5ee5c27e606f3a71f9ba44a51ca6d343d9f6a7717e97fec100ab95e813a755e7

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260925-j664katarg
SHA256 5ee5c27e606f3a71f9ba44a51ca6d343d9f6a7717e97fec100ab95e813a755e7
MD5 66154011261503877d9f7f773722a5cb
SHA1 eaefa920b9940ee53ca103befda06982356ec9da
SHA512 8ca573c55540925ec9606cb579f5678790cb05399f7258f5c153eac73786382f6ca2122dba259872e5d4d9bdc6bd1dc6e7ef5e9b63f2583771642e45140cb50d
SSDEEP 12288:F93G6vHzOASubviBNDYa3DK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:FVGGTWBZzMPrVmZeHgCFyqXHH
TLSH
T16E75122176C0C4B2F6A3193549B499710A7EFE301FB0899F7794276BAE306D24D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2632	elevation_service.exe
1096	elevation_service.exe
2924	maintenanceservice.exe
2896	OSE.EXE
2616	PerceptionSimulationService.exe
2132	perfhost.exe
4632	ReFsDedupSvc.exe
696	SensorDataService.exe
5972	ssh-agent.exe
4624	AgentService.exe
4304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\11af0820b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec58546fc64cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068447170c64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012b46a6ec64cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff80896ec64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040f48dadc64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4624	AgentService.exe
Token: SeBackupPrivilege	4632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4632	ReFsDedupSvc.exe
Token: 33	4304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4304	SearchIndexer.exe
Token: SeDebugPrivilege	5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5096	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2632	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3812	4304	SearchIndexer.exe	102
PID 4304 wrote to memory of 4516	4304	SearchIndexer.exe	104
PID 4304 wrote to memory of 3656	4304	SearchIndexer.exe	105
PID 4304 wrote to memory of 1292	4304	SearchIndexer.exe	106
PID 4304 wrote to memory of 968	4304	SearchIndexer.exe	108
PID 4304 wrote to memory of 2456	4304	SearchIndexer.exe	109
PID 4304 wrote to memory of 3944	4304	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 91c9ebca39cb7d5bf306c26c30848d9634ed5629b6dc8153b2016b47ef0983a2
MD5 5c7a05d45e55e3a0af5b5daeffbd7cb7
SHA1 a7ea7ffb52355ede3b769731e1ca7bcf2e3f3b55
SHA512 a0d087a1cc13a057f904b3954d9b94cf7cf25483b74fb4450e00151f21763cd4718cf728549d6bc4196df47e9d702d955e96eef73a26248496106f748606f5ff
SSDEEP 49152:kb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnKgweACFzXHH:e3q60jBzgrACFDHH
TLSH
T1C4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 5557841077236af94132b791da619942838fef9335afb51a28e2b9760ebc616e
MD5 7f104ed0ffb8eba7bb02ac8fc9020ca5
SHA1 3c6980baf7fccb348eba628df9aee2b6ba6a7d8b
SHA512 c843e9aa440eff3c537b260ce13f102bfd2c5166bf0fdfb5de5f0159618aee35b8a2dd33d62c7ed700081a0e831b419333a9746e38f846f4767162f93b811ddc
SSDEEP 12288:c1XLsswWkxy2lRq2czAnK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:qXYfDtczAnMPrVmZeHgCFyqXHH
TLSH
T1FF75012877D009F9FE67823DC9A28402D673BC5047A0D78B07A496666F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 72b3ef8a34438c25e5c1b499238f4537662bf681eb382d8cf64f504acb954754
MD5 37ea31c00c12fa53f8e29e94a160ff7c
SHA1 a831a4d0699fc4d242e59a562c7a132234e07a48
SHA512 19d1c4cee5d05c8929146050d433c576c0ade4c0f41740f57003890660f905401ba934278719b3106546acba7cabd7773d66a23f10176a82617ab64520d0a89d
SSDEEP 12288:YXZNYVLeyUji0h90ZD0wxpGZIVuNrHsCK6236urhHbmZeHTU0REgl/jrWCD5aZ1+:o0Le5ji0hmxKrMCMPrVmZeHgCFyqXHH
TLSH
T100959E16F6748735D073C0B9C5D2A68AE97230815B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 73b5615298109a737fd78c0ea3fe179b16c35c0a67930259b19fa6c16b28eba5
MD5 d2ba663625d02810cae38199503ccc58
SHA1 373ffa5616d8551702dc084e3b88477492dd826a
SHA512 a974f76ebb613e4a70228a36159ea69cddd22f505e26870e40c19e8d0c1207aebe7291658054c9333c4481caaedd776daac76ea522acdeeec8ff6bf39bb53648
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWr6q8wyuQMPrVmZeHgCFyqXHH:Y/ezSC6vUzPviHjyVgweACFzXHH
TLSH
T1C2755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4e3bed952eace48ad9b0dcd8b58eb8aac8689189682ac3d758a9eead01284f0e
MD5 58d5c0bb3f197f3cbf0b67da4862632f
SHA1 11a1b119c1a4b1375b85a52581dcc2b5b576d540
SHA512 2b40cd0ade071354a94f2a3c6c1e1aca8b341fbd407e40b0d4b9b8b8cd528e86b3e5ced808d36b64003495a3ae43a0d0cadf9cef60c71b94261d7780b922f83f
