YJtWLNiXicJFFRGNzj3
TLSH
T14365026171C184B2EAB704350AB89670AA7CFD354F2548EBA3943B6E5A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4272	elevation_service.exe
4952	elevation_service.exe
1136	maintenanceservice.exe
1912	OSE.EXE
1980	PerceptionSimulationService.exe
612	perfhost.exe
1048	ReFsDedupSvc.exe
5656	SensorDataService.exe
5216	ssh-agent.exe
2912	AgentService.exe
3392	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9e3fd1f024febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000812ba865612ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f39aaa9612ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a849a67612ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	1048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1048	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2912	AgentService.exe
Token: 33	3392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3392	SearchIndexer.exe
Token: SeDebugPrivilege	5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5068	2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 3064	3392	SearchIndexer.exe	100
PID 3392 wrote to memory of 4520	3392	SearchIndexer.exe	101
PID 3392 wrote to memory of 4172	3392	SearchIndexer.exe	102
PID 3392 wrote to memory of 2876	3392	SearchIndexer.exe	103
PID 3392 wrote to memory of 4324	3392	SearchIndexer.exe	105
PID 3392 wrote to memory of 3792	3392	SearchIndexer.exe	106
PID 3392 wrote to memory of 1500	3392	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f6aeb5e57009465212f1861b4700a54a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1136

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ecf99b73c0b2fbe80c7a01d16269e300f2ac693ca075386fad1dd6649bf2b203
MD5 4a626a7d4641a7d5289f3386ae886257
SHA1 5fe971e7ee3fe15109b84a563faa1549db74deda
SHA512 79a16b8583e0e920607d83176b74f443be323ea83ac96300cefe37dff0d2394eeff3bf25c49210b870b93317d3fc2e74fb57cfcbbdd1210fba58a540ae460f92
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxncLNiXicJFFRGNzj3:T3q6mjBj7wRGpj3
TLSH
T1FAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 29a5d19b9475cb2b8a6dd4a52c2518c73785ecdeaa9ac309b348a14f2065d929
MD5 251fe30bd06024bf91df2d70524f4055
SHA1 f83d4b2b5d4149f35583a612fb8603bd709a1804
SHA512 a0ed1fb234e69e216fda2d7361cee4c62267f4aa76994067d9d79dc9a0cabd36d28ac502a56ceeb0b58332cb0b3250834f1c6afe4683f0badb88066f47b686fc
SSDEEP 24576:/XYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ktc6LNiXicJFFRGNzj3
TLSH
T1CF75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 549b1ff2ef45dc8a899b9a6fb89a0b39be24d7cd87f017d717d673cd95c14a25
MD5 a799211a8a96b617386d5fb98809f5fd
SHA1 beac13aac9dda817b5893117a8d3b38ed0be75e4
SHA512 ced0e32db6bee0146dd8603157eb1da8a1e78edd916c1dbad893e3e7dbb764aac8320ad34669ced2bad69abbde7de00c58fcd38a15543601c9198217b17b3d64
SSDEEP 24576:Y0Le5ji0hmxhrM0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YPji0AzJLNiXicJFFRGNzj3
TLSH
T1FD859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f367ed66a43ed7a27e1270dedce4f2fd9d4dfeb0f0c2ecb7fbc1a6f0b8633802
MD5 1a63f4270da9aa10cce660aa0366f53f
SHA1 72f203ebed9415951b6180224c69e93f0b520ccd
SHA512 2c90c609d97f8a0da424ef73030d14e4e10b70ab78e1cc0c17c5211cf6661a3e63d52fedbacb7daa6ab118f158374e4226aba242956bbb0d5c45303f4f4ec1de
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWj6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K/ezSC6vUzPv+HjyVLNiXicJFFRGNzj3
TLSH
T165756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2ae22b8a51ea491e413856844ed6384201735b8ebcc9a0b2eb18e4ee9a3e9f2
MD5 604dddeec0fd8b21a265537bf84ac959
SHA1 0a6701e2766b21b7a16d66ede29c39b938458a69
SHA512 b424f3d0b357ead2906940ef3af71f20941c3821fa0b933ce61071ba978264f8df1d098601d7716a55da80fab99a7ed8c99d5c4a465cfd191bc86a5ea59950df
SSDEEP 24576:dVbqPb88hv/l+BT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dVO88hXl+pLNiXicJFFRGNzj3
TLSH
T1CB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4c3bc4c3ee2ad6e9bfa2e9b88767d6690f68aa3eda865167bf98f3c570ee8552
