2ff96a3984517f7397a50c4cab359114660097110b08abb0b0259942d7c1796d

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260701-e1k7pags6w
SHA256 2ff96a3984517f7397a50c4cab359114660097110b08abb0b0259942d7c1796d
MD5 70c9ca1f15a1f35a5e4adc7fae24457c
SHA1 26b22258f6943e817a5045ec0c6b8fd6d4b6a351
SHA512 0ea2d4124b3d843713293a9be356fb9ff6ce648459c8b5b79ae35d601377ce99296cb6274e28d0114f760184efc2608af39900a0e10187e4d35fc84ce97d5c1f
SSDEEP 12288:7UYJ9biSwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+O:YYJ9basRjhm0Ijr/eax8JXO02q3A
TLSH
T14275022172C090B3EA73487009F99670997DFD724F205DEB63617BAA5D342D09A3DBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5708	elevation_service.exe
5396	elevation_service.exe
1996	maintenanceservice.exe
1952	OSE.EXE
5704	PerceptionSimulationService.exe
3172	perfhost.exe
2696	ReFsDedupSvc.exe
5724	SensorDataService.exe
3564	ssh-agent.exe
4264	AgentService.exe
5788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\72191b8743a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f7dc2cd1109dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e9f98d1109dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061d690cd1109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002818d28d1109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031bc348d1109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002629d48e1109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5708	elevation_service.exe
5708	elevation_service.exe
5708	elevation_service.exe
5708	elevation_service.exe
5708	elevation_service.exe
5708	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2696	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4264	AgentService.exe
Token: 33	5788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeDebugPrivilege	4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4736	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5708	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4036	5788	SearchIndexer.exe	99
PID 5788 wrote to memory of 1092	5788	SearchIndexer.exe	100
PID 5788 wrote to memory of 2648	5788	SearchIndexer.exe	101
PID 5788 wrote to memory of 5784	5788	SearchIndexer.exe	102
PID 5788 wrote to memory of 6096	5788	SearchIndexer.exe	104
PID 5788 wrote to memory of 5372	5788	SearchIndexer.exe	105
PID 5788 wrote to memory of 4228	5788	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c23d07161c32d0b3196b1a4f1c30d9b760585e2a5b3beb2154022e48f61014f7
MD5 159a3a17b1b5e7ab6b8c2cf77775a0c7
SHA1 f4ea33dfe9a82cbbc43ec69f0f116d7d99eaae1e
SHA512 23644e6c21eb0acbf357ae78aa4ed43d4365a12eb2f3896bce57d6da4de23a237600d3e619a21528f6316ff2e6e0c226ee7b3427bfd92fe533d43247ed7492c9
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGEjhMjSax84:h3q6HjBxQWdO
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 72977981e167ca34ddb72118eb8ca18daaacea646b57bf8aec62212056ccaf9c
MD5 d49ff55189a7e009e34470be3ecd0bc5
SHA1 3483243e88e6a3e033278ce9eb51a3fadfdc38b4
SHA512 9c851c3b6bf83a810119aab69e1735f96753bcf8712527a707ec3d30c5e3d732c555125ab9deecc8a7214419127ac59a78911e73f3b137ee7d7beee872efe8c9
SSDEEP 24576:KXYfDtczAdsRjhm0Ijr/eax8JXO02q3A:RtcQEjhMjSax84
TLSH
T18A85022863E409F9ED67817CCCA28505E673BC554760FBDB03A4A92A1F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 85ffe1a86a5db1e7414ec37d8f31e8889dd1675e8a48571584188503f24437b7
MD5 1ba1b4fa2aa658e5d6c7dafc221805ee
SHA1 fcea8963ba5ef26448027b0e06919ace424a8119
SHA512 86dd689074c7b12b688d4894bcb744612cdd7686fbf36036ce2e307b2a2e2abdf737e42a9d9bddcc54e969a4acbb66cc189eb0be9bdfa8be9a06b1617aff6a3a
SSDEEP 24576:r0Le5ji0hmxirMOsRjhm0Ijr/eax8JXO02q3A:rPji0AcTEjhMjSax84
TLSH
T15895AE16F6748335D073C0B9C5D2A68EED7130865B308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69a4e502d249bb9b4ef752bac56a572c2a33bf189028176622d21bd3d60939fe
MD5 841cd428206dd7c3b583b28cefd2c24d
SHA1 7ec1172d58e0c3bf01e12c11b1ca598ceccf28f9
SHA512 b8f08425587b779ba04bde418778dba4139e59912eaa4c31d2effe819131aea768b4d29c1752f4247f8d31ec3b5e24a0292eb95097529b361415e1df074fcc0b
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyugsRjhm0Ijr/eax8JXO02q3A:E/ezSC6vUzPvxHjyvEjhMjSax84
TLSH
T171756C25F5788323D0B2D0BAC5D6BA99FE7230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b6d70452b68d66ab5cf095e7d039e65d5a365d0aa59e9d3d95b3a5a892d69552
