bb8a9f1da88fa72086a18855f9ee183edc25a2509c8bfd657b3fadd8752a1af9

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260715-pgwjesfv4x
SHA256 bb8a9f1da88fa72086a18855f9ee183edc25a2509c8bfd657b3fadd8752a1af9
MD5 3331f782e7363d06015897ca6487aae0
SHA1 698871ed15ff625a76d44b6218ee8a78505e45c0
SHA512 895a2202d05ad87c90657fa500f63be8618db5c344ba3bde9ed2692a0407affc558350a5f905c1c64c21ddf93619f651293e5dcbf2079c3fe8e3385271732758
SSDEEP 24576:7YJ9bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7YJtbLNiXicJFFRGNzj3
TLSH
T1A765026171C084B2EAB7043509B89670AA7CFD354F2549EBA3943B6E9A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6128	elevation_service.exe
4184	elevation_service.exe
3236	maintenanceservice.exe
1880	OSE.EXE
2548	PerceptionSimulationService.exe
3788	perfhost.exe
2108	ReFsDedupSvc.exe
4896	SensorDataService.exe
5700	ssh-agent.exe
1032	AgentService.exe
696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bd06dd5a23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007392c2195414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000589753195414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8b80e5b5414dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c469011a5414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b221ac1a5414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a1ac85a5414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097fc531a5414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b38b8195414dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bf8d1195414dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe
6128	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1032	AgentService.exe
Token: 33	696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	696	SearchIndexer.exe
Token: SeDebugPrivilege	4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4216	2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	6128	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2740	696	SearchIndexer.exe	98
PID 696 wrote to memory of 4812	696	SearchIndexer.exe	99
PID 696 wrote to memory of 5396	696	SearchIndexer.exe	101
PID 696 wrote to memory of 5620	696	SearchIndexer.exe	102
PID 696 wrote to memory of 2512	696	SearchIndexer.exe	106
PID 696 wrote to memory of 3264	696	SearchIndexer.exe	107
PID 696 wrote to memory of 4536	696	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3331f782e7363d06015897ca6487aae0_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4184

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4896

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 33348a1feb1451d7c8171bc560a9bbd40b532a94f8a4c0c1046e82fb05017b9b
MD5 8bb896e059458c5d85419e7a98a8c580
SHA1 db58b0d921f9a8fe8829f00f8d1427435978b518
SHA512 0c6ec7ab3fef2d1b1c231585e4622228bb0bb6cd094fe9c9d3f45e17779e08052c55411c710cef585fe253205affd067d2853ddee2e65bd5769f095f6bde8743
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPLNiXicJFFRGNzj3:O3q6mjB87wRGpj3
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 00adf18563f2d2edbea0cfb644cb0d4aa1a0302e056a46de4ca14524ae2904bf
MD5 b9141d3f9f64d3df66afb48b59564619
SHA1 2caa8b5be6ed918b6d38eaef109fd1d5d7ffa542
SHA512 1ae4f980ed9181c6bf800cbd0c19f176c8d9684865cc29d9cc023630009af70bcc3be543511aeab77bd8a35ed45d4f360d2c35d572c4c109f13b43b2a00a180f
SSDEEP 24576:+XYfDtczAY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dtcpLNiXicJFFRGNzj3
TLSH
T1EF75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3237ca0c441a63d91c994e608155f0e12b8f02637dd87fe6bffb2250691b1596
MD5 869d6a67545eeeb55c75f6d814d5a2a6
SHA1 08a31b5e0d423283ed870abd90adb2a83e4699e7
SHA512 0a84410bb247cf1af967c95ef5c3b7890547fd618f66a7fe7150e6305a5b422076548039e29ab39b29c953d1db4dd20e0994a43fa3a71faabd4911b0e48af63c
SSDEEP 24576:c0Le5ji0hmxhrMH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cPji0Az2LNiXicJFFRGNzj3
TLSH
T1E7859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 051309aaa57c22544024a133d3188d321fe5463ec1b6fd8c57f02293b36d5791
