18deca871ecaaefb16452add584948e6a40d0bcdf3be6d8529cf4723bd63fd57

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260720-a7g2dsc17t
SHA256 18deca871ecaaefb16452add584948e6a40d0bcdf3be6d8529cf4723bd63fd57
MD5 a5439fce51a2640db2330a0214d97d1a
SHA1 c06ca261e217d1a7c21afc3e3bdf4909b8aa74c4
SHA512 e14942843dd8720c3859397a757aa6282a6ef1212907c69e99850076534472e67b745b1b061d766fb3aaac8ff7d5737b351b77c6bccd880ac09a6e819c29d6ff
SSDEEP 12288:4UYJ9biC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:FYJ9buSnnrFb4PM4MYgLxEVyGLX
TLSH
T17655013176C080F3DEB7053045F8A6B5963DFC72AF6159DF63942AAA2E342C09939763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2844	elevation_service.exe
6008	elevation_service.exe
3700	maintenanceservice.exe
2072	OSE.EXE
252	PerceptionSimulationService.exe
5908	perfhost.exe
2680	ReFsDedupSvc.exe
5536	SensorDataService.exe
1452	ssh-agent.exe
692	AgentService.exe
3776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4870432523e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e8573e9e117dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee5c79e9e117dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bc533ece117dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f8455e9e117dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028e402eae117dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bf34f27e217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8ec6427e217dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbd75beae117dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	692	AgentService.exe
Token: 33	3776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3776	SearchIndexer.exe
Token: SeDebugPrivilege	4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4856	2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2844	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3404	3776	SearchIndexer.exe	100
PID 3776 wrote to memory of 424	3776	SearchIndexer.exe	101
PID 3776 wrote to memory of 1612	3776	SearchIndexer.exe	102
PID 3776 wrote to memory of 1016	3776	SearchIndexer.exe	103
PID 3776 wrote to memory of 980	3776	SearchIndexer.exe	105
PID 3776 wrote to memory of 1640	3776	SearchIndexer.exe	106
PID 3776 wrote to memory of 2176	3776	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a5439fce51a2640db2330a0214d97d1a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa62e22f88fc319e50be94e9c948d1b6b4be539560d509083a8eab252c8229a6
MD5 86f33f7515de06a8ce2a818cdd3deb6d
SHA1 ac6262869eb5b95e7af6527af43bd812aebb1b85
SHA512 d5b0b0058ffdaf12ed12ab6ebef4cbccd31b6b0530221062cd20e6b02e6ce2df76295a990a28aafa782e9a8911a32e1b8ef032a217c1a26192942a6c9f160881
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCj4MYPVyGL6:c3q6HjBsV2
TLSH
T159D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fa4907262673e07cfce6eb14a7c71954f030e9e71093da71327251134e6d61c3
MD5 99e2effd263126e6eff7868495b8f9fd
SHA1 82d3ce43add44812c34e389b4b60e99334cdd35d
SHA512 01085e8f801b9a8283d9c21c011b09692db94e8393baf2ed77780965dfb8ed87ae16f8a19325456583d659833f6b11438ef23d939acf9ccb89512a23bde52a5c
SSDEEP 12288:q1XLsswWkxy2lRq2czAH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9F:gXYfDtczAISnnrFb4PM4MYgLxEVyGLL
TLSH
T17065F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6a3a75b61d08a19173c11867c60703bac402620c66f8f7b03f646a8b798daaf5
MD5 aa5141d618eda52625d29ef58d571994
SHA1 c0234c5a5f7c4c44b4e6ab04e186b8acbf7a0187
SHA512 e14f95ba5033b349825840fb8901297b91683413e7524eacb894579822f0529fe049b4f845aff6c68df04cf5921b2efda918de674d2584409dd7cd390d6b0e49
SSDEEP 24576:80Le5ji0hmxirMhSnnrFb4PM4MYgLxEVyGL8:8Pji0Acpj4MYPVyGL8
TLSH
T19E859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d4b925bcd446208a48fc84f9d45b176747b47090d2ac4bbc490051a6c821b7f9
MD5 5156730429779a8818e20a37cf96472a
SHA1 c986febb200eca561761f4809f1c819b6d43f904
SHA512 4b0038b632704a9c7cb95062b410a8d5b4e457cc2e5082f259c626df2717ab409ade7f59588a5e28eae9d4d48439e2de367284a7312510efe7bd6b766e264b7a
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu7SnnrFb4PM4MYgLxEVyGLG:Y/ezSC6vUzPvxHjy1j4MYPVyGLG
TLSH