SSDEEP 12288:tVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98jK6236urhHbmZeHTU0REgl/jrWI:tVbqPb88hv/l+bjMPrVmZeHgCFyqXHH
TLSH
T19F559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7c80fa6431a01828ad5a4cb1570c0c033f013da6533ceb6bcfe454331b7c6e15
MD5 60f7f8193dde2adfa200359d9c2a2681
SHA1 3135fb09ea2591612b55601b8a0308420b80f3de
SHA512 95f6a8b102557c5d8752fa3502c1b716a35b3e649e2389a7f021bfa48f09c9eb7d321512353f6248f45063088f17c083fd90aa9194521a3d5da47732d8bd12f9
SSDEEP 12288:Q/OK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:Q/OMPrVmZeHgCFyqXHH
TLSH
T10B652355ABC0EFF4FB9A553B855A100206E7EE404EF0C1186E24B3C7F535AE2C8E6927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 51e9273a3057566c20bdaf59e0184f91abadc6faf7c2efa684499337402cc085
MD5 740778b1e6d7c44ad74c0c124b4b950d
SHA1 d074364b0a39d03206c9c465406887c65b05d44d
SHA512 2313caf673c3c2eb2ab5ef3fa453acc16fb980891620faf0ab7908a756920ebdd02fee5812a402b9a10f54bcc110be63d2cc30c4d6cdd19fe6f4eb8cc1a1d63c
SSDEEP 12288:neBNUbTVO86U7K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:nJIU7MPrVmZeHgCFyqXHH
TLSH
T19F75CF3BEE68FCE2D27A8DB95691860097B278304F6193CBD174834EDE235E14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 feb06c07c6ae46342b65958448b116b58820273113d79d3943c8c042abf07d0e
MD5 67c88aa8a402b9feb54ec2bd814c5ae2
SHA1 86410abbb78f85e7b44d1ee467669f77f73a8375
SHA512 17fa80d95463073e38668f2acceb0bd65010d2987a317b420547d70fe030bea63f3a6cbe0225dd9cf5bde7ae23ffe0754fd024fab6ebbc42b676d0a8851201b6
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:mQvGAdlCEL8c/RRNw5CAgrACFDHH
TLSH
T1CB267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 736c5b14db1cf4cea9eb56851756f4851476c2931ed399c8316a3fc304d36feb
MD5 850978eab7396a0c1b63ba05bfc263b2
SHA1 4cc14122684bb96afe44767cbba699fdf8761c91
SHA512 63d24bedd03589cefbd443e943e09aa534c61b102762e1f9f6ae4e4ddcf29bd45dcaa7543effd63dba38d776eadb97e155047fb980ce69c75650ed63436aac2b
SSDEEP 12288:NAwSfxL/2Dc3uDLLmt0LDQewsAjBK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbR:+bewsAjBMPrVmZeHgCFyqXHH
TLSH
T1A885E031FE70E436D77B0DB61B26C706147DB9204FA119C3E3A89A8E99306D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 de1ae0bc416f38d140a9b2ea52b2f51077823b72e26d1f9f57e029e38de2ab8a
MD5 51218cddab21e98d8dd747331fb6a10b
SHA1 8ec7d3453a5dc2fdd14d00aa4971053e9e961040
SHA512 66a6cc8caad6e8785c5fd6e2a003822de5422f984fc7ccc5a5032e1930cbb5728064af03284bd80a8390310f453aa4408806dfb05dcce23e5230f0c2a5aa4487
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH+rA8DHH:yUEtQevvqc2W1cpV2RI32wB
TLSH
T1BE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d3703dba2c613f5a1c790129aa066020780b9dfd5bb9875b5f1588b616e9bd5
MD5 fcb736edcad01a7b517d5b526b369dd6
SHA1 ecf142505b19c3709533593f0383d0e4b9532baa
SHA512 131782e6a25ca822d929ce0abe4766fc9abda7ca416354506345258a1646b07c128e858853abfefbcde5e91d2a27e137c37840ed6b473a9a7576e9561af5d292
SSDEEP 49152:+CbRquA/m2yL5zTfFiV+XenmE3/zhgweACFzXHH:zoquVjnmEgrACFDHH
TLSH
T1C6D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb264cd4e626362c6d98f0700e2a223f2f9343aefb666555e364de92bea33a4d
MD5 e77b0f4bee13a433de024283fd19f4db
SHA1 5e9bcea88ffcf5ebc9e2d8c1785d6b39a6026898
SHA512 8519b87383d6093ee767a1bb8220fe42c95b165166fe19b4ea62893f04a8b38c9c509890df4eff033f57d883049c95e00824efbab2807bc67cd1368dc2dde5d6
SSDEEP 24576:yAhGL2IFoiwtA5l7S53kMPrVmZeHgCFyqXHH:yAM1Foiq50gweACFzXHH
TLSH
T10035AD80EBF955D4F5B3AA7899B68171EA76BCA55E31C20F2160D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7e2dd8cb77ec449b513715ab773579d610663bcc0fa3c52ee6d093bd45375eaf
MD5 fdfa5d6a5262bc80cd871beb59270fbd
SHA1 66837b1b13231ae084f0775cccdadea56597c23d
SHA512 e15fed085ade2e601b3f565511a2838912f6944356b9877d895827e8e99a5d37dabf3090e0962e3b7c9b2d262acc5df924bbbf5117c9b71770d7b35bb24a320b
SSDEEP 12288:Imw5HEjsChNjBFgl0WDm+CwK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:lwuWOW1MPrVmZeHgCFyqXHH
TLSH
T17275F14676E41CF9FA67823985578132E7F2BC012A61C71F1760C65BAF37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 1df7fd7a8fcbde8762cf6375a9dac6f29e3f031e34384a759522bf24552f64cd
MD5 0334e4468bf527dc36bbb2e2ce811ce8
SHA1 8a1d8795f98cc16b419c51a84d8c43cd37d8c525
SHA512 9d8653837b35100bf4596eaeb69e89e042af9c38a44f41a64088dea6972464055f23bd4a793e9d611c1347b4c5265536d21f19157894756ed181c3e2efaaf756
