e95a2f00fadfb0eb987d98135f3ce1a49cbefe48741ce0cd82174f78d88ee524

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260723-fg34tswwbs
SHA256 e95a2f00fadfb0eb987d98135f3ce1a49cbefe48741ce0cd82174f78d88ee524
MD5 0dbf52e2d05d03fb1af46ed48726b161
SHA1 39eec14429a0cca1c6a2b8b983c62343f31f891c
SHA512 ef2fac0915b0dc9bb1a94ece8a5ddf3448e8b964b1d404170de92c747a3d0c010a9165ab75936500c7ba02b70083ea7582dc7216acbcadf5126057d8899cc0ab
SSDEEP 12288:mUYJ9biqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:nYJ9b1atr0zAiX90z/F0jsFB3SQkV
TLSH
T18455022231C180F3D9A3193106E8DA725A7DFD715FA159DBA3903B9F5E302C09939BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2884	elevation_service.exe
2340	elevation_service.exe
4916	maintenanceservice.exe
1332	OSE.EXE
5640	PerceptionSimulationService.exe
3420	perfhost.exe
3344	ReFsDedupSvc.exe
5632	SensorDataService.exe
2448	ssh-agent.exe
876	AgentService.exe
928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6977ddb6e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a55178f95e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e55ea3c5f1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009ae536fb5e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004727d63c5f1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c547defc5e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcd8e3f95e1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d652efb5e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084a042fa5e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008baa46f95e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	3344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	876	AgentService.exe
Token: 33	928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	928	SearchIndexer.exe
Token: SeDebugPrivilege	2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2820	2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2884	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 3968	928	SearchIndexer.exe	100
PID 928 wrote to memory of 3432	928	SearchIndexer.exe	101
PID 928 wrote to memory of 4652	928	SearchIndexer.exe	102
PID 928 wrote to memory of 4332	928	SearchIndexer.exe	103
PID 928 wrote to memory of 5556	928	SearchIndexer.exe	105
PID 928 wrote to memory of 2468	928	SearchIndexer.exe	106
PID 928 wrote to memory of 1228	928	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0dbf52e2d05d03fb1af46ed48726b161_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2700 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2700 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ce6b1d2b5808e0ed84d8e948addb8c0597d614bc3c2d624491b5c6ae1c586af
MD5 5294f571fa6560776d7b2b038fc48d60
SHA1 3a6dfe26cedb8f7ee8d0685de46417a76f1ff489
SHA512 8e804b24c72b2c088f7c5f2f0dadd24e771346d52df0f7e5023a2accb4eded616785450ef598d727fc406036e9aec7f2b66c9678620d631cef8c82b870fb7afc
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLaB0zj0yjoB2:+3q6HjBdB2Yyjl
TLSH
T1B6D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f479b0271b52a7c30e3a874e643fcc73dc69fee309f98c2593ce783cd37654af
MD5 202e6eb426d5e2d7eaef98243d0ed174
SHA1 4008db21a34b8e07865259626616db66251b4eec
SHA512 bdd58e2993e42db10582030d754583519416b88b8680f044edaf312cb67362373fde55f806b0a5562ce89ed77f62efaa86433d21afd71910be570bf97d9dbddd
SSDEEP 24576:YXYfDtczA2atr0zAiX90z/F0jsFB3SQkl:Ptc5aB0zj0yjoB2
TLSH