MD5 aba240c4dede808d3f0f873a0d3ba89c
SHA1 c83aa94051b97694cc69d33d768de3205b3701e4
SHA512 6528f25a652aba01966a000ba6c025e36e60c16327d782f3f0fa8868639161d5d06afa29ab548b174e88733136d67f974e8e2382df5907b9f13c77483969d55b
SSDEEP 24576:dGY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jLNiXicJFFRGNzj3
TLSH
T1215523D3468854B1FBFE003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 dd913fae6723f59cb131bccc22d3df77ba83fe088140bd03d45bab41c64dfce9
MD5 287c5ff44b17b2b1bb6286a711f82ffc
SHA1 a8b7583aedfb761c0b126e67bc667e8094e5792d
SHA512 cfc34daf9d55e7fd852472bfa6dc18b8b54b2d42d17c1e51ca51b4652e3139d4f7b506472bb2a874e4a2336cba79c1fcdf6e29dadeb65d1342017332f202bbf9
SSDEEP 24576:JJIUL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JJIULLNiXicJFFRGNzj3
TLSH
T17E75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eafed34b890f0190a90db8e32ef4f4daed101d08153586fa4c34be6e4a58e644
MD5 22ed6bfd44c7c3c74b6c479534679f5a
SHA1 9be7a6e0352aff7e06fdb1595156e07f3c598032
SHA512 de0f4d3041c76d11d8da5d743f174486f3864098f71cad606ed2ec5647c2d9fcb5bbc7225447dfa98b015a23613ed3c2ac5598ac2e7249af947e726eb33fb19a
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:XQvGAdlCEL8c/WRNw5Ca7wRGpj3
TLSH
T13D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 737ff64138c25e7864419b94ea4176a9fdba097a4a3c142cc5fde62e6ced5d4e
MD5 8721893b08bb512a985685650e172b44
SHA1 4296306ad281b0b5b337a22216657fc9715d4249
SHA512 20441cd9eef3e5b7f58e07232fb6976c00856554afc3c81aceed14128d93cfa4c8ff76ebb89acf243c4510da3b69a3b0d0d5239ebd20fd0a762cc1e47557ee21
SSDEEP 24576:0fewsAj5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Glj5LNiXicJFFRGNzj3
TLSH
T13075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 08f9444a9e2287b38b81aaa06ac5a49b42302a0f63972117d12805b3cba2f3a0
MD5 4a4d4984e0dc208496f13c1ae27b77de
SHA1 6be7fbaf97afda7da4a16ccccf063cd882f2bf3b
SHA512 14088f6fb1872e051fa3674ea14c0d5281c2bcbe9cd9663ebdcba41ba166711e147ea1eed79a040190beb099d450adb475ae01eb8c46e1b0fc0e918755b1bdc1
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHlF9:lUEtQevvqc2W1cpV20I3279
TLSH
T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c5f6d9c10b7662c3b7075130186f0c6326b6488a6792b11e3e0a6c756a5612de
MD5 23748747d03e8a287695bfba7251b255
SHA1 8f16b378b95d997c95f8cdc506edd384455f7651
SHA512 db834cf139703b1c09d1f1d4e5cbbbb957f19074f7d30cff55ba0ffa8d686eb59375756ea3fecc796b1e510653960538f17b083aa77f157c2b567e076b3cc503
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/zZLNiXicJFFRGNzj3:aoq2VjnmG7wRGpj3
TLSH
T165D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f579886d1ebbaa0c0eab746f34d61818be9e4fde83c0e5f452b7e8806290bb1b
MD5 94de90760e23a50bd7bba1fb1232d9bc
SHA1 0bdb318f00aa170b5ee06ea760acdcca55e163f1
SHA512 ec4130aaf4d309007c34f0b675705fb7baa4d6bd35277a0437aa13234b826ecdaff59755da189fa8569608292b6bea8402e1be2f0194358bee8082b0cbdb6885
SSDEEP 24576:yAhGL6IFoiwtA5l7S53m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAM5Foiq52LNiXicJFFRGNzj3
TLSH
T188359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 631a63884c0ce1fe209c3a4093d489fd38d14da179af612cd006781dba604118
MD5 ec230a5fff0755c4aa3f2520c31515f3
SHA1 149617cf0e5978992ee3c3efd77ae241d1783a49
SHA512 a215e3668d5f46a7d7070a39f9212b9abda07b2915cd4509315f7f22ea8b006b292ed4af44131e0d45231bf27853a4b4c103c94dc3c84c9755218b832c046f97
SSDEEP 24576:8wuROW1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8wSOiLNiXicJFFRGNzj3
TLSH
T1FB65F08632980CF9E9B7413986578036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cd34797fe69021b8ec099697ad0b7e6ec5c80ca2633ffa66bda15d3ea0d92248
MD5 d3246fb68d36fc6a551a4a58fd1d2ff9
SHA1 cf74ae4f52466b95e9231853493f7ceaf49c9d04
SHA512 806fa146ce3715626fce6f4207170dd4400e3b4ddebf87596de0c9156fae0156fad41ffd046937ad38c9f2a794605f9405822c15cc2bba19f8bfd8cab567680c
SSDEEP 24576:XZuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JLNiXicJFFRGNzj3