SSDEEP 12288:ULZ1IyxK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:EZu6MPrVmZeHgCFyqXHH
TLSH
T12465125A37D076F9F397523DC9E5050287B2B8511B7183CF1A24A29ABF33AD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dbf41e4fb9244f42589a6b1699d8bcd83e785abafd9ba324d6ab8157bf14af36
MD5 391230692ccc27b3e31d74e5dcaf1292
SHA1 bb2fe0032f8e6a47e339c981d376d6fbe578f7f7
SHA512 7bc9ffb519fc660a040afe04a9d49267c11c2b2baeb8217496e0433c6d959b2f1c3de1a512041d8672bbd13a35d8c0f35456471d48ba5821c7ec81e7af11817a
SSDEEP 98304:lQRQyi36YOcPhLvw2gAf+PN3fgrACFDHH:cQyiKahX+PN4rA8DHH
TLSH
T122667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 50977a11a4d66ad520fbab45d8babd1045545c60c38133f65dde387a9a5c7a31
MD5 423be73a1b921d1d5c66d7f788361f21
SHA1 d869ad8d36699a767d4c510c1d04b0936de29cb1
SHA512 39cc9962fbe9681c75f6d6ea54feafb48cced8053ba41b1f7e115551afa76a784dbf319b0f26b48b14f2da4084957d1dcad3ea8156466edae8fa59d287b23012
SSDEEP 98304:BQRQyi36YOcPhLvw2gAf+PN3fgrACFDHH:YQyiKahX+PN4rA8DHH
TLSH
T15A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e1bd313ca3b69d602bcc42996fa6b38b7799d6d49220293c813741dadfba062
MD5 3b23d83af84480af20734adb34c5bf93
SHA1 400b2b181f0ed9062516accabb321be061ad29f3
SHA512 4ef32f9fb71d7f1277870ce3c60e7694dd60c3693c64b54e1c11f30e488da33de66a503724a92da9cf2ccb23424eb1be1222717611edaf821c0fb2f4c6c89585
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0KMPrVmZeHgCFyqX:w68Qg55nhceWu7PNU3/RgweACFzXHH
TLSH
T10FB55A33B2F200A9D44DE1769F4A872196D27C758FE0D3DB8515720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 18689b84a24cc85367de35be2ab46805460e74d3a7e0f71335f8280b52ff0bf5
MD5 139d62b5982ce361ea49211f497d2010
SHA1 6d1514ae912e867537a59ad8b6799f70cdfbc1ab
SHA512 869a7df5d0384b6895a33f32b0c0dbd5b141d841d0e66ded7f7f7f9fb0e8a170a968bb5a47fd7abb53e2b8b64f1bdb96ac248051c1b6d9eee5a82301f51967fb
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZOgrACFDHH:SLIHjWhDrA8DHH
TLSH
T1FA168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ed3bf383be9cd2cf2b50c56f47e6a66e6ddeee80bdaee02741c179e96e65bbfe
MD5 21c89b19d991de670a95b7edd68b56ac
SHA1 cb4a933540594c0b6c20a4f1eba5498f60327cee
SHA512 cb3712e06ea817578d39552e66fc2131e47f93d26d0c052374d9e9be98e55023e80b06b592458d8071f28725951c28be833a0709358ada602d8aa8eb39685f76
SSDEEP 49152:bB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl3gweACFzXHH:Nu6JmUxd2d3grACFDHH
TLSH
T141D59E13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 18882533c5cfad20196abfccd530350e7cd4c311d58d080dfd119dc8f93004fe
MD5 742ea0ef5093ca591a7cba21ef8f8ad5
SHA1 e8a230493151f8b8b04b2325549a9c76177abbe5
SHA512 5cf3a312be29179154ab6951c701404e9d76f952d8c56977c2ec7369aa1efee33f2f373f20a1efe5426ed3ed99975980e18bee90b79948ea6681b7ace5f2b58f
SSDEEP 49152:q1hpsNoJpF1A6BU44CwH7R4xbgweACFzXHH:qmifPkREgrACFDHH
TLSH
T15DB5BE13F2D901E8D06ED17887569232EA62BC450B34A6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e5cc79f35e16b46b8c153589bd1d370c6fa5ebb58c4d8ebdea27a5b7f45c2134
MD5 07b8e1e39305b574d56850dd3c89196d
SHA1 7f1a640ae477051f3866eff5e4f3fa84105d8772
SHA512 7a2e3575f6700b9fa3c786f0dda394cea61553806295f0b432ee4c1ed91d2b8133b486c882fa4f1d2a415f1f47a715b8bd3c6e71edaf0d4d902ed03efb116a6f
SSDEEP 49152:pSuZQIY0Be2KNRVtOnks6NMHq6gweACFzXHH:n5dKvi616grACFDHH
TLSH
T1AAC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bd553bdca93acb54e7c5e7a0f6bd90594e4e34fa3f4941056848adcb4adae846
MD5 7a12371e73ab9011aae0ad0815db4230
SHA1 27d8df841eda0da3ea3ad6d5fed97269b530ad84
SHA512 67eaad67a38e0fd84b6c02f107ece70e6de115cfe0a7f503c1eeaa7af53461a5ee0b52b239eeae42c7d14450ef7874682a3f1593dea06ff7ee2f89939fa9f273
SSDEEP 49152:ahtSn8EApI0figXgiDn0AP5wngweACFzXHH:bX2iyphIgrACFDHH
TLSH
T1B495BE13F2D901E8D05ED178C7468632EA62BC150B34A6EF0A90B7562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c377a7c763bd5a7d55537cbd6fe6ea8fd72ff08785f5906148fee227aa086508
MD5 66fa61b312f215cf9687eeda19d5b953
SHA1 4f36222fea53010c692bf1341e5e31cb412ed980
SHA512 1092708ba7ff2fc635d0c3896323f9b95149fd7255ef8da1b9410595d639c83aa94d497700a891044c4b7457b302e345677e3bda743e0f768d86cf9b3b3efef4
SSDEEP 12288:+mK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:+mMPrVmZeHgCFyqXHH
TLSH
T1A4652355BAC1EFF5F745457BC256100205EAEE405FF1811C7E28B287F632EE348EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f5b9ae1ffa0cd403cdb38f12525ed193ad57bbce07f45575f82467e98709541a
