ad8ef078e484f6b671441cb86dd027ec90cfa32d36be212320be1cc2cd200573

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260719-vs2sgafw8l
SHA256 ad8ef078e484f6b671441cb86dd027ec90cfa32d36be212320be1cc2cd200573
MD5 1d6fa01f21598aeccb82f4cde492dcff
SHA1 9bec2710818da9f8288296a4e4656c9e6645d5b0
SHA512 b3622cdb009b5a5de761efb6535eba00ab1ddeb6442cfba0f5add2b0527dd2d12201602589389d2571d658bf128bef2ab88d4fd9ae3048bafebd28249e1b0e14
SSDEEP 12288:OUYJ9bid7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:/YJ9bQSBFW8AimYfStN0zsmw/PC5L
TLSH
T14D551231B5C184B2DFB7453209E4C6B1A67DFD329B6489CF63942BAA5E301D09938B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3520	elevation_service.exe
2108	elevation_service.exe
2276	maintenanceservice.exe
2768	OSE.EXE
720	PerceptionSimulationService.exe
240	perfhost.exe
1928	ReFsDedupSvc.exe
1752	SensorDataService.exe
5444	ssh-agent.exe
5188	AgentService.exe
2224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f836bc74238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007915f152a217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000042b1db51a217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c19ce90a217dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df89b4fa217dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086712551a217dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000214faa51a217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047ebc753a217dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000510f7d51a217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e08ea351a217dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a78b1e91a217dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8b8d751a217dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	1928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5188	AgentService.exe
Token: 33	2224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2224	SearchIndexer.exe
Token: SeDebugPrivilege	4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4100	2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3520	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 5892	2224	SearchIndexer.exe	100
PID 2224 wrote to memory of 3580	2224	SearchIndexer.exe	101
PID 2224 wrote to memory of 4912	2224	SearchIndexer.exe	102
PID 2224 wrote to memory of 2704	2224	SearchIndexer.exe	103
PID 2224 wrote to memory of 2020	2224	SearchIndexer.exe	105
PID 2224 wrote to memory of 4880	2224	SearchIndexer.exe	106
PID 2224 wrote to memory of 3536	2224	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d6fa01f21598aeccb82f4cde492dcff_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 2788 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 2788 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9dc67d20c420f5f72b0e7ed4292adf428e033e916489dd28b486668707595d49
MD5 9691d2fc01976b4bc211e7dc02dda39e
SHA1 b8fd5696fdecb9c51e1e7b49e4ada3999d649394
SHA512 8a145785acdc3dea38ffba3ba59145692619ee465014a1d7e84267458db3a74ad58a0db1fcbfe4d7da06a81c1f1b00a9d7307cd831170e6d18e722697a3c36ac
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTSBFWBiXwCzkg:W3q6HjB3FWBig5
TLSH
T160D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 85dd80483754a898bd170e9ffd6ca474bb2ee71bf1f2d7add7cff094d374c952
MD5 a8bb846d850bb7fc78ec90a73c306c4a
SHA1 e371d11671279eb1d5774b53c7c54a63af865161
SHA512 fc83c9d5bd92ac70abadfa23d88c431fd61c4019be1487354404576a2831c04c8833599cbb56c5c66f6f61d56cda02cf940226d10b43b493f604b54a9804913c
SSDEEP 24576:PXYfDtczA6SBFW8AimYfStN0zsmw/PC5L:6tcVSBFWBiXwCzkg
TLSH
T189650128B7D508F8ED6B823DC9A1C411F773785683A0E78B03E49A651F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 69faff88e955189775e54f655f162972d6353e0011a1e7b211948a2ade1ea0c8
MD5 fd9571adde3fd7ceb24b6c2c72c3c333
SHA1 8cd141eaef488a5be1742158ca783306a35172fb
SHA512 97f099b4a4322d152e9b6bd2216e365c65d6c6ed602ce9e6616ccf99a633a770a420b2e518c673de62917dc048b2319da61c452a52f09e20674fcfd1d55cb584
SSDEEP 24576:I0Le5ji0hmxirMLSBFW8AimYfStN0zsmw/PC5L:IPji0AcYSBFWBiXwCzkg
TLSH
T19685AE16F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ffb70b31f1a1ea3db2cb458eb13e2f5f6a02d0e5b3116fc34308ffcd45496d8c
MD5 8cd36ce4835c79488d1e8a92167a23ef
SHA1 7141927f7e7e408244b7671ceac67f195185c5ac
SHA512 9c49356958cc750e5ae88da2423c50485267199432a3c3a4c57fe6a22bd9f3ac78091fc920247e76d05ece82a710a84c33afac02a6f69838a0794319dc60dea3