TLSH
T10455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a79c305dd80226d90f2cab8d3323509b4e7831ded573476bd2a931a4e3f37c0
MD5 dc40b428c1467c93e7a423aebea83753
SHA1 9de3988afb8eac84851e248a37f2df17c4c7f719
SHA512 4444fd6bca1a0ee9f45f00829b78df43ee4161a85dd6e204981866d64ece9b2406fe5202268e5efdd5e4014bb39be3cdf5cff530bbd3eb70eeefb590937ea464
SSDEEP 98304:7QRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:KQyiKanX+PN7F9
TLSH
T118667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb28bdbd71ba4514c8e7bee124adf5afd68e0d643c62862fa56b52f79e3da51d
MD5 e2594862b5b4b8633ff4edc0fa0492fd
SHA1 808f0719b2bea69a951dc303eee6ee4850bae690
SHA512 080a7dd3472c5daaf61a659b15558fae90cc075a546bff483f39a3fc7ae7ed2b0c4469c560e6353e21b70015c93641ab6c47e379ee49e5a1a7a5f16d0be197df
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:MQyiKanX+PN7F9
TLSH
T147667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 51997801d0087e05409562f28f5d2427dccfdacc12795b275ec528f559aacbd3
MD5 a46afd989149820f9d4e39bca5ac9d85
SHA1 61592e4a8f7817535d596d2bc893983a365a0172
SHA512 93f53ca04d59dd244c67bff168f24677334a6c8fc79047db926451fc8dc75169aaa3d84ebd60c278028d7f8405c2631dc7a83d2cba890f03bf6c07488b6d1077
SSDEEP 49152:368Qg55nhkeWu7PNU3/JLNiXicJFFRGNzj3:hthTRc/J7wRGpj3
TLSH
T1FBB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 84c717b2d609a7fe691299995fcb61c980a3e6f5111f7c6a1cf06f5fa821adad
MD5 0639653cb17f74d2976c337b2ceaf22a
SHA1 71f6aef8398157f7d63943bcb61153ca6a6fca52
SHA512 88cf35e52aa6c070efd5c9e833338e0bd787b093349a1e926e13c12ea0152c8efc78edf0ffc95ca33956d4e5e2f86b1250a13e6bead3663e6df15614de506864
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZY7wRGpj3:BLIHRWhCF9
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8a6964a7489d4c2c348e58e4c157c1e06725851e96152f7f3ddaa62d9c35ea9
MD5 7eb3a43b6af46c772da75ef18f74042a
SHA1 c326ed957d7527a4738d48f7fed7e407ff4f370f
SHA512 ef5a98dd4f56d44c0996c367f5fbd7e16bac8368e4067e389e6d038e279ba76030030c53b3613d912aa29a156198c37a28aff8dcfff04ec9785cd529c759a82d
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:ou6JmIxd2dP7wRGpj3
TLSH
T1FBD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1afb15691c8092e398435ab50f55ee7981dcb7ada8e4b63d469bd3457f8cce37
MD5 5f8f59836e4a33957a8769d32bf944ce
SHA1 89bc46c3340ea8cc677d9792f55c4ac26f660d44
SHA512 e2284314dfbf44f360dfdb2d00f86d527ada26ba413c16472ee1d499b6b6291fb1c9590a007c5977421328135d800b2e370901f673936a060cbf8fa3786bbd72
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xrLNiXicJFFRGNzj3:GmifPqRG7wRGpj3
TLSH
T10DB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e52035b886285b397258d9609b7859947cee99b921ad079104c38c2367eb0900
MD5 91fbf0b5e51e9c997f37d67cb4309b7b
SHA1 55d00d903ee1730ae180311cdb6b8bff11db3399
SHA512 c68945fc12cca4cc8789c1d7b742974cbe21c202ada627ed793888d8bce87796c8c666e33c4593459b960af72e020a2443d2521be39067cf1a7204ce76218542
SSDEEP 49152:ESuZQIY0Be2KkRVtOnks6NMHqMLNiXicJFFRGNzj3:W5dKqi61M7wRGpj3
TLSH
T16CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e482d6c7ad35b17405156f67f8327a80fdfbc779bac36d4865138e37d23a9452
MD5 54bf4b38f5015b058ea42fdbd30b4c23
SHA1 e1936c50ebd1cb83c0234d6b0dc9558cd819d9ab
SHA512 37e5a7a74ad10fdebe52978f2f0949bb19f0f8b04fa00d09b85a76cdc63984aa2b1e80aa7aac4d50e304380a6c8bad144736e5b3161bced52901aae7023fc4dd
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5w/LNiXicJFFRGNzj3:eX2iWphC7wRGpj3
TLSH
T1A995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0d8b0875c44176d6098a7240af8a6d5c6cd2ddcc83d299d4ce5c145d35a4d699
MD5 9ff087d77984f92929feb075bfb29c3b
SHA1 1a0a0458bbdfbf05d4ed84d5b079e4dd20fef8d7
SHA512 5bbc54e6eaee53ae64de4912ac6d51a73ad2b008f90b02ba6f040bbd6c0d0344c696b23f34cac1de1aaf0a8f73dfd74347d34610778f83fe31b8f2315a82a630
SSDEEP 12288:oGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ow/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb3cfb6c53a2a6e982da003da0148eaa67204b59368c7e50b7ada2ffc1f33b6b
