7ed383e94e2c2de02540cc95ba72a1179ca24d92e1ea6658e6ece01d30b6d216

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260720-avyhlsh18l
SHA256 7ed383e94e2c2de02540cc95ba72a1179ca24d92e1ea6658e6ece01d30b6d216
MD5 d3a2d9af11503b88afe55aa5d7f2f038
SHA1 7136169c2611e8df0a521198cdcf6a278b96d70c
SHA512 ec2985e493081d6ec19f61a48266d72917ceab704220ba0f7d9fb50f51ba2c87756eb2e420b7eae0bb69d91d57ddd12738f2a7654ad5955694fee3bc1d585c8e
SSDEEP 24576:IYJ9bSixOFthHE8MEX1XsdIAhb0VECwN:IYJtSixO3hHE8MEXWI4bMQN
TLSH
T17B75022177C0C0B2DEB7193505F8A7B59ABDFD710F2049DBA39227AA5D302D09D39A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4088	elevation_service.exe
1964	elevation_service.exe
4148	maintenanceservice.exe
2584	OSE.EXE
2364	PerceptionSimulationService.exe
2320	perfhost.exe
3708	ReFsDedupSvc.exe
5720	SensorDataService.exe
1248	ssh-agent.exe
1952	AgentService.exe
1772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a7c4b9223e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e448ca90df17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042a92f50df17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085a75e50df17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cfec090df17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000721b9f4fdf17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	1952	AgentService.exe
Token: 33	1772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1772	SearchIndexer.exe
Token: SeBackupPrivilege	3708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3708	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5956	2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4088	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1988	1772	SearchIndexer.exe	99
PID 1772 wrote to memory of 4432	1772	SearchIndexer.exe	100
PID 1772 wrote to memory of 5592	1772	SearchIndexer.exe	101
PID 1772 wrote to memory of 2036	1772	SearchIndexer.exe	102
PID 1772 wrote to memory of 3104	1772	SearchIndexer.exe	104
PID 1772 wrote to memory of 2204	1772	SearchIndexer.exe	105
PID 1772 wrote to memory of 2460	1772	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_d3a2d9af11503b88afe55aa5d7f2f038_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c91b760fc2803a3b13eece200f0d3dc937ef9735914d595b1b31b9e816ebf8da
MD5 7ebe199a8e838236e9d9bb721f480cc4
SHA1 7ac42c4bc2dced887722381319d4865ef1cdd34c
SHA512 286a7930d4fa58ec15f78317f619c0e54f9ab03fd5d01bbc37fbd9e15220356ee487c86a6f8b59d650de88232d8027dd9e39ac5cd53070b04b053bfcb02101e4
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+ixO3hHE8MEXWI4bMQN:53q6HjBOo3tzfG9btN
TLSH
T1A6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8c0635f8e6a11ad6b5fd96d7bfdfe5684a08b40acbe27165dae1ee791fb2741c
MD5 540cb4d4c9508b8a186c7c6921a883bc
SHA1 592e32c71781c88082eb9e97b1f34c0e23339f58
SHA512 02c3ba8ba0d38972148a091a36c8b38244eb817ae82ffc80499f8d9ac2231cc87deb9d304256d05c199df5e7b8245d04cb60f712f7f68a1d36cc6d4038c1f5fa
SSDEEP 24576:QXYfDtczA3ixOFthHE8MEX1XsdIAhb0VECwN:ntcAixO3hHE8MEXWI4bMQN
TLSH
T1E585F12977E405F9ED67923CC8A28615EA73B8910760E7CB03A499261F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 222ec4d7aebf4fd99dd3b2785e3015df1239934ff02b663350cb68073ac9d713
MD5 3bd98dc9eec4a3510b705a778a5ee5c1
SHA1 20fa43098906eb4ef7eb67114f1c27e061d1d160
SHA512 73d9826d7a4076253754408e90c072449d73bd93913d7d9dbdbb7bcc9516f063a1917185d8652e0b27867bba390eea69daa12d4d40e02c626686c54dbf28234c
SSDEEP 24576:10Le5ji0hmxirMWixOFthHE8MEX1XsdIAhb0VECwN:1Pji0ActixO3hHE8MEXWI4bMQN
TLSH
T1B0959E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b25220e443a4b159f1c799922b6f7b635d7ce1a9f8eb23705acb69746dd2491f
MD5 bbbe3aa458a28d27afedbab443386dec
SHA1 8ef72c71190fa83b73d722f027144eb719a14325
SHA512 7ff25875eaf322dee2ebc9e231a523e3b9ad7ecefa3bb1bb0c16e62034fb18a10f318e3f2d2f43c080ce552ca61d4df2e26d36f8ad73d006827798d5e931a041
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyuQixOFthHE8MEX1XsdIAhb0VECwN:8/ezSC6vUzPvxHjyxixO3hHE8MEXWI4H
TLSH
T18D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8b4365842633dcef1c4a0122b307d89a94c9c0320fb872ad465ab43795fd4fdb
MD5 a83ed81944550386095109cd7cb5db9e
SHA1 292f8489d909ef525cd3ef746df0a9fc9d5d8b65
SHA512 325a574ed089c1156a9cced8029af0abb10c5b5e003a4efa3704db75fd411902a9f2655f8c94c9ea02c5c8be5a4204c3d6e0663475aeed1b9006c8812d967e1b