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyulSBFW8AimYfStN0zsmw/PC5L:i/ezSC6vUzPvxHjycSBFWBiXwCzkg
TLSH
T17B755C25F5788323D0B3D0BAC5D6AA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 12c13699b311278a36b5e4e231f2dcbe343e6a6b6a3559a9b6b55cfea8eeabdc
MD5 e524c49f74e9787cf71eb6b41b036493
SHA1 6f3da79dfbc01fdaa062f280b158d8c18849f141
SHA512 187f47d450ad53ac533aab75351444dc4284f2d624b21f11499941b9f7080233292793bcb91b367f41e78e63e4ce732fc03715856683dd63e7358eea46b4de29
SSDEEP 24576:1VbqPb88hv/l+6GSBFW8AimYfStN0zsmw/PC5L:1VO88hXl+vSBFWBiXwCzkg
TLSH
T11D55AE66F5B48331D073C0BAC4D29A9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8b7465045be6ec5eedb4f02cb62bf2ecc818706c6b07d9668badeaa6443ef8fd
MD5 9a2155c89826bc9dcdd91d2d6e483ca6
SHA1 69e85426db93a891cb609749445546e96c4c4db8
SHA512 46d01d73e5165908503fe24c1849a6cb2bd68449b57ee547f0ac53847948a073b7b27c6bcfcd93dcdfb869de5881e1c232a3561b410d29f8fdd0b5a035765897
SSDEEP 12288:wRp7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:wRXSBFW8AimYfStN0zsmw/PC5L
TLSH
T103452311EDCA15A0DFABD3374684C8C8B3BB5E3AD1D8C14A91C53F98497C8FBA564B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 39c8d28ef9bdcb4981666d907da74cfb6648a4a39ab8c0bee4a5dda21cc46752
MD5 be8ab2445120b9d46d02f3f89f2bd23b
SHA1 c21ed89dd63a9079ba53d2492b26f14aa018913d
SHA512 3143cffe636756d0c1fa977adc846d4f2f3d549e92bccef5572ef9c582ad6feaae929981df21365811b074b104dd40c8b707cdc750c8f894973ae5e509ef8054
SSDEEP 12288:BeBNUbTVO86U+7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:BJIU+SBFW8AimYfStN0zsmw/PC5L
TLSH
T10165CF3BEE28FCD2C67E8D795A91C640E77278308B6193CBD165830E9E235E11E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3ed4487773dd4f11c6f9601be2a95d9f5be7104848bd186d48f51e0a4dab92f6
MD5 700518f331fb3f1432148db88ecc86a7
SHA1 a4ca3ed85da414a226f57935eed4c97775f6ac6a
SHA512 a487b0e154b7131de1027b7b52a3cbe8b3de54dd65935a27598fa8becf3068dd174a31c97477b9da8f5bf3327ec3d9577346595e73cce444ec7887513d8e498e
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:GQvGAdlCEL8c/yRNw5CqFWBig5
TLSH
T12A267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c19119df3879a07ae177a08a023b6f43b1203a0f0bf4285ecf6b45232f4c4a42
MD5 1626dcd4569b72cfb7b01423980247c8
SHA1 8ab29878ff2284ed0bb2c8591d1e0d2ce8857c92
SHA512 84b354d72dd3412d4daf642671719ac99764ca2bfe5e5a857a71d4595bea4f15d83854caa20f52766d6711fb3b4836a68573c3f604aab886e3cea03b446fd33f
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAjQ7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0z3:AdewsAjoSBFW8AimYfStN0zsmw/PC5L
TLSH
T1FF75E031FEB5E036C7BF0DB61B25C716247D7A204BA11AC3E3E84E9D59341D22376A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 750cf53e90a887809367fd7a45d889cea7691b3b0c331ee7d5e1e5a7a1c915af
MD5 81a0d9b15c87dc6ca174f412f9168d1d
SHA1 af8dd119098b88764bfd3cb40ad0a439a1b81a0b
SHA512 e161cd09fb9b1dc295a7f34a4328221df126941ccf292d903e96610501567e3f9dd515609a9e448bde7fb3c1610cb04ef92573b94e124842f2e03aa2b73d3822
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1FU75:WUEtQevvqc2W1cpV2EI321K5
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 782aa1e1c154ebb8b40a20081b4c9c7df217ad2b4da7065d8cd0e244b9d6c900
MD5 19af7be0f9f962c5749659636e2670aa
SHA1 c3dbd7d8dac3aca49a13e888111293cc0e3de684
SHA512 e3cd974c075dcf09ebed75df6790b50fb72cd7062c760825c749e8619e35507aadf287c89e1b8593ad0f64336a1c0703fbc208ccb27c90f5e6064edab6054630
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zISBFWBiXwCzkg:roqtVjnmOFWBig5
TLSH
T12CD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 de93f702848245f5bc1210a512d044cddc7a7c1e874c1c50d70a095a3bb3906f
MD5 d4057e795bb7591c79bdde0a5e8a427d
SHA1 9c1cfcbc993ae7e236f64ad7e528ec4670c9ee61
SHA512 3b93001ed60a0e8fbd48243ca78639c9e43b20aaeef51d3466ccee9e3cff08b627f0373e09f3e0f6adb83d40c7a544ea4c31d20de620344b714c8532462d469e
SSDEEP 24576:SAhGLJIFoiwtA5l7S53pSBFW8AimYfStN0zsmw/PC5L:SAMyFoiq5ZSBFWBiXwCzkg
TLSH
T183359D81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1cc94cafcf938c93e82a3aa467dbe198e342b1c62d98dfa8bd493cc86a49a393
MD5 798ba3c1630ab1236896c8d421a8f365
SHA1 43a1a30a35881a70fbe005cae3e12800cf2dac9c
SHA512 c260377eb799b134b5deadc9dfaaf27f35a268a5c023a2f8963d444bd4d6a8af01ce6117815d55cccef421974581fece83a0e181229ac3c5a0389686df4d7fb1
SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+Cn7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/Y:1wuoOW8SBFW8AimYfStN0zsmw/PC5L