T1DC650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a86b415eb14923fc78b9f21749716bcaafa15a26a0e10a4fe3f6bca13eefb4c1
MD5 6736c22fed18f2b996e7b96885fd1390
SHA1 f19226bf0c3c479743d286420b0c94dd08195281
SHA512 4ef6a7ef663ad8192debf3b4b133086a0b4b76f7c26c9fb84b37f8ef796d671225a0f8705fe3f2c6e6e36c50adb0e858e2f5d8d2d90279adc373b43350cc164d
SSDEEP 24576:I0Le5ji0hmxirMjatr0zAiX90z/F0jsFB3SQkR:IPji0AcgaB0zj0yjoB2
TLSH
T1DD859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 537251ee4b9bec0b1b413c818124b14d52debc1be93b65a0d8edb7f761ec0fd8
MD5 384b354508e412b0acf2dc38bbe82e87
SHA1 92c8f779874ca1bb0d26754e1461ad3e77c0d0eb
SHA512 9824e96a36e069ac2b3e16bb9f63320bb39ac406428a1799f3c95574692902835d9117094a8d95a37beb868720085c6623ff5ad95bdfca7c9a427572935651a1
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuJatr0zAiX90z/F0jsFB3SQk8:+/ezSC6vUzPvxHjysaB0zj0yjoB2
TLSH
T1B3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20c905a35ccfdea11c96a29e90680c653e395283b7410c99415d79b6852e0b04
MD5 2977892beba1b392f0077b216c157c48
SHA1 97a03528380fb26f905601d88b5cfd9033170b7b
SHA512 d81acc506fe29ddb90928b02c680489fb175f1087460e15d7686791cb781ac4450635a1e91035d3b983a58abca85a878891e9b186704daccb0f84e22910e8d43
SSDEEP 24576:LVbqPb88hv/l+6qatr0zAiX90z/F0jsFB3SQk/:LVO88hXl+/aB0zj0yjoB2
TLSH
T14555AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8d0d0d889f8fef26f102b1a33a010fb6c8ac61aa6c0d939f161084ed2688dbe6
MD5 da7a511960ce1339a6f8176638a85bb8
SHA1 c856a3826c5b1b35acfae9acbcd23fe4350581db
SHA512 dc5ea2ebc78996e36a468687cc1ac71e222b3f8ec0f734fc688082aca8eed1a0119ac809cdf75b48a2ddb03e3a14344265c76bcebf52ea25f8b3235656359e2d
SSDEEP 12288:uRnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:uRnatr0zAiX90z/F0jsFB3SQkj
TLSH
T12645230B340E80F2CDC32B3566989C4B1AB99EB065E2AF45E2D13F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e04f8917fe1e663fdbff5684e758ea246898d5f269303dc7e1a96195b01b8139
MD5 dd5824cd1b9b328c8592babc8c3906ab
SHA1 f9d1f4b35fd94d5008de97db1bca49a8210ba91c
SHA512 619816a56edbfdd1e5ea25e818c46710dc684dc4b06a09ba09f3da523ced035bf62f09f6b50d954a5e601e0007f489bae3f0f1db3a9046dd07fb1dd86fee4f61
SSDEEP 12288:JeBNUbTVO86UiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:JJIUiatr0zAiX90z/F0jsFB3SQk/
TLSH
T1F065CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6498ddb5953ff231859d7a0d4c006967dbcfef9ebe7e98019837616c3fb0ccbf
MD5 2a0cc2a88b44315cb5bedc2d290a0cb2
SHA1 1a2a837e0ac4e8f1d6c3d322fe857169ebfea772
SHA512 c17f6fc28306ef37b664df58cc39fb1325fa280aa584625d665b5b0f596c1e428a099aa6c07733e45ec7e60c013d1716b65014c77af003772ffdbac4194fb491
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:NQvGAdlCEL8c/yRNw5CgB2Yyjl
TLSH
T1C4267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cd1c377ca017dfef628276777c5af6185e2034b1cb11daf1d439fccf4dbb0e41
MD5 6e39613aca52524bf721860c325a59de
SHA1 749661443cb2b61fd5775470b0dfa1cc1d0759c0
SHA512 fb0fe40f117aed86f17f4d2555f36448e19ebcf9d147fdd19cb64bf663355deb870d83b1916c04f83421767f146ee40bc847507c142d7005f8ec504bf725b849
SSDEEP 12288:CAwSfxL/2Dc34DLLmt0LDQewsAjwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHc:HdewsAjwatr0zAiX90z/F0jsFB3SQkU
TLSH
T11B75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b0bd3661c2babd93c3da1c09221936f9b266daefc066997111357b03c9153832
MD5 a017a91548e389fe0f884e90991916c3
SHA1 c38453873ca425a00ec676c63fb2c77e5ef88042