MD5 90ce246f338ee2bd20e61fdbb3333d62
SHA1 ae73e5c5f40372aa5804f5e27f9b9e5d2caa3aa1
SHA512 c9a3e4089ab53d98b6dbb18ac3257969ab5aa0267a1e6ef62df799dc3f2c7ac89edf16683cfd300fb8a4801e8110eafdfcedbaa21c68ac6971e02eeea07bcbe6
SSDEEP 24576:bVbqPb88hv/l+6BsRjhm0Ijr/eax8JXO02q3A:bVO88hXl+aEjhMjSax84
TLSH
T1C6559E65F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C3E676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3913b2e68b0da64a8af1265291c039526da5ac0ecc7a768f9512780e2b16aeb9
MD5 1c597ed91f6ac814fe9c523630b8b056
SHA1 81e85313f723d391a7b2e5edc7ddf2b2bd57bbc0
SHA512 b410c11c249aa8a78ae1dba62a010695af86ce0528c1899db3a866d6b45ff88af4b92f8978ec465544621652d9993f766305c85d8df1575393ae1f14deab43f5
SSDEEP 12288:YRnwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+c:YRSsRjhm0Ijr/eax8JXO02q3A
TLSH
T1FA65235483E42282FF07C8F09D9B1808D459EE694810BDB76622BD6E2CBC4FF965F947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f48e8e407dc4183c8ed04b4a431fce4a12171831e529de75402f287d15ab8f4e
MD5 9653f9e821311fee245a8bc2ef01fe75
SHA1 afe79353093505c5d4b291ee13b9e06dc632e277
SHA512 680403f9554751a5fbd1d58295defb035fba57db051198f6b9a9379c20b7fcc6f55331316522bbc072dcbc5f79accff5996ec3b9bf7c7b5b6d7f1e8851c64119
SSDEEP 12288:ceBNUbTVO86UkwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:cJIUJsRjhm0Ijr/eax8JXO02q3A
TLSH
T1EE85CF3BEE28FCD2C67A8DB85A918600D77278304F51A3CBD175820EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f1e02e962330619195e73e14ecb0dbd5455c7bbaf661dc4d51511b2c3862199a
MD5 4c4d072dda9a98a8ec7678c215cbddaf
SHA1 540d92f56ede9c861605e22479b717da38d024d7
SHA512 c2b0603a8816385ba6b44ba6ed0c7883581dd57189e1d317d094b9f48bca7d24354fc487cbc70d024f02cc6cd35751ba666a9a5b5d7e12e3d16c9ea55bfda7be
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:UQvGAdlCEL8c/yRNw5CwQWdO
TLSH
T156267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4eb8c25606d4bf383892d05ddf19c8a33a12818edd7240f2d4ded0b74a7bd112
MD5 32261a91b62d17a09e7229c79d22c8de
SHA1 6bdcbcbfea8d301bd37a50ba0234cd977b2e9910
SHA512 d388f418ff497a5e781af2330a63030f844edc7ba2d5d6a21b4215859218d82204341364ac52fe76a4d00b2fc8dda8540d5be2053f303c5d5ee5b285ab0b4479
SSDEEP 12288:vAwSfxL/2Dc34DLLmt0LDQewsAjqwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZ2:4dewsAjjsRjhm0Ijr/eax8JXO02q3A
TLSH
T10B85E031FA74E032D77B0DB21B26C706546DBA204F5129C3E3A89E9E59741D2237AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 261868da345102cb52b29ad9c453e23eaf019799ccd2d9bbf23b7faaaeb778f3
MD5 d6de7e622c33cdfae22df3c475853690
SHA1 b0c890156893abafd438449815d21776a6782a73
SHA512 ce068842ca8cca9907595a868373ae002a7cd61b9e6c2586a3b950ad3fa04eec347b0dd7d7faa4dabce7dcd071ade8e9b92eb32ab283d08df8af02a6e43db295
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbQW:3UEtQevvqc2W1cpV2EI328
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7825025c0663e988c74eeba45e49b35fc14b7d28f643fdcac3becc8a1448bf5
MD5 74f66db6048a82f4dafab6be5f08c758
SHA1 139d27e65fc2756b2127e6a0fb1bd59c7c980d5f
SHA512 53e8b250205bdcb5938b294dfc9d21f31cf41496d63206b9c88b5ac3885a1faef174f7d7c62e821f81a592d97a7fe5314f08a7cc97688720df1eece45e093fc9
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zDEjhMjSax84:2oquVjnmMQWdO
TLSH
T1FBD58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d6e1261469c284a9b7e4de1627203fc2fe9250f962c7d821ebeea04e616a09ca
MD5 4294bfc94100084f3d20bd6ad46b6abc
SHA1 82e5e0735cb888ff338b8ac0609c99de622e0d42
SHA512 f4140b0ddc51ff6da469468e676e1598c5082baa73c345b679d6efb3bb99968390900264b8edeed6a8006d9d3f73924e6349d4a81cea51050b0e84fdd58af9a4
SSDEEP 24576:vAhGLJIFoiwtA5l7S53ssRjhm0Ijr/eax8JXO02q3A:vAMyFoiq5cEjhMjSax84
TLSH
T19A359E80E7F955D4F5B3AAB899B68170EA76BCA65E30D20F2150D11F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 200e968d134a2401eec5bfac3816d3b8bc192269e8d742eacd851cbda2335b25
MD5 6b3b77cc5e9cd16cf9ea5cf609bf2528
SHA1 2cb3dea26500fe0c6617eaed099509b4b867438d
SHA512 8da23d1a899894efbada10c578d52e69b5868a5b3396dcd1708abdbbc3b8ae24c6d12201026f7edd4860c923f0974cb29e0920581afb6812e6e86af235ed7aa8
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CxwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+g:KwuoOWPsRjhm0Ijr/eax8JXO02q3A
TLSH