T174755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d59c99dd5159555953e20f7bf1d98ec47beddad55792f5e54a854cb3790d534d
MD5 895155a35787b5004b3deb57c09a4577
SHA1 f5cba5033dbfcaadf944e1f2a5fc4ac0fa10be81
SHA512 397715effd3aeee06e5a153d1c46dcf2c1b3287cdf18a0683177ddb741da990b81bca52f004ee26346272f6c80c67a1b905728c16df187b61eb192c8eecac348
SSDEEP 24576:AVbqPb88hv/l+6sSnnrFb4PM4MYgLxEVyGLY:AVO88hXl+mj4MYPVyGLY
TLSH
T1F3559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2b6146e5983439e4c2bc7c70d3c96fb7132f6f2aff12367bf59bf896e8c30dce
MD5 e65cf72f49b67995b31961c28d72118a
SHA1 ca0688ab553d1cbe91428bbfe88d9250874999f9
SHA512 5c8b4ce2d50d74dd9f54b37439a23371825c9342341696d46614a6e064661f5c2c21dbd3f577960881c85fa0efc93b0be0105c30e1a25abd1257273d4b35f73c
SSDEEP 12288:DR+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:DR1SnnrFb4PM4MYgLxEVyGLW
TLSH
T1F94523A72BDC10EACFAE15B0D1B96AC8E205BC61F875B20B6750785B363F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a4d092ad026edb30264c36e1fc2ea0dbfd96d8767a77d0bd93c2631f10aa9cf7
MD5 d69d8ac5ac53b7380ec8fd31d7bcabc9
SHA1 3da9dbe002638c9c7455ce1901e296944e292360
SHA512 2bcb7825fbe38aac0dd373b432bf101b2e88326f00c16674f2c3b83cba82d3c43d4b6e845ffa67701fab04b6dc65f1f7f46824dbcc60f857a0248cd1e8a650ad
SSDEEP 12288:seBNUbTVO86UL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:sJIUESnnrFb4PM4MYgLxEVyGLf
TLSH
T1D765D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eccd0029dbf791ca65463ae98483b28e8bbcfd1ba659742d98ba059b921c22d7
MD5 40396671613ccee082c488cbf9dd1215
SHA1 712d4ea9d05e9aaf59de09f9dd5ac137a6ef0742
SHA512 53447047ca7f8fdd3ae5b4544c4ff82764415c4064263db72b98cbe77220a5c3f97f96fad513031253928c200497c49245f150697119db94879d91e653088117
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:sQvGAdlCEL8c/yRNw5CRV5
TLSH
T1D3267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 25cedb8651e1271cdef834a554c2f221abc5635d099693ff12457e4910eb68f3
MD5 275de0db965ab2708332395a8d7afdac
SHA1 963c0ea3d0c56216811603ddcf03fa96748ef552
SHA512 eb78d41ad16c7f17d62044ec361a3063897c558428f729ab0b81ff94005a169f12f8488999ce7fca285c0b7678df04bec99bf2795a682e5430c08c480ff155c7
SSDEEP 12288:rAwSfxL/2Dc34DLLmt0LDQewsAj534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA4:UdewsAj+SnnrFb4PM4MYgLxEVyGLf
TLSH
T1F375E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 71233d64674f64a021fb30a3ba82c5023f444d005f0c334abcad9b05f519fab8
MD5 4e9dfa701b3f67a67f8d675fb428d068
SHA1 1ce3564835d17d99f97bd64bb456da4c519d1461
SHA512 a4726eae5824e079ef4682924750f3883d3dd411f4eb31b214fd02e6b707ceedacc0909f08ebde60e37972075a05af2e0eacd14dfd4a0e495ee34cafe4adc399
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:yUEtQevvqc2W1cpV2EI32
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 30da9a79685995ac51387b3ca7771102a2da24f9dff6d05f6c1cae4b4da62c4a
MD5 9a6fe705dfd7b94496302274913e8d65
SHA1 b3230d084fe9d39776934795967c6ce75991431a
SHA512 2fbbd5e28ad97f8ef0113dde12370ed61b4cbc3017f1cc117749944818294674c9d3af1413fe5b20975080fa84978b9e259850d466fe75546785bc31d73173ac
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/z5j4MYPVyGL5:uoqtVjnmNV1
TLSH
T159D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e5216a735cfbe01bbf4eda490fb861615519746d8455ff90f93498d14da5669b
MD5 189dd9eaafed65b785b3214531de7188
SHA1 afcac8b5ebd63536346d1cbe9e6fcbe76cdd190a
SHA512 e37c58dc90b7c1985b7c019d22c9aa8c43c9fdf340722122e9a381bceaf783ab2fdf6c50ed952160ffa3e1428dd58f4145f937489681681370f2c2d90e5cd3b8
SSDEEP 24576:KAhGLJIFoiwtA5l7S533SnnrFb4PM4MYgLxEVyGLv:KAMyFoiq5Aj4MYPVyGLv
TLSH
T16D35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6816b6e850ca96e92a1636fb5617e0bff471ec183094adc8e9d04da4fc40eb36
MD5 c08683d5f142e14fbd3390e7f0e845f3
SHA1 d16027aa18a34ba0a12cb9fa0fb20530a232ab87
SHA512 6b55d1374a5af4e8f0ae2679a2dbf9f5fdd54c59c10d0fad9781150a5a377d4d0061b13cfb35d85d036e43a198b9709cf2971d9bba569e0d115690fcc541d30a
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqh:kwuoOWaSnnrFb4PM4MYgLxEVyGLH
TLSH
T12265F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b498c5a5f25b91822e4513579a12aad77d7e4100971467d3687d1882a72bd62d