TLSH
T18B65F14676E90CF9EAA782398587C136F7F3B8122665C70F13A0C65B5F372616D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef2e3b754b8832814a90ab80bce7784cad530286b2c321274efa0756c82fa8be
MD5 b5a76f5404db86a52791a4d7bfc0b121
SHA1 e777cd921d1f75b06581c6d6833a1283e4448e09
SHA512 f644d6a0b3d2f8124171de9441aba8a2f7a6a4565731df0544c8ca31ba15c9c9d9abb6c62549ea25f41e5412c0f0e99ecb432b9b127602d28a83be3976b1000f
SSDEEP 12288:PBZ1Iyg7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:ZZujSBFW8AimYfStN0zsmw/PC5L
TLSH
T10555125676D820F4D7A7933EC9E08585F3B27827A37583CF129407691F26AD62E38B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c1f768082202afadf03737c06739c0180507d9327d7dcade046438a24ebc416c
MD5 f3a3af220c7994a3971784e42e7aaf8a
SHA1 0839a98c2b1253fa981e62e841b5fe0c659500e2
SHA512 6936aee0ee0718ada915b0dd22bc21f176a8610ee89ac320d74d08e7c2cc73dc820f1b057cddcd464cb95045a51dcae6eb2dbf73c15cbd64c76fc9cc64d72c3c
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:gQRQyi36YOcPQLvw2gAf+PN3zFWBig5
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c1ff60b0deff370ec531c0b1da977be42803a5140c6ef8b83d32a9999ceb64ec
MD5 f99607829b4bb09d4ad66be49114f33c
SHA1 61f68a8fce3575437150b31281afff55c964d234
SHA512 3b534c868214f9fc6f8936dc299125485b01c2bc07ecff5fdb835d43efb73b280e697bf19b1e06c41c4112fd23443d00c4b7ec23407da834d8ee6973bc4c7977
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:yQRQyi36YOcPQLvw2gAf+PN3zFWBig5
TLSH
T19B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 422d717d1c18f364cae609a2ecb86dc75df62ffaa9d4b2cdf127ddc95842d02e
MD5 5eb7fda9d6654ff9b23d690b3cd94f41
SHA1 1e9764a6f91c9142e57b661837467e381d46bb5f
SHA512 f39a4902b1cda7ea3e2b5cde1f114bfd788ceaaea2017d6a5b53b8345de2080aad6dd6825e1493c195e549ced04fe4c8c67ad67675e130347699456958916dfb
SSDEEP 49152:w68Qg55nhheWu7PNU3/YSBFWBiXwCzkg:qthWRc/9FWBig5
TLSH
T166B54A33B2F600A9C44DE1769F4A872196D27C75CFE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bff3b6c153551bf6793f346893eb875ab621936d7d1aa9df3ce358474d13582e
MD5 50aee3feb4762a3cbdd1eafa07efd4d0
SHA1 a83d7986b18c8b3a26193c41ece12a8ffc567997
SHA512 1edbcc1122fd286475b2418b423b29169664f5598ccd8364ebde4eacfce6e1e17d5174576f9f71ffbf22de50046f74fecf833ca6ffb081f8813bd4377fa8a6f8
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:zy5112gYy5azzVvL69nLKnhZ4FWBig5
TLSH
T19D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff4574b0873e672768de2f107bb563571137577ab3cf04878f9132d59bc00029
MD5 87f204e80958ac46846d1649bdefeeca
SHA1 cd4a716880a09a8eb973fafd1399b3e4b28ab4af
SHA512 2b02689ec2a0ca8e8ab4b19211b4bdaba5939409f78c239cc2e828475365d17f4a8ff66f3f9e37c4e8f5a948d8a8f0ef1cc8472aa056a34a966178395d7d1a51
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqSBFWBiXwCzkg:Fu6JmVxd2drFWBig5
TLSH
T12BD59D13F1DA01E8D06ED179974A9232FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 82aefef8953343dcb91e80ede8ae76c9e65fd04d993ba4a566d609497ce4233b
MD5 1e57cbe2147e087a8b4ff042c8921819
SHA1 f476f8f9b5ab45412dfe0254ae0b2f9917f4f017
SHA512 4a678f4b2ea98602312b51807f032ca63356541229cc0ed5cf20a80e3b18a1355249c298330cc4c0253d28872946f2c4c30194ad3296f251a704d7911baf9a72
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xeSBFWBiXwCzkg:HmifPbROFWBig5
TLSH
T18DB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6eaec3c7916df1b0d2397a1c6ab1fb674d74c5bd818bb623bb0af4b740b056fe
MD5 e0e8da5dfb76e01f4e97f72002ad31aa
SHA1 60117096a55e59e63e253e6caeb0f9a5ff0ed805
SHA512 f35c512ade08d718a8137761fafc4f3fca2c5e5e9744cc9b457a1afd6cbdb7c9759a7e7bf32534e6b5a88c1077c4aeb3ae5e578f0fb2ba2de00894c6e93eaaa9
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqjSBFWBiXwCzkg:u5dKTi61UFWBig5
TLSH
T1ACC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ef9bdccc386a6458844605c4b6f22d0f13578c620cf6e0d3a344fea0880a8b5
MD5 844ed10f742355f5381499d154db0ba2
SHA1 264aca76a3bb4870ffe3bb1d4caa795a1543a8be
SHA512 03798c01a3a501562537147ff13abc3cee5972bf35f73b65036b81a0d91d4059dcf6ffb29b9841cbf2cdc8ebf90cd080b9c551c8f72458a58a4d3119401020cd
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5w6SBFWBiXwCzkg:oX2iyphyFWBig5
TLSH
T1D495BE13F2D900E8D05ED179C7468632EA62BC160B38A6DF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 aab086990fc72940d303c8a06b1f1f7e2c298909291806e8f14aa1b7e7d64a7f
MD5 a5afb4a1e59c4dbe560dfc97ec951bff
SHA1 3c7d730e50d7857a31b2fbce033b04f419a10472