MD5 a54bd7af662f450468d9ce4301c31e76
SHA1 0fcd4abd6131edbda80cc759414729e31ff7b3af
SHA512 a5fe68ad719383a4a555bd3638d7b61cf77dab9d4385f4ffe86d1424720dc4cdd63045e6473f09eee278f38442608631fe7cdb6ac95f135b5647c5532ed1726c
SSDEEP 12288:CdK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:CdMPrVmZeHgCFyqXHH
TLSH
T14C652355BAD1EFF5F745457B8246100205EAEE405FF1C11D7E28B287F232EE348EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0ecb7d83e0bc15b3765d637ff5a1767147a4a666959e285cb553cd5ea05a8ae4
MD5 615fe998df5cd0031649a96cdaf41d2f
SHA1 30f3e1e57b0e06422dd3372850a04bbbf8ae71db
SHA512 7795e38031574c10bfe2c027d0a0122ae6b8c4a10d7287764d3b15f09faa21993db7805765d866773aba007922528aa4e1360ff5ea3eb96130c8cef8c8fac582
SSDEEP 12288:ZzK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:ZzMPrVmZeHgCFyqXHH
TLSH
T164652355BAD1EFF5F745457B8206100205E6EE406FF1C11D7E28B287F232EE348EA96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 d13308e572522397e6cb7a6bc291aaf5c4501a10eecf0f46f64ac300cdb7338d
MD5 e6554c4a11fd98b0afca8380b30263fa
SHA1 2853900de33e93cdc8d549d1a6d695675db1a9d8
SHA512 b75b2a675714e662fcad924fdc686eeba2d05605f1677760c03a21bf6bf6888cd73df1e8869fb3091d53efc9dfcafbc55685a4dc8cf83b26d24bde474e8abee1
SSDEEP 12288:wVEK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:7MPrVmZeHgCFyqXHH
TLSH
T10E6523557BD19AE4FB56923AC556000282F6FD809FB1C21F6F107287FA32BE24CB5E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 364a52b40d53f0e3a86d198ad6b5ecd2cac59b8d543aa0f0023a42a35176a8ed
MD5 04694e38317d8edc61369f2555b4e6ef
SHA1 79134f61e281663981b5e10b5c4fd23a4c3c9e23
SHA512 78d61aececa1d31d970232d8f8df45d6988c13b4cab1440ecc5aa73aa3b7d6f4d0d5dc51d7e95a43e60f555a4dec9927b51001440256fe0b55a636acb66d1b2c
SSDEEP 12288:asK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:asMPrVmZeHgCFyqXHH
TLSH
T1DE652355BAD1EFF4F745457B8206000205EAEE405FF1C11D7E28B287F632EE748EA96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e305db60ece0bfd7aaaf89ba2f263cceb9f30ed5f618b215b924f24818829e92
MD5 7af90fbf8cd36e6376d03ca187c89803
SHA1 79b6ac1e4cbd9edbc397138f913fbd0c96f3e2ad
SHA512 2d13655cd88fc9ef427dfe2826669b8cceaf0846355b64da124c08a1c8c4c2b0b2e65c9d2a03c6c4787315340613ffebbd9b47c3e9bad39af645d92075643fc4
SSDEEP 12288:T5K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:T5MPrVmZeHgCFyqXHH
TLSH
T1BF652355BAC1EFF5F745457B8646100205EAEE405FF1C11D7E28B287F232EE348EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d5aed6f26d8ea765022c075ae38ea32ae997c0c00bc10bb6608c83cc3ea2c993
MD5 983514f9ce870eacf99e4d93f5ab664a
SHA1 493bfa1f783a57f06440cb9d799a844911f0c8f7
SHA512 587509dedd690660c2bb2d0431013f2dc36679e8184cca668a1c035705c5188fae1cfac69f9a83bb644cabd3ab012a68a9b32f6e9a3f04ecb92f81741bf6e9de
SSDEEP 12288:0FK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:0FMPrVmZeHgCFyqXHH
TLSH
T114652355BAC1EFF5F745457B8646100205EAEE405FF1C11D7E28B287F332EE3489A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 8b62db52febdf1119ed43674a06246d6f9335bbd8783ea92c2c486e145269129
MD5 36cf066b3b2b73a288b544ddf1245d9c
SHA1 c7013837106d2a40aad1826cf1248eae26db48af
SHA512 6870a0fa458987ce47074cbf9bbcd5c9f7d48a3acf6a9d9ad8c8109b39304f9b4798f0b00ea5a275c7dd5e08215e400c484cd59b1919c4c16f47884f2a2f54f5
SSDEEP 12288:PiZwbbzzFEoS2cPvy9K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:qZMvzFVSO9MPrVmZeHgCFyqXHH
TLSH
T18075F1A5B3901DF8ED67813EC9154806D6B2BC550BB0C61F17A43667AF337A10C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5179d851b64d37af3a1e53c505ca0ea656212c359814810c5d9d7438e7dce2d7
MD5 678ddc1047e69e6eb0e5adba34369e4f
SHA1 e51e0ab729074b2e42554973b5f36848b5f14415
SHA512 f4b32c77dda475bdaa708f2075df9e1e15d6b6832f5ed363edeee4ac11d34dd32e2f9a257e8fb11c86814f52c54069e78fa2fbf7dee44c0b6b955597f5503a5f
SSDEEP 12288:vqK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:vqMPrVmZeHgCFyqXHH
TLSH
T193652355BAD1EFF4F745457B8246100205EAEE406FF1C11D7E28B287F232EE748DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 90cd28dec244f7452851da4fc5bc3bae9ce6d5100dc33a2545ad523a37da9b52
MD5 0868329b8fe3769635e211492cb37d1a
SHA1 af2b67b54a2929b3676a06c2c3075e4f4b5eb811
SHA512 adc098aa009b56324a50bd74ba485ec90cb504ff46dfe08f73658d9262ed2db2fa200ca517713139e3c20d378c5184f7b567a513686a8a86aedf8ce7a1e7ac70