MD5 d282a361e340a2b67bfc339270b2d9d8
SHA1 86c88f6a43fea999d1337b49fa6f646734452769
SHA512 6f066dfd8f272dd8ac5c603518ea3983dc263aed9909870d0096896515e47543311b237a6338a62c99d5d5ec63c2c088d876175149de40b20a5944889b8d9073
SSDEEP 12288:YBZ1Iyp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:GZu5SnnrFb4PM4MYgLxEVyGLW
TLSH
T1E855129A37E820FAC6A74274C4F55A88E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 48acae36b5c2b985dc459b01e1ed7fe549917a29a428f6eccd3dd0f9149e3330
MD5 34d5d71c564671346ae6f6c1f35319bd
SHA1 28af51d0d10f0a35fc4330af2d3df601406d739c
SHA512 0e38f86dbc1beca38097b33de7c432626cd6a1eb53b0f8e85586f5b8e8674e5d120ad594a05d32cd6ae1fc33be6dd3cf87be01938dfb9a5462ce716846822e68
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:WQRQyi36YOcPQLvw2gAf+PN3AV7
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f098db7280d6110e8772228eb74e930d6eb78ebfe8b1091ba82822d1d1432040
MD5 512614d3f0cdd6f0ac424d797df2bb3e
SHA1 ce2a1c2ef4d910adbe0f9ea1301a43c03c392c3c
SHA512 a86d0ba9e13132b3ca45d59f5a3602a282019b6cfb097fb35d6120193a3bd172db9f72697dae9b47c161e3bb67bcf398793dbd1f8074423840d4d37533b5f2dd
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:VQRQyi36YOcPQLvw2gAf+PN3AVa
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 824cc508723c7c48c46692d67e15355ab9bb4cd52ceb86735b80d2e8a4cd4e03
MD5 66157798f6d8669f6fe5b3ad9bf0f9f9
SHA1 1ede937dc1ab73c9d1b164ee3e78a89965fe403e
SHA512 bee01b1b34886675fa438cf758f4366428a5386e18e17eebdc84fd657249dba28fd4fd5011c1db5580a2a62d80e0b91994844fe3547b9c82a1b6cc0834d4ddc0
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0JSnnrFb4PM4MYgT:b68Qg55nhheWu7PNU3/pj4MYPVyGLM
TLSH
T119B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c6ff9c379fa41131102eb99623c620cb8e2639bd0d9b2076fba9e63719b12c33
MD5 f812f3aa6972887fcc70ea3e946fec77
SHA1 7a7f3cd6e94c70b9c23eff7836bddac67bb909d5
SHA512 67a99c069af9a1d32e67b520df9f0d4a6f8fd0d49bda5b3511f15d2261a607f7d50552321f2d6c8bbb24eb3ec7c56ab25cf39bf5173b951920225a8a6908cbca
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:Qy5112gYy5azzVvL69nLKnhZvVk
TLSH
T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e40ce0c3a01f5ec109bee5b4199a161670c1076fba8dd8dbce841c645f56422
MD5 a4f6d54b999b610166e109f37b30e7f4
SHA1 b1cc5d3db9d72ce6323134bd5795f5754ba38e1f
SHA512 d5419f61ba116eb4b7700fa2b4e0d892ac1456e27c5354459e502f8f8792a291f6677873d5d92de6b1259f9541e99a2cc02af6a6f69a275c76fc8324a12e659a
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glrj4MYPVyGLO:Ku6JmVxd2doV6
TLSH
T188D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bcac897e5393595d2b1c06d2ae965d7bbd69b746115f373992ca791bc35a79de
MD5 9dd835dbe6ab8f21ac7b1de56da7f63d
SHA1 3f884558d13a4b218bd16eeaddb769129a20646d
SHA512 2108fc418c7dd6abacf0f12076fc8fd5fd791ba69a29a1c20580be3a9d8c43ab77027259a6bc8c491767bd116d835f88518ad0b083bf2847a320151b2243aeb5
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xXj4MYPVyGLR:nmifPbRNVl
TLSH
T1AAB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b2665ecf8535b5e0bd097c707145f35b14d83dfca2f46fd6667f4b19a7a1df37
MD5 234800e6109a32791b914b99b10affec
SHA1 26eccfef283083eb646abafd88afb414089726fe
SHA512 f6ed0025660b5a4de80ced5bdbd18128f52ef74174aec9027d5441268ffd4f6aa2f6a2838fd5fdb8e9d32bfd7323efec7f3aa48f74722dea347ea6f35f0b371a
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqyj4MYPVyGL9:C5dKTi61DVh
TLSH
T1DCC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 47967d06b3589876d34de0a186853b51e22b34c2da3dae82c57997e56db1f953
MD5 a45d7a3f5f8664a3caecf673f03ba8e3
SHA1 8076106be35eac9668a9a6eb3e8649ef6d100b55
SHA512 aa843cf53eaff863de69ee048baee8b55b9916eb667f0f36705c6829ffc6ff4c71ffefb8f6e7abf1c3be603902e19e5fb645f373d702441f9362a35dbeeac99d
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5wbj4MYPVyGLP:bX2iyphJVT
TLSH
T1F495BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 60e9db52c87036376b21b90acb9bab31e8d21d9e7fc8ba3df91f00dff178132d
MD5 1e4fa219f155ec6f34b555e351420538
SHA1 5b985c6d6b22e0b35bd48492836cac53cef846cf
SHA512 ef528256765c3ddfd2b3ff8ef7d03fb9f19716b770ce72b5a3dee012d6d4c3f60cd0ee7bd98d048eea8c296a691e3747bcd2ba31a0daeaa0095e1d022cb6bcdb