SHA512 a538215fdcd74a3ea5eff6d5a0344d2bc6607ecb194ba5d3e167414b914a73efc25b4f3f1617e27e9439d3bcfe1ba00d90899a87de738230009ebf3d031e5b25
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXZ:dUEtQevvqc2W1cpV2EI32p
TLSH
T11B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 29e6044030d498a6c76bcad1d5e0b76eb3b4b69b120dd28ca24f5345d3e15a87
MD5 aaf1c2824a67896784924a8649e99d06
SHA1 4ca2f40a85848e9dd9af871ad257aea5e21772e1
SHA512 06095eff8ae749e62fcc58343722a64a7c59bd287d71c16ab0ccd23f5243513954424bc91cd2a379e88ec9b7b6f5bfb3b02cfb775c669960fa438aa477ad2074
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zQaB0zj0yjoB2:ZoqtVjnmkB2Yyjl
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c41b4c8b8c684aa15ebc30118c535d7feb2de47077bf77692c8177468632b620
MD5 2ea920256bdb2be1a39cb56d66a162ee
SHA1 24a652ded666222f95bf446141546b7affac615c
SHA512 484ebbf7367d47a5a0caed50bb2e8c7e72053001a4df42f7ee0d2e82a103a8b394297aa4600bcf619e7560580534e9d7e30aa7cda2a7a8ec1f0d7a311de0df6a
SSDEEP 24576:FAhGLJIFoiwtA5l7S53Vatr0zAiX90z/F0jsFB3SQke:FAMyFoiq5FaB0zj0yjoB2
TLSH
T1C2359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 543d04224affc0c2edf8be152181f14012cb910dceeeec674383548cbc715312
MD5 6bc83487041e52d1492e13fa6eeae2f7
SHA1 b432abed5183d03eb59846cc02a78f109726beb5
SHA512 e6b10432a1274ebbc154442fb1287c39f83caed93af2503b745f6c477fc622096f301930a73fbeea8c1bc7afbe3847ba86dae2747c93bc55aa34e0274ae3a10e
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:qwuoOWMatr0zAiX90z/F0jsFB3SQkM
TLSH
T18765F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 483e30095bf183fd023e173f986e4c5015f9df55ed3b8790cc7537427f81dae3
MD5 5c23bd5559da978187d943bb79ec4442
SHA1 49901492c8167578f956646087a52df89f3729c5
SHA512 7905af489c2dd08924af84a5c1e942d61c3c4f816ad55d46cc06b1249a39ac9d6e711910af31887f1e3bc7e1788512ef1d22c1b20548e2f601dafefd271f6fb8
SSDEEP 12288:SBZ1IyAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:8Zubatr0zAiX90z/F0jsFB3SQke
TLSH
T10255124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b1b1fe4f354fcc936df36b2147e7bba5b0a4669d4370447d3f21d6e2404fe1b
MD5 f9e43e58ca10ae39aca26beb577920af
SHA1 673bb1ba21990b1f3702939995151e1748d17317
SHA512 de71827404dfbf14e5c669c2ec51c15fcd1b0cd36a4a6daf4be56d874d902ec2b07a9b5fe73616d407fe16184278f5e5870b667ab981ab063647c7995b898b64
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:TQRQyi36YOcPQLvw2gAf+PN35B2Yyjl
TLSH
T124667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3887e298e5a8a0e55ee3364576370d20e8120c039fcdd85ba3dace8d43e33080
MD5 3ce702afbfeb0273cfdd6f0808a3404a
SHA1 ff467f1b15ea4a7b8a48cba75fa12faea238efd2
SHA512 a059564b9bca041ea28a5396b09ea4fbd9f7073d8b7da9350b3aceca2accda2494f4119bd154f9c49a41bf4ebb0f44ab69ec75f0b1e5afe4cb219bdf6deb4063
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:LQRQyi36YOcPQLvw2gAf+PN35B2Yyjl
TLSH
T17F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 13776bee3c6ee636986a51664d02d9eb0627432ecd8e1e1ab5138fdcbaf6fab1
MD5 bacce6d9860e3310665123afe2adc366
SHA1 fd48fa4e7d44bf458853edccb2bbe8f79c4e9cb6
SHA512 6464ce878f3fccfe5d014ddf805ac43c8027923eacef413596c0fb38c25cc8c283878324f3816dd57073b7ab7c4660042cb9090898b38f767ace985027e1537a
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Latr0zAiX90z/FW:n68Qg55nhheWu7PNU3/gaB0zj0yjoB2
TLSH
T1FAB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2a855a356ad1f63a7553587c58abdd35838209e0c323d47478d7c8d327891f54
MD5 dc341231f92629b174a3aa888a5e2f71