SSDEEP 24576:yVbqPb88hv/l+6TixOFthHE8MEX1XsdIAhb0VECwN:yVO88hXl+KixO3hHE8MEXWI4bMQN
TLSH
T150559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0a60f24082288793d3d742e7701f178bc49b83d97f58b375ed9a6b9d5452e3c6
MD5 24af63e9e38cb3eed80a7c0e6d91e726
SHA1 e2ff9c028fa39afbdc34c956380d31dd76d78848
SHA512 5033169aa26c89c6c580966b1d0787a4aeedd177ed59879a3c1f3a3174ad912df7e502cfe7efc3636441627a3e7d954e88b439b3cce1ce5372e8ff7ab2e9e2ba
SSDEEP 12288:eRi5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:eRyixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17F652303ABD481C6EF8F3A3D60AA6BFD56D2DED0181448C3C2533566687B2D6D93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b75a67fcc45666eeddb9cc2f2c882d234c79d6e4494767ee394257574e9044e7
MD5 5dc427fc5cfc6b578f0d4a48db80916f
SHA1 86c7a54c2230c917cee82ae64d672b6a81373ce2
SHA512 ea09db1eb635fe6b5f654c888cdb0012fd33d9e66bc51197c78d9b8f24f84fd9e85ea5d6dd63b4046be99848a75913a97512b4759b6e758021e57dcbfee8a8c8
SSDEEP 12288:CeBNUbTVO86Uh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:CJIULixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1B985DF2BEE28FCD2C67E5D7856918740E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 364f00c22fccbc34ca109032090884f38659a3ba7a2cf1aa5d9caa9403903b6e
MD5 a34af46bd49451d0728be2008cffc6e0
SHA1 17b7c99400dc4bfd9c3da7ff357b9d31e41ae24b
SHA512 76508eb4a880db783acbaebb55832931d887c09bb890e67dcee06300e75d3556ad9c2686849eb59759019c704d3dbb6faa4c7f757843258e0624f3a3194b9b55
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:JQvGAdlCEL8c/yRNw5Cbo3tzfG9btN
TLSH
T148267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 fecdbd3004e0d184c19151f98d88e26ad38fa8fbca14e7e52953b6b085529ad6
MD5 1f9feecc20b18ed15cf88cfd3c6d14d1
SHA1 c6d6f52be1be3abb113f008e5ab59d7f278e2386
SHA512 ae4ed7d67a55cbfb9701394b1cb3ca9f2a389b0fecef80154231f2c258a2a58d9d7ac3b2749056a66ee0677bef162f3ff4e5ba87eb3727b01c3dd0c8f130a1be
SSDEEP 24576:rdewsAj9ixOFthHE8MEX1XsdIAhb0VECwN:5lj9ixO3hHE8MEXWI4bMQN
TLSH
T17485E031FFB4E036C7BF0DB61B26C716146DBA600B6119C3E3A84A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f8af7a9925b6597b827d6cfa35cead48f84e212c072358b70739d8f8b48ad4a
MD5 4bf79f261f58650cbe046442ff1a1b9f
SHA1 7e70d986491d1e5146d760c516f44091ce1cf3c9
SHA512 51547ecd2e5f48e9d1e79cc051761b7bd0e8c59087e56575c284c3dd098e00cfd319c1240874d0b4e711453ed20f46723b362b790698481e77b2e13014e4a694
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHF3U:XUEtQevvqc2W1cpV2EI32h
TLSH
T160474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1946b6a2b83bff8e176aa71eb175596d5bf33e5d449765cdc5b1bb5dc11c3c3
MD5 630bfb0e30a10fd72e673d7489800eff
SHA1 c3d498958f2ede236e6aca39486f1aa4b5f7ea99
SHA512 d4db34719a1cbdcad604e11488adf1347f0acdbf506dc162553c1853d0343c106d2aa4950c7d082ad393e13891862c7140c23372a09702bfbc93b314eccf44dc
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zdixO3hHE8MEXWI4bMQN:toqtVjnmvo3tzfG9btN
TLSH
T172D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 84e477542910275a692bde362968d57f4e940fc101b7a21984892981eaf0add7
MD5 77e2df4d35dc6cd70d1ce8b584f20eea
SHA1 c8dad81a8e11b021881d015bd3c58881803a6275
SHA512 bbe6a24828ac4b694b06ea57efc470276cf4d1335f27d371190416a526b5314f45c03265a41291501dccee18149557913693471f49abdcbd4163e77906887009
SSDEEP 24576:eAhGLJIFoiwtA5l7S53UixOFthHE8MEX1XsdIAhb0VECwN:eAMyFoiq5EixO3hHE8MEXWI4bMQN
TLSH
T146359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d2694e93af87115aa904d9ee8ed4c1660ef8e727692eaa8b6bf59ddf6c804527
MD5 94a6b02c724b542391267cd54f8f7ba1
SHA1 e0130df5f55d4d35da20354588629bd52eb24db9
SHA512 3b3dc2f32d39fcb73e674105f5302a0c9daadf6d46b06e2f1e6fe27e9d7cbec3295702780ec076bc1ab41a39f274a098461f8838c14acd74c6707165739952dc
SSDEEP 24576:nwuoOWRixOFthHE8MEX1XsdIAhb0VECwN:nwDOoixO3hHE8MEXWI4bMQN
TLSH
T1D985F14677E408F9E96752398557C236F7F2BC012A21DB1B4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0c6be682cd0a9c09fa0360bd0a9078165164f135816e0e01216ab504850807eb
MD5 ab51304dd663000707f951a3be22496c
SHA1 4d4d990f16a1d948983538a16fef56e7f1445248
SHA512 c8517730c39efca359c30878e26e57f29ce0a62ce9f5c50aba48c1765042097e733328743d0b930fa8af10dec9213c46a2ba641d24d8595afe2bd9073cc2e388
SSDEEP 12288:WBZ1Iyj5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:gZuOixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T14475124637E461F9E597223CD4E55799E7F2B892273143CF422202662F73BC25D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1193062104cb07e8fe5a026755021f7448e8fe0388edb40924cb1423d0d8c41b