SSDEEP 12288:UW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:UNSnnrFb4PM4MYgLxEVyGLW
TLSH
T1AE4523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4ca3f8b5397da784524b3fe0532bbf210cff628148b0bf15a04b3d91bb3cf2d0
MD5 b58b45aa94598d9bf5440f8894fea67d
SHA1 ece733094f01a1fbfd5aa34dab8cab6f9e337344
SHA512 fb89214a9d3ce39c5838effd6fd9e96bffeee0200a703f5370e26ac5d053c10261554bc90bcda9c8eab0693cd3d3e675789ef9398df7c6888fc3e8917ce06b5a
SSDEEP 12288:bl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:biSnnrFb4PM4MYgLxEVyGL6
TLSH
T1E74523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20B7B4574073B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 70cb7abaed55bca0c1b331a1c746582b4d656583616b8332612d9954f8d86ceb
MD5 805c149f43a50350905d22ac5195d15c
SHA1 389d712391ff485c3054b5e878346a393b2de41d
SHA512 d29311c9193d238b63e044f2b4fcf7d02dee54c38df94a8f29275d02a29fd47915979f430305130711845406d6e7606b8282e8c2c31c40daee74b07153780052
SSDEEP 12288:ij34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:i8SnnrFb4PM4MYgLxEVyGLV
TLSH
T1304523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20B7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a1bb3d2ee6326cf8b3e4ed9b46a1e0c0fea9991e252a0a3c696dfa8267b7bc65
MD5 855a3989a059f2456368641ad28c6361
SHA1 2b9324b497ee73209cb080fa2f5c2746d4c9e028
SHA512 9a3323e393c07131f043b6fb443ef5c5f86daf24ac6730010bdc94feaa1f7c1f24a8bd5fd441ba86f02e93698d1ddc78bc669fe00e82909041af5a90fa656e47
SSDEEP 12288:tVM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:/SnnrFb4PM4MYgLxEVyGLR
TLSH
T1CD4523662BDD10EACE6A96B0C1B556C8E2257C61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 51ec21229b4fe5a156433f7ee0c5515bb10ba36d4ef5f290e8123ab2374e7dde
MD5 52fb104a7c2389a5954ee0df4506f34f
SHA1 61f09713c4107b43e0b4df96541d6eca2290f057
SHA512 7e54024bddb0f49d332223b798e9b5ae9eef238be8caed95453315a409c120032a2ea57704efe9682db6d4f882e4b61415dcacb8e9ed63817f7f0738ed1469ab
SSDEEP 12288:AU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:AfSnnrFb4PM4MYgLxEVyGL/
TLSH
T1F84523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a820078a9fa16954cdea981c5e440afabe5fbac8aaf6b06220b72dc2d3c8df8a
MD5 af54f76b37ff767cff40519702f0c7c5
SHA1 d3ad284149c1f2369d58cf322de1dc4a1992fd5a
SHA512 93166303fae6ac66600769ca46e1623ee66423c585e9ffaa65a1a6995fcdfa7672b794e97ae042cfcca90a07d4b40ead1e584499995d96dc3da3672a63b7b2bf
SSDEEP 12288:HR34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:HWSnnrFb4PM4MYgLxEVyGL6
TLSH
T1D14523A62EDC10EFCF6D16B0C1A966C8E2097C63F976B20F7B4574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f0a1522042090b7a92fb34395333ad190d9920cda6f334b769af5907d7fb08db
MD5 b1715f20081e3863eb390b5836a07cb7
SHA1 8b3f9c17f7b81b326fb17dcc939aad601de2bfb4
SHA512 e782fc140ea01847d1355cc789532f6e7a55857750c9cb5e879275569936d50898badcc1b255cfed5851d566ccf8cf6bbeb9ec0975131290d22167bc2189f73c
SSDEEP 12288:qt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:qqSnnrFb4PM4MYgLxEVyGLa
TLSH
T1AE4523A62EDD10EFCF6D06F0C1A966C8E2097C62F976B20F7B457417373B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ba544954ddb289bb629159b2f2df09998bfbacc84952b25f308d88a61ce97a1e
MD5 f61705ac465bdd806d4d04e7fcdc88d0
SHA1 dc76dae1eb2b3d30aa316bda18a472aac580fbb3
SHA512 5d7b8f66f2c4b798e3f0aad231b54095d3a58e37c7755ec2dcd02b7f38df24fe7ffb62d427dd3da0b254a211a44ad8a90c27a0eee2dbd3af01da95c16d70458d
SSDEEP 12288:/iZwb6zzFEoS2cPvyF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2T:aZMSzFVSOCSnnrFb4PM4MYgLxEVyGLe
TLSH
T1F16502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a27e8cb717accf49a1536b9ac2f5837405b57183cf99b835abd9810de5657e9a
MD5 14271bccc87459c206cfbf37230a309b
SHA1 3ddd999d4a905dbfa01c1b78cf5859f78afb9add
SHA512 e6d1a36d9891c28068cf5b495ff1ef47147133b26d9e8870e34be9d9a78a61b774225af6ebe8da897cc41993b411b9e82ae001b7c28c456664aa2632f82d7e12
SSDEEP 12288:D634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:DpSnnrFb4PM4MYgLxEVyGLG
TLSH
T1EE4523A62EDC10EECF6D06B0C1A966C8E2097C63F976B20B7B4574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d652bba371454650185b0ef68f1f3808be7c7494c497af9e6ac5ea9937371b6e