T1E185F14573E41CF9EA67857889978135F7F2BC022A21DB1F1360CA5B6F372616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3dca293bcd19d02c8809ee3a7c00efface0e1a76de3d7ef20d4730ef6452f6a8
MD5 5d4f80953c61f0eda418038d3b85c940
SHA1 c8a279f456219717d708b9a54e2ad18e604dc1b7
SHA512 e2593a32bd2fab6e1d520884e5c4300297b0ff92890cde3211ac1ad2602cc177244058230fa193df230e20e40bcd0c432a4ebb40c582b4bfe62daeaed8fbc34c
SSDEEP 12288:NBZ1IyawYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+7:rZuWsRjhm0Ijr/eax8JXO02q3A
TLSH
T13475125923E431F6F65385F8CCE60504D772BC66073153CF12216A6A2F76ADA1E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 914a2eb4611795dc74cab28795b5f572aa83c9c2d1b7ca3883d9964a31d7b332
MD5 da9e2e8b6a148f1499e376f59f5e96c2
SHA1 dce3a2277997b04437a5e9cf58d37c9e46b23988
SHA512 d79a5477b76a36c184cc118b8aec95a828796e8c42d1b5adecd05b058b84405239639c1762752ea8491b2ffbec2280e6c1974818c78ed0608d29134b27f9df50
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:uQRQyi36YOcPQLvw2gAf+PN3lQWdO
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3b5c90ead25422c5804f8c2111d3d4967c206cf6a4c90f0b5114545a8426d92e
MD5 188ac91f0d14614f6207cf0475adc704
SHA1 43fdf8ad360de9ae8f855e5982ff86d7321455f4
SHA512 634b022fa9e7626a36c627f1d21d51ebf18ccb536d60cdb2ed3d5e890e93bbce6401bd9b1a1e3a2a3557eaef6edc47728103387d27189b21c752ede3e9a50f20
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:QQRQyi36YOcPQLvw2gAf+PN3lQWdO
TLSH
T1DC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 89e765d696f5cfe955a6ed29a7b8545b2464732c1354f5f82772fccf3811d7af
MD5 cc04e1f06f6aae4e0a46152a3b653414
SHA1 47c61065094fb4cc326ac9a36f9d3f541a771bed
SHA512 e5160e48fd1ee3326fd11569518097cf003f58fda1acfadf32443a3a66f91e7eb6dc7cf94c4d8a4f373babbee9d06acfdc333ff6b95f233a3a6a3480846917bc
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0GsRjhm0Ijr/eaxH:S68Qg55nhheWu7PNU3/TEjhMjSax84
TLSH
T12BB55A33B2F20099D44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 52e4714828c6eea087770b294d6f8f80cd1cb9516d09cde39041c255aa894785
MD5 09f0a140ce8d8ab1d0bd4856f6b8575d
SHA1 16689af72ea807841131c1caae7d66b60e0c4f90
SHA512 47bd4a98b34d5ee8101d23ecc0978e7da20c2c0bbd5e2ae97b918fddb42fef911407e8a854f7b055788c60d41142b5a59c9e1568da879cb411e70b70ece05dec
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:qy5112gYy5azzVvL69nLKnhZSQWdO
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 57991cd69ea4e82bcb4488aacaa996e192ce8930cc9698b1994f802bfc9558e4
MD5 4cb4ca9dbb65041763b829301e9eae7a
SHA1 d880c4e9328c06463975be127ed48b08b2baab8d
SHA512 9042393d4772817717ee0953376993c5f8a5f314eefed088cedf2431a6858b5d9cbbbc66e2c95c2ed349f164b42b933b36d9da42454a248c18b3d50213312bd6
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNEjhMjSax84:3u6JmVxd2dNQWdO
TLSH
T114D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 972cdd3f99b2f57cde54e88c0aff3dece354879a5a5ca977c8780d18e6a1262d
MD5 2a1b35e157dd74e47aaeb3b6e95fae9c
SHA1 177bd69fbf858205f8c5d51d1b769ea6f1ec51b0
SHA512 cf1b47a2a2bf2f92523e58bddb2c7407142c4b32684a45e33014e75fc9545341416f512d97e2dd2b8806f28ef735c8ea243c2685931783f0a4c39c83580ee67d
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xpEjhMjSax84:fmifPbRMQWdO
TLSH
T1D0B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8cc43ad38b8c7fbeb7dc99efaf1d7fad89de241461b946923ca8395ba4232f50
MD5 d8d87bdc2b360b8999981f4c097a7834
SHA1 c283b23f3a965e2cd32d223275e92b04f607fa58
SHA512 d340143b8ca565d3e26543ac4bd8ae6b0673c3d372a556715bc71c36afbe9f4320186a6bb34bb7cefee8dca44e042ff2d314b0d11f322a035559a1adba810a1a
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqWEjhMjSax84:V5dKTi61WQWdO
TLSH
T1ACC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 518304784d32ca0a480bff1e60657ed5df31071a154af6d5aad10a80049be99a
MD5 7d9fc118f7806513eea851955c153dd9
SHA1 a69b341fac7df99955553db9a568192e90d9a061
SHA512 acb39dfbd75eab21b636647599669e2cd912abb9959072de0c5f1f522c791f74e1de9d552ab726290bcba335ee80cf76dbe7765c284421c01f28af7aa9cbfc99
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wdEjhMjSax84:nX2iyphIQWdO
TLSH
T13C95BE13F2D901E8D05ED1B8C7468632E962BC160B34BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e4ae80dbabdfc448112f12533e835659777b824b6e0070d0e3aa3182753b61fb
MD5 1e4e8f0e9215ec63cd2d1c03cfda146c
SHA1 fd19905527d344a0cb3cf1fb4fce254d719c81c1