MD5 fb7ba5dc4313bd17fbbe42f61140dc1a
SHA1 ea1a49997b1b8650187e75745af8529b9466f8de
SHA512 834087ed28758ccdbdff5434d69abc038d7daed585e62a381ce5ccb67a0b6186c9ddd9e52f78bb82136ad386fd0dd096b71a7c253469adb641fc9369ae5bf5b6
SSDEEP 12288:1xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:19/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6cc106d9b9422d9f9ebe238466b5249398847a972cce2a06265422a19b6072aa
MD5 1c6a1a1e0a4705c67de5bd812e1d68e9
SHA1 109e46872232675fa618254a34ceb52336ed8b46
SHA512 8cb974dc5d517122e56e46dd46099ffabdf63f1314aefdda83aad720897bdbb705a382d90fb7469d4abf5e508eae7bfea55150991676bb2df9fbc9bc7429cdaf
SSDEEP 12288:dXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bab5bd6c836244560ac619965739f9cf9086aa90ea1c8ffbed4d4d9d80bd2c01
MD5 89a84f09007be7190f261f77245c6e6a
SHA1 18da14392b5e0b0659fae48dac431977d0e5a11d
SHA512 a36a5d6aa21c36d585140481c4829263acbfea0c94b23c0f40f90311f2036bdc4b886cf0756eade08830658deaff21862f29541280b6b728af33f4e38af51b13
SSDEEP 12288:7V8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A552393168900F1E9FD8039CA764424F2947D6CD7325AEBD3003D1E5A75BEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c0655cf0096f17cfcf7e951e4e9f3b4b93604041a4190388f280b8d992f77e1e
MD5 651e8095e67944bce11c65647355713f
SHA1 4fcf4df3c4e4b41357a9e682437e44c1272ed777
SHA512 1c5322fdd970f7b1c0b71499dd9646109ff3503725a6a05776cac66d206e78fe26cd2d29e87a6637625a6fd4051eeace356ecfd72be507fe4512ced708a0cf0c
SSDEEP 12288:IEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 67c2618d380fb00740a598aa9d779e87c99c364f889e45ff35cc3cc0a5574cb3
MD5 b861268af3278a548dec8c6e95ee4726
SHA1 f45233de1d7f2ff14cb6a09c3160a8836df12745
SHA512 b33dcb65b0d88e9edccf2f38ae96ed98a190b41e6679f8ffb33c604eb8dce76d214657bad44e4707407cf3a948a45762f02b3e9b6a1d1b7313b9d4cfe616aa19
SSDEEP 12288:CNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3548955B1FABD003986754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 72295f54d8165547f987597d236ee7a7a996ba89ab08c6aad908e4fe4f05961e
MD5 ae39081ed28b53d636cd161e1ae3f4a3
SHA1 ff4a8b0d7758d6127a0f1161e4da688d39362e1e
SHA512 2adba6d8030542071811eefcca6cb09544455d02561cf09945bf8a6a8aedf47e4659486a002aed8eb66d6c1fd8359a97e5afbae366f02e38f59a1f53365a4369
SSDEEP 12288:DZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523D3548955B1FAFD003986354428F5882E2DEB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b9f97c55faf12f551848938c02bfb962a80685709bddeb3779c91dc0e3255493
MD5 167ec99bf6b9e59792d01cd9334f54b2
SHA1 72ea195795448c3efa9cf6709f5ffa3400534743
SHA512 f3317a7c339c3549dc0906872297e717944fea87bee65d754c38f53b9131f1dd2c565d8cc03635063b56e64313cbff5e547256a65b5ee3255e318e313ee82189
SSDEEP 24576:CZM3zFVSOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CZM3zfBLNiXicJFFRGNzj3
TLSH
T164750195B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 94b1a547d5b3161f6a28b149092d6aa499156d274c15991b5d833b494184c66d
MD5 8564f49980d88e9ad1bd9d34b4488d40
SHA1 5aac2342991e8535690b68a118a987cbb6b0f966
SHA512 b87e82120ff315a9a40db929f75ebd657e8b7f447f9d5f4c525740f8530e3358fb55b683a34789181f0e56c857e0ee821fb8b1b8208d75d46ac8de3e8b3f315f
SSDEEP 12288:0aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:08/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1FAFC003DC6754428F5886E1DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8b4166d2a7065ee0089f187663cba824616314dfd223697c3deb23f03a0bc26c
MD5 38a1118d10364365d9e85f4d9ed5e3b6
SHA1 565267b689c89c5ab4bb46bbf945a67b977c1433
SHA512 b62b0536aefb91fd382238fb8ba05dd04a2709ecafe1ee45d6e51105daad4921c0464ac0ac0db054375e2fb54d3906725716f8160a542493a630a6c412a295fb
SSDEEP 12288:j+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3548955B1FABC003986754428F5886F2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9c757f0e5c985bcfc13e0eabad42eaf8a5e4cf84aa5fac77d0b86151f86988cf
MD5 bbd7d6ad70c610b3e3b0e4f1645ee5ae
SHA1 ff17438f918a02b0698686febcff4a4d7ee4e591