MD5 b68ed347568c8d2dbbcfa009ea3f74e3
SHA1 a0f06df9390e32e2a771e20d228befd30414d16c
SHA512 1b2824f8e57993644a899797aa24e2d6f00372c9a7c3e6668adc3b541abf56808325611506f6d0c1c30bead6862e9372409dc0876add558ca30d0d8fbe50a8d6
SSDEEP 12288:mu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:mlSnnrFb4PM4MYgLxEVyGL7
TLSH
T1BA4523A63EDC10EFCF6D16B0C1A966C8E2097C63F976B20B7B4574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d575b3c29670322bbfff2a1e9b1d92eb3f3cf49a8785afbec175116ca17ced0d
MD5 e856f65375415caee8eff05d67f166b1
SHA1 31e989428c7489885b6aaed781e6ef22a37565d7
SHA512 f882b7cba8e4217a3d90e641a012b47dd7a6f1a40c262bd634df1e20e0c25363162f5744485528c714946b98dea1c4fd9082a7bb38fcd605732f72b6a9dd70f2
SSDEEP 12288:MyPz5L8p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:VzyuSnnrFb4PM4MYgLxEVyGL+
TLSH
T13B55025737A530F9C67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d14a4419dd3b5e0923c6cd5dd4539335ba6f232678a99c801efac152f6e64c93
MD5 a0055e192af9f7504d4e9bb41ef8521c
SHA1 5865d84e5d40da9bec0f1533480f2bebc95040e6
SHA512 53d536e909b7ebab5b5cd1c4b0edd96fb98391558c291d45631d654bdf5c04825f425effc589a987ebc0ae5ddb8cf1b08b1e6f6dc7ca993fb00d53edcb4c954c
SSDEEP 12288:t634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:tpSnnrFb4PM4MYgLxEVyGLI
TLSH
T1BD4523A63EDC10EFCF5D16F0C1A956C8E2097C63F976B20B7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 605e82747d583f95f202e88154844b90c775f0a36b241272b823226cd5c5f4e0
MD5 7d155853178169c9bbc8700510b1f193
SHA1 633b61ee0d13a45de8e2e1a10dddcf1ace32b74f
SHA512 6a11d3b80bcce8264ad5ff10e7f73d5e88e7a4ed4d39c69b6f16dae5858f63ec7278e78804c741fa108e2a5e03dcd60a2a0dae6b39ab2ead6d835e764edf5b48
SSDEEP 12288:S634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:SpSnnrFb4PM4MYgLxEVyGL2
TLSH
T1944523A63EDC10EFCF6D06F0C1A956C8E2097C63F976B20B7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4bc2bb0f193c75d8b9d2ef4bf74e29d421c9f41cfa7984020b97b227f8293307
MD5 3cf168d672257583bf6362843340828c
SHA1 d4a52372430e5c1dd2f37457667373cb8ef6ba46
SHA512 ea3d93268128726d8c47a7923038bd0a6a161721f5169cec092d7ef33a547489f06203f011ff2d9d5a28e9992f80360752c8b220e7c04332ee7b2f2e7490f32b
SSDEEP 12288:EyPz5L8p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:dzyuSnnrFb4PM4MYgLxEVyGLq
TLSH
T1B755025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 76bbecfc8036e81451afe3d8ceab901d956a81b8d2042eebe7bd87bc879bae48
MD5 e4aaeb3d80acf5d361ff932cdd3cdbc1
SHA1 e007f87d5ddcfd01878e4127b7204389fa08fccb
SHA512 f15b5e6f8deba2bbfc2af37e15e59deda41ca044ef139aa0231d481ede602370b5c8fc60efafbc86870c78da5ce53678259d870412653983933459f3be8e981e
SSDEEP 24576:VTHaLl3z0zDMSnnrFb4PM4MYgLxEVyGLD:VT6LljEj4MYPVyGLD
TLSH
T1C66502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3e13a423c217dab8c68ac0e81d63cc559d174b8a7b97e1e8a071858e7b212015
MD5 b370bfbb37def9452fecbf8139946214
SHA1 1aa01121fe09bb62005cbeb0346cbad7955d2da9
SHA512 d6cb9804dbda0711530f5f70d077a29a130e4f6c006aa9461c22d20212283018f45a10ec65284c1db855c64e34d1f6eb7e662657b7fb75e5a84b45ffdce7031b
SSDEEP 24576:z37d9CHKy7GZgSnnrFb4PM4MYgLxEVyGLK:T7d9CHKyahj4MYPVyGLK
TLSH
T16075DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3514c9fc4ec00c98dd2a764b96c8f503b5c6243f8bf2bc24025a0da45b4784bf
MD5 8d491f7f656ad6b4547217abe5117c2a
SHA1 bea55f1b03b8e34fa5a2805d83875f4cc38a1057
SHA512 86848d99cfcad653028113f880717fa8ad36e94135b65bfb3749feffab93957c322521b6ea404e4c628e23dad56ba7c9aff53e216c25ff6e658271d9e257ccfe
SSDEEP 12288:4D34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:4cSnnrFb4PM4MYgLxEVyGLe
TLSH
T1AB4523A62EDC10EFCF5D16F0C1A966C8E2097C63F976B20B7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 490a26bfabbaea3b583ecbd84371d11befc6d06720f9643031d11d4dd95167c6
MD5 278a4f9cb3d020e5fb7074d15012390e
SHA1 a4891ac9222d1bdb8001606efd4925b4e4d3e82b
SHA512 78e334b7031b82534cc9ead2274a858b486069961a0bf9e9f4ea94ff750839ad92aa4f2346ef1c208c1f841c5aa62e838fa43342c14dce6c3423a723f32419f1
SSDEEP 12288:GJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:GOSnnrFb4PM4MYgLxEVyGL+