SHA1 ce602d3ad3f94e992d77b73011c1c0473685819b
SHA512 a99453d784a88c1f7879ae27ccd6b3571cbe8c73715e1cd8377336b9ec4e147e671e4185c0c947176f3fdae57527c4f126135f74733f2be8b44a5ea07b16da82
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:0y5112gYy5azzVvL69nLKnhZaB2Yyjl
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 71646c0bbfed9c665bda3ff44aa7528017c2a0a925930694b94b04edfe6a8ffd
MD5 b3ccc360fcbe4867c53cd169de51ce93
SHA1 c8bceba8b2684fa645701d9862a1d9efc3864f36
SHA512 cc8f776c1a4d776587eaafc22faf99b698eeca8bde5bd446eeed6796497dbaa409f3c61e822d404b457e748a15729fb846dfa20b8090a35c16c71bce98c7f3f6
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmaB0zj0yjoB2:fu6JmVxd2dxB2Yyjl
TLSH
T10FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3221b056ea2c2b54621e25b565f0de80ad93a53551f130ec476ae46621d6b6c5
MD5 cad56336a38ba19b492f6125cf29b8d1
SHA1 5aab257df9ba05fd9804b5844f6dfd5336031045
SHA512 ad5f8e71fbdff4c5fb51e1cc933bfb137a29c5174a80dbaceead1a3a4a293839a972c14143523c94e3fde0696577a9eca8de5686ade2b1a7d41806e6db16090b
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xCaB0zj0yjoB2:3mifPbRkB2Yyjl
TLSH
T1D2B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 94a1ce6ce2c0ca5a61a579d96bc666305c4f748d1c87bb6a84970b8e23124454
MD5 5ff20b2afbfbbe1ddebb7efde511db68
SHA1 81ccb25a8165738afd6fadf3681f05f9b37499c1
SHA512 3fa0feb93d10cc3b66443798583071853f5d36f247d2e76b58e797cc6c8ab7eeeb45f57b756885020d04de84e719cd590ce5c05a7f5f15fac2f609fc16f0fc0c
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqbaB0zj0yjoB2:35dKTi61GB2Yyjl
TLSH
T122C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73e3638d56e1a1974927fb2aa8f8e1a9c4ba42af7debbb55e78a1b88a65f2b07
MD5 ca7d68d98835bc4eb7c549fdd8a2e040
SHA1 bb4a67ec97575e697708e5beb36485c72c3f8965
SHA512 47070840a4b88376e34a52c138cea2476eaf03b125a35624bad2947f8ce6fff9ab4af603d21c5da059853d82d042428b01f8ffd6995a93e430b2cff022bc9833
SSDEEP 49152:phtSn8EApI0figngiDn0AP5w2aB0zj0yjoB2:YX2iyphoB2Yyjl
TLSH
T12995BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 be3bbf4b5214e3bf52f964360f23f348060bd4f0e8c11046ebb00bccbfd608c3
MD5 d0e41a3f5ac5724ba23029cee87f2631
SHA1 593532d4b96fc96e7b551b47d6f7e177f4050cc7
SHA512 63787c774d753f5425944d3377886618024a0a1851c7cf94e9e2b9b46b992bfb09544d95fcca2b61bc1c23e9458435da331c527d2258cb4824aa566fc486b17e
SSDEEP 12288:E/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:E/atr0zAiX90z/F0jsFB3SQkQ
TLSH
T13145230B381F80F3C8C31B355284984B5AB95EB4B6E36B85B2D53F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e1aac29679364f1f6dd27c620b5382baadfb1307fafb500c8393ee8ad006bd4a
MD5 58f18991dd25d4a76e632ba24968261a
SHA1 a8856590d2f055f8a6acf4f25f01a23709245977
SHA512 77ff5925a36e4d3d9620ef0e0aa86ee11504767ca9992316b893eae6b5906f8d1194a71920bee76d96379570996d64f873077373dd397a94353e6ccd8a4347ae
SSDEEP 12288:wUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:wUatr0zAiX90z/F0jsFB3SQkS
TLSH
T1A845230B381F80F3C8831B355284984B5A795EB476E36B85B2D53F0FDE382C71565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a51c4bb0494b50ef60a1a7e3f276dfc6596ec566322b6f2c0246a3cb7a9091b6
MD5 08ffb218862830c486adbd0feb29032d
SHA1 4977b798e00e32f40864e6f9dcb4b9892b6975c3
SHA512 d2d406b4abc9a0233a12a248789201871fa817548da6efb9784e70384228906e9f1d1906667f98cb9ad20baad4592cf953c0852451fbe1b9afcdada8b5c97559
SSDEEP 12288:jaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:jaatr0zAiX90z/F0jsFB3SQkx