MD5 2989ea9b346b9e25d63434674faaaf48
SHA1 8bc393232c3c807de16f14a801be017ecc30d745
SHA512 3021e58bb6b4013b8dc66f119aec36ac8af57ec6d40fc5c0d7bf9e5c78ebf82a69b93df5753f94a04813ccc805531440f2ebd8a1de15015ceee59182782d4070
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWj6q8wyu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2/ezSC6vUzPv+HjyCLNiXicJFFRGNzj3
TLSH
T15A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 640a879ab78133bb61ff8bd502339277e02d1a7bc71a81763c4175848845b00c
MD5 4c258fcd6bfd125f519699bde5d65006
SHA1 d650167e4a8292f2dfaaa9c30e5d749550b5aabd
SHA512 8ebceeda42983858b1c63fc58ead1fca1ee7ea0b840a5f84f69e4de24ef3e0225419bd89dbce14030161b82268091f0151e226fc8b668837d3f7415203390522
SSDEEP 24576:qVbqPb88hv/l+BM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qVO88hXl+WLNiXicJFFRGNzj3
TLSH
T1F7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c59bfa675ed22ba30c5fe37fd279122d24629bb8926d61ae295fd634d058ab45
MD5 41c8ae94579f4369a4b95d6fb57f6025
SHA1 4f3702c375c6c3be03ded11927c8873fb41caaa7
SHA512 f4e8438416fdcba9f19c5567acef8c7405fa854699a5520fcd8a638d71ce856035d0a5f8138bd0836d32b793759940999e0080e2818c1eb5cdf4f1d7bf5ba94a
SSDEEP 24576:yGr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JLNiXicJFFRGNzj3
TLSH
T1525523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7f21e9a8dc00058aaceef5c799ec311d9ca1689e9fb31c222b4b98dc4c299efd
MD5 05af3e4a71f2f05ffc90c6da3e4e556f
SHA1 5e4b0bb992b42d5b120b80e3c5de06ca56d0fa41
SHA512 44d76cc6da9caa0186053e54cbcf12ab0b3b3f08443eed802946294690b643641ab4fbc454dd694f7efc4bff652b2742ac85377f3e3a83920bec747f825b7789
SSDEEP 24576:CJIUE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CJIUELNiXicJFFRGNzj3
TLSH
T11D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 25733e343d39bd4fdffda9079c7acc619f87d1f2db7846da3be7e7e9f6cf40a3
MD5 47845be97f4fbeaa0d6a77f5cc87bb5d
SHA1 ade89a87bbd28cd5f42cf1aae1c3b8fbf8aa1de7
SHA512 b42444ea9e1328afcf023200551128c4c880ec6378ac83fd911a3c4f521a106a6b9ddefaecfb9c0e91cf0a959cfb32ed96c0d64130be1958a5a149924fe7a801
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:dQvGAdlCEL8c/WRNw5CJ7wRGpj3
TLSH
T16E266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e1d28dbf46912d3f77c20b8045c9dbd10ed6e20e97fc1818cc3dcbd2c94761fc
MD5 5ac382099e34c19087c60c9b8f6a94d8
SHA1 35984ab80bc4fab9ac107006fa712e0fcfd34ef5
SHA512 5aeeab0ef73cda184c69afe8371f67f010f15e2a639d5e011524c169007445bb9db2c848675c177193c30cff9e89bc3baccd6a714449141c5cd17dadea7a22ff
SSDEEP 24576:cfewsAjG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ljGLNiXicJFFRGNzj3
TLSH
T12175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1ed41e02b6b122d3f98d30b021a5a9cf41b394c84f38b6c1d22ffa667c84702c
MD5 c358d66a5e47b440b9c630cb3c274627
SHA1 29ec6b6a6efbd55267f6a6db08bc91701a931980
SHA512 9bb3d838750348968d614d01dcbf538cfd49ffde3ee61ae07e459c8e5e82ac04b86f29f9cad9e3cd4cf343e7e2b40e933d6d5162262973006089a2180449ca60
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCF9:mUEtQevvqc2W1cpV20I32W9
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 86b5c8e4cb41596963a973a80335b7d9e0962538bc04994aecc780bf3a08e691
MD5 aa8ddb9d7808c35ff98f0cd9eed2f5b6
SHA1 9d4b38f64e078b7509f77c1d565ded9c5315b58a
SHA512 0835183e96f86f228ef827b9dd5b2eb18decbe9c2f4485c9a7ccd2aadf73fbdcc9173ab6acaefd1567332cc2052ccadd33a4de63d7c9c80cd11e5438647e439f
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zmLNiXicJFFRGNzj3:ioq2VjnmF7wRGpj3
TLSH
T1ECD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 349d2d6dede378aef16f1d3becf1612b561a0af87c357cfd9c04496469e6a3f0
MD5 730ba29aab15187d21c8c0803e22ce2f
SHA1 beb2f71e9860c71fa1291becd658093259ba8789
SHA512 5a8e31794905f950187071e53910a85cf4812e447fa8d833a7708c97d05f4d2441d0aabdf2b3507bb34408f8288c85cdba0fa0fb6d8773b8ae73fdaff042d1fd
SSDEEP 24576:kAhGL6IFoiwtA5l7S53l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kAM5Foiq5VLNiXicJFFRGNzj3
TLSH