SHA512 fb7150b537d5aa6a89636df0f2a38fb9d8bb53c1984e58ea647ac7120be41c3e72e73b78c537cdfffd913badf432ebb17f9eb1780e84b209d8d1ea3407031b25
SSDEEP 12288:KvwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+E:KasRjhm0Ijr/eax8JXO02q3A
TLSH
T12D65235482E52286FB07C9F08D9B1408D499EE9E491079B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 47ca66cb05d9b5a89df0964ffe9afc9c637982ed5c6f5268605a3fc2dd0835f7
MD5 7b05540915d8ad7226d65dfd52591937
SHA1 e953376079621e61e58d29aea97b04fc2332997a
SHA512 aa33612eecfa6a97fbbeb5d92342dbe8533ef7403f01af24aa268895ff999ef085e9db065f62e9b4d3e60a26a6b1d4082bec95ecbd64e688c862c1eed52a0855
SSDEEP 12288:wOwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+z:wnsRjhm0Ijr/eax8JXO02q3A
TLSH
T17965235482E52286FB07C9F08D8B1408D459EEAE491079B77723BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 968b4ad06889d0ffd0b6ad44c84bf921fb635d410eaff6a9f5ccc7c09fed5d24
MD5 5df75f944c59df9c296f064c765f46c3
SHA1 acc51cec0927517237fabb8ba108c269a79a1781
SHA512 a5a0f579ed8ba9c7221eaf60f90e92857fe21bc0c302a99ac190b0b6a9d5a60104ce3ff1c3ce7bc3877aee3a76989ff7f53b8ce92a28fa4d6fcec24a3122b08c
SSDEEP 12288:VMwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+r:VxsRjhm0Ijr/eax8JXO02q3A
TLSH
T1E565231482E52286FB07C9F08D9B1408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4d85e38e0a5eb5d893a4f3a7b8b4ec0c2221a8d4cc60f5b3e60241036f494f60
MD5 1837d078c6d40ee3a72fcae4f1604f00
SHA1 4862bb189ae0ca29eeb1a25309f7ebfc160c4923
SHA512 2abc140201e1dd81fd52f20fe487c201f2ee33887f23ec931113d30fd960e4c487c31aa97dc5e27bcfca46593502cbdd6f02087c61dac4d72a98ceef3ff8ab6d
SSDEEP 12288:yVtwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:PsRjhm0Ijr/eax8JXO02q3A
TLSH
T14A65231553E912C2FE07D5F0CD970004D0B9FDAA4A216AEF67127C1E1DB82EE1A3EE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 102570292c90beae26ebe3cc4fb93230ee2824484070c30a722dcda6cdabf994
MD5 a73c632d2b7388b9bb3f271072de272c
SHA1 20cc0a3a56837ed354bad39d6fd4af0c67714f4d
SHA512 bdcc512ef65c410f026cee09b8dcd73b8821eaf629ccde7553ab5b438fe42ddb6a1f31e2ef59fbf7e419a3756c80e806df098bc03520ef9d6e32666762cbaf95
SSDEEP 12288:wlwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+h:wEsRjhm0Ijr/eax8JXO02q3A
TLSH
T15665235482E92286FB07C9F08D9B0408D459EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 619096573c2ab5cca555294e04b56204917e79844a76f3351a096917e3def3d0
MD5 e28f24bcc80ca6b0e807d37eb52a09f8
SHA1 2051e1db6fcc162af7e5bd2477b638abae805e1c
SHA512 5ae1f52984d8f88a51e08c0e3c970584099e0a250321fcad4dcded6a2cc2963224e7ed6fd60c8ac04b752671d41b00913b2c182739651a12a33f5a9369f10d59
SSDEEP 12288:RywYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+T:RrsRjhm0Ijr/eax8JXO02q3A
TLSH
T14065231482E52286FB07C9F08D9B1408D459EEAE491079B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3feb1a17a66543cf86ed6410820f77b53241c909eb0a2a5828c3bbe8974012b0
MD5 fbf468be1fce3e096303a4d7f767fe8e
SHA1 98017370ca9484a77352a511f553572face22c00
SHA512 46e3fc516f78ebecea76c2459a1b9455715dce006acb5852e093b57f70981f839b0b7f120b621908fc096ae2f97810406bdd68722e915705864886e7c95de8cd
SSDEEP 12288:hGwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Y:h/sRjhm0Ijr/eax8JXO02q3A
TLSH
T1F665231482E52286FB07C9F08D8B1408D459EEAE491079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 145711021075bde4a2a1a3ae41e963d4bea9f3030b58595cae9a938dd432f66e
MD5 1d7a0b12aa5f30add5f523c6452e047e
SHA1 dae6eae8837b629899a6de2ea102f9bd74dddb32
SHA512 b0438c4d396227d6f324cba2a022181a51996af7751ac0d2a18b598eab9f1f6aed2e5e551e5cef51055f177d91fd983884a1c23b248a4075048e43700f6d4b7e
SSDEEP 24576:ZZMSzFVSOHsRjhm0Ijr/eax8JXO02q3A:ZZMSzf7EjhMjSax84
TLSH
T136850194B3A018F4ED67817ECD564905D2B2BC5A0B60CA1F13B43A2B1F773A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 1dbbd598dfd8c1b1862aa7ef3c2431873828d56e051bd7395baffdb5bda14429
MD5 a77ce000527073bc721c759e4635c55c
SHA1 9c945cc85ca0f6408a4d20b3f3a449245ac9c5d0
SHA512 5617617dd2af314a897fce692cec1cd829b75d062eb1e7493ae377dc6a3689d4a4f66ad82a96d88e2ba50301bd2936b6715bf72c55bdd0917b150a000f0e9b53
SSDEEP 12288:tbwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+q:tmsRjhm0Ijr/eax8JXO02q3A
TLSH
T17C65235482E52286FB07C9F08D8B1408C499EE9E491079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 73aadfb105d3bb40a04d07f6138f3b1cfc71b989b38e6883413550715f669bae