TLSH
T19B45230B381F80F3C8C31B355248988B5AB95EB476D36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e8b4e3481ee718b4a5990f998b37cb3a09fd324d5bb1f70b2c9a7e7cafe73fc5
MD5 cb8a6393435c9e89a296d248abc8e717
SHA1 d1c55e2f1f81cb4a9db11f1bb0d21e81bfb4e46a
SHA512 7ed86d36327184221dcddf1b03305b96d42a7300fac449c3215191725ed53f16a72a72ac1a4a741856263ce4578f77ae02c5897650ee5568814074dad9bab2df
SSDEEP 12288:HV1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:Patr0zAiX90z/F0jsFB3SQkA
TLSH
T1F445230B351F40F2C89397358694884696B5BDB0A7F3AB9FA2813E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fe05b67497953b675cd08e796f97b98b961a29a12a57bb0f6b4c79e1e4c92e64
MD5 f1546514bc8eb4e3c355695f6ea59ad6
SHA1 fe0257ca2bcaf9d27b4fe3c9af9dccc2ea8192cf
SHA512 d6a54df2daacbe38fad304c84e46bd3cafb52763d17393f9c695fe5122f4f6aa967ab34decb4dcda2fe75589b753bc8d7d6763e0ec21aeda2c8bc0fcfda810a6
SSDEEP 12288:W9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:W9atr0zAiX90z/F0jsFB3SQkD
TLSH
T19945230B381F80F3C8831B355284988B5AB95EB476E36B85F2D53F0FDE382C616655D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 59a016c648bfc25bff28306fb9f9c6e5a4075e742276ae951180d9f6957a1b1f
MD5 c2649ba14887f33fc29c332310caf323
SHA1 54f5906ea2b4b954d3967ec922d4115accd77108
SHA512 d8c8c2b6c27738d7505e56c6f9db9707de9df5de8956b4ed250cbcca9ba53aeb9e749a7b206b4211babc45838e10b6cfc9c367be3d0f09a74c89be68794c8962
SSDEEP 12288:3oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:3oatr0zAiX90z/F0jsFB3SQk1
TLSH
T19345230B381F80F3C8831B355684988B5A795EB476E36B85B2D13F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c7a813a80038cc5e0d9c0544934cb818765b36e0dfe161838ee9ab10b5b055e6
MD5 9b4a68c3761a913fd8de453c6780a7d1
SHA1 2cd5cd9b81ba48a3e32c2b5035c1114ccce302b0
SHA512 db4118acc4fc3139e42c2cc11bb3db89ea12ed25c954230f333970a8960388dd8c69818026f6f53a3c5feffec46b1e3c189604929b16bdb374f80b76fdd40ab4
SSDEEP 12288:o8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:o8atr0zAiX90z/F0jsFB3SQkl
TLSH
T1B545230B381F80F3C88317355244984B4AB95EB476E3AB85F2D57F0FDE382C62525AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f753f573bdd769153ba794466c9e66395dc54d6f6de7f4720d35ae45a497a4fd
MD5 6800f4a09b175875c9f92ddc213ce7cb
SHA1 8c1b8701ced0f56205b185dce3946a69754232c6
SHA512 639b08be2c84515e0e13152108ad044d690385ce18951bed6688ca9ba6fecb6c03b4c039d9466b12a2e28579f1253c64199d5e0ac2578832564d565cd819ae69
SSDEEP 24576:5ZMSzFVSO0atr0zAiX90z/F0jsFB3SQky:5ZMSzf4aB0zj0yjoB2
TLSH
T1FE65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cb7fdbedb5397d22a561b0e04ba5edbd9a961511add172ef04756d6ff79953ac
MD5 e292ce7c0f0ef25a227785efc9eaf397
SHA1 be837282b6c9f336f70bd83743965d6331639ec9
SHA512 d63bd1dde1f5c98a477fd8a2c487f636afe96b986b94b35a97376667cf0cd5cc9fcdeebd69c95101283375f1f22236b8b74ccd1d2f50daa1badd11a6c195f46a
SSDEEP 12288:MrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:Mratr0zAiX90z/F0jsFB3SQkM
TLSH
T1C545230B341F80F3C8831B355248984B5AB95EB476D3AB85F2D63F0F9E382C716655D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 90e81889aff5b7e2a45fb40465460d9faa551874da91a95d73d1b6f56b38c79c
MD5 0584745b40344b68ea8a065357cec431
SHA1 ba77fc3623976fb3f068adb2e6a41ba3f41d12cf
SHA512 76f7c1e0026ad92130ef7171a6d7dac96d4b7c91a9fd6345f8c0e7672760df8b55118a094f3e63ab4d68bed11c6204e5a97b3a418f270c3fb5eb446ec73109e5
SSDEEP 12288:C3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:C3atr0zAiX90z/F0jsFB3SQkI