TLSH
T1FE4523A62EDC10EFCF6D16F0C1A956C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3e8007777c8f5c50b6bf0ba058487ac2222657bf24f33de168826bb2c6aef56b
MD5 5d2d551b584e609cd698ad7a76f8c565
SHA1 74d9b7b66388b3a5e81b5edaad3a56fafa049489
SHA512 ce8965aef8e8fd7415728c5cdabcce89a1c16675bfc372c43e209984dc96699fdc4772b79e2807c521d31012c672bbcbb45064823a0faca22367bcc4a23990c1
SSDEEP 12288:bw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:bDSnnrFb4PM4MYgLxEVyGLL
TLSH
T14F4523A63EDC10EFCF5D16B0C1A966C8E2097C63F9B6B20F7B4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cc15d8767d3297159bd0d30425257f85b897f5a78683e149c953363fd3a12632
MD5 3f58171615044bb95a979e71ff56e863
SHA1 7c2ad698ce5be706a3583a2dedb47282be426556
SHA512 896db6ee23fef5156a36b41d898c20af07065c48e07c35919a87dbd652259396d2dc0b171c9e16631d1f4a2ea3ab6b7505ce91f66ac9255c9c0446a8edb1a391
SSDEEP 12288:d634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:dpSnnrFb4PM4MYgLxEVyGLp
TLSH
T1494523A63EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 468ba397bd3bb1e08b9381c52ed313d5a44f4fd2ecf76f26729249173f1da126
MD5 ff5e6e6b06a11e3da096b83de06003f4
SHA1 e3a36e2c953735a86f5d2d71a4e77baa6146bea7
SHA512 7526b7f007cc258d40c1f360c5b6ad31a42555e8b69ce581995ab1bb9fe2d8ad11ddec4f0d6fd6e05acb29b6b9bc375c5cd6270f5a1b513097273a8ebf9d46eb
SSDEEP 12288:OD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:OcSnnrFb4PM4MYgLxEVyGLN
TLSH
T1044523A62EDD10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ed9ef74d5c58c5161238109f2f35e84a4b58f685919e018a4d34fdbf481f398e
MD5 5e1f330e63394b4beabec3bc056de613
SHA1 7e379e35602a4f9d6b7001db0a1eaafd438e299e
SHA512 cdff7cfe7e148aaeb14c4932481d137482fce51846b238df4373b6c43b153635efdb575d5268c8ae0b3c65619cf6ed141d424b0da7e53bc6d75f2589eb9a7c02
SSDEEP 12288:li34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:lxSnnrFb4PM4MYgLxEVyGLb
TLSH
T10C4523A62EDD10EECF5D16F0C1A956C8E2097C62F9B6B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 df409615464201c47bbdff7f10d92b4abdb444170e79f9f12dc8a3d413a6f40b
MD5 f93953be6dbffdf033141e5dc9d1fe6a
SHA1 f199d1102fbc851e4e0c650a497f488305f63a63
SHA512 f941f960370b84be4810b1b00878cf35e9503c146675b4e793bfb8e8533a0e0ac2d8f441dcb5695d90c2dc2eb4641b62738e5eb37f25f108b235d7b970ee572f
SSDEEP 12288:iU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:ifSnnrFb4PM4MYgLxEVyGLu
TLSH
T1764523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20B7B4574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 016b5b964e58d93fca77e07312701d9420d1aa4e73d3ed5b85938a5d06eb6d12
MD5 675e0f83782ab382c8e462de6d659262
SHA1 55f9aa50accc7bc4289a947e6ae984fdc9186a4f
SHA512 93d6dbddc8c8492d5017ace58eaa1c56cb6d22111e1caa60365d591f3179af274716b99e5e58947c5865f04825fc1ad48f2708c01b45972d0c38e69f89500f66
SSDEEP 24576:Pfwvok9RX6wkyAIVSnnrFb4PM4MYgLxEVyGLL:pMnYIuj4MYPVyGLL
TLSH
T1BD85D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 61e7f83fe91b8c8841cdd7d68e94aed026abaa9ff60589239db4371ee107f6c6
MD5 3cac1d995bff62aaa47d809a6972f055
SHA1 5f042106a3b681f22812bc6b910fa5d1b1832fff
SHA512 851ddbbf0db38347012db5976ed4b0fb47ef8ea656a6c1a35daaa941f1ff55bffad98a3597c78330088d40389ea5854b5712dd2c2c30215f4070331f54a37d61
SSDEEP 49152:kYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07j4MYPVyGLq:qySzPgVm
TLSH
T130066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 666861b184e43af202f2b6b35deb96dfbf64685529655b9f9f441705b48341da
MD5 5e0dc375c71c7975cabc4dd16118086e
SHA1 ed8071c2d2fb7a010e36f440fe3587aaf5d6329f
SHA512 3d13958af7ba151287d6040c36ac02e2bfde5d908d6efbdccaf17d3da96173c4f5e6d6a6835184a8ae8e973a9c4c13c497e3dfba09b2578aaeac1762373eff28
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYySnnrFb4PM4MYgLxEVyGLB:W47JUQj1irIhCnDHUPfF/rj4MYPVyGLB
TLSH
T12F65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0b1bc99b250dc1741a5433a65711d88a1d877722c3574fa0f89df5d362ccd84a
MD5 8cdf7946607086e09158c74167e02a7a
SHA1 cbff2289fed0583d62eeaed72dedc0b3b78339ea
SHA512 44f62324693b01dfa0bb9a0c109dd1fa5d1048675b500484460c7e2e63d4aa243e72744d0b8af79147dfa70539a380786c7cc35ed013625c718bd4965a237bae