SSDEEP 12288:W+K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:W+MPrVmZeHgCFyqXHH
TLSH
T190652355BAD1EFF4F745457B8246100205EAEE406FF1C11D7E28B287F232EE748DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 fc5b875cea862012fa348eb36c72d7b1b4065aa0c0f05def64f965453738eb2d
MD5 ff40a70dbdc81cb621d65dc5e2105022
SHA1 6c5a2607afe3e81c8ba3d266134bb5e216b4c7f4
SHA512 34f2d0653b7edfc1f79bad1e446895e7d39b6b0d1ff2723718d014abf92f4b502926f1e4b66d220ca11111e82c957cb02eee2d65818d86675a9f8ddf01e0639f
SSDEEP 12288:TyPz5L8xK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:ezyxMPrVmZeHgCFyqXHH
TLSH
T12875021777E131F8E2668239C9521902E7B2BC310B708A6F1B6453B76F336E14D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 44eaf8d9dcee5dab354b36a13e4c7b86da181c3e18e7b7f7de9adcc1071d859f
MD5 b9e5faf228230080bd3032c3d6f3e4ff
SHA1 19f9dcee8827612828e26d88d721afa5152cd57e
SHA512 1ca9c00c9cc607af723f77bde16b2fd0f37515bd854dcc9bc1dac81882c3064a61ccf5824597397d0425bf62ddb889b6fa2c51eadb8eb36c012f2aab8c6657fa
SSDEEP 12288:AqK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:AqMPrVmZeHgCFyqXHH
TLSH
T12F652355BAD1EFF4F745457B8246100205EAEE405FF1C11D7E28B287F232EE748EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 adeacf599a03765a5bc031ecaaaf0432b97778df2e4ba41141a82a4b00791c5f
MD5 62ddfabbef9b2793441dc80c4571241d
SHA1 30e27bf8537ec0ace271fc625d1563280511e37f
SHA512 9d917213e3bd0ebf436248b14a1abd04e73c4cc27c7a8228a49b6adeab7011d7ea16848e05de00d75eeb993253a38f05262b762665e9f61a93451603a6ddc2fb
SSDEEP 12288:zqK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:zqMPrVmZeHgCFyqXHH
TLSH
T11C652355BAD1EFF4F745457B8206100205EAEE405FF1C11D7E28B287F632EE748EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 8f76217b13dfbd5eb6566145fba63f3b640224e74d5f591043ab51ab5b286094
MD5 858b7633d94ed35243ed28446ec955eb
SHA1 b1bfb27a2b0ba1ea7041d05169f44522ac5048cf
SHA512 e4b4b86cc224dab68cc49148e172e2704b3d3741a7d492c61f0fe257c5fb0ac374de0e2822a1962a83c253ca2f90d6c94abd16c86e3f12c0134b01cacfa71fcf
SSDEEP 12288:SyPz5L8xK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:PzyxMPrVmZeHgCFyqXHH
TLSH
T1C975021777E131F8E2668239C9521902E7B6BC310B708A6F1B6453B76F336E14D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 17b21dc946657b490467762f3235991d82daa80ef3608c61af98cd60e4cfde90
MD5 8e0bf49153f7817226ff6e720b8ec9e1
SHA1 2537114ca201605168bf81a889d27c585fb89bb9
SHA512 8764c131664a6142abb86250046922f66a068d2121d09ce743d5febfdce24c578a8b9fc982c24ce59023eeda3eca669239b148ce52b07713c1c38a5cc92c116c
SSDEEP 12288:aCd99WYoaLHF3z0z04PDvhDK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:rTkaLl3z0zDDMPrVmZeHgCFyqXHH
TLSH
T1E475F1A5B3905CF8ED67813EC9564906C2B2BC550BB0C61F17A43657AF337A10C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 aa3e12aa26c220e01dbf687b3c30eddf4dd17f4eb02637dab33a5689fe6f9614
MD5 f64c7e90176c2e95011705e4f061ac29
SHA1 ca06fae1fac8d2af447492121718727bbc339a23
SHA512 e9dc184789249df327ee1501fe95ced2ff3e69ca547bdb9f8693b9a9b7abbf71cce9dfecbe1675d7b0d819804a00d992d9813839cdd3306e613a0a0a1d317561
SSDEEP 12288:ji4e7vRdTfgwCHKy7GLbbdIv4K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:j3od9CHKy7GZ/MPrVmZeHgCFyqXHH
TLSH
T1B895DF90F3E414E8F1B79A35C9764502CAB67C591B71CA8F03A4665A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a6c81408c9fb089c46f84c8776373118c1e033478fd8282f68e064a0fd2f7691
MD5 4cbb005a0992e96a7954ec37443614b9
SHA1 ec6dccb8820aab8c837d202966dcf6b29b5857f5
SHA512 d08b691a7d1ab4c1075f5637baa1841ec276da347f8b9fe12d751aaf66ffa4a6fd71681418c2b094c9ed5236ab3fd11684170e5e36618770f75adc624de75521
SSDEEP 12288:TTK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:TTMPrVmZeHgCFyqXHH
TLSH
T113652355BAD1EFF5F745457B8206100205EAEE405FF1C11D7E28B287F232EE348EA96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 8a3e6bc569cec720bc9b328a90fe9fa5d04946a93f5749e129af0c9ae0339b99
MD5 ab56214ad690c7aef95b03638ee9b1c2
SHA1 ae975d375c85a1847fb58eea3e69b88b012e92c1
SHA512 5a32d05c8b6d64052a42284c4e7397b7e82049c07ff3078b2bf615b3eaaffa86edf5660e6142a90a47ed793cb339a107d67e3813a3c5ae42fb3d7675c86fd9fb
SSDEEP 12288:FRK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:FRMPrVmZeHgCFyqXHH
TLSH
T1E9652355BAD1EFF5F749457B8256000205EAEE405EF1C11C7E28B187F732EE348EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 5f9217d030642d87aa749dd4aecd2f16c6020854bea014f0570c9b34b8ddf6b9