MD5 d7268ec2ea228ff4a95e7dace15eb11d
SHA1 1ceff3c48f138a43aee1a4199e88bfed1e2ba2bb
SHA512 8893f09062bc84325be16ca6d7d7e1267b1184f3ed40b10cb2544a427e6687ad134fc4d98c31fe1206190485eb4d34425db05a6a2cd8aa0216403e282086a19f
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN36o3tzfG9btN:HQyiKayX+PNb3U
TLSH
T1CD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ad8ffb1c2c30bdc4a733a0aff04396dca26208e590dc819becd80d67f044f612
MD5 d3f15154221742c7dc82f7c2f6694646
SHA1 62ff91ec6c313a13ac294ddb70d54c2c6df65680
SHA512 4467a3fca5ca353b6449a1308f5ceaf5c72bc506f0af6a505920b960af163f78b486a522a7c427e98b9eeec2856dedea47ea2ca9d022034ceac0054378dae9d8
SSDEEP 98304:0QRQyi36YOcPQLvw2gAf+PN36o3tzfG9btN:bQyiKayX+PNb3U
TLSH
T121667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 749e8b8d22934687bc5a5c0fde217ff6a0511ce87ecefcde70ecc69e7f77faf3
MD5 f2a177986417ae4e872f079a006c74b4
SHA1 5f5be7d08ed395c5665b32537af4e41d51dd8fdb
SHA512 f9bfb0c5887991fc684461f11660ae53155888c381a994949d6b8cffe66c32040018c779119068f5fec6943f7f268192da01c786d857b421f22a577d5b6f4d1c
SSDEEP 49152:v68Qg55nhheWu7PNU3/tixO3hHE8MEXWI4bMQN:pthWRc/0o3tzfG9btN
TLSH
T171B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 efe6c36fb420b440976cbca7f1965015d40d53ef33dd2098d39a89fc1c95d60b
MD5 c2f8d4bb0cf461ad06f27d0168a4184d
SHA1 9f0fd41c1346ef303b9c0f4b745ed08a31f5bf03
SHA512 57ce9f59578547132ec59e2c488cba046b93d47889da8352c1584a7ec5baf23467d1a701fa626853c1285c3945dd62a0ae89295ad2d1aac69b856cdf1feaf5c4
SSDEEP 98304:Ey5112gYy5azzVvL69nLKnhZJo3tzfG9btN:FLIHmWhI3U
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6839e63d620ac053a46cf9591aa8026984697fc952a3e136a1f8ed4f1b8fe4f2
MD5 fc3d75377a7d86bc8d1f62b73b8c84b4
SHA1 0a8890a1c0d6457ed1fb6b8111131f2cd71b5f9f
SHA512 96c63271900b40b5d3fdebb5c2f39237863f425bb312e965cf7da3762808e0f4f0a9b35add4ca82be65d9009842360a8a3bd046510501279a4b7fb56faa538c1
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnixO3hHE8MEXWI4bMQN:/u6JmVxd2dio3tzfG9btN
TLSH
T165D59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9c380f68260829e7fb88e7cd91042ac85be3daa0a47bb15be2470fa2e6c638bc
MD5 878cdbb28ec55c58d5c49134ebc67b04
SHA1 7b68e87811722bca052db7c618566b9728efadef
SHA512 fbe838fa007ef7177a0b289ebef790bd4b8347bacac1525e555bf814715fff6aec3e2a4fcd76f47245678e4e65732a38efc66ca57ab3a7af2e694f5c8c10cc13
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xrixO3hHE8MEXWI4bMQN:cmifPbRvo3tzfG9btN
TLSH
T14FB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a65f947a3486024adecca9ae6bef5842de06fb6018bc4536e0f040ce1135f657
MD5 da980a0cbb72ca4d203f351d08f2ef3d
SHA1 944e6bd9c7fb6f2ca800aa7453345ec621ee144b
SHA512 3d2c40daee10d1bcf23dd1e36826396046b983fb1ae479552b31890c71b60c17b3c41d22dc7cf5c89a5fcd35575693ac87c99b09ca2e0ee4b68e9a84c7835caa
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqOixO3hHE8MEXWI4bMQN:G5dKTi61Fo3tzfG9btN
TLSH
T130C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e6a13c3bf53ed584a046a35b289b7fe91aba0b4d78274b501fb00ee2d574eb8a
MD5 b64af07c6a6c2959777b99d45e79c6f0
SHA1 2469d6e36665911cf655b29ce06209722d47bfd0
SHA512 410aa4d4ccaa1fce6b009e99411590ffcd62d7bc7776c0dc1d11edd3ca7364f7c83d65d725979a0bf6a0d1e870a662ef7c5e130ce9e8bdb96f10b47edcd523ec
SSDEEP 49152:khtSn8EApI0figngiDn0AP5w3ixO3hHE8MEXWI4bMQN:lX2iyphzo3tzfG9btN
TLSH
T11695BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9a197dcd001aec0b50fc999eadfd5ecb888f2df7f549839745b4c00aef10f716
MD5 3fbd4264e14ff984d14904729d8d632c
SHA1 0c7efb3ae3608d75a505cf70066614a9d57233ec
SHA512 5d978fba1db8ef40463d89dcbe66a733fd680ca1e0dd7fabfc1b077290d2189c5c9845abe4013665de512a9b6202d4affec5e2210e527411f3c800bc20f90c8c
SSDEEP 12288:4a5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:4KixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1B3652343BFD5C2CAEE4B373D909957FDA6C6EED5281004C3D257202268BB6DA593AC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1d4a96ce6d979fc8ab95022ab8242a367b8ca606c7252e827f8873e0d721fb5e
MD5 500a8e2899c7d07a265a168cac7b4f02
SHA1 cf340def957cd0e01d295b29155dff38c73b9b9b
SHA512 8ab5efd1d614041ebed50e9aafe35ae0cb38fa170434cf49491e6249324b995f5438796b372e901e980137fecdbd850b89e156e26e5658fee85def3933f784da