T1D5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e5c9d4bb740e21fced93e3d21459beb1792e2dfe8fd77f0e46df1aace1469004
MD5 bba4b63499916fbb5aed952f67ec2124
SHA1 74dd7c39ce4d4ff3c0e2993e9eb69453a4a69abe
SHA512 4409f851bf20f74c24c2f7f8d6c290b603b99aec68abec6ff309f51e8485baac24c1bcce7ca3c1c57f57c8b7af2d650a04f1b91f7d935b67f6e1706381184ea9
SSDEEP 24576:xwuROWi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOxLNiXicJFFRGNzj3
TLSH
T12965F08632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8898e76206869d86d1888970915d5889419ae756cee001f7f5f9dee4da275bcb
MD5 c0e081e574e1c6036a08f62003b8b673
SHA1 a9369bd5782de2d82b9d11d0a5f31a0629dcbadc
SHA512 2066c218b62763d8a25b918feb3da184eba0c2443bedd84a64f7fe3af188ecfbffbfc4600dff38406920ef640e7f4e37b9589b80be05c8553b2d990129e963f9
SSDEEP 24576:aZuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HLNiXicJFFRGNzj3
TLSH
T18555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 97a03e404137968a3ca8ec431126598691758feeb17f69bda60dbdb7bda28a52
MD5 08a1b1135275ae22ed9ef5619d7abacf
SHA1 dd6e9275183805f4895dc4673bf34b530043e62f
SHA512 015c627680c4b888482415a1496a0c36cde217e8d1a4a0c1cfff016f17c9e84502339afbc430200191083c1fb4e4548353756aaa9285228e0be24cef8be3af14
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:9QyiKanX+PNcF9
TLSH
T10A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 72a9af42b9c6fd4bbc508c686ac0ad9d9768cd63d7c7a6024e03bc7f0034cf68
MD5 420739dff919fba80baac0400aaea296
SHA1 047618ef642557a1c5631153e4dfe7324424e33e
SHA512 835918c6e7f6f05a654bb856e9f5fb41ccd267c9741f3dc5b3fc3942fc67b0c7a62b75171ed78ad9dd11ad908e8ef2853980322471f069d944b07c5938283a1a
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:oQyiKanX+PNcF9
TLSH
T1C4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 468fc5fdf32de782b64ed7eafb2e1c74e145d796c4522d263d063ffb2dd8e1dd
MD5 9c19c0ee776cf8bf5b9dff6b199e8729
SHA1 36354e61cc28028c4013630169d4c09f9cec344a
SHA512 9164b0c3f46186bb1a3546acadfc9fd952e089a8e3471e0024bf6c161eb89e6a55b959a3ade6184875a8089f4bdee66fd739004d90784ff9472cb0e04ea1e12b
SSDEEP 49152:B68Qg55nhkeWu7PNU3/2LNiXicJFFRGNzj3:/thTRc/27wRGpj3
TLSH
T19BB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 25bde84c606241ff774bd96a43f92c67062a3c4f0bab77bf2358185ed2867b5e
MD5 3dbfc68bbc772a5e5bdd830725640ecf
SHA1 cf055e85d0892d6ee3ffd685b3bafc0b201e5123
SHA512 bba9ade5843efa999c7757a97420b0fbe118857120193841ead9a64e415f1b4cc7605957124ca3ed7b22c7bee7d862cfd067c8c4c14d3ade0801e4c3bbc990a8
SSDEEP 98304:Ky5112gYy5azzVvU69nLKnhZr7wRGpj3:zLIHRWhRF9
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 beffaca4e919c1215e0f7ddf4de2634f08635ee71ec9884bb2bdf77ed0a5abf9
MD5 35b554657f98d88177330b7acd5de9c0
SHA1 a3cc3882673dabf1585f00acbff59a2594037607
SHA512 323dd0fa1785a011578e03d641a7f4078dae8ae92d4e01943486794aeb9a1508bcb86efcac5ae1f83bd7b300af2fb99dd651286c707dd6543beca4e03dee1db1
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glILNiXicJFFRGNzj3:Vu6JmIxd2dI7wRGpj3
TLSH
T104D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 106b1fad9cdbc339dc84f3c6a42995a59e6140f11040380d31a52d81ba75638f
MD5 96cb8160630defdf2ba20d2f31589dea
SHA1 4712b8a7db4d6d8dd6c4a238682b705181aef3ea
SHA512 8b6d07027b11ce85aa993041e959966461d5857aec6ead0adb75cd04018bc494d96a29df5c1ca4c015d06c7f565a94c4738032ef0278cbd6ba22f1734c51214f
SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4xkLNiXicJFFRGNzj3:tmifPqRF7wRGpj3
TLSH
T1CEB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b19ba0e7e8c82cf54fbd05110d61a7811b31704b5b71b20d3a21ea562b34e884
MD5 fb7730b08ff6a198dd77b7689a751678
SHA1 f8f96a1c735d8d63891636afafa1398da0836bda
SHA512 9ead655e335cc3a4528e37e107bb1c2cc6abcff406d27e2e94cb482517f3ea31e1c7c92d89ea1fecc8bba9f86efe3e2601d67561132729d3ab68600fb334f031
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqfLNiXicJFFRGNzj3:O5dKqi61f7wRGpj3
TLSH
T1B0C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fd0efa0c697b54edde1ab028f49e443260035b52a3a46b3f5422424d1cf5a76d