MD5 14f528d26a1e1fd02df53fecc3e1bdb8
SHA1 9cc722b363b342f7b7db3430bac6d74f88a867fc
SHA512 918e6af2f76de64e10f8c602cf505fd90be2e10be8992b641b055fa2fc7eca1429b4e9831eb32eab7348572bdafd36003941364c041d51249a1492dede3ec6b3
SSDEEP 12288:H4K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:H4MPrVmZeHgCFyqXHH
TLSH
T185652355BAD1EFF4F745457B8206100205EAEE405FF1C11D7E28B287F632EE748EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 877a29847a2658ef23e86cb4cbce75e6974a5058bffba793f244f68265a478d4
MD5 980970c19ca504a48dca5de444f3a252
SHA1 12e8afe6b7fca3c6c0ba9a40ed389de6c8891e42
SHA512 3371ce5d539e12a0fc632a8ed8d127b9e9eef3d31c5c67f999e6ab71a83d283c5845a76c2ecd2fc8ce1c31f00d2e3d53cb55991fdf9d752ce3e5e1a6d8b13544
SSDEEP 12288:sqK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:sqMPrVmZeHgCFyqXHH
TLSH
T138652355BAD1EFF4F745457B8206100205EAEE406FF1C11D7E28B287F632EE748DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 16f4d24c86d9d701971e4839be056e788cf6727b0262894c35129cadf241dd11
MD5 22a9f15c4292592ea3cab3d5b79ac549
SHA1 5a7bac5b065d5365e14511b6697e92fb75d0650c
SHA512 81c1f39f3c759bdada79d6991b9d633c166f61acda07f15975fc5bd1f0bd37fe5d80cf21e9d20680129193b2cfb1245d7cb1867ee662f9202d06f2a02c92781a
SSDEEP 12288:aTK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:aTMPrVmZeHgCFyqXHH
TLSH
T134652355BAD1EFF5F745457B8206000205E6EE406FF1C11D7E28B287F632EE348EA96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 e10f17dfb57850e0c68ffa18cc84a8b63dbf84ea91bdf5b7ce127f2b3a2cbd13
MD5 c766ee171a90c582b1fd7f07935cdbeb
SHA1 1cd6ca4a5fae4665ccf74083fa1cd643f7b2d9b6
SHA512 5d210d59b66a41638309c5535ace43ec1924db30a61c67ad9cdb7d97ee096baea82b908cd73fcf6a8651edc9958d0a298dd228076159ab0e53667bbb9b9069bd
SSDEEP 12288:5SK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:5SMPrVmZeHgCFyqXHH
TLSH
T198652355BAD1AFF4F745457BC646000205EAEE406EF1C11C7E28B287F732EE748DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 5ef0ddeb957b84a735cad90c4a9d2e13a88eba4afff6ea3637916222629c0f54
MD5 eaa1dd2890b745237ecfba413ec4213d
SHA1 7eba46929cb45c2b048cefcb1667ede1a83e813e
SHA512 cebdd1f87d95f28114e275a8fcb1702ee8d6118cd816bcbe4f65e0318d2a0fde472daa957f5813cd4a9a9b49dad604e718e561a68349cce5d2bba00dfa248744
SSDEEP 12288:2sK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:2sMPrVmZeHgCFyqXHH
TLSH
T16E652355BAD1EFF4F745457B8246000205EAEE405FF1C11D7E28B287F632EE348EA96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 268e33bc211ae185cae56784e27454bedc9a2065594e7f7927d7513dba1d604e
MD5 1992c89dbaaba4bf84180fb7329edaf8
SHA1 264618ecda621dfdfbf20186f0ee50f89f9cae44
SHA512 1e4938392feec531b5febfed6b19413e87c2c7ed5be1b99fbd894578175c3c653bdaacdf582c799e663d885472d99c663bed42e9415bdf78465188241c45d1b4
SSDEEP 24576:8fwvdk9RX6wkyAIuMPrVmZeHgCFyqXHH:ZMnYIugweACFzXHH
TLSH
T11A95D029EFD848E5E1B7923C89B7460AF6B1B8581B31C2CF125953AE1E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c873667845d66d66f14fab784a135fbf78bad975a6b6834298958e549a0f3bb1
MD5 e3c06d4e57614760bbb0369be74106e9
SHA1 8288fecb2383cda5e54b5665c7d21c3e044f490f
SHA512 1e7c486a0e5a78e80cf848652e820fb55c7a2593fd223b54ecd0014577e343507ff7214c403c164e1432e2449b179f272e42919947d743b40e84401726133492
SSDEEP 49152:qYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HgweACFzXHH:WySzP/grACFDHH
TLSH
T1AC066C56A1A841D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0358a466cd184f558deec7a443a14801a138c57311524d426137727b96529ab9
MD5 a3171d0c399eb8b6d78cf47981dc205e
SHA1 29ad7076b996770d4f3e08ca1689bcbb9e2d26e2
SHA512 78577d1e3d74017ce7265673a7603227998d4bcbee39f9da04d0d1ee09eb0adc47a59d54ac9405a26dad75f5b98c84c8df4faa32d6860e3a0cecf94a414f7e2e
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYtMPrVmZeHgCFyqXHH:A47JUQj4irIhCnDHUPfF/3gweACFzXHH
TLSH
T1D765AE1DA3EC02E5E1BA927885154A5AEA71782D1F31CACF2270937D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 47d952e47079cdc35c571b64dd1a6135eda7c98a2e352238d2c3316bed09d78e
MD5 98eb5a7702ef87979f7649ba16e8307b
SHA1 bb572be1bf57b602374bd6ef6df34f7318ffaddf
SHA512 a6cadbd6334fb1c974d6e3d1af47be9b8c645e08e327a8c4266274f629117e1cd4c6749dcc6f4750aa5668cd4d73e25f5f06f70668dc2910732d6c631f12adaf
SSDEEP 12288:blsf6K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:w6MPrVmZeHgCFyqXHH
TLSH