SSDEEP 12288:QH5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:QZixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T121652343BFD582CAEE4A373D909557FDA6C6EED1281005C3D257202268BB6DA5D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bc1e2b250f6fde10e8805bd2f5bd96139903d4ffa95785f61bb109586cb8d44c
MD5 5e944b212d467fda53cba9619424259f
SHA1 44953cca0f3f6bd6f94b69ad6694f981f59b2a17
SHA512 584af7e0c802f08bf26d7913ceb979cd35619a7085478997a3f93a78661fa235faacb31e02b09120e7c90fb4dd37e57500ad33e9b2710243f60d75f392c4d57e
SSDEEP 12288:RZ5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:RDixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17F652303BFD5C2CAEE4B373D909657FDA6D6EED5281004C3D257202268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 26b9ebe4e011031f50475d8a4a17e804d6367c9404a3a4f81cdc0dfe54765ce2
MD5 7e2c14b45bfc92c21b6c5162469adef6
SHA1 4cb11fcabbfc4ddf173a7eacf71a47c7583e2eef
SHA512 0709b5f96e6cd900f688b33d7015bc528ece9c47a9d7bca8dff618585c87eec46449f4bd343ad8133c2b6b5ecf23373783768cc30c932e71a2e2b5d89c1db3c7
SSDEEP 12288:4Vc5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:TixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F66523037BE981C5ED4BA73CD0A657A9E3E2FDD02A3156CBC20215261DB33D59D3AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 16d8e88378d8331e28b7dce2ff1918acc209baa0491d44fd9931caa097a8f567
MD5 4de7dae1c98b5c8b36394067bd5bda51
SHA1 2868aaaed86764e78a7b08607ec39ce51c6bb2cc
SHA512 143d3121a9c9cd6de271e10f13ed68a97d81a47d8b8079f17da025ecb7ae8a0016c885964fdef2262f932ce563529d854136cdcf8d3f4187bf7786ce67824062
SSDEEP 12288:ik5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:i8ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T11B652303BFD5C2CAEE4A373D909657FDA6D6EED5281005C3C257202268BB7DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 259804b75580df335a9ace4ba9210dbfd8c9e3d61478feae3697ca544b1a470b
MD5 327ca6a3d5d933e2e3bcb23670b6c599
SHA1 394c97c189aaf0c934834784df398ba209b9c415
SHA512 90436aa86328e13930a5f1ab8ec14a445f463f64c36cdbe66e2249458a47c6f9eb211fdeac79e434169ec8176640f32d5742d38219b88007fb4e5000fd3a661a
SSDEEP 12288:cr5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:cVixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T13D652343BFD582CAEE4B373D909557FDA6C6EED5281005C3C257202268BB7DA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7de0049e8aafa495807d5b5c419253d0b17e41e939031892b1d662cfbce58cc6
MD5 38e6395e271294f9eeaff5979b13d15d
SHA1 139493a3b8d988bfc5a1898cf5f9cb66969fba52
SHA512 b1066ee153f0e4dc8b0e36cb733234c099db01b73037182f77dea09bfbce9df06ec2ffd860ee30cf0aeee7138857a727d7f1b9d45d506c6b6cbf8bf0d0c2d7a0
SSDEEP 12288:eP5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:eBixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19B652303BFD582CAEE4B273D909557FC96C6EED5281045C3D257202278BB6EA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 aca2ac3ff59ee2fcea9370e266f70eb7b786a83e5469fa2c2c6ec6a182cad3f6
MD5 7cc1354ea5eff5ef36e3a43f35ac124c
SHA1 1ec109d0c6f926a8df2655858e95a041e167c2da
SHA512 db2ae4a3ad501d032a93edff364de08d76d877ac8893be38c162c36f98f25aa8c1062826572ab69a93bb28b5acc4e3866bd225705dd4a2f219431d9950fa5dcd
SSDEEP 24576:FZMSzFVSO5ixOFthHE8MEX1XsdIAhb0VECwN:FZMSzflixO3hHE8MEXWI4bMQN
TLSH
T124850195B39018F8EC67823EC8558A56D2F2BC5A0A60C64F03A536275F733E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fde3cc57766004807fc4839b5e89cb91a399b4ae599e829999f127c12735aba2
MD5 516814c85935ef11a4950d5452397f83
SHA1 7095e2504d947a5a3a8656e0dc609fefbc061ed6
SHA512 559cc7ab316604c5985f7d4f69ce2b6595d78c83ba368d5819271fa5287adbfbe87548fb6018d46218f73879fe440f18743beedf24e8d43afa319b53c995d32c
SSDEEP 12288:A25i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:AeixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17F652343BFD582CAEE4B273D909A57FD96C6EED5281005C3C257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e31238ac9fc4f762c2ecda58a95599d6504d3dd0948c3db72356ad5f23aa5adb
MD5 796c60f8c2507978437e349609c8802e
SHA1 af988a3598ce2feafa19ff309c5b3f8a1058abca
SHA512 59472ee7f001f2f1c798ff1c013c8da01ef33c517d23d7671058a6aa53b2a1fd9417013af4d878146becbd449c49cdaf4955b03922c87e81ac7eb80ce7b8e253