MD5 0b1a8d2f8f8474bb6bb5fd1e83898c4f
SHA1 52990923468eae79984fba2dc40ff453e6bc20d5
SHA512 fc89c984469157d08837c3d999464e95113ead39bd1850397cc66ddf45ecd0367de746b2030d532f37c5d1158d2a75368316c6492c4634e7df62d0eec1d9d417
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wYLNiXicJFFRGNzj3:bX2iWphR7wRGpj3
TLSH
T1B895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 299f625edd7d9703ce33c1ded5907a4ff4b7035cc37222b685f80b8d3cabfc4c
MD5 2de002cecd432c331f3e74dfdf0115e1
SHA1 226d44582ccc0023d9ec3fbb05fcd01d42a04adb
SHA512 d6d67ac922638a54212a1ad268ea1d9e2400f8ba8014ad4d5bbf87282ca3824b49396a0ee5302e3b30292269210d0768382922cd8734b861c244e2b617ee1d60
SSDEEP 12288:jXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6687478f9b11b3581011ad91863edb4e8731cda9b0f90d461aeed5edc3c3e01c
MD5 6495fdda38e85e547ec7d4ad3c12efaf
SHA1 5db9d13f28115d7bd848a6500f4119b05fca1faa
SHA512 b8665fa5c718c83e5efe22d778b3bf33dd16eb3ba32892e33f86fd64498b3472a0407c4fff0cbe6f08078dcb9c4111188da726535b9764c9d2ea61bc3dd3c4a0
SSDEEP 12288:p4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523D3548945B1FAFC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0c2d98a6f48b0669c6bce61415d288036952f94862ab73603bc87d78094c51b2
MD5 f47749ab729298e8510c8f8cfa4fc50e
SHA1 8a8a33ae1dc1bb247e041381d04776238786e3fa
SHA512 f38bdf955a6886a074e4ed1a28a51c392cadc57e3f25e525dad1a0f5d14cbef87d31305414e27d4c76fbe295cfa555a65229ee0b86b42e83f4c1d15d978b7c79
SSDEEP 12288:/aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D65523D3558955B1FAFC003986764428F5881E1DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 aa6c1e51207fcc4e8e1694e086a768cb940264da261e6d67e6405ef6bd215fe1
MD5 0fca7034e7a3e7f95b3832e66ddabce3
SHA1 0b6241002574b7b27ec5bfead6e906fa31a836d9
SHA512 dc0d0ff892aaaf4b549dbd67b609c09761fa4ba7723769ce9dc68a3ac04bce72cd2823bde930984b83c9998a2efa5a6d0aaf88d37ef8f3f0d77b02d9ae9fad8f
SSDEEP 12288:vVZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D552393168901E1E9F9803DCA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 713085b5a78c3f7d4bfaef1738c392a11837a7af4c0da99c1cf50a818e6ed6e8
MD5 6a498b65634c2ba529f760e4f0f7a881
SHA1 db02a962f3e79c81dd377e906d0d901878c8293d
SHA512 9a5fb76b7d4a3732b5b8bdf3564b624770d04f60557ec6629c3c3e7f60c97b985b2448567cbc47d42625adfcbbd604a7917ccb0c8e350ebef6c6af05cd1e3b0d
SSDEEP 12288:MhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3558955B1FAFC003986764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 183b59f0ec1285d2089728fe85a5405e55f000d1b506c8c1832a4e5701049762
MD5 0cadf85b738446d4c06c7f1300fc5534
SHA1 1dc10111e8199486bb49d314d642f2a8a3369210
SHA512 b5b287318bdac2cdbed6fe5eb2ba9d4439de7aa0d244cd793978a7c827986c0a5a80b476b4fea6b6256bc46b112f64bd9aaf704dc4f50efb68b92905373b8801
SSDEEP 12288:wUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D3558945B1FAFD003986754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6e1765e0b54599121fca27d1106df06376df7deedbc65a425ab1cc4b8b2d9339
MD5 c0694961e2163d43fb89f20db6eb841e
SHA1 fbcbaa42901c419763d2f525f4c2294983876f47
SHA512 256282f3346e43b495246b1a3609bca40ef9fd674af76ac97935758327bfb85a3a1be3a23cce495b7464510075ec24038a5f84f027760302065d92e4e8e4d206
SSDEEP 12288:sAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D3548945B1FABD003986354428F5882E2DEB5659E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 58f98ce223248f2198ef0f99c08978d7723c56ab4a416f4f04225672d7a91fea
MD5 3eab289df0cb9906be1f2c7efe12f7c6
SHA1 26f9f42a7eeb542e4120a8d8da7e13c71bd9b286
SHA512 ea451275565976fa4010ec831c419c2eda37bfb3e1aaa07a65d621adaca31e3ec87dfb454ce52861a28b43b7e011fe3c9d28b3f1cab2a14a740a27dad92d5c26
SSDEEP 24576:jZM3zFVSOq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jZM3zfOLNiXicJFFRGNzj3
TLSH
T1E6750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9c0ffa828816b615307be6ed7efb86339f3f1193de19d746032ffaee092ef52d
MD5 729812519ac834659acd81d38c9b9931