T12D75F119E29452E8E26E617AC7560501B373BC2087F1C3CB6AD0F57E2F366D14DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b0052a889ae4a932e0fc8968cad89e0644aa352a6332899c542d557240596107
MD5 f8a89790bda0608719e4d5d7ef655186
SHA1 fa6d2084cd56a2abc99a62aa49a71000e6f3d19d
SHA512 8edf29cca78b3b107398551f46191ca053dd21819386821110ce6687b6f9dbacaa5fdf63655397055d192736a5baaa6bfc2c54d6fdd84914b2feae7bdb15e93f
SSDEEP 12288:beJsssmzziMQGBIayUaz4dFs8Yp2iVvky0C3xGA:b9Cz60Iayd4dFvYp2gkyhxJ
TLSH
T1423518007666CB8FC66980321E36D1CCAB707D11EE45AF0773C98B3F9576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 417ca9b3ece899bf9d0c57476a58243116f9028ad9c042ba9accfa3f6584fc58
MD5 460a7ffaaa2194ec79154695544fb6fa
SHA1 84c1219ad6f199f996908ef43f157e21d5dd7aae
SHA512 d664c32608889ace332aabdd7869848e4c7d87731e1ad1d3028029275f991724787806c7d541c3739f8314ad1e74da260a36095ac265f1db5060a22ccb9f2de0
SSDEEP 6144:hdR/+2//GVzizpg4zmxgAQWPOlSRDeZIL2joL8PtMxA2PtMxA6RbR5P36f5x8S4p:B9pWPCo2joT5GSqcs
TLSH
T14D65F8815137E7CFD1FB6032072A5B8C6B64EC03B7056F26B389453AD86AB51A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 bd52493b40c1becfc297852c311d3e5bc2e839c6673b641793f38f2f309c5fc3
MD5 61e0eba364c7145dfaf6000c220582fb
SHA1 10635b7aa8feccbb6e814218e7b037d121d9dc45
SHA512 dfc9fb351339a5eea4d460cd7a0778873cb4294a05d7433814839963d853b5a82aaa30a1023bb506b8744773712ed1f34d3e9cfb311771ce32ae96b5e76fc631
SSDEEP 12288:a47iK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:fiMPrVmZeHgCFyqXHH
TLSH
T1F1652321ABC0EFB5F769567A815A1011029BFE504FA0C19BBD14B2C7F631ED28CF5A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 56177bde3c48e400a09b49a3b16bd69856236b62189970e16486d52166261a8f
MD5 1efed1aa2ed9dd6f64d934fe82ec33c5
SHA1 52b8cfeb37a0eda942b24c7317657d7151bab2f5
SHA512 a7c038e3a2f4d1b6400707b2999db0b8b0b07547db5d8667437944889d0111a9b09284032f62e0b8dcb33dd42ad5bac7a65496f8120998a0e20db8e18dc41c43
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYQMPrVmZeHgCFyqXHH:+gb4mBIBhGFtgweACFzXHH
TLSH
T12865AE1E22E802F5E1F9D2B8CDAA4417D6B378160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b5ffcb3204728dcc79dc712781cea99d8439124ddaf71b490ad698a318b9afde
MD5 bcf25960021f57666d912049794a2a11
SHA1 9723729588f59936955b0e180ffc225b7dbbaf17
SHA512 3057346e2617f0a5b5bbdd0184f42b6a83501a0e607a74cc5d1f82cfbea957173c87809059c8918097ca26f5b4de830a56cf58594a0adfd746db52c2a0d371c8
SSDEEP 24576:dG88u8FpJqH1Dzria7/m9MPrVmZeHgCFyqXHH:w7ZFPqVWa7/YgweACFzXHH
TLSH
T13F95F16577E102F0E477D13889464663F6B2B8110364EBDF0BA88B561F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1a2106cbe4209bbc37d67f6b8b5e773a315e0dcfd57cc054561592b7a4efe557
MD5 4d90a4fa86e2e2e3c4fb4d9533836cd3
SHA1 a541e4c5295e96657a57c650a315e6d73072cccf
SHA512 c843b82cec073016e78595921c93ca0468731aed03f0b083c2076006b2e369e32bd81c43c4e578058ebedde43e45527d3760b1866aedb948e1a282859ce3b9cc
SSDEEP 12288:XHvUrBFrEjwaQpK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:XPUr+NQpMPrVmZeHgCFyqXHH
TLSH
T13875E12F66E81CE5F776A17D85824609E772B8610751D2CF06A0917E5F33EE8AC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 33a987ca0749b6bfec6219c3c580e855201cfa112a7cf3d37996ab15a23eab5b
MD5 d78d43547e29a9891a35bf043f1ca2b2
SHA1 eb081d6061316aa51b425e6a724e12085c84eb0b
SHA512 e6a5dae2f5b0b2a765646370a5681c2f2d31a1fd31bbced231dd991c418f2b8c75e41006d672a186fee36d02666453078487aff0835bb0eab46e28e5a84ffcac
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5gweACFzXHH:aG05lO43bWgrACFDHH
TLSH
T1A8D5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f7fb989bd7124df05880f6d6bb9b2c4e3d89b9f0340329c74241af75c5df67b1
MD5 fe226a21571e2c288d5534253bb9b2de
SHA1 248c2f5cad048d775f270d5c304578be1851f999
SHA512 e57386575ad2921a840a0dc8652ae437f65b43ad74df69c054a721f649e7f239a3a7ec86cdd65bb1a93998325b2d1725ce03d008a58a766667da93556ff895e1
SSDEEP 24576:pfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnHMPrVmZeHgCFyqXHH:5a5POZ39Jt2pasx2+mRgweACFzXHH
TLSH
T1F265BF5EA7F801D5E6B9D17DC583460AE5B1342153319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c2254ba875e757aac05300dca103c60f2345a8db19c456e2480aa8d478a331ec
MD5 353d80617d159e16472f5a713a26081b
SHA1 4738557ed28365207404cb16c75fc6ab21de76f2
SHA512 a505205a746b60d83d72832230b0e45b9b397c05e1851dc04c5421dff6c3a709cacf99f4632d9fad9ed83d99deffa76b7919e5f5b86a4b2dc5ceaccfd464cd10
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkVMPrVmZeHgCFyqXHH:2Nc/zEOVHF4gweACFzXHH
TLSH