MD5 5a1ebc91e51f545672acd6f83bf50f7b
SHA1 5fe2ce7e23c1c34eadd7b1e083c4f4f329ffb5ed
SHA512 5f06880a96ef429212ac30c41e7c22ca876350ab39f4993a305d99c0a1f7539d44c363e7d9a4a95b222e1b993a994fcd6c465580bed2d3af84b27f4f50b454e0
SSDEEP 12288:yXwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+E:yisRjhm0Ijr/eax8JXO02q3A
TLSH
T1B265235482E52286FB07C9F08D8B1408C459EEAE491079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 288ed1ab55a0f8657039c810ef98a02ccffb717b849807b146015025069fb8a0
MD5 b82e90467bdd00972a87864f8c31d81e
SHA1 ec9b0e5b93276b5ec70523ae7623ac6e96947759
SHA512 eab45ae84d63c43cf5675d25c448359bdbc2961e327ef9c2c30b02282166094f66bcb822c42b90de73bbe8fad87c45a19eee132e6d1c6df2898025f87fc794f7
SSDEEP 12288:AyPz5L8awYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+v:xzyzsRjhm0Ijr/eax8JXO02q3A
TLSH
T10875020763A131F9E527C2B4C8921905F376BC3607209EAF13605A7A2E776E55E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 511889b80b048d7c78bed10d261e9785ea3383bb8d87e1f03911a3d93cbca8fa
MD5 7007c1f1e27e7e0473ccb09019b5d6c1
SHA1 8b54246b38fdb34b51c2a9837c3eb6ecef0a6ff3
SHA512 1f3585a975416092ac2618d32aafe0894708a2b159dbb017506cc0d632821c4641a12f2cb1abe30999de95da233bee721e01e9c690204ffd71c7388fe0bf6a97
SSDEEP 12288:vbwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+t:vmsRjhm0Ijr/eax8JXO02q3A
TLSH
T1A765235482E52286FB07C9F08D8B1408C499EE9E491079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ce258f1a3f670fcdcc7317adf409af33ce2173636f48ec4156dc62056d8498ac
MD5 93db806c81bd18813eee4ac50722e315
SHA1 ea45a49e7c78a6a2e443467f3f02a907a7fb5382
SHA512 1a340852a02280aac89858c39212056848b124c0358c869bb4fa559788ea9a62c3f2215bc18780bac79fe4b0f6d71b697a397bda5247714c2b01946914d6631a
SSDEEP 12288:fbwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+e:fmsRjhm0Ijr/eax8JXO02q3A
TLSH
T16265235482E52286FB07C9F08D8B1408D459EEAE481079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b8b25aec45d297eddc95a37030e25d1561b7d76551d3c76f6f6c532619cffd47
MD5 ad96e9dd18421767ada9180448f5f0d3
SHA1 490286c65c8a04a022829f7a2b8e0f2898038cef
SHA512 7160171a4826be3bd29e15fcd75acdda97449e82b5c64c50d2abc2bec325b1d6c327c413b41b6d61114cdbe946306eef2d4553061adaac11f641f4e51716870d
SSDEEP 12288:3yPz5L8awYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+f:6zyzsRjhm0Ijr/eax8JXO02q3A
TLSH
T1CE75020763A131F9E527C2B4C8921905F376BC3607209EAF13605A7A2E376E55E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2b0eab373fc7f40d94bddc9346ef88c6b2dd313980d1ddb89c5e9dfbf797c11b
MD5 b9c9c4b99038f91b971051098b3b907f
SHA1 5a1ecadf9bcc4c7175e982b72f82146e37e27aec
SHA512 8f0fb30835dcdc672b38627d82a2ec978a70008a236ab02e2ec55f69b2197fa705db56d581c8cb7e44ca92a17163a6f06c3dad516d23fceb18bf71f2be3ba0ed
SSDEEP 24576:5THaLl3z0zDhsRjhm0Ijr/eax8JXO02q3A:5T6LljgEjhMjSax84
TLSH
T136850194B3A018F8ED67817ECD564905D2B2BC5A0B60CA5F13B4362B1F373A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1aacc9d9436ba579c115556e3e20aa91af597a81adb8438b7dd18079d321fdc1
MD5 f6bb7a7d14a3c2456fb7c0c6ecd7fe3d
SHA1 553ec5c4c43a56b9a5adc59d64013559bb3a01d9
SHA512 5f0b459320e670187a6a00e47d60607f8ebe33a4bbe2e618981ac5287bf3b8e8f56afc9c9dd95ca10e38844d3ac1cbc9523486dd9655de72fa05bae2e4b28a7f
SSDEEP 24576:s37d9CHKy7GZFsRjhm0Ijr/eax8JXO02q3A:W7d9CHKya7EjhMjSax84
TLSH
T1AC95CE90F3E410E8F1B7DA758D764511DAB67C9A1B21DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0141e6980a8ebb5803d972530398ec9787d901e33b4fa9f93f2f9fe07bdf9337
MD5 fa8ad3aafc31dac2e1086fbed427310f
SHA1 1b31fdc24a34156816e117ccd62196553d4f04f8
SHA512 cb2270e884e1793f0f808b33cfb24980b342824187b262a7b645d0eb005006f191276b5acc9c62af123186f2b46a0f9f9b38b893e8a67b82f6496a10b92b6c11
SSDEEP 12288:xswYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+q:xRsRjhm0Ijr/eax8JXO02q3A
TLSH
T10365231482E92286FB07C9F08D8B1408D459EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ef34d124df4d8ba9a32f2135cf387a37bf21f22eeaff4633289ac75ba60b610c
MD5 510d2a836d73f93ee1add50b0593ffd3
SHA1 e2dd19cd756958e9800fd36f7b991b1069ab9445
SHA512 450a2514cce7b4b80375852e3b6f1c7c74fa845a9f3d25e3515edf7997820eaf383098f117507ac2bf3e2bf59caaa6fb5fb6692c7ab539e810d6d78d517b7914
SSDEEP 12288:f6wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+B:fTsRjhm0Ijr/eax8JXO02q3A
TLSH