SHA512 c0dc2acc42a912b7238fb335ac5c8d668fa7c4cf9d8658b70d7540a7d4842ab1f5f9570b9412a846a3eaa4e9c0f67b6e33138248f24dcd8b6fb44e2e9f892924
SSDEEP 12288:HB7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:HvSBFW8AimYfStN0zsmw/PC5L
TLSH
T116452311FCCF06A4DF5BD3378684C4C8B37F5E3BE2D5814AA1C92A145A698FB2564FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 014505653dc121d8d0c439cefe879da6885bb281fce619e3d6de7dc29cf73881
MD5 ea361bb2e50aced7c47b0979c6ec955e
SHA1 8af9f62c8b58bf07c20ba9daf521ffda3875b2af
SHA512 cd73f37b35d71d07af98197a45b9577f0fca803543c342afc5344ce1fac2e6054ba19f134a746a05537c5156cea574037008120758a5054cea3e7a633cfa4eca
SSDEEP 12288:DE7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:DESBFW8AimYfStN0zsmw/PC5L
TLSH
T151452311FCCF06A4DF5BD3378684C4C8B37F5E3BE2D5814AA1C92A145A698FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f2713f420d448037078b76ef7a176dc4b4ee9d5f9d7b55c3b917dc63c596a808
MD5 65ed06ea549c9ce066a6d256e7f9c53f
SHA1 3caaa4acde2929d16dd9d35965f4d25c6068833a
SHA512 ede196ba665546f1f63e9a04db9e3df5ef6226dd8dc2ece4534c43ae6377bf510a3cf8aee5a5971f154b08794ddbfab8bff5fb949a586a8b1ae2f984e7459484
SSDEEP 12288:W27x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:W2SBFW8AimYfStN0zsmw/PC5L
TLSH
T1A5452311FCCF05A4DF5BD3378684C4C8B3BB5E3BE2D5814AA1C92A145A598FB2664FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 85c5640099fd271ac04983f7b0c2893dd911666616bb1bcd24a467d7b56b0b88
MD5 539693f54fad8d04d66b52915ce2f113
SHA1 4c4e70c9f4d6a7988285292926f6bbb0b86230dc
SHA512 d8650591e33d879f17f1b4a47e460f4c8acc90c0d72780b092029f1eead881821aab083d95c31c252cd48c3d90c574d1e5f1f4721f8f8df153140db9898f067d
SSDEEP 12288:QVT7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:eSBFW8AimYfStN0zsmw/PC5L
TLSH
T14B452311BEDE01D0DFA7D337C690C4D4F3BA7D2AE375828F92811A590E656EA2934F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 219ad15b3e33293218bf4987580c9b990f94e1c073e97dd88c61ca5341fdaaf4
MD5 52af42c51bb1b3f5487bb5a15c75d8ce
SHA1 492a7181f51d08d248048425e493627723d67558
SHA512 23b9fa995917aa1ee63514fa52db8fcb5e8036cf182087708c93a8100653d7d4e553ae09345afc30308aa6f50d86b117dc0eb25cf09b35b3b994e6b774026f0e
SSDEEP 12288:S77x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:SRSBFW8AimYfStN0zsmw/PC5L
TLSH
T171452311FCCF06A4DF5BD3378684C4C8B37F5E3BE2D5814AA1C92A145A598FB2664EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b646f47ce2bdc7ec53e67d213df26bc107f5eba2252648aead89d8a4b9d7960e
MD5 18b72b0bbdff0a4918a9d409307fd467
SHA1 09179fba94846762669f6f7bac08aade89b2b274
SHA512 987d1665758525e3e64edd489cbf0e1a91f8b2e17f45d96317b3d371d8791dba323fea28219a81fe3ac8803594251ff280d35aa2e4fa30bd70838d59c70e522a
SSDEEP 12288:mo7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:mASBFW8AimYfStN0zsmw/PC5L
TLSH
T16C452311FCCF06A4DF5BD3378684C4C8B37F5E3BE2D5814AA1C92A145A688FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6d2f9321e407e224ef7a6f6a87ab1146b198ee637d202edb3d74e4bb6dd2e740
MD5 1d4d113759463aceb7a61dff335d12ac
SHA1 6ed792dc5cddb78bf85f37649814c6c0fc86215c
SHA512 c623dea3e4cf9e52c69d6fd7d0606243a673ac701a5925ffd215d7dedc63cdcd6cb277c42ffb22fc4890315a4251d8e22564456dd659f9d74a8493cfdaa24c5b
SSDEEP 12288:6M7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:6sSBFW8AimYfStN0zsmw/PC5L
TLSH
T1FE452311FCCB06A4DF5BD3378684C4C8B3BF5E3BE1D9C14AA1C91A545A688FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 48749b136c051c278df2a6e8fd10366034e2d39bf4ea720f3a3e12cb7c6de273
MD5 9b005bf7be84575b606fc4ecb27ee3ca
SHA1 fe05c037d5cb7ad8af23202fa8a24985a352daef
SHA512 b87b9a78c056bd3328be0e1db929a061080e6da5740e603b690ab6526f5d38402548ec4c60c94dd216774cead9bc54dcb6187c24f50dea0c7e3fb0c71b313d97
SSDEEP 24576:xZMSzFVSOkSBFW8AimYfStN0zsmw/PC5L:xZMSzfQSBFWBiXwCzkg
TLSH
T10E6501A5B39018F8ED67823EC9558946E2B27C2A47B0C60F13E436665F333A11D3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2413a2abed3886881a03bbd355d32f8ea8e591f88e43123cabc8e76c02120e71
MD5 365c0af5e7b6ccfcfcda8db1eeddd553
SHA1 a6cf0f9a4ad2409371241d7b087b51ce2425ecab
SHA512 f3a3e93d64757e854c034844728933fe860ba6966ad23999fb3ed2531179de36bf7e0b76fc7eca7dece033bcbc57146213d84fe29a00b19cd265d92d44201d33
SSDEEP 12288:qd7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:qzSBFW8AimYfStN0zsmw/PC5L
TLSH
T1F5452311FCCF05A4DF5BD3378684C4C8B37F5E3BE1D5818AA1C92A145A698FB2564AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0afa7ddb3b318026d3b976db11a5adda8618202b47833fde933d889ba201ac1e