T13F857B1623E901E4F6BBE1BE89779546FAB17865173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a95937bad58cdf12317474f2269b652c704fdd16cffc501ef5fb89f232cd43a3
MD5 65ef590216994463e12f5ebff1cb2e87
SHA1 bcd1daef2c2a5154eca67cfcaf38aded4a11a430
SHA512 7a785902d897b30f8a3130e4fd144ead3657c8bf0734de79019aa2e1f8285bdedd14fadd548d3034fa827dfd048b0132421ccf801ae826f165f87bee575e8dfc
SSDEEP 24576:BtkNvNnaFeYhJNtmZBmrMPrVmZeHgCFyqXHH:BtMwBtOmrgweACFzXHH
TLSH
T10655AF2EBAF446E4E1FAC6B5CD238512E6727861073293CB5290C13F5E279D88D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 8f220eb8d00851a45b2bec120f1a7ca595d5fde8537e3e0ed4c2e27995adfeaa
MD5 a53aa3d4f0a98493c33ee92e68dc499b
SHA1 fc3be897e544a34504b57901fcdd17f1c7db6a80
SHA512 a99af7bfe0a86f105ca96675f6ff6df786c7bdf32cfab6c909c9f15ed9e726dc5abd7c4b6bb4fbb15276124ba8c4ad9faa9ac55a1e3bf1ba5af54d38d879ef0e
SSDEEP 12288:RQcMxWDXN1Dp/fshBItT1IQgAGK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwan:tD3FHshBIYQgAGMPrVmZeHgCFyqXHH
TLSH
T1D285E13DEB9804E4E57BC1BCC6534506E7B278A8073256CB1694D1BA6F2BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/696-305-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/696-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/696-93-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/696-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/696-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1096-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1096-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1096-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1096-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1096-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1292-320-0x00000248DDA50000-0x00000248DDC2B000-memory.dmp

Download

memory/2132-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2132-288-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2616-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2616-67-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2616-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2616-271-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2632-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2632-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2632-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2896-225-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2896-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2896-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2896-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2924-45-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2924-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2924-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2924-39-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2924-47-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2924-50-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/3944-398-0x000001F26ABA0000-0x000001F26AD6A000-memory.dmp

Download

memory/4304-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4304-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4624-120-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4624-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4624-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4624-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4624-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4632-82-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4632-289-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4632-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4632-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4632-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4632-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5096-77-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/5096-0-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/5096-7-0x0000000002200000-0x0000000002266000-memory.dmp

Download

memory/5096-6-0x0000000002200000-0x0000000002266000-memory.dmp

Download

memory/5096-1-0x0000000002200000-0x0000000002266000-memory.dmp

Download

memory/5972-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5972-109-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5972-307-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5972-108-0x0000000140000000-0x000000014020B000-memory.dmp

Download