SHA512 252b48d6ad2055a7ac5177efaa63864dfc601d9d80fda69d1b39c6c7de3d3d5fd84f6d68bf8b3268bd11ceadc610c73930ce015f94ea1090f73e95723d54d107
SSDEEP 24576:kzyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kCLNiXicJFFRGNzj3
TLSH
T167650247729530F9E17A4139C9620911F3717C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f609b23c5574011e935635ed6d6d04522e2d95659a02bfb5e324b82326bff4a2
MD5 8c030f3453523345e18d8f730333d866
SHA1 603cfff323feed9f9c00a11a63a4887a4c967435
SHA512 e786f0110afc77e5314e459f3ca41ee36a81d2eaa4941c8958442e069672db40712372c75b90dfdb018b12e895d306aa738b2aa169b526792ad470643af74eba
SSDEEP 12288:RaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1FAFC003986764428F5886E1DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fc3b89de6f733b77794d020bfe193d27e844562fdacc8a1ffb6a2ed3d7f86ba1
MD5 d67e28269db1b3e43327f6e261fa5ce7
SHA1 25de34644a6d066cddb913471ebe7dbbe58df55a
SHA512 8bd117bdacd36ee2dbcf2e65f5a926f30fec1847038ef27a821cde3769e76835dbb7ab84c2da59ec848b70e35e5aa7d9cd0d21feb2d0d62e61f0bc6951ac9efa
SSDEEP 12288:haiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1407f47f63f5f5df2cd2fcc9496ebca0b09579a274e2e0d2f0314df5bf4939a9
MD5 a1945baee38a709aed8864c509ab6040
SHA1 e39c4496cedc20f6b1b5d267bfed6f60719be31d
SHA512 59017d8b71bc3125269daa50a9a5b645615c7a3f1a62cd40f295c2f42fd9e7c3f79e54119e4890dc5cdb7295f0c6dc37268119e13e523372e6866bf23e73a57a
SSDEEP 24576:dzyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dCLNiXicJFFRGNzj3
TLSH
T17B650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 efa186b01026b949530fe54a248a7bae6e32b081d1bf5abbd6b160ed26ef0bc9
MD5 21232c23f5e7284c37d676e5158e676e
SHA1 74b8b49cad6736991a55d3521da5ffa92073c557
SHA512 88b28acdcfce6ec5e85cdd6aaa7020012d73e87e5b848b2f0e578e64fe86b6a04bde466e63766ad4b930ca7c21137d5a854a4fb12ef862d82e8684d2b4586e09
SSDEEP 24576:lT8aLl3z0zDz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lT7LljqLNiXicJFFRGNzj3
TLSH
T1E07502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 40f2836c36c7e443790c180ab38d0f4e61f1755a444537934361f03dd57d73bb
MD5 caf61170631d50298c8a05c607baf65e
SHA1 4af8d322eb79aef9d631bbb29e32e3dee2814e10
SHA512 fa31d532ea02db4de51d1b6141244da1920eabef6ac7f09fab95cc1d622ad9ccdeb791595ad9223bc42205c090306ca7e1bd7a663dc042f1f57a72616387045c
SSDEEP 24576:j3rd9CHKy7GZ3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Drd9CHKyaBLNiXicJFFRGNzj3
TLSH
T11885CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 53608fa85fe9275a448938a90b1f5579e6004408cf2f28bec2ced98890e7a302
MD5 d66966ec63fc02c9b06bc4b87f8d4fd9
SHA1 cb44b32740d4d1fcf246768a5d4fad7e92a45ef3
SHA512 2418db16dfc17a426239a535a52386796bf820a894590287aa12dd0f713e1ab30f98083348a86987067f5d9f80b36eab610f6e7bff0a87675ce4acdde57b1004
SSDEEP 12288:S3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1085523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E3483D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f4d7210f6b8778856cd1d4600c08f5d4ffa20ddaac4080008f46881d3d1d6af
MD5 2170da22644537154e8043a671a5d7e6
SHA1 bbe3cdb1fc50317464df7ed6dbf06160261589f2
SHA512 e49fd58f993967425c431916a5d1afe6100fe39e51ea56d04795c155df2d3374e632073bddbc80935eae8ca75771058034ddabbb4029ae3f14d7658730b780f6
SSDEEP 12288:tFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cab307e2ab7d26eea429087a9437b111b98dd400b7f71a5e944d7bad255b7f32
MD5 d82e0602f7e8dc9ab60ddb507c906586
SHA1 6489f819f31f99f5715d17102e5ac8bf0d249b58
SHA512 1dde6399337c48248bf99c9493a3663f4d894201a698f827e660c7b2fc527eff61705bc97f142e489f2761db6232a6eca6534d51e34db040dda88e93cd373549
SSDEEP 12288:pgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:py/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3548955B1FAFC003D86364428F5886E1DEB5619E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 91cb5ccec63d10255dce9ace66a36b6324da7cb6914b017deb5c434ba790c81c
MD5 833ec6dd15be34ca38aa9935965d275a