MD5 5c7e3acbe773182e6009172282738777
SHA1 892441ac770418be108823ac2d333199d0c5a5c8
SHA512 26e7f308de0ecf2fe977549c6564256fcc4baeffb1db3f1e6865480e862a0bfd0e56158ce31e864d5d746b96638f3489ac1e845a4c0d36e1d71a642c3a379bce
SSDEEP 12288:P57x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:PnSBFW8AimYfStN0zsmw/PC5L
TLSH
T1B5452311FCCF06A4DF5BD3378684C4C8B37F5E3BE1D5818AA1C92A145A698FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b398e7bbf802a0ea6b878b5b7b6e0aee1157c6b5403d153863bd4d096b44580f
MD5 6425b50f68e937eaec596f84890c98ef
SHA1 1f9447d360b03d2394b137f089b6da73fce47240
SHA512 922e102535c3401a48cc0ff597f269d848e787769ac0616b1f792146c911905f9ebbc25beb73a8a1864260afcc8c8fc46d196552dcdad434616014c239046f95
SSDEEP 12288:8yPz5L8g7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:lzy4SBFW8AimYfStN0zsmw/PC5L
TLSH
T186551213B6E630F8D667C33AC9914941F376B83683608A9F539407762F276E15E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3dca16db0dcdb7f9164ee0915a195b6b31403a731a6aa2f4ca2fbbe55969311d
MD5 a606d55cdfbd00098a0d136d112ad823
SHA1 d5069c8199f284a839eb5611e3e38e46994dcf22
SHA512 90070322ad5ba3052e407b50ddefb5633b699de72097b1935c0d3778d964220c34f383b4e835b2013b66dfb507a0a48255daba6c52c89c650c483bf95147de81
SSDEEP 12288:Ld7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:LzSBFW8AimYfStN0zsmw/PC5L
TLSH
T1FF452311FCCF15A4DF5BD3378684C4C8B37F5E3BE1D5818AA1C92A145A688FB2564AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f1432c119c2dfbfeba0827fe60184c9a218ab8b45a3c8de852a188c22303e2c8
MD5 3f57238fced783b1687e4867dfdb6668
SHA1 bda53ded1b118513d868ce17e05fb0d40a1451ed
SHA512 b54b6e4c44637cfd1f809415cd115cd197e92f67678ece0f88f92d5b0a0fd36636fb28b7ee4e39713280292c06babecf7f839ab20f9ce9896aa843a65ce5ce42
SSDEEP 12288:6d7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:6zSBFW8AimYfStN0zsmw/PC5L
TLSH
T182452311FCCF15A4DF5BD3378684C4C8B3BF5E3BE1D5C18AA1C92A145A688FB2564AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 174ffde897ca9552e30aeaf0ccc1f190ea031409fc21e6100571ff26b673e649
MD5 706279ab497ef4afbf7068669d118274
SHA1 5ddc5ff6a02dd6da3bf70045a4c9c7f347199e6a
SHA512 d2957d37d961cdb22c5943a604ce9db8f8d7a42111016336e0e51b89e926d4cf908eece4a5e48173ae2655c13f5c29ddf415acc076ccf7a4bd43404f7972626e
SSDEEP 12288:iyPz5L8g7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:/zy4SBFW8AimYfStN0zsmw/PC5L
TLSH
T1FC551213B6E630F8D667C33AC9914941F376783683608A9F539407762F276E16E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6f7121e0a691b687c9052bf1e64abf6ade917dfdf171b91107c9ba1572ab7f4e
MD5 b1d3cb310a236a35d60bb13293faa3f5
SHA1 aee6a69ba90fa259b2e02cb32bc05ed3571eb936
SHA512 6e990e499b40da74401e1b59d5f97a22d5249443cea8532d2c84a4852f423121d6fc2a310ea4d73c8d446adb87394e14feb9249c9187edaf4c741af854f7460e
SSDEEP 24576:sTHaLl3z0zDmSBFW8AimYfStN0zsmw/PC5L:sT6LljlSBFWBiXwCzkg
TLSH
T1C46501A5B39018F8DD67823EC9558946E2B27C2A47B0C60F13E836665F333A11D3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7dc6156fa5e74469aa5e78c06e8d10aff064190aa9c2de8b99cfdfe86e03a839
MD5 0bb0075d775f15c5cf8f2808b17bd6c9
SHA1 b1b0d51fc0807a0c2f0373cccab943b1785bb0b1
SHA512 e44129f2bcb39a526501e77a918d20feebecdec615f871494bf6368606451ef50eda27b281718aaa5f5108b72b3d32f601735b5628a638909e09eb09988cd77d
SSDEEP 24576:t37d9CHKy7GZSSBFW8AimYfStN0zsmw/PC5L:N7d9CHKyaQSBFWBiXwCzkg
TLSH
T18575CF90F7E410E8F1B7DA35C9758511DAB67C6A5B71CA8F03A4261A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a5fda0982c341ff4b20f8d74bea22d796e4e8c05c2465d8b0c25fa5f416bbbf9
MD5 956b6414dfd0a315dd91824625566182
SHA1 703c536874e19c91edff23a3f8f97341a2ffee14
SHA512 e0c1580fb4f25d40550bf061a8786b05d284f9b4d988ef22cf3726a31d0011db253dec79eb707601ed8fb50fae4b7ac8cc134d70a7bc2d3d8667cf2647824952
SSDEEP 12288:zW7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:zWSBFW8AimYfStN0zsmw/PC5L
TLSH
T13F452311FCCF05A4DF5BD3378684C4C8B27B5E3BE2D5814AA1C92A145A598FB2664FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 38901e313386477214abaf6063e54d6c6c9d131c5b5349a360ffc6984aca4b8e
MD5 bafde1861e284ee78e172daac5bedf9b
SHA1 5c61ac5c0f1bbafe6a011ef678a78d37024c9641
SHA512 a720c06d010d4e2c9608e1111e3434422bfe118eccf9cfc5ab8823bc1ee0dc7f835504221e399ccd4385979e06a8729786b4fcccf2de6b19d7332e7121cc8410
SSDEEP 12288:1A7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:1YSBFW8AimYfStN0zsmw/PC5L