SSDEEP 12288:Uy5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:UCixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T132652303BFD582CAEE4B373DA09557FD96D6EED5281005C3C257202278BB6DA5D3ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1118b24f752874d1154a43793f8203d714289e103a8bbe621f4908f2042fd22c
MD5 bc90bc08ba8085d212060c614802aab8
SHA1 4369c48b98fa08af695607d66e4510f0b3aa5afa
SHA512 cba427179bc6c9c5de12c7ef3ea479dce83dddab94e53357a28ee5f2c83a5a7e3996470e3a59938c0681b1a5d04eb462909a5dae242f7f609874af087a6c545a
SSDEEP 12288:2yPz5L8j5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:LzyNixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17975020777A120E9D567523CC8A21B56F7B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 acb7a9346f3d7d6cd52fe80579b3a36d060a49f69cdf0b6c8c036165979b9d4c
MD5 3e497d0194f91d060254d8c2ba1ca74a
SHA1 60cb6dcb1eaedfab719010dbf9baa5dd0e103fbb
SHA512 06cd6c73b708465ded630a411c493f516aba7048a551827aa1a3e81b8f40053dc38a6bb823a6075e4d5290b4aefe5f34a7e492f0e13f3a9f807e642050ecad79
SSDEEP 12288:t25i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:teixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1CE652343BFD582CAEE4B373DA09657FD96C6EED5281005C3C257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1e0ec13dc3fae4b28f12fb6f52cc35ec26b04b8c375e4949c9324880506c1caa
MD5 f9e1db3f40ca92a87f9d999d356edf61
SHA1 e77b69eff38f738c5572cbf41198fcc6c1df03d4
SHA512 b909884eb5c19a098a5a3bc0903f1e09ea400ae6296107c9fbfae1db0049981bf5912bc93024654b264e35d31de4163ba49b2bd90063f058cbcc1d8d8d8a89f6
SSDEEP 12288:E25i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:EeixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T180652343BFD582CAEE4B373D909557FD96C6EED5281005C3C257203268BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a301daba8e8d1cf6908a59e17a116ee605ef74337bdc5d5f016ebe08605d12eb
MD5 ed76118e2618fce34fb6430be986179d
SHA1 7f1a4125824758ed3b72a4deb676c2bf3708bde4
SHA512 402c2050834343c90dd206947eeb2b8d020e457a9d3122ec4e627018a017a4d6b1be69353f3ece9e990b1e0d71dab07b9e994a915e09df15f5bd2ecb38856b2d
SSDEEP 12288:UyPz5L8j5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:NzyNixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T11075020777E120E9D567523CC8A21B56F7B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 adc1147faea59c07010204c68d8b0912321f7b6108761143cf967a9702a82093
MD5 3e1ecc33b05b03ec23d3457ecc506a31
SHA1 f1cbef98fd84cb409d18fc60eb343e53194c8be3
SHA512 d9321e1a02f962e0be90ab5bac9aa27f2093cecafc9b819c0c6dbd079aab5a919da32f6bb84f6942de5ee4cd8f5e20f2353424739bc900f503caed5763f08eec
SSDEEP 24576:3THaLl3z0zDzixOFthHE8MEX1XsdIAhb0VECwN:3T6LljQixO3hHE8MEXWI4bMQN
TLSH
T1F985F195B39058F8EC67823EC8558A56D2F2BC5A0B60C65F03A536275F333A11C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ce37df867ae41f67bcea6eeb420e0ad225445c590c7ff62922de47c31fddde01
MD5 c74856151076b0605fe2aabddcd66c24
SHA1 ff11998f64eb2f3ea0056429435bb25259b82940
SHA512 867f6e1c243493e8859990494dde657ff807916ba67b90d013eba265416bc119c4d6d9ecd4b7834e8463c7e99dde0e69cc814786a93e8315102a981e3685d213
SSDEEP 24576:h37d9CHKy7GZvixOFthHE8MEX1XsdIAhb0VECwN:R7d9CHKyalixO3hHE8MEXWI4bMQN
TLSH
T12495CF90F3E410E8F1B79A3989765611DAB67C991B31DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8caad802b4ea880378711f2cf5ec90160d4f9afe0c22038dd267594db2d1253c
MD5 7a4dc30bf2e615beb3d35695f32c65b9
SHA1 3abf664e60f02f3999f8277fe09bbfc13174fa00
SHA512 b6629e29ad5da0ee11534ffcea2609f3b17d023d0b0a152e7209d9d3422c8899aa1dcc131665e9285cebd8b7a73123cce1562d2f0dfc8dcd043e0043f3f26d61
SSDEEP 12288:U55i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:UjixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F9652343BFD5C2CAEE4A373D909657FDA6D6EED5281004C3C257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 60f6939ccd80d5a2861528eff52b1c57ed3b304adc45117b3db10a36e2ecf079
MD5 b38024df4fd5f2bd24e981585c93294d
SHA1 55c8fa864f38e240cb805620f37bc8d47b977ca1
SHA512 55f2e796a37750ab0cf4e1a845e6d914d2cfd5247f3700994297331780b5fc0bf5ed42eecaf1c5eafc9076cb0e8453163218059c69ac11b60388eb1b156d277c
SSDEEP 12288:aD5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:atixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T116652343BFD582CAED4B373DA09A57FDA6C6EED1282005C3D357202268BB6D65D3AC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 da0be36bd494347ce6616b95a766a6e074443819a90191fb52bb21ac1fd49e75
MD5 0379b1e4ca704b28cab3e253046e5a4e