T18B65235482E52286FB07C9F08D9B0508D459EE9E481079B77723BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 fa6d021dbe9e0a8682e933049dac9619887b240af95d0879d6d6e1a6781db308
MD5 520a1570bb6bba9e8edd72d5c8c3c697
SHA1 f78414918e82556223eaa747bbaf086be0b6c679
SHA512 265e82246d3eab45d2de2b1278170883d02c7eaa6d7214b2d4af7f9bbb1bab8987e9cef975718336d080ca1af727bddbcbca055d031d8365f2dc81cf17574544
SSDEEP 12288:kpwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+7:kYsRjhm0Ijr/eax8JXO02q3A
TLSH
T13D65235482E92286FB07C8F08D8B0508D459EE9E491179B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 fbf7ded44e07670394c7b809c445d3d4c789cd626ae05905a136cfda6d13806c
MD5 917cf6fc73f4e4727da892470bdda5c8
SHA1 8966ed573912278a015bb84e75840092db47824e
SHA512 0b22ab365cdc193b4a10b585da5f5151a6e5ce394a42f68fa54a10a3b69d064f79fc2880a176c95a73c250c9d01a517cc9c4500eae4ef4dcf8c3acf4f5eaed0d
SSDEEP 12288:5bwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+r:5msRjhm0Ijr/eax8JXO02q3A
TLSH
T16D65235482E52286FB07C9F08D8B1408C459EEAE491079B77727BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 457d1b08ac44d8a3007ec474060edbe37604b5835ede9d95a13d456b9fe9c271
MD5 675191d8bf7dca3cbf9a29f9e40fde13
SHA1 96b994689d0fc2bed450aab36a8003fa9323c0ff
SHA512 785fdda8b03c80c50f38d71e3f4c6d9b5e45b4ee5281541eb5e303d40f4b92d3600198ee328be47308b85a36adb3809581bf4a11c9b4ec6e6447730d63ac5dd6
SSDEEP 12288:WswYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+P:WRsRjhm0Ijr/eax8JXO02q3A
TLSH
T15965235482E52286FB07C9F08D8B0408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 430d31cd6503445d6948a7bbbe1bb24503f2ab081aae5f1afaf33588dd7f2819
MD5 4a4ede9fa42060c0a07bf3114e6991ed
SHA1 9289caf1eca0e1658aa0664152bca5f10ee736a3
SHA512 4ffe8b66ec1bcad67ba2512273dd1d8f9a3c08b61d081422d50aeb64ca0efbd814a8b525acc33a4909dc66cfbe8b8d673133c12cfc9b6ed46c7f3b534d3b23e1
SSDEEP 12288:mzwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+L:m+sRjhm0Ijr/eax8JXO02q3A
TLSH
T1A065235482E52286FB07C9F08D8B0408C45DEEAE481179B76723BD2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 09d407cee92788c9dc426135ff751b5f4139512c2614a550a30481a4cd2142f7
MD5 00a0304fdb00a14477aeff6f7a14d91f
SHA1 9ad67571204a5beada3e45e127ce1ba6290c73ee
SHA512 7d09136f91bfbf857418477ebd869a81fb1a87d7e1ed61ccf0a492df374d6f7f398c8d8de34d3206d2dc56e0dae4a7ff12c0a0ed48ebd5e7904278deaa6cacf1
SSDEEP 12288:dlwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+P:dEsRjhm0Ijr/eax8JXO02q3A
TLSH
T1C065235482E52286FB07C9F08D8B1408D459EEAE491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 a44fd42a79602605f5985a3f58ba084ab83f00c7cecbf715c3dd828641497771
MD5 e44a0137119ec034131974d3241d48f0
SHA1 4020bcfe20f135ded00f4d9b5a96b73e73784373
SHA512 d00d481f36c2afb2a5bba0bf986bc88469584c2ef4d70d1638ef161e525b8a9ff44ca7cf1f0a4eb758b71b87b9d0a7d3a7d3ca8bc26e4d4ffcbe3858cea4eb3b
SSDEEP 24576:tfwvok9RX6wkyAIysRjhm0Ijr/eax8JXO02q3A:rMnYIyEjhMjSax84
TLSH
T16C95DF29EBDC04E5E177917C89B7460AF2B1B8690B31C6CF125A536E0E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 44584d2aeef0a77bcf2cc044fd5c5ba7d107968f4664244b3fc47cf0fd97d798
MD5 b776f65fefb0300613e2e635d9d674e7
SHA1 018f9cd5b10f52c4d1086a85df1c3f62ff0c6f56
SHA512 6f0ebf39f03a6a572b6252116e16b4a63b348f1eb078e80a2537e3465b7e0999f794fa3961b3f0b06eb5ec41511c3185b91fd76ce1774c8adba88f579fdf7bce
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09EjhMjSax84:0ySzPFQWdO
TLSH
T177066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e111cb4a91513ac103ad41a047edb95270980f4e41eec551e424d4aa81b1290c
MD5 c2949bcfc609e5f945c80575394fe34c
SHA1 f7d046b864747523c934babefb6f86aed3c02bde
SHA512 fb3ecfbd2276e9df4285ab72cede2a0af70280117435046fdfabf9f88d0d0c4af4f014a695af2a3664892bcf45b6c7904c4c93aff8ba47c19c714703a2ffd22a
SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXsRjhm0Ijr/eax8JXO02q3A:047JUQj1irIhCnDHUPfF/NEjhMjSax84
TLSH
T10E65AD1DA3EC01E5E1BAD27885154A1AEA71782E1B31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d63d7541d4348af51a39e8d1bc0bbc49940d1693f41bfad2a01bebd0dde804a1
MD5 7df7de7eb747856e5f876f758a4e59ec
SHA1 2a3d23ec49c8918c84bf95f4c88f1bd18739d9df
SHA512 aae18f3cd5ed353fc746d684c5121c4c5ae52051342ecd93971cd646216edee1d415e79cb979e307c6244101ee0cc5f98f35b044b4cb139868852942b85dcc1b