TLSH
T13845230B381F80F3C8831B355284984B5AB95FB476D3AB85F2953F0F9E382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 94e5f47227a3fef102cca849789e91bb305068d924b1b72eda3840b7bc9db151
MD5 084d2c0dba6b669dfdf71677cf895ee1
SHA1 9f722064e03492336dc359f4538c3791dc365a5f
SHA512 834b689ab79aa651604c38c702ef543e8f18d2e793f6ad9c2d907e51c9c0cddff0501de42936ab2b5ba852c0f62e03b702b3a803dbc66188763c8d920dde3e12
SSDEEP 12288:qyPz5L8AUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:3zyAatr0zAiX90z/F0jsFB3SQkO
TLSH
T19D551207326620F9C4639238C9901906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d54d00d6b13d72334e62e84c5a2962da9c91322d98e566f4ce9aae4c905ded16
MD5 8bcc32a92c44fa6c0829223f01ae59b8
SHA1 6e35f440b6859be7e9a1f470b6d29b02f5d0a399
SHA512 559e049f880ea035e38baff30e8dab848e60562900e32de73341a2a29e5902ab5658302b575135ab7687092f1394829ee07f80307ca89fca31be7378f23c42a0
SSDEEP 12288:rrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:rratr0zAiX90z/F0jsFB3SQk/
TLSH
T19845230B341F80F3C8831B355248988B5AB95EB476D36B85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 65b4d77ff59082bbd880e3d239d53472104ce570480e2470ce10b444cffe2cef
MD5 17149b93fbb9002653428b1d41219e7a
SHA1 e42b7289c1dcd3bf07f2f95214a3a93df8d85375
SHA512 d5bb65dd627e0114273e71c908613fb91e4833277c1f5b4a631a85425dc62c3531d7db8bdb67a7e40f184e537514d223370dd120199a7d2606ab729a4197b1b5
SSDEEP 12288:WrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:Wratr0zAiX90z/F0jsFB3SQk6
TLSH
T1CD45230B341F80F3C8831B355248988B5AB95EB476D36B85F2D63F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f23089454f147be81407efdf307b461083b92d4aac05954f5f10360439fffb75
MD5 954b3c9dcdfa799a85dee21027064a62
SHA1 12cf76e9c6ce216a36f12ce42ceca4d5a95a6d73
SHA512 896f792a412364c8705d19e668181e47671d4c20b33665e21d7e45875b736d2067b34526e617d013b133e6c9a78967a5450f049bac844c9f68355b1c04b9b6f3
SSDEEP 12288:uyPz5L8AUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:zzyAatr0zAiX90z/F0jsFB3SQkI
TLSH
T1C6551207326620F9C4639238C9901906F775B83157A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cd71f3c55a8e1f2685903e3de74d758138b1eb63c1c93caec285b68fa5d53714
MD5 583d63ed7bdbe8057761e486d6b25cc2
SHA1 8ff2183f565136f1941e743e7a700eb6a2835ca6
SHA512 2eacc2605a36315c4c251bff85db5bebbc0718713017491fb6e06bd18bef044d9013318af4b3d7aedc0a5fb29aeab9a6d05855e02b2bb86cf4bd12cb9a87d252
SSDEEP 24576:oTHaLl3z0zDKatr0zAiX90z/F0jsFB3SQkw:oT6LljJaB0zj0yjoB2
TLSH
T106650195735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1427ac7e737912de5baef5ee60f9d5950698215cf23fcef361f18c3cf26a2b3e
MD5 3827e62b7e4190a3fab2f89451dcc59e
SHA1 ce0585162003c92e2cbbefdf5fe7d998e5ca663a
SHA512 119305389130764ef1ba3c3bdf70349baab695463c7a923d6bcfcb798b06cc6dcd9ce7df431c5102058480ea0e6bbb960394d01fcf863787a81c6be6eaca71d4
SSDEEP 24576:437d9CHKy7GZuatr0zAiX90z/F0jsFB3SQkC:C7d9CHKya4aB0zj0yjoB2
TLSH
T10275CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 65198cedf6a05fd77f437fcf7d10ceb86365d95a9ce42d0b97e9d5f8d53cf0a5
MD5 b03bd2e0094cb8b7594fa68be9e0d8ae
SHA1 46bf3dfbe83f7eec722908b5dd34cbc6b5748d32
SHA512 02b8ffe95431833bb0dd643e9bad45f4bbd145cef6d4a3dee9d178c24f9a14a40d816890ef4910c67110aecf9e347b38e575c1407cc3f3247317acf2a20e276f
SSDEEP 12288:M6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:M6atr0zAiX90z/F0jsFB3SQkm
TLSH