SHA1 04e6c772ae06e7396f4118d77cc83a0e59ff6199
SHA512 1866edbf937403f560dc69a3ffd9ca6ee6c77df4ff5d5e1cbd7a625155fb121f36a1a1b76a74afc9f32f9baed92f9d6df453b63471e0f3a878c72f40e2bde9c9
SSDEEP 12288:c7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 09c5ab432237d634663b58403a6dfe44b972a471672ea94766a1ba74a3815d9d
MD5 b6cca63a4f54f6b5c3978c2a35b6bad1
SHA1 91cbb6b393f7403cabdb4100a060e96729df7d67
SHA512 bb81999daff937ed348547072f34d1616bc1bfc12aa1a42eaf1d5ba6ee8ed3351446f99afcef493dab8df2fa179288cd9ba7d6572f2c465c71e3370ffb6c403d
SSDEEP 12288:KPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548945B1FABC003D86754428F5886E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a0a3cd6eb8b60bcac3f159082614868e9966433b4a394c627de2c401c7b9732d
MD5 ff18afedf74fe10f180d384277adb640
SHA1 1671035673254ba86c80233a0bcd1492f00cb717
SHA512 1f6b3b9553a75a090fef22a6b6a891e1bbbf52f96a07149e138581d7da8540a80019afcada1e9248b3f16fb879dfe874cf008331e6bf134466c1f3b91442f5ea
SSDEEP 24576:fzyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fRLNiXicJFFRGNzj3
TLSH
T17D650147629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d48a687e4b82546fe01c8bb1246de43ce354b1166c4e070717028c582afc6b71
MD5 cb03afb18ef7e8f1ead9f87c35563710
SHA1 d0abd17266c0fb008a102a6afe239f4d7042317a
SHA512 1bf87b482079be3624026c1202bfc0e159f7e31388541627e5b67b1e3c5037b7ccf59c8d2b3b57c92f2b91dcee58382e2408fc8b78a8ccfb60cce9bfd0d12083
SSDEEP 12288:P7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a9446f0e57efa4bf475b9d643258b119e9e4f2c4c7ef0fc0705caa43ec92c4fb
MD5 a4415d06c665332e665f0d3c08fdac9b
SHA1 9bb8c8c046fb93e82758b292e688795524be44d8
SHA512 98b0b7add0c35dd60a8dc1f6fbf2a06ddff811906692bc8b4ccff331484def87ae2b40b1958b84d0e672d89d8139a5670d8af2292bf05a23eb82c1c907e04a9f
SSDEEP 12288:/7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 efdd7ac9dccecacafaff378fda5642b0299ff94ceadc4eb319c9e86d95dc38a8
MD5 376894e8b9864d5a257dc34a0e5988e1
SHA1 ab583f8f4168fafa82d3526be4e4df8dabe88e57
SHA512 ea902e5c817c3367e13f1a8665890c0b969db250474fb72a3309ce28925de483240b821137f2c6153f4c5cf6c3b42b93ea3457b221ab2fe78e7101803e68fd61
SSDEEP 24576:jzyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jRLNiXicJFFRGNzj3
TLSH
T122650147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 25b7e2716ace35bf3c5bc124d7147f06699aa3c2decaf085a19d70ed1fbe5520
MD5 7a3c8aa2b684822a8b33b116387be211
SHA1 a0f40509b3f769d4f64b152f0fec8f5bfe76579d
SHA512 9b1b3b734fe44fdd20eace0b5bbe8efdf1fdeea10f3b99a84b59b6d51b14c02e8e63d1852ae4ad92a72bdf8947ccfeb1fcb2ecbc066c6d5851984ce1ceea01a2
SSDEEP 24576:pT8aLl3z0zDs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pT7Llj5LNiXicJFFRGNzj3
TLSH
T1587502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3e1313c0767a4865e586b32571c0be60484ac8200e07fdbb712036f8fda567eb
MD5 7500b22747f1f693ff105b8050c0e618
SHA1 daf4cf930e39370465e788bc06ddb85d6b89f6bb
SHA512 b7e822953cea7b93cfc3e222a95f9063d05088581da716666609013c44fdd125aac1df9ffc82cf9bf4624578ed17d971fa4f4cddb9fffbf549c2ef9b80255b3f
SSDEEP 24576:D3rd9CHKy7GZw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jrd9CHKyaOLNiXicJFFRGNzj3
TLSH
T1CF85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 69671396848356b56d657f0632fa8fbc6ab060dfd30841583503a9066cac36f3
MD5 cb53f9d3b0d39d88aac1d63d98675069
SHA1 8c2fb367eec869d215a68d001519fe9fefcbc47e
SHA512 017f044a75f52bcfb9d070065a8b2b316b53dec78821e5b39450dc6005854ba15e5bb01ed1083437c3d398d94bbd49ba26f144b8e0d4d9367746d8b675738d1e
SSDEEP 12288:J6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f7e339a259765a1d04c21f6cc5ab27a52a1803ab98afc37275d611a6ac3282bb
MD5 1c9955d9f5b177e6a51d970daa758c02
SHA1 ad28087fb871f5872744471c28ac600d9c98fea2
SHA512 37e637f7d9ffaa08886d54ccef682de7b3fb601ed69e8548318a70f250294478f518277e9d87ecf0699a9480a65a809a1770a9e546fd290fe13518b5dbf312fa
SSDEEP 12288:zMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 80d5d77697ad459eed3b9ba85dcf77571ccca557b7eb462c763c6749528b3f4c