SSDEEP 12288:MNsfK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:95SnnrFb4PM4MYgLxEVyGL7
TLSH
T1D855F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a23e4f3210d91410fc4841856a6d1ccd88a79e5a662ab983ee42e5529da8e4ca
MD5 023e29e9784f03c758a03796746ab5f1
SHA1 11aeb208f401d4ad441079a65b5b65542b4bdf98
SHA512 a07daa3336166194e81801e7189fb4e741f7dcd640672687cfd7fe8cff097406013e28093a05634b2b99b2769a87fa58db9c7964ac5e5d85c0bac066aba54519
SSDEEP 12288:GmNkAU3frEge15bPgLEWy+RPfQ8j/uiRmCaJuNInV:Gc9UPIpNEy+1I8juiYCaJT
TLSH
T1183507417666C74FC6A940321E36D1CCAB707D01EE04AF0773C99B3FD5B6658BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8dafb099e57f8a6320f0651da1c07f7801ea88f8e4ffdfdaadf2b9145b336bf4
MD5 77da9f20457da3b9292d73c7352685ca
SHA1 887f656e8b627094dc6086b75b78fb4390563815
SHA512 98e12cc6911e8af35507c9f8454cd0a2955e876b6d6755cb783db92c12e8b5ae387840b0a57c309b24925a8b37a4b6c1c20589e6107a3d4be406e271097ff3e0
SSDEEP 12288:4X+jew7cnSbyloUM+MLeA1MrqDxtQ1y8Z:xjeubyK2y8Z
TLSH
T14155E9815137A38FD1BB6032072A5F8CB7A4EC06B7495F2677C8453AD86AB11A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e59467a93bbc6da9593b39f7ecab83c94a5f96653bfa0cf08d046157ae05218
MD5 d76c2bfdbf64e22137d1c0b02f288c1c
SHA1 14a60970b1a731c2682f0fbb81a10360e23dba0b
SHA512 fc194701fd0591a082a6155a2a0f83fab953500ca798f9b93576f6c37f18c2b5a06d216d012717ad2fd9d74c8fc5a3684e77c1b88d0c934fd53f1021c1c4cff4
SSDEEP 12288:+M7y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:7BSnnrFb4PM4MYgLxEVyGLn
TLSH
T1894523722BDC14EADE7D16B081A99698B209BC31FF61F18BB7407446363B6C89CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 949042b396fd90b738ad2c9b4e20bb36618f342b7fbad6da48c9c143efbc3f66
MD5 28517e322b1f5fc6afcb1f5291b6b42c
SHA1 9d9690f7a7b258be68a0a52fbfa379f26717fa13
SHA512 36170e8bdd634a6c632690ef92a38919bbd500d612c2cc107898e2e7294a1160436027e233fe598cd5a9e4d86ee15892aa14072aa6339cbd85bd53b036f8eabb
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bY7SnnrFb4PM4MYgLxEVyGL7:sgb4mBIBhGFtj4MYPVyGL7
TLSH
T17865AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bf44eba62fc3885db82d107a30dae21d2a9c825d8a0798d3b3068bd30d440376
MD5 930e262577f00f5d7b1b076bf987eb06
SHA1 474a5f18a4bd70ffa76c560f6e3f3c6088647db7
SHA512 323f967cd23c148068c0cc6da870d395762d47b6055a5813154d2838d100f21d716c0e2a4786346a77d9e70ae459a393d85e1a5cd304d306df6e0aaec6fad4ad
SSDEEP 24576:3G88u8FpJqH1bzria7/mCSnnrFb4PM4MYgLxEVyGL3:27ZFPqVea7/sj4MYPVyGL3
TLSH
T12A85016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7359533c49a189b99af96a441b259c33f456c923b0123ea791bc1bb579d8e7c2
MD5 91a638a52782892a37e97ded521820db
SHA1 a6376225459c071bb18d63d0c866db26916f187b
SHA512 18468072b6bb2b67c096b6a4c9bf7978395e530eb9fc669768634542ec0526f66f1bae44abcf6ec0cefd50840ed392d682b2ca1b79aef8ed7c46c2a6b2ff34a0
SSDEEP 12288:0HvUrBFrEjwaQB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:0PUr+NQGSnnrFb4PM4MYgLxEVyGLi
TLSH
T16D65E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bfe225edd9aed559df61480d4da9a0f8f1697b165bdbbdc326e8defa47cdabb3
MD5 6185801a3da57307ebcbd5c72d5852c4
SHA1 10b88706ca1116575a81c0b3dfdfcd71d61fc2a4
SHA512 b1791f374c55a4d058f9fd716e2c0fe0dfcbebcd539e264f8d13d16ed88e5c5d652a30a9dd2baf9c1240a74590422c265bcf40534987c15d829c9f38a39a7808
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxj4MYPVyGLm:pG05lO43bnVa
TLSH
T161D5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a192bc2755c2af468e5b2de2837beed0ad63100caa7839a025e91f41f21e0b99
MD5 ca3a8cf393bc288862efd9ff6eb69651
SHA1 580815e66ea42fe8a93aa79ed052dc8e267b05da
SHA512 a8f6b9fec62bc33c223d9c94cda00871726c2516f9a474d502f7693f6ca97e20c370d4efaa52e9b8b2acc985119b96ca2e01cc9d0b998c23c35e7187025fe0c5
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnoSnnrFb4PM4MYgLxEVyGLN:Sa5POZ3+Jt2pasx2+mpj4MYPVyGLN
TLSH
T1E065AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f649bceb5b07a6cf36a01bf18ecbefdae59f8f6e0a7d13af2e42191ca17fc6be
MD5 568237b92982c17acdf90fc54ca00342
SHA1 3713f17ccb9f372bc12991e4039583b04342174c
SHA512 78e60bcae72336a04f7d71974fb08c92ebe183f989bd2531b3ec81bdbd82aecb7f37348090cd18bd19f3d98bd838c737b3de0c2ec4877a3910d2c2e259ffdda5