T15645230B381F80F3C8C31B355248988B5AB95EB476D36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ca926aeb0f5912257baac79f43e351faadb2911fb9d69839670e549dd1b563e3
MD5 bd18b7269df0263ad611b2a020369298
SHA1 a3159748756ccc4ab02d8dc71be3efdadee8d57d
SHA512 e05d665c9c456d136f1042b9d31df3774a14204537f87907a19a50d38ef5003a65ee02ab29b57da5a8303fb5b6279fbf30af3c48b910d8897a42702870a66477
SSDEEP 12288:CgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:Cgatr0zAiX90z/F0jsFB3SQkE
TLSH
T13E45230B381F80F3C8831B755288884B1AB95EB4B6E3AB85F2D13E0F9E3C1C615656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 828b15929e64abbe92d231f4fc67dd6d8db9b5b4e1e44dbfccf6785898db2082
MD5 87a23bd68c99ac508da7b65234192a20
SHA1 882751999168612c192cf3dcf2dd0b0370d3e62b
SHA512 f1f2071220f97a6c6bb7e633f22672ddc29cec703e366d0bf57853e7544233c92b3522c3eaddff16d92f0e4bb4e277682cb5da1bb6d043a7a6793080fa1ed9bb
SSDEEP 12288:xRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:xRatr0zAiX90z/F0jsFB3SQk4
TLSH
T19845230B341F80F3C8C31B355248988B5AB95EB476D36B86F2D63F0F9E381C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 15cf3c203eb7f0b22b5d1d9b287075adbefe92ab3ccd8b8c458ef96c92938c8a
MD5 c91ba1e7caeafe9e08f778dc4c82f9c3
SHA1 93cb5695bd6f90f1532f1c85a8ab3c874ee18aee
SHA512 452a33a51619ee773977ff2103c17579627a8e344b6e4d958f9c1b6d04f118927efaae2d44932607153a3f4bbd633a8efac6c82a559ca46b3d80de728a51496e
SSDEEP 12288:OrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:Oratr0zAiX90z/F0jsFB3SQkw
TLSH
T14D45230B381F80F3C8831B355248984B5AB95EB476D36B85F2D53F0FDE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f3135fcf9cac269eb369d4e921aa34e2879ba644126e649441159849ad9399c1
MD5 8c305ba5f9c90086141d5bbacae61783
SHA1 89531fb8e144700ca64dc86bd1001c53f3abcb16
SHA512 e2eeb11ea459c767a99994a2d1a3eadf4133c008b6b2ce35b31517db100229021597e3d6c2adbf0626df211e27a25a14ac6ad67a0276fac688f9b2278f772fd4
SSDEEP 12288:56UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:56atr0zAiX90z/F0jsFB3SQke
TLSH
T19845230B341F80F3C8C31B355248988B5AB95EB476E36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0d58a96c5133568c433c0cfc19da7dd550fad5cc31b518ec8b09a7512a05f238
MD5 d5b40d0707b10e2c785a4065abdd9d78
SHA1 3cd9b3973532976fa8874154c680543a0bc1081a
SHA512 6a04c423a2ff62c8f2c74ca7b4a3d5821fad1b74437d4266bee97b076ef216e966a72acbdb8abda2c8f35407fc8efefe194d88858add896369f58a0b8d6ff17f
SSDEEP 12288:oTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:oTatr0zAiX90z/F0jsFB3SQkn
TLSH
T1DE45230B381F80F3C8831B755688984B4AB95EB472D3AB85F2963F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2a34050386515095b92aa511e13787bace94f9587ddf96b7e6f3bef7f12db725
MD5 16596d319cc619f3e4c059eef11bc6e5
SHA1 f3eabc89a6beced0599d8096dd81605cdd5ca25f
SHA512 1a41e2ff5e34eb7e1e58ae92e7eea733e600c8e8c0e47492995e5579c4e834848facc00ca0ce64a89274a53d02566fe7022a84fd106d7cf10fe1920b88f4280d
SSDEEP 12288:29UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:29atr0zAiX90z/F0jsFB3SQkw
TLSH
T1A245230B381F80F3C8831B355284988B5AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f6a46c071ef77afefae19cd9ce635631ca61879df2cb6aed2ec14febb3bed448
MD5 b32427114f3e33d85e33e4e883f7c1b9
SHA1 28d931b58582ca2eabd8f5da76aa8cbb7d7b12f6
SHA512 5cd621f27d9ba5c3146bbcde2cf0238194681678b8ba67e744c26fa0dbee824af30efb9318cfdac63ab85b7ce84e808f24b7e265313db7c15fc8e757d8301b88
SSDEEP 24576:Cfwvok9RX6wkyAIHatr0zAiX90z/F0jsFB3SQkm:uMnYIHaB0zj0yjoB2