TLSH
T1DA452311FCCF06A4DF5BD3778684C4C4B3BF5E3BE1E5C14AA1C92A141A698FB2564AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f2394be20b2e20ea5d7436bf579f76d7e1cc3c6b8969201b31ea0692191a8aa4
MD5 5d8a4bba52b3287353113c8da614fbde
SHA1 3d46e942a98449a988fea2e814d2eac14878bf00
SHA512 9f4fae4535092d653f2890b27e54a7c0319f00d06a6be05cf34749dd70e4bc106d68b8b5b235836e1953ce268b74351dffb976c32fb27443a41b3ce8f3bdaee6
SSDEEP 12288:ZP7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:ZNSBFW8AimYfStN0zsmw/PC5L
TLSH
T105452311FCCF05A4DF5BD3378684C4C8B2BF5E3BE1D5C14AA1C92A145A698FB2664EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 43cc2b836f753f0c4880c78f110f3447b73579a08fc1ffd4701f9cf4c1f44933
MD5 0deb3d21863ca343999c328793b2e2a2
SHA1 710c40ecfdca58f5e87f25966cb9c8cd7ab97f3a
SHA512 7e0b8008bbc41a9d3e42b08d10872afc90032f2ab35f938cc66098afc9f4c72bceefa288cdca72efe4fb73b01069e68637a28311c70935278a0e3e4938b90cdf
SSDEEP 12288:ed7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:ezSBFW8AimYfStN0zsmw/PC5L
TLSH
T199452311FCCF05A4DF5BD3378684C4C8B3BF5E3BE1D5818AA1C92A145A688FB2564AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3d6fc527c883bd7cd5faf11fd41c80a5cd6d469a628af248adda8124da1c27a2
MD5 89c1dab8d2dfd504d882e33c9575cc92
SHA1 c4d924b820833f121c180c42da9ef25dd198a97b
SHA512 70e204d55134df6cdc9ee38d4c03867285718e959670517fb8aa3f6c3fcee93a2d6f928760654f89988e78f2a0faa35fc6aebe401e5ad0e3f31911d4950c2692
SSDEEP 12288:7W7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:7WSBFW8AimYfStN0zsmw/PC5L
TLSH
T1D1452311FCCF05A4DF5BD3378684C4C8B3BB5E3BE2D5814AA1C92A145A598FB2664FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 49127be03f955bde52929e5f49fa3b3ee7002d8e50d85c7b8b800d29c62098e9
MD5 917ec883fede220a8e515f46002298f7
SHA1 dd2b5bf8ee75f3f3a6766d6be5619ade42e6b8cc
SHA512 746df3b89d62e9b62f304feb129daf75ce6605ae7eaa033576c11e9e796a0b7a779699448fdcac98662508d246ca21081547a54844d7f6c0b4496a6fced7ed2e
SSDEEP 12288:gF7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:g7SBFW8AimYfStN0zsmw/PC5L
TLSH
T147452311FCCF06A4DF5BD3778684C4C4B2BF5E3BE1D9C14AA1C92A145A688FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 124ea9224ab436ff8d99edc11efcc59765eae7e5b984d11c97cdd99816633035
MD5 c8e1eb5f2b328f3c745a6659954c7002
SHA1 a581520647eb634ab5a803587bb7bd5740525f66
SHA512 472ee666c3a362877a174540cc520b12c3bcb6102a7e7fb4a770b8633f0e42ccc278e5cdb3fc067b523da085a5841ddbcb30d4fb36e356f227ab409d354805c8
SSDEEP 12288:V77x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:VRSBFW8AimYfStN0zsmw/PC5L
TLSH
T165452311FCCF05A4DF5BD3378684C4C8B37F5E3BE2D5814AA1C92A145A598FB2564EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6c42aff3e44d4194a1988df4bcf1aa5342a111d0ddd9f5c653b04eb8369e3f89
MD5 2b9a251692452df8d7418d53f3749447
SHA1 ef7e1093508d2d6f53ee879d68102900d74b6072
SHA512 66bdac6f60f4de75b099feabe4d6ab76957f7170d23972fa9e3ec4aadbce8c45ad93f1fcb7e381abbcfdadd02ec53f745f28efe67c3f9825facc1190a2a1f1d5
SSDEEP 24576:ifwvok9RX6wkyAI3SBFW8AimYfStN0zsmw/PC5L:OMnYI3SBFWBiXwCzkg
TLSH
T15585DF29EBDC04E5E1B7D23D89A3460AF2B178295B31C2CF129A536D0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 72c383c670bd1d4e3da5405bbe0c910f74264339af7f7c81bff8c1f20287a377
MD5 2abf9de4fcc7aa09f3112f3d193832b6
SHA1 0f162eff59e9b47cf6bcfde56355e1e276788f2e
SHA512 a8b5aa29e0ec9f4bd0bd0470cb13eb70dfca930a868766997cf964094f5f81bcc8666f669be3a708ae2740199549791d3acd36906e95013eb7a0c5f66e330128
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aSBFWBiXwCzkg:XySzPTFWBig5
TLSH
T16E066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 68e6f2d4e3da702bb4a5b2596cc32fd3734977d5e6b75e32b20a158cd4c60fe8
MD5 7644377f6f30c69544c520d8c451418e
SHA1 e994d260415bd7008d1870c286e0eff3ab73ae96
SHA512 766db8c0d989b520f24b29ba5d4638c7c72d8d09932de83aba343f4651d8f5ce813fbadd75d9665e9a4dfc9a49bf84cb66c8c3b696f298af2d84f1e1cedb99aa
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY0SBFW8AimYfStN0zsmw/PC5L:V47JUQj1irIhCnDHUPfF/qSBFWBiXwCT
TLSH
T19665AE1DA3EC01E5E1BAD23885158A5AEA71742E5B31CACF12B0437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 02a5b0fa3d5e9500057cc0ff0a395df3790a26c84a6c902b5aeae659f15faebc
MD5 3312fcfbaea2acf9a1688e3ca4e3115f
SHA1 2fc4b217bc49d350d85f6e3fa6431fcb29000fd2
SHA512 f65425b51778b1c033d23d414e5ffaace2405313fb74eef00deae2871c5074bb1aa7c1a556b4fbfed62597083a24d404bea2248010156d9f117fc3d1fa37fd54