SHA1 06c92e3d0d044cfc746707682a8fb9ee39617cf2
SHA512 96c4804547e9be1e0085a85893eb3fc4572bdb5c66997523b0da4344b5243dd73ae6fe7d62e922f6b2c718a7f1da515fa322ffb9acc8f208d7576b0d4627efea
SSDEEP 12288:BaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1FAFC003D86354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7b72c2a2e939ba731091fb9e846057a21d803b9f89e4fd06dd620528c11feaeb
MD5 0d9c3f67a248ec28f24b01c9a6ff1371
SHA1 9181ab6dc68560e558dae067f716fa9bf1acdf64
SHA512 7c3b94de837485f669b4724a374bdb72e68bf366e35c31b4771f19142ae94d11c3231fd85d5d964be9810a05089524b8331f362e387347549e73c2d837095f1b
SSDEEP 12288:/3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c9cf03c7e6c49893abe5d41c71b67df5517587ec9ae286e13363717ae347eff2
MD5 a6bc0420110063a6318d5af9b42fa8f2
SHA1 5bc1412950c8354feb4588fdad3113fac5415fef
SHA512 8d51606c9c57de993d56d3c17e20abfa9becd651e45643fc7b70229f1658a741900aec039984e7cf3f63e3ac421821add175ed2e431fc5e0f4579b79c03d805a
SSDEEP 12288:KCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1795523D3548955B1FAFC0039C6764428F5886E2DEB5619E3E3043D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 25987616b7122b1bf506d677a91f75186777b787095e57ae9097eaa1cba15dcc
MD5 b65bfdd054e8a48463e9cd9a51d08f1c
SHA1 349647d1c66549ddd313de83b24273c76eeb38ed
SHA512 789b78213a8c0035a576ac922aea5e798d6dba5ccb927988a24bd6ef7f75c245f479b35a5f8e0af049af079d3f31808dd613a132544494150ec71892eae64cc2
SSDEEP 12288:BEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1ebcb8026cd0ec1e138fddd5e237ea3cc973f2b8cc976502ad5e93cff3582596
MD5 fdb615ca2476e2640059cfd6498a54b6
SHA1 0fd7f4874d566539a59422ec3a03230ccda83978
SHA512 38c9f43a47f125c869f7845ebadbf234bdce3f4465e79f2e273bdae7bbfe599e8011fa6a540d15cc5bbca378446a8f8309e0b82511785051fd0794b9c92e4a63
SSDEEP 24576:tfwvzk9RX6wkyAI4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EMnYI4LNiXicJFFRGNzj3
TLSH
T10285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ff676aaa35d608fbb82437cccf0da2f591ab6ee37785fb9ecf9ac85632c889b3
MD5 b37d616d8e5753904dea59b9e52fbdb4
SHA1 e3fa6d952554a8322a2e321d43f42ab6bdee94b7
SHA512 f53f5971d506e6d44fe3907c7fe428641df530794649205d3115aad4b0e0097c690054332baaae5b57deecfa05b0c5e3af8f57fc68f59ed0c9a32df56ca5a14d
SSDEEP 49152:RYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fLNiXicJFFRGN:oySzP37wRGpj3
TLSH
T122066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7f5515963d66c3261f984490fe36715725597a5beea1395e7fd977ed124619b1
MD5 208defb820e35f000b8d7e2d60c0f316
SHA1 4b7063d2aa3d2ea505b9f2ea86473da6bf83d8b6
SHA512 8e289cd95f058e801355531e44b1f83823bcd8705b95eeb89f97d8a72e8e4238b5b3569852ceb0e95e3774f830b0e8a89d8f8cce75b241413b801dee77520380
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:447JUQjqirIhCnDHUPfF/PLNiXicJFFS
TLSH
T1D765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9b78731868e993664eb8108a2c30248fb7b9ddca8afef3c67a4149326bb880f8
MD5 11bfab69a6cceff3606501d371dec1ac
SHA1 4515116b392af86fdaf6ec951ed9559588f0017a
SHA512 9349295f85cf784b75d1b150b48be78d44f661987b09051c2afe2d8047a1d5de1e0a2d595a510aaabf6da4eda65446576bdaf7c275986caecd8493536c5b2964
SSDEEP 12288:DpsfKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4877b6f1567024275f081b690370dba8e2bb7951dd2f4ca17eeab895a6dfe4e9
MD5 e47541e8f14cd20207048cf39c74d5d9
SHA1 79c5187fbe0a8a5b7d64cc6741b6489d07735c60
SHA512 552938af665e8d0784f03435f6f13b65858413b40c21a3e29e7b8ec3c1704c7af0d4e19b1150cd3f7e75412addf776d929deb9a009abce79a0199d3624633aa1
SSDEEP 12288:x9QIivAU3fLOY4v+xUgrXh1uJzO39lfXkBHP0o4n2s:x9Ni4UPignezYlfXmHP0o4H
TLSH
T161451841762AC75BC6A950321E76D6CCAB707C41EE44AF0373C9873FD476668BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ceec1289eb04147c25c2366c54d1ad9832bb2e2f9fa3b25ebc33c3335b08aa7e
MD5 658ec55878142dd0a029c650c1ba7b44
SHA1 123e97155d593aa9deadcc3900efdb2d18600bf1
SHA512 a2b9fc8b2e98a3202b0bb42703399c3c11ed0a85c5e80ffe41a859457cf525e788d68912ee4b2f4167abfffd16c956b1a31f65a2d96dfb7950d40fbbc602b1ba