SHA1 c780da9a33646c75f214dfce4fa4b85148b44115
SHA512 b93702437f23d4d16bb520bb731b4396a4999b191e886f3f31a7d72bd6145ac67ea661bcfa90fd152e6b416cc86f24123618ce588caa68525c34a5c403e3ae9e
SSDEEP 12288:zI5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:zYixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1EA652343BFD5C2CAEE4B373D909657FD96C6EED5281005C3C257202278BB6DA593ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 1e9f83d86242389f3c8c120ca2235a69ec9d6334048da1bb0c6e22909e539361
MD5 ba1c556219657c7b5c638e5efa81aa87
SHA1 90bc956001ab21180b0dc93a4b1986a394df1657
SHA512 5d7f19930fdb05932be467359c43405028c619887a3a6dc2e799e649e3e56b65802fc143ea49723027b2924e5538be3f0cb55f737c29b43ad7d96279cadc5a16
SSDEEP 12288:B25i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:BeixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A3652343BFD582CAEE4B273DA09657FD96C6EED5281005C3C257202278BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2bec909a01d052fea40df32bcf3956155e89e2e20391a4ecb652a47a1646966a
MD5 3bde5bf00e7aa8ba558da48e564d74af
SHA1 36df395e514098b05ed3d2beb26e4661cc9815e3
SHA512 f15ea56940c10a3fda3de38d9570a8ef83b732bdbb29a7338728d551195f0f1ac9fbabb23568751483f36a0caabb63289ffe0a75057da443fb57769bfc199ef3
SSDEEP 12288:p55i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:pjixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1CF652343BFD5C2CAEE4A373D909657FDA6D6EED5281004C3C257202268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d8ad51207b51955b60646e769265e034e696a7a9185e959a64459a01f8d7f52a
MD5 efb379baeb140e16203c1ecad388892c
SHA1 08dce1738bcb86c178f876fd9fc85b336c98bc20
SHA512 17c396edc40a363fcd173f579f7820028d8f02003a5ad36edd51d684d8969045c3f404b2f86a079bfae3fe4e638907449b76115bf749fafcd3589a71b66b5b9b
SSDEEP 12288:Re5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:RGixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D9652303BFD582CAEE4B373DA09657FD96C6EED1281105C3C257202268BB6DB593BC60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2932edc2162e94d3a158aefd15135959c34012cb13b8ab9edb0a4d8fe9b2c0f5
MD5 56ba507bfde9050222dc2384efcffdd9
SHA1 1bd37042865f0e9559168dc789723a1f2983dd2a
SHA512 a4282aaef5418c47b6e5cfe54f0fe441e98823316ce8d2db852b777b8bcfd1926f43ba49cb697e45e946612fe5aac369c709f6c4e2171d52accdcdacf6766162
SSDEEP 12288:Ak5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:A8ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T119652343BFD5C2CAEE4A373D909657FDA6D6EED5281004C3C257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 51fe99124dbf6c8f119d35e417489e4579226605f8d5695128a2f91bfff0ca0a
MD5 098d397c3e6331c6b643ca3a861eb60a
SHA1 049d8ff13526a9c1cb09cfb1607f608214c8db7c
SHA512 46995efccf98ed32ee4f7d6e6ecb7b6997771e65c621191f78ec827d99a3e89b073be4189114e31b8fb75006cf801dcd47768e91b6ec2ec4a8f9b8dde6bc672e
SSDEEP 24576:dfwvok9RX6wkyAISixOFthHE8MEX1XsdIAhb0VECwN:bMnYISixO3hHE8MEXWI4bMQN
TLSH
T15395D029EBDC44E5E1B7923C89B7460AF2B178691B31C6CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d8c48250e2b1f10f65a6b01cb5586cab9f2575f088c0bf6f3146ec4a37daecdb
MD5 d7e33ec47000fd19952609532af15718
SHA1 41a0982274da03d4d1de23eb772dce66ea57bdf1
SHA512 f314d65379c5246a4e25b8633bf173e6eac09f2e29139485ce075bf380581adec7ee3d77849971ad1066d4e239993cad0f5da15af9965a6d4f516fdf123bc94d
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XixO3hHE8MEX0:EySzPao3tzfG9btN
TLSH
T153067C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d8f2aed07b74ec0603b258146f1cefa40cadee628d3d5f3a8b75d6d6a9693842
MD5 4ceea60524421de964daf2e49c947ff9
SHA1 52fa72d6077884fe3e8ed54600d8e191b54e972d
SHA512 3361ed7bb221d57ac654338acb49d653aec840022aee18b64b03d2e2f09018e53fbc5ae532acf0d5254148797c8ad3e74870b317710c5c927ded72b0be79b3cf
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJixOFthHE8MEX1XsdIAhb0VECwN:o47JUQj1irIhCnDHUPfF/nixO3hHE8Mj
TLSH
T1AF659D1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f804be98d79de450e0cfa1e1e980ce4e69d64b000201f49477c5dfe7fa3eae42
MD5 18d5e5c5e01c4d9f36608c16af31ba39
SHA1 78dffb6d12c6fc55da39186dee1da2b555a6aaff
SHA512 2862dc6de8809c229060ec629a37cf4c9034ad41c0d3642206ec804d67b9afcb9a2d7dee96a25234e94f6866d866114a6cc89d3402005719acccaf6a17eb8ffb