SSDEEP 12288:SNsfN7x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:rjSBFW8AimYfStN0zsmw/PC5L
TLSH
T16955F119D28802E8C56EA23AC7458A80B3377C2693E1D3CB52C0F53E1F7A6D55DE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 88e66b5b42c45bc52425e783f5e18b7796e42b07c0e630d990449c25500a0318
MD5 bbb24e28d076b9094b935202d7803034
SHA1 12eb6c49bc2d4180546d9f116846e653b5db5dc0
SHA512 18e07392bf51526e2a99e135dd75215cd4843781541a9637390a7645ebdeb706227e063801e19fdad9ac7f624497e982c6eaf1efd5e5b3eafd8ead1732fda3f6
SSDEEP 6144:PxQsBC2na2lDPPrER/fKDexHM4Fy5uEykvHQx99TDsUIeMspN46ooHq3BKO9zIyP:fj+2uy5uEjyzDjNhooHqxKOFIYcaXlU
TLSH
T1B1350701762BD75FC6A940325E37D2CCAB707D05EE456B0372C88B3FD576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 693939e3d11fd42e5d00804ef0c9afc53a7ba843742f120766390ef3c4b5a4bc
MD5 12c51c6445beb5dfbd01e7b41456621a
SHA1 9425546bbfedc7eccde163f5ff6fc3db9a4e9405
SHA512 fd0a1bee873f688dcd1b9cfb55ea118c33cab47bde8759f48438f2a3c111624d140ae5219cc6098b7d94f15dcdf9e897ab45754f8656b818ac4ab7e631ae2d6d
SSDEEP 6144:H/+sf2T5//owf4Wlp9bJHkvmtkvllJe8LKplaJ/7ivSKEdR6QFHWQTVvjk6Bp3R9:HxwPz9bJse8LnjfZ77TLg+IYnb
TLSH
T16975E881553BE39FC1FB50320739AA4DA7B4EC16B7046F2673C8047AD82AB15B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d03b90f75325038f9a016a12d4287e4495258d848cb2f7602d27ba6cdb6c81d1
MD5 1c0cc102fcb4f22c91ecd255bfaabd0d
SHA1 372663b95ad663d8939d80b94ed852dae50536f8
SHA512 d046e80f4d8cc25b4f44d94228c79400cdc49818c69b0128813d56916ae8a91e2c8737cfc0b7ee31f5ddb1af2f6de3bda53f826d1bcea79ff6619ad706eda296
SSDEEP 12288:tM717x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:GrSBFW8AimYfStN0zsmw/PC5L
TLSH
T10F452321EECE1954EFBBD3374588C094733F7A3AD794C1C7B0852A9459788EA2D74B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7996be1de8107f6c37643da3d55e10671c5dd91185d9d3f15042492381829669
MD5 60c99920c1b935a66d189caa4882c3fa
SHA1 e3e6ee7050f8930cf47a8266d15afbd37475015b
SHA512 f8f7a10845c863672d898183dc37b35a9013f77842305ace48cbd81f050f115bd99d84936b2b9d47fc39e1f98cd9b34fcc71e39a1c068c3dc02e7ffa389dd30d
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYlSBFW8AimYfStN0zsmw/PC5L:tgb4mBIBhGF0SBFWBiXwCzkg
TLSH
T10D65AE1E22EC02F5E1FAE2B8CDAA4417D6B278164731D2CF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 42ee4d5681a41578034c03352ce9e1fc472b1ece145137f4e29f0b22b6f2fb87
MD5 51dba83ea132f6e889c549c10ad1a944
SHA1 016d1bbf7814c71d300fad798714864e1930a0e3
SHA512 c3aa686b378d5d35d85788970f9b0821c4e7d2128ce313662daf66ecca2f36ec2784c6ee39167448e5886a28e44a82afc19d9e8f556bd018bf35037ca764abe8
SSDEEP 24576:1G88u8FpJqH1bzria7/mkSBFW8AimYfStN0zsmw/PC5L:47ZFPqVea7/tSBFWBiXwCzkg
TLSH
T10E850265B6E501F0D47BD138898646A3F6B2B4250364EBDF07AC8B551F23AE50B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3c9f20600c928a159d5ced4b978f3812efd8169bb64e72f1fc860d58dae26c84
MD5 ae646d1f83a19dd7f1198544495cc3f8
SHA1 ae68021c37bff53c487369e187ec7bc071ca9759
SHA512 a56c517970802ad22b12a3fee6b1f8ab2c30fcc30fc238ed8b4b99c18d16ae011416e9ba4c60a52add8198aa13dbb5c1ec0f1812431a5e0443e1680cff6296dc
SSDEEP 12288:NHvUrBFrEjwaQ47x3S8s+iFWPXUAimYoSzPrw4ZpMF3HxfN0zsmov/PC5V1:NPUr+NQQSBFW8AimYfStN0zsmw/PC5L
TLSH
T1AB65E12F66ED18E4E67AE17D89828609F772B4625311D2CF02D0817E4F67DE87D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 84edc227f3962de9b744b9d7310f850841c8714d7c710ac9bb5f021f2a77f38b
MD5 19adeb8744a57d06cf0a31f8cc63edca
SHA1 4f0a31b3c27c7fa69ea6e551800071e2a93bb555
SHA512 60231aa1ad87d76f4e7c67e0246553cc82d87dd8bc0148935df3a598a7f20f7d24964080197933a87ea63c30c52a7032edb346db6d58eea9b874645cf75b2e4f
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjASBFWBiXwCzkg:UG05lO43bgFWBig5
TLSH
T11ED5C06A62EC11F9D1BBD17CCAC6860BEBB23425033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 64025d45fac7dace856f04eb901bb68f10cb191f5dab403521023d301bd8785f
MD5 d5c43c97e19c56cb165b542d2ab95ee2
SHA1 b06dec79c211641ad96f072c98b439e370a56b24
SHA512 27e8f5a9028c9e4f3db93862986b3224d858fd17af387e0d79d82590b8848d93554ee69fcf1d766bab0ea866bf69f66fd5606543d09cd9b04e9b8e45e8d7d156
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnaSBFW8AimYfStN0zsmw/PC5L:wa5POZ3+Jt2pasx2+mYSBFWBiXwCzkg
TLSH
T11165BF5EA6FC01D5D5B9D17DC583861AF5B1342253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 95f89ce1b6b7441076b4c47cc6f7c0953701f7bafc253213450b6f63e3e7e764
MD5 cedf2d59eb0e0fa29a1ac79f7b2a8271