MD5 01a2afc4fee6d8ebfd08cdd7655ec997
SHA1 d06bdb77c96cf392d6f2275841a3becd77eabbe6
SHA512 72492b1da327e5514d4e215f149d3af91a65940845ef1a8ad483505a60967d748ce321b6448cec1c6f92ffdd12c239b567f028d66ce4b91954d995908966b0cb
SSDEEP 12288:d9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D3548955B1FAFC003D86764428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 30c8c6c3ac54387cc992044cfe0240910ed4b12904ba94f44c2d216e9a47533e
MD5 b7346176a1b7a64f2a9cfe25950de38c
SHA1 5cb2a489555e9ed2bb30efd2324e58a784f10743
SHA512 64d4e46a76363e162877048d75bd5b91bde0f52b47641fc2da5f3d960e901c95a06833fe2e94a418114aff8b3634187e10f81b7a8c6d07771712dd24b6f6bbef
SSDEEP 12288:s7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D45523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 68bb5bbd1595072707e5d154942926038b8d560cb8bf56ea64ab31cf53a8c337
MD5 35d3f90be1585bc0666a3d6695f2e27f
SHA1 048fbd27282ea56f526eabcd36cf2858af3759d5
SHA512 ea0b87f7ff3a293fcd7e8b0b094db51858a62d2a14687b3026d08964897c47038e6a51347c89d36f5fa09df027c10b17e7fa96a56ba94c40cc08ec769c0afd03
SSDEEP 12288:o6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bd5049dec75aaa21b98f04357a59874e84415e0c1a3e55c46ad83dd21ccf60d2
MD5 e727c717f57f3794b965423b07ee117f
SHA1 43afc179cf2775808951297a08f844e0282c5b81
SHA512 39b59954b3f670871f78303b1746e10844c146f2c01881167f96f4b0d714c2c957861adbdeb1fb9d5e7b1d12ce96ccce9fd517aabea38becf08d068f0895a819
SSDEEP 12288:NDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3548945B1EAFC0039C6764428F5882E2DEB5659E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6c66202cdf4231ae01855a6305fcf714d75c651c84a1acc2fd6e3b1f72638443
MD5 c9adbc176f5e8d6ac4a9bc633ef0d51c
SHA1 a588070b462fd80e4e804927c1433364ccf2ca95
SHA512 ea16651990c5496476d18e0cb0a0b21c218e6f3975e11967626421500364e0e7b94dbdbb71b91210af2b587a21c9bca49dbcd51144bd78ea97cfa7a3cf627789
SSDEEP 12288:ZhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1015523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6146278d83530a6f6d3d7e90c83481526c5249747722b313d9c1f708021a13ad
MD5 d861ee6e6c478de2b3e890ba4111859c
SHA1 5e5a035716f0c841d07329217f41be75a05c3d6f
SHA512 5cf02be4a1b284b78b4dec901cc41fcf20cc518503be60456c644f5e54e425d7bd551d4598aca9cedd531a0c06656c648a40a986aac887dc8418b0b09e03c02e
SSDEEP 24576:hfwvzk9RX6wkyAIL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AMnYILLNiXicJFFRGNzj3
TLSH
T13985DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d1f342800a0271601100f106bbe03cf5d336961f07962a8b2b244c5cce548083
MD5 9c8950de7ca8292e2ee6770f09029cfa
SHA1 188f4241d3f4a09c183ad8b4ae9d4325204c6f62
SHA512 51ef3dba3bf47cfb19a74a4f84f6defed5c1055695912cb405c31d79df36ffa600192c71c106ec1625d37b4ee27c35b161c6d1fc0affd631f767592f984e790c
SSDEEP 49152:MYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04LNiXicJFFRGN:DySzPw7wRGpj3
TLSH
T126066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 839e9475ae1badbe3eb385c27cc76eea22455183bfe9ce64980f06f7d9690640
MD5 353e7e54966cae0adc28a490973f723a
SHA1 929251b7b516f934a8db60229acb401c320e0dea
SHA512 0c762f0e9903dbdb460c84eccf91c3dfc75b1940534a06706cecbc890c05ee42ae3d742ad60f020d8ec24c7cb1d031d52425667811d241e788a99f404387b948
SSDEEP 24576:Z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z47JUQjqirIhCnDHUPfF/ILNiXicJFFS
TLSH
T10F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5e694b4a1446120bd210dff296eab6b2ebdd2f46e4de40bc1b2ede670dd27820
MD5 9de5d1d8b14576a443fe12a049b72869
SHA1 0ae5516283a1f9a73793c8a66b2f16e061e788cf
SHA512 73456b9b94657f95ffb1074bca92eaf38bd2706cac634a84c779b8b5bcf092894c83dcc3c992e75b37d828ee7bf83f493802f166a8d58838051df4c1ce062942
SSDEEP 12288:epsfLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 894bc4cbc698418590e012a32eb582fe171ca3fb8fc7cc046cb4cae139008835
MD5 56d41e13a0f1e4c4582e5412b584fdce
SHA1 4d5258b9c43431c0ffe571dd1c896b41455c9678