SSDEEP 12288:zNsfm5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:wOixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1EE75F10AE39842D8C45E6239C7564B85B3A3BC6147E1D3CB92C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 57a62f345e3312b6c58135674c1a4289585d2d892472ac722fea44e8bb47d164
MD5 9603838b340e49b580e4f4fed9746104
SHA1 e73f037fd3760205fed14eddaeea6bfb9d190787
SHA512 368c08aa8b3ea6b779335170265650611a4b9960462006cd12a28c2f0db463818201665d19577bce3c6d463b9b3f44284148def6632091a8af1e016799f09b41
SSDEEP 12288:VhkxU3fXG55KmX58O+7PyIFiEz0PcEC+aRM0vXo7o1ljb2F/PtYn:VhMUPL0PcN+aRM0v47ofjb+/K
TLSH
T11C3518417666C74FC66D40361E32D5CCABB07D41EE04AF0373C99B3F95B6658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3b2eeba76d162d8f0d986234234d4767e4cfec96794c828875f3655f2a7263d4
MD5 75655434fce3a1e8524ad88c20053bcd
SHA1 a4bbd87cad67498da55cc31804d7c6e13fecbbca
SHA512 9cb043514f6d67a3ea46b2a5a1437653df9aa19ada5b386b755100f10ab973d8247378a0544e973658bb9ae7a26db9a4e7a137aeb623e90eb10382fd599eca9e
SSDEEP 12288:hKh9Z+7PG83Xk+7PM+7PGo5ggIFCSg9+7ZGySgeIF+IFRgQX0XxMT:hKh9hXNT
TLSH
T1A075FA41A536E38FC1BA6072032A5F8C77B4EC06B7496F26B3C8553AD866715A0FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9eba1354e8c28f02b9eb392cf23597032b35e8a5d4f7c8c8b8a20f53bb0e9905
MD5 92dd85b9b94b51b12e1e08c345a8cd44
SHA1 c3de35feacb2bced019f962f42d24d3d33c5399c
SHA512 285a00167761fbed24dcbb0885d124bcc42f2b181c00499fa618372b441d85bb534094a8cd2d3471dce1e6c89c60323cdf445de65ebc41a1dfd54c89f554aa9c
SSDEEP 12288:dM7O5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:W2ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T11F652303ABD8C1CAFD6B3B3C505A97B866DBFEA41F1084C3D10321666877AD69D3AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 52f8623de01bc6cbd6b6943321926a0e5a33b28a8ab02a8c155ecec2619b2060
MD5 8944cfffeb207207d650e9767465fc4f
SHA1 41f16b7f64ae6317be74eefbd86aaa863c3ed782
SHA512 c368e7f481616fce0af422e3880b40613a4743e2139a8b328dbf3efedb77dccbf057b4ab59e45357729b0fc29da208a3c97b604883d4e06cf31e24e28969da77
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYQixOFthHE8MEX1XsdIAhb0VECwN:Vgb4mBIBhGFJixO3hHE8MEXWI4bMQN
TLSH
T1EB659E1E22EC02F5E0FAE2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 64baf90e431fac7530c62805e4fe45418dd56bcbd545def036cd91b1decc266f
MD5 b0e82e6dc4ab7d9d9a92dfe138d1b6c8
SHA1 6ed893c3fee0313f14921f24aa28a37d3e71e300
SHA512 c767e8fe91227b6a4bcea245a013a7092397da487dde967c7a44651bc9b5bb276236ffb5d872cd9a14edce5a93298ea715280d5b8eb1ca73b6d67a42016cb856
SSDEEP 24576:NG88u8FpJqH1bzria7/m5ixOFthHE8MEX1XsdIAhb0VECwN:A7ZFPqVea7/4ixO3hHE8MEXWI4bMQN
TLSH
T11D95F15577E101F0D47BE138898647A7F6B2B8250364EBDF06A88A511F33AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a09b2569535b09284d868a7f8c96047570f84a1cdebdbc7ebe069e541c4952a9
MD5 40f33d84b3af8d8d02a1effe4dd8325a
SHA1 9d38c204a6f95a1521fcc5da66e52b65ed84d3cb
SHA512 b3d479c4e2aa09aed3ca1fbb24b89af91b8974deba2a3643a30f4bdf3b0b9bd9b7e025d5a85b2db5e94333050182dae8a99e89354cdf99cce6a18ac4b404b655
SSDEEP 24576:EPUr+NQlixOFthHE8MEX1XsdIAhb0VECwN:EJQlixO3hHE8MEXWI4bMQN
TLSH
T17B85E11F27E818D5E67AA13D8582871DF7B2B862071192CF0291817E5E77ED8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4bdeebf64ef203c20e5d66eb72b6fab3c4e3e90ef45767e0a91d1c57d9070e70
MD5 494fd834f4d02454e620b90f6f8f9eca
SHA1 94a96264123bbfa3ae67bf161cd8dbfb56a09d6f
SHA512 999912aa88afeed38c5661d24197a0231403426a79110f286b11ca23114e1f6f2d3cf03854af03a0bab599d3ccd11ab84b24173868ce13b1c5028eb7012a8e19
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVixO3hHE8MEXWI4bD:aG05lO43bBo3tzfG9btN
TLSH
T1C8D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 67b4c8cc919060a425b56413d87c999c7800e14e98fb6bfbabc360d64a0f10e0
MD5 c5e489c4550a8c6dba426cd69ca4db70
SHA1 bc465254b4594bebef51bedbe77d34be133033d9
SHA512 33654ea8060c6d5be32a6251dfe2dcab30f3c8e2bbe5c91712b7b7cfafee77a86a2e074f5aa48610837c976a76f0930592ca071a66775aa07eaecc4aed7dba63
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnXixOFthHE8MEX1XsdIAhb0VECwN:6a5POZ3+Jt2pasx2+mtixO3hHE8MEXWt
TLSH
T1A965AF5EA7FC01D5D5B9D17DC583861AE5B1346213319ACB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6b306a673e6a40b5270a6a8d6ab71292287c96cca6a00c5a7274cea3cdb27df9
MD5 b8bb25dae36dffbe31d611b7e7552ca4
SHA1 4b2a5cecf9cfbf8f4210362b10bdfde9df7f9b17
SHA512 6cd15d0f9b160e1b86f86adc24db093e513d999bd035bc0ef9e07c0564e6e1a451d64af2f593baed2455c2e53ce1dda936e30703d887351921ff90b2e646c090