SSDEEP 12288:bIttguWhJb5Eu8o0o0vpjCsQOo+er4BDODAPaTo0JgYfqAzLN7JsfbTX4rpYQLSA:stzdjHRmZoBDOFfTNtCzKDzviq
TLSH
T1A245194165A7E35FC9FA90370372C6CDAB649C06BB493F057344CA3C886697EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cdbd5858edcc28d31ceed2bab7ca5e522a8dfacd96871900f8612ac2337c9fc7
MD5 81852115499c539c82ad9547eca4ba0f
SHA1 1bdda41558335e63438d7345ca36ff807d62f64b
SHA512 9f726fb24273fe686b569af58d7cf87f5c678ef3de73d5788ffb536e9d3344e3e627a0543277163a0ded0c38a4559d27f3278a7401509c6bc87c4b5a22204ac9
SSDEEP 12288:TF7yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T103552393468D59B1FAFD1039857A8434B54C7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1073b9622053c95e0f2596f21032e7c69f685e5a932d916f6e637d7163e29a75
MD5 c5f29bcf6b4d55c71ae40ccf5912232c
SHA1 4048752a4600aeb60b774c3266ca73693c4fc99e
SHA512 8e24cdadb9dabd91f304df06472328511c8efb5dd25b2e280db0eafd05a56df67538d1ca582d7bcccda1c8d2fa1b8da7fc1cb680a40339855b0c17c026552f68
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ggb4mBIBhGFNLNiXicJFFRGNzj3
TLSH
T17965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d61575f75988e439fd64555d72513a8c45b7222de0a3188df09934d273ffd25c
MD5 37a9378cafed46253e2ba8516b87924d
SHA1 5d4448de0944c486743cfac59bfcc4f71885ae69
SHA512 870a2484f9deda634b68b47e62df629ca3547ff28dccc2f3b123262615084baaf98f279d075f38f5c1fca8cab6831c2b2897a7c4e79c71e7e58f66520d788714
SSDEEP 24576:vG88u8FpJqH1vzria7/md/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e7ZFPqVya7/SLNiXicJFFRGNzj3
TLSH
T15F85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 101a496466cf76c55b442526c02e7a53ecbaabeaaf43879d5134c413a28f8be3
MD5 7ae37aeb0317b175faad40bf5278cce0
SHA1 e62c8b5db159a0ef69d98d9ea59c1f7a16993d7f
SHA512 8f409b5ca6cb6ebaf49c3d63e308420a82ecc1403d25df78ac6c391763b2645905c385f878807a6d1a3d58a71aa01de6e2e50a60ea75bc279aeb21440af4a815
SSDEEP 24576:PPUr+NQB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJQBLNiXicJFFRGNzj3
TLSH
T1A165F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0fecbdabff0da6d4bb70e82be7d216a9217a9015364b5c745031cd95952abd41
MD5 460bb13c6af73ceec024748e59af4138
SHA1 d002431ba5124318c9a389679a6f7c059770d9e1
SHA512 9dc00eeede70497752963ef353e99da510d38952c217f4f8a45558b9014d6afcf2a7a2f3774fe7b8794a493dd117535669f6291a255a1856f380f0fd2d2bca1c
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRLNiXicJFFRGNzj3:UG05lO43bg7wRGpj3
TLSH
T1F5D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3dd65b710b880ed2745ae010d10afff599c329c6716045ba1d3f04eccb994d7
MD5 f1c3fb5b8bb274c2d32ef7775667b6d6
SHA1 f2872f6f73445833a46e2c5a15c8d74583a22487
SHA512 0d674af8ae8d365f9e1d56ca06b544cf53c80ee9e78fe008e6790ef72391e067196daea8d44a0a62a700c318c67cb197a48dfecbd9e6d5c3c4678137afe2b208
SSDEEP 24576:Bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnf/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ba5POZ3lJt2pasx2+mJLNiXicJFFRGNf
TLSH
T16165BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b3dceb05d92d8114fe6afb69cf6dda30a82f0cba6babd9bc7e3cd234a479778
MD5 5312ae4bf7063240e2a3e1897ae7127a
SHA1 aabd00d40f43746b7bdda023ae024569e5d1b2e2
SHA512 da1b980272600d7b86c81b01fb15d9d382a172c3b0dc333664f46a0ff17bdab70919655f6379df2a3e5416eee2abcea438d287c60e9c5b82a538473eec595171
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Nc/zEOVHFyLNiXicJFFRGNzj3
TLSH
T195858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 55ec3dcac24088a826972efc588c40dcc7f6a15729e84dde97856610f4d4493c
MD5 ec1bff8280050f558626bd18a33aa869
SHA1 0b7232bbd35dc322088009fd0090c275fdfddba5
SHA512 b36c2fe532617e66c9b7a50562ba12dff510f200b5b2598d95620a1a6c78a3c43e5706568bcbc627a171977df59c46bde55a3b402996d49d3cacebcb1946b6d9
SSDEEP 24576:7zkNvNnaFeYhJNtmZBm7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7zMwBtOm7LNiXicJFFRGNzj3
TLSH
T11E55AF6EB6E846E4D1FEC675CD238512E6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9529e5a5066632d1efe2e94e68d1e39ce2a5707820986f2fa6b010e30a6ad655