SSDEEP 12288:0NsfrwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Q:FWsRjhm0Ijr/eax8JXO02q3A
TLSH
T11375F119C29812D8D11EA1B4CB560A00F327BC6587E1E3CB63D0F93E1F795D55EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 a729f1a05d388c5d8847ce87f2c1e554917efb8447b7c2e8ea9441fff0df3ac2
MD5 193ce8a72752d7505a20077c1e02c59d
SHA1 3db6aef75621bfcc76c4ba2b3393d6e5fc7d1406
SHA512 441fe2712b25c5c95af1f2ed15a744c7114a13aefb35bb5bee8807e71b86da50092cc5e9249c8f6c495c2865f7f13fdd53b9860aca1a3c07a8da92d319893c6a
SSDEEP 12288:9qldTU3fuiEoToOAp9PzCcemzZqh9XP+2aLPI4UE7Bi1x:9qlpUPLV3Ap9PzLj4jf+2AA4UOB
TLSH
T18C250700B226D74FC6A944321E72D5CCA7707C41EE45AF0773C98B3FC576A59BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 60a92877454d535de85630ed812c7c8a789d183d5705a28a6d0c3fe5b5978037
MD5 14a8fd27b9e45c799847c99a1139ab1a
SHA1 c4f2533ef53d68e7781b5278a76038f6ac7de72f
SHA512 290748658660930279eea84c96bd3d8f0e3b260db186cad3be91e8cbbbad11c53b3640823fcfcd82528d165ea53fd77fe3dcb55a5e451ddf151708c766eebcab
SSDEEP 12288:hiO+VyS68OPOep5pLpl+f0AKSDllHU9/eigZfsPqv6AOi1XWRov4x+nkIUYp8nB+:hI6LWep5pLpUK+lsIUhnB+
TLSH
T15175E9409137A38FD1F76072072A9B8C7764EC06BB456F2673C8453AD82AB55A1BE3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ce10e035202a7ebecd02f123dc7e697967878b4ae3b80f576602beb22344af3f
MD5 04694c557382ef879c80fe695c4941c1
SHA1 da242409c3a825d5a8532a15dee534dd269fe39f
SHA512 aa2d6947194c8be12ccf56f47550d56c5c2e80804c00af863b8faaceef19f3c964236384f55905f7e39102a083c3a67a70b32ca6c89419de180bc687df8fdbfa
SSDEEP 12288:p07DwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+L:6usRjhm0Ijr/eax8JXO02q3A
TLSH
T1E365231183E82646FE27D9F0489F0414D01EFE694F10A8E7B612795A2C7C8EE5E7FE46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 08a66916443f5791d2d3467643bc0c418784df2f951c029a9adec01c10ddb2aa
MD5 b2a1f38843c1d7783a3d5512906cd1e8
SHA1 bcc8f934a885ceeed0798de043d0d22c5ed1e7d9
SHA512 1777280f96444618d58a593aecca4eda60d2c2e96d8c5b2d7af0c7b9160c81b95148fbbb9d0d09b7077fc9e1abcd14e20935271da608cf127eb919f340b0dcc6
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYgsRjhm0Ijr/eax8JXO02q3A:ogb4mBIBhGFXEjhMjSax84
TLSH
T17B659E1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 be0e2b9665a0fc85466131452176968756b47a01f903f95d1f4ee8f165d9653a
MD5 69d4697ec83a0533c119af1823e20768
SHA1 a98869c69fa7b2a130d309ded8b483f130237bad
SHA512 abf5e7b0f7b19f624954b5068bcb4087be8f2c192ee8c61b0a5ddd5ce75f62a8c1e21f783b14b07aea12d037950f8cdc62f21151edf84e787aa701280292d4d8
SSDEEP 24576:gG88u8FpJqH1bzria7/mHsRjhm0Ijr/eax8JXO02q3A:z7ZFPqVea7/4EjhMjSax84
TLSH
T19395F16567E101F1E47BD13889864663F6B2B8250360EFDF07A88A551F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 c9f7d8a0844c2193c802e3d1bad523695a2f2103d2a1b816540e56403f1bb745
MD5 8e59380a7bbe5a7a6c76bdd6622abef1
SHA1 8cd4702e69f76ad5b546ad52bfe4fdf60d797566
SHA512 9867a4a3369660b0a05f32a12b2e3bd17ad23f7943d98e1ad5b7480fbdfd48649af940a8eb30b22ca39f9dd4f90828ff9649b11fac7dfcb820d2da6e9b8f9103
SSDEEP 12288:CHvUrBFrEjwaQiwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:CPUr+NQ7sRjhm0Ijr/eax8JXO02q3A
TLSH
T17585F12F62EC18E5F676E17C89824609F771B8620711E2DF02A1917E1E67DE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 09709a550282aacb33766ea625693f17bc0dad4bae8758247982b65304ffaa73
MD5 84f788ce2f973b4ea00576c67e2982e4
SHA1 2734d444c94020d0917a07c46158cb61538067ee
SHA512 3bc10ff2b11df9e489e0ad00d7698ec8de1dab0087f3d8b2fcf5cb3f50fb68d222af4d4ba1adac4d2c534ef0883e2c6e66392b476edad105bca65d26af0035b9
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrEjhMjSax84:UG05lO43bqQWdO
TLSH
T1B0D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 03d2eee977e7b7cb0c3e6ae5faeb541d0e6279b7ca6c8b72a785558a3b0e4aaa
MD5 fbee3090225098471d45302d07e2a7c1
SHA1 af5fd58c4719c17ae0939c699fbc40fdc5ee528f
SHA512 add75ac60d9f72812b8d35051ef320cede0ab0f847c867de906e4b3dbad6358e6b398b75e26d18012a57e16e10d1bb0711bee3f33be726c7cc6cb05b32235421
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9sRjhm0Ijr/eax8JXO02q3A:ha5POZ3+Jt2pasx2+mTEjhMjSax84
TLSH
T13E65BF5EA3FC01D5E579D17CC583461AE5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d699eb6ce1aa463fdf243fbda489450223322d85aa036f201c01cf0da1135114
MD5 47fe4d6e92252f63d1f8ac619854cbeb
SHA1 00736338a57b1b36e8c49977ab355f02df8f6d72