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkxixOFthHE8MEX1XsdIAhb0VECwN:pNc/zEOVHFYixO3hHE8MEXWI4bMQN
TLSH
T11A857C1623E901E4F5BBE1BE89779646FAB1786517308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 789accf5d03e587437d2468c8ebd6ef2e4ee28cc52a4205134e847f0a2ea7b19
MD5 5423176ba883e0be30453ab173201323
SHA1 6e221786def9b37c1fa3ea1fb92ca412ef7765f9
SHA512 eac3116d42c41d5a3f2721b6c5974fcee705e682a989f7653858bb7f515cab48eb66def753d8a285f28d2a1cbda57af3311e08b6dca80fbd47367b9a6a9c4c2a
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmbixOFthHE8MEX1XsdIAhb0VECwN:+8MwBtOmbixO3hHE8MEXWI4bMQN
TLSH
T15155AF6EBBF846E4D1FEC6748D238512E6727461073292CB9290C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0d829a6fada01c1e8b7ab9b468a68f3f390acd0658726b83533b884b79b2ceda
MD5 c9bf7f6375c0493b77037bc93966f1a6
SHA1 c5ae37542bc9abfa3b39fe6b5fef7dae9d39ea50
SHA512 753aec33f9f77553bafb78e83b4a01dc45e707fa29876dcbe2678eea9540803b32a7500a7e4c1e591b7c1095eb079c046dca0176dd65ec1efc028fe40494577b
SSDEEP 24576:jD3FHshBIYQgAqixOFthHE8MEX1XsdIAhb0VECwN:jDVHeBIAAqixO3hHE8MEXWI4bMQN
TLSH
T19695E13EEB9C00E4E57BD17CD6638A06E7B178A9032155CB029581B61F7BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-113-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/1248-115-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1248-121-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1248-315-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/1772-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1772-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1952-136-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1952-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-134-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1952-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1964-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1964-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2320-84-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/2320-79-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/2320-309-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/2320-78-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/2364-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2364-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2364-308-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/2364-65-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/2584-54-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/2584-61-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2584-55-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2584-307-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/3708-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3708-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3708-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3708-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3708-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3708-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4088-14-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4088-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4088-21-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4088-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4088-20-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4148-50-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4148-46-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4148-38-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/4148-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4148-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4148-52-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/5720-102-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5720-108-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5720-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-313-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5720-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5956-0-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/5956-77-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/5956-7-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/5956-6-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/5956-1-0x0000000002570000-0x00000000025D6000-memory.dmp

Download