MD5 9cdeedb1440d1118b9b948af96bafef3
SHA1 514f43646e5873ca88053abcfa078660294a88a7
SHA512 e4a9872b84fa854d073796153397236649eff2c1ac102efe8d3622801e4c831d487a49d7d485d06eb3e321c29c93093e6f0e4f5c82b91d8654ba4c43db7a7f1b
SSDEEP 24576:+D3FHshBIYQgAQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAAQLNiXicJFFRGNzj3
TLSH
T1BF75E17EE69C04E4E57AC17CCA638906E77138AC032265DB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-296-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/612-78-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/612-83-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/612-84-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/1048-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1048-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1048-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1048-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1048-330-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1048-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1136-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1136-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1136-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1136-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1136-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1136-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1912-61-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1912-56-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1912-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1912-171-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1980-75-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1980-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1980-66-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1980-279-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2876-328-0x0000025526EE0000-0x0000025527128000-memory.dmp

Download

memory/2912-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2912-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2912-128-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2912-134-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2912-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3392-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3392-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3392-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3392-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4272-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4272-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4272-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4272-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4952-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4952-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4952-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4952-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4952-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5068-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/5068-7-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/5068-1-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/5068-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/5068-74-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/5216-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5216-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5216-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5216-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5656-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5656-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5656-314-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5656-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5656-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5656-108-0x0000000000740000-0x00000000007A0000-memory.dmp

Download