SHA512 a05758d8ca470ab46b6990c1f6fab015a0d797834a9fbfeeafc7c1fa96b34ea94a8dd7d9c28efd980e82b6e4a7ef3974c5a7a03d9f7a846684ec1d76035166e3
SSDEEP 12288:rik9U3fpyOfcbfMYn42QJ6Wv/u1b9fcsZh2WTkRoPu0OsqWJr:rikUPrfcVn42I68u1b9fcsZERRIDlqQ
TLSH
T1C83528407666C74FC66D80321E32D5CCAB707C11EE44AF0773C99B3F95B6659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3a832178f8a5394da667bcd6032b2f5b215081ea31ff46dba85fd2cd9bf52b39
MD5 ab09359bbb42859cbeb13efea1f6fb57
SHA1 f98a7f95b1b5c62e919421915bfd87d49cdacbc7
SHA512 6e9acaa8e2ede037eb92a6b02088175c631662f338280c985be8d253b969b0b538894d9dc2bb67721ab70abe66e0b7bccbb0b17071074284126a3aef4e9f384a
SSDEEP 6144:ITttzArLGted0kNZZ7HKLV/vllTUKFhdBTFpFqysodGYsR+qrSjzTJb6D9tMxwDu:uQqLNvllTUKD5qSuNuC4
TLSH
T1D665FA415137D28FC1BB6032032A5B4C7BB4EC17B7496F26B7D8453AD86AB15A1FA3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dc1f87fd9f347f9348ef52a34552c20e459371d7a6faf814715d0d00b751735e
MD5 495e2de37e19acb2d7538df7a696eb30
SHA1 95d6eb21dc80755a1299cf39ffe3a98b03dfdd91
SHA512 e967595a58058753d8fb3d93a27df1551df217eabf7d5bb5a2b9aee58f8de72209f722d5c267cf2b5990ad090fe645e09cd0ce27143987b6b0642a8b44a2412c
SSDEEP 12288:XF7TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T117552393468C59B1FAFD1039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a8644c4b44a1fcd7bf63fc175585785260829ddf2134a78d59f77569c40447ba
MD5 78d34d729dbaae8cf4dd78789ad9cec2
SHA1 a9c3d68ac3a362f7c2ded8e0549974681a944aaa
SHA512 2a2529e4e89d16f978a8ee4f6ad8d0ae24405579f05e5547ec17d55ab02a017d0dee1677424f2e41f91aef7473ff74fa3fcfd850ac5004fded8554345a9b01a7
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Bgb4mBIBhGF6LNiXicJFFRGNzj3
TLSH
T1D365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 131494044a528d7769193ab56d0eb700da68bad56cd5bcf564b4a330a4d63879
MD5 f7b4b46c888667f12648684c260ea2c0
SHA1 ad96a5d4cec86955fdf34db1bf7cf29c0e2d3e24
SHA512 88f386c5292e40cd1c5a9da5bcc2924629a46f47dcbfb55e101571c32141004c586825c4491560cdfdb0f6859482b73139756e14c91ca18cacc9b12b4e52bfe7
SSDEEP 24576:qG88u8FpJqH1vzria7/mq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R7ZFPqVya7/BLNiXicJFFRGNzj3
TLSH
T1D085F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e07ce786adfd3202681e9fc79828abe817423cc416ffab387e36f520f4b085de
MD5 ebb4fa440e08a3aaf875b3f713e371d0
SHA1 eafc552ec5d5ab1c5daf7b9f381b7b9595e3abbb
SHA512 943fa01ffac5f77dfecf6e6f03f4e47cddaecb6bc515eae84a3dc1b5cc9759fdc1134072feb861728a41499dc21a2c865dd92bcf181b3bd6352c94ec60b466e9
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+LNiXicJFFRGNzj3:8G05lO43bz7wRGpj3
TLSH
T1F0D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0b5dad15c9a8ccef790ce5da96b9f78aad28236cabb67d11682591789f84499
MD5 1f787e86fddde005aa14c0311b43c3e6
SHA1 56672f9ab206ac82b8c61d6dd00b9a0fb4d5d55a
SHA512 f379f5cae5a607ed40da1398450971353be51f1114172cb05c17ec9bfa6b21395d3344ae74a78b89987876b900446caa9eaaef15b63a1710fc832045eff33dc2
SSDEEP 24576:Cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ka5POZ3lJt2pasx2+m2LNiXicJFFRGNf
TLSH
T15065BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dfb69a40a37cd3da6cddd7cbf1f0452e91f766c1ee1b90d021b02ffc16606819
MD5 d5c6e606f50cd0e0dfe8c6e70f373989
SHA1 4cc2f455cf289bb2018dfd11b66fb7795fe04474
SHA512 a622aeae6bcfa750584e43ee8d70c0fc56190c340d0bfb2e3b7ca5ae8fe5f644c800fa7e3154ce14ab873c6bc642b1ad3c9ba1e484e11300e35a7284b2d74e68
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WNc/zEOVHFhLNiXicJFFRGNzj3
TLSH
T164858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6ad3dce381de091b86db008c5bbcf72714f394f17db017f67643072fc1f7580
MD5 988bdecc9c354de672ae2a796f57f801
SHA1 50f0624a8bda92b7e1a5ceb9999777209a4f1f7e
SHA512 0f90b428fb328ad4e48118def21fdd5a8d75cc52422942f71ea9cf5c9817703a233f10d6cfdcd82038a1430f6a3aa15ae6cec9fb6333e3d2b327ceb1db6534e7
SSDEEP 24576:izkNvNnaFeYhJNtmZBmU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:izMwBtOmULNiXicJFFRGNzj3
TLSH
T10E55AF6EB6E846E4D1FEC675CD238512E6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c85a275b168d9051c59307197ea9b5e4fa399d4f099096dc968155e8d81755c0