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fk6SnnrFb4PM4MYgLxEVyGLI:0Nc/zEOVHFMj4MYPVyGLI
TLSH
T1F2858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 558bdb65c7bd3a22d70d2103e26206fa067f1c0571cd37bd2682c8e61ea6ad84
MD5 7934fe33861e25e58eff3c9d9eba915b
SHA1 be0c944478cf15db09ef37d51afcfd44a4ee19f4
SHA512 a0e9ec8244a1b4ee8cb89ac30aeb8f4db5d0224e41d6483de96773c752c3c0fab0c6a79adc81a4b8b5ebabc6029a01535f635085a43ee339cdb686cb46b81e7b
SSDEEP 24576:08kNvNnaFeYhJNtmZBm0SnnrFb4PM4MYgLxEVyGLe:08MwBtOmnj4MYPVyGLe
TLSH
T107559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 08784bb03261e38f5c0992e7b02356fb512f8a2a461d8ec8271e33bee372b4b4
MD5 d7a20cb81f02b19b08504f7aa6200219
SHA1 dd70d7512924c3573513ac285a092afb19d2d21a
SHA512 1dfc8ccc60c467ec14c224fbfb8871d4bc215c2dbd0e97da49982df9dfda5833b9e5ae382b0a522e0ba909392c3ac796a469e76e75bc8af8df34153a764e7056
SSDEEP 24576:LD3FHshBIYQgAtSnnrFb4PM4MYgLxEVyGL+:LDVHeBIAAGj4MYPVyGL+
TLSH
T1CC75E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-243-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/252-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/252-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/252-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/692-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/692-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/692-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/692-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/692-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1452-117-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1452-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1452-123-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1452-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2072-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2072-210-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2072-55-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2072-61-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2680-282-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-327-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2844-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2844-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2844-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2844-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3700-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3700-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3700-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3700-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3700-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3700-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3776-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3776-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3776-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3776-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4856-6-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/4856-8-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/4856-77-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/4856-1-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/5536-311-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5536-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5536-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5536-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5536-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5536-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5908-273-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5908-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5908-79-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/5908-84-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/6008-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6008-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6008-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6008-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download