SHA512 7d48c27a4e12ecf276dc6f0a1d06d9a13cf82d75dbb0651a3c57545c6530c54e9b822156e3eae5e1aa15f468341b68ec047bf28a73fe0a41d2c4f0ae9beb664d
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkvsRjhm0Ijr/eax8JXO02q3A:4Nc/zEOVHFYEjhMjSax84
TLSH
T1DB857B1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c45f41991a4de174c99475a575b94863ec19440fb1dd8f9354401acfc5c9747e
MD5 a6ad74009e124c2f108480bc15eef4ac
SHA1 2aa86f283c7a0ddcb16e784427ec3f1ac914b97e
SHA512 3c85324a0f2dee88165d64e3becf6dc316b6eae5973ac5e8e8c9244f4c5f45be4d65867bcce66932bfea6eb6b8ad3513ec753daf73f0c9afc1cb5b634e711b9f
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmZsRjhm0Ijr/eax8JXO02q3A:g8MwBtOmZEjhMjSax84
TLSH
T16855AF6EA6F806E4E1FAC6B4CD238512E6727861073253CB5390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1cf0b65cbf33b4761917a31c89ea0d87c4d18d135db9161dbd8eba0f1d4d5d3a
MD5 2b00fb25e9579e111b0be0299535a7ea
SHA1 6b536a29371225a655c5f873e3b2e95dd6efb2ac
SHA512 66502454ae5a79b932e9984f71feba588b15ffb3c25edfb0ac9bd52a0981b56a0b7891bb292c44457e7d6c00dda70920b515785c46855b6a4cbbbb1bd5a3c460
SSDEEP 24576:DD3FHshBIYQgA6sRjhm0Ijr/eax8JXO02q3A:DDVHeBIAA6EjhMjSax84
TLSH
T11295E13DE79C04E4E57BC1BCCA634A06E67178A9032165DB1294D1BA1F6BEE42D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-222-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1952-52-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1952-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1952-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1996-48-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1996-53-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1996-45-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1996-39-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1996-38-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2696-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2696-318-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2696-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2696-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2696-287-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2696-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3172-77-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3172-272-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3564-107-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/3564-108-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3564-303-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/3564-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4264-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4264-128-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4264-126-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4264-120-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4264-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4736-76-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4736-6-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4736-7-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4736-1-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/5396-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5396-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5396-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5396-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5396-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5704-64-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/5704-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5704-256-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/5704-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5708-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5708-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5708-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5708-13-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5708-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5724-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-304-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5724-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5788-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5788-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5788-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download