MD5 3234496de79e9e679ea96e38027b62b8
SHA1 15286908ab3d74ec05057de927f47875bf88a385
SHA512 351ddbd30940a82061bde496d83447f805a98f2a800b64ed4434b4738af543db4fd0efcfa4a1884c40b0bd4dcae248a0eccbfd990e1e21424b99d03ed742c2de
SSDEEP 24576:zPUr+NQO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJQOLNiXicJFFRGNzj3
TLSH
T15A65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 edda16598e177c6d240db16f269e2b634a7a525de39d0647e14cd8016ec77016
MD5 a8f34ab1e0848d7f49f01c092a677362
SHA1 1f49252a6a98262743260e8eabc74d7261284e81
SHA512 4ab0819f072abbebb2d25b2cc927441f90fbaac7b8200c7e0c4f7e74bb6ad3d6523543347bb514ebbcac7465ecf1fc94db28dd1e09998679789ce9a078f50406
SSDEEP 24576:bD3FHshBIYQgAD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bDVHeBIAADLNiXicJFFRGNzj3
TLSH
T13B75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/696-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/696-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/696-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1032-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1032-128-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1032-134-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1032-136-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1032-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1880-284-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1880-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1880-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1880-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2108-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2108-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2108-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2548-299-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2548-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2548-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2548-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3236-40-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3236-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3236-47-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3236-50-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3236-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3788-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3788-79-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/3788-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3788-84-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/4184-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4184-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4184-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4184-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4184-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4216-77-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4216-1-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/4216-8-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/4896-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4896-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4896-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4896-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4896-313-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4896-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5700-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5700-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5700-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5700-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6128-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6128-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6128-20-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6128-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6128-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download