SHA1 47daba499afed1f3be9b9f438afc78a58c818337
SHA512 fd39a52fc358eea1e4d82f9c1913c8c77c213a2b00ca7d23c3a73bcc2dfca4ccc0c25c070f49cc83e55f5fccb027dec7d5a54bcb676fd6cdb2e979c4dd8d19a6
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkcSBFW8AimYfStN0zsmw/PC5L:dNc/zEOVHFNSBFWBiXwCzkg
TLSH
T12C858B2623E901E4F5BBE1BE89679546FAB17869533086CF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef09e69a386d6770cf793f6bb854f0273827b89c41e2cbc081dcefbf1261d59f
MD5 103aab824f766a703fddaaacebd94b16
SHA1 49920cbdb1fec94a31964074a9c7ffc6eea3f2a1
SHA512 109b56b2e2f7172c2422134a16ab84b70e492eec35121c2b52ec3411a1397f54694c0c0c67b690f9e96a18f2990e8167038b1aa864a4919ac4477f3703bc0674
SSDEEP 24576:78kNvNnaFeYhJNtmZBmOSBFW8AimYfStN0zsmw/PC5L:78MwBtOmOSBFWBiXwCzkg
TLSH
T12055AF2EBAF806E4D1FEC6B58D238512F6727461173293CB5290C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8e34d60d90119af43296c76cc3c16ee23cd9efa044382795fb1b5f5582473498
MD5 45c3c3930c6ebbcf36c3461f64ec6725
SHA1 b45a91735a7113754e35dac70998bae445766216
SHA512 a633e81bb617126c4cbf04e902999f582bf3d53d87c4ccfb05122becb69a9af6f532b770b71e6c5f1b12aa9f0bdb52680e9caf41912087a5ffa182b2656ac0ba
SSDEEP 24576:7D3FHshBIYQgAPSBFW8AimYfStN0zsmw/PC5L:7DVHeBIAAPSBFWBiXwCzkg
TLSH
T1E475E13DEA9D04E4D57BD2BDCA538906E77238A9032256CB12D481B91F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-79-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/240-84-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/240-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/240-260-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/720-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/720-224-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/720-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/720-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1752-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1752-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1752-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1928-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1928-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1928-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1928-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1928-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1928-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2108-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2108-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2224-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2224-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2224-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2224-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2276-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2276-38-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2276-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2276-47-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2276-50-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/2768-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2768-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2768-188-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2768-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3520-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3520-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3520-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3520-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3520-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-77-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/4100-1-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/4100-7-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/4100-6-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/4100-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/5188-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5188-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5188-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5188-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5188-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5444-121-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5444-115-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5444-122-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5444-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download