TLSH
T1A685D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d2e450b2bb0640d9c2ff2c6681844e36c05ec446f833a1f88b84eb42d10e6475
MD5 1ee1d53dd6fcca7aa2942ffd1f1c309c
SHA1 2aee8275e8e869b20c9ea671388c7d2f9e4a225c
SHA512 c79677031da41d95d524fa880e70ea1436a01e1a5ab92a1e7d4d067e2e809844dd1f659e72759cfcf884e9a1758b3e691b9f70f83d01cf469bc2f05a9c51ca33
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WaB0zj0yjoB2:7ySzPZB2Yyjl
TLSH
T1FB066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 03e77eac2e15dbf0d852b8c5696cbf43ce907e553ea56a79a5fd31cde34a45d2
MD5 b1c2b06b2de58b915f521b5f9e0db646
SHA1 7654e93bab00026a4f1adf89b71875a8e40ea760
SHA512 3284868b15682a9771d8d21f2494356dff2f52733c31bf221ba3a7dbb0bab7255dfe562425bcfb4424eefca60fec1dafb7edd9ffe947fe7ed7de11984351d861
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYEatr0zAiX90z/F0jsFB3SQkH:v47JUQj1irIhCnDHUPfF/maB0zj0yjos
TLSH
T12F65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2d58488b52b6aff05c67e83840394f7bc71ce16f55dcd16ee3348edec229439d
MD5 e17fb9e9ef5a928549fca376d93309de
SHA1 76fea64c03e55adf59dd825aa22d1df00b3a4285
SHA512 408e200ff2d106c4e96222b7c863f52ed2840b4fa39709ad6103f9b042c38eb26bff01f5ca1791aa26584265e532ae2d73e6bca95691897c730cfd4a2e461e34
SSDEEP 12288:1NsfbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:Kbatr0zAiX90z/F0jsFB3SQkT
TLSH
T17355F00AE25801E5C0AE6239C7544A41B7777C6493E2D7CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1b4acc4726f03c1f37440a35576c980949fd3aeb54ae8c6315972b6d3e650432
MD5 7f1a7173db57a37ab4a2961f55804eab
SHA1 1fe660f3642cd17b1632c7dd17b8c547b01bb6a1
SHA512 77b02e2199143fc107b3fe0c0ab49373b99a92295bb1d098d254a03e09d53a00bbc1dc5f7b91c0a56253a1d14d9f145afba5b2f7f41eb309d153a6c0a0349337
SSDEEP 12288:axs8d+U3fLjjqSLUXGtw35yM7aOcOzj1SpXhppZ6:aW8oUPLqK6B7a1OzjUpXhpa
TLSH
T150451740762AC78FC6A950325E36D2CCA7707D02FE05AF1773C8473F9476668B6B6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 b18694ad5a0a8b266a62a19a1f1414f8a70b891c155e6cedd44f6cb29e06ec57
MD5 8098b053433799fe6d486f33c0a4dccf
SHA1 8fec55db94c01edfbf70db199b3dd8e574e7f0a5
SHA512 fa40f1c7594e3a0a3818a72a6aa37b12f5ff82f4386f3cdb0b74749deb8632b94088bcdf2d0e548036abdbe1c331c9d874c5a8ef1f42d496e28f1ca2412ec534
SSDEEP 12288:5d9kFY78cS62sdxVHpvc+kzJLBloMzzr8joMIA+:5d9SEjTd/VRMzM8MIA+
TLSH
T1EB451A41A5A7E35FCDFD50370632868DBBB49C07BB452B0573408A2C987767EB5E22E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a8581fcf38bc84542390e1c6048d36ea79a642baba87a7258d7d1885bcf81c15
MD5 0e5af5057c63c28735ba67fa601f0c51
SHA1 ca90d4707ce46fb6112b216e0c9b9c2e98d3f87d
SHA512 595e394ff52cc3e3acc768b54f8bb7e9b468bbd87904fc7197f7524c77d5631572d04d9cfe4bb07f2514f1ac05a4bfe1a9babdc72e7a9933bc13ecd71e84e81f
SSDEEP 12288:6M7DUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:3Datr0zAiX90z/F0jsFB3SQkh
TLSH
T1E6452307351E80F2D8E32B3452588806267EBA746BD29AC7F1813F4F9D386C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 27f82ff80f3af3d3380d7d308aa0a4bca3bd30152d667ea0a0be27e00853f152
MD5 2676b7c20113b9df5fce7156190ec9c0
SHA1 322d5277cf811a88fc23d56e2f671e26a98fbec0
SHA512 f76493b567de94bd01946d6b59b39e78b6f0a7409b4fc84a816228de3fe485cbc09d143a3ed52fb6d3514aecff3426d07d2a066e5bf627d4f0c2492f320e5947
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYJatr0zAiX90z/F0jsFB3SQkg:qgb4mBIBhGFEaB0zj0yjoB2
TLSH
T19765AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c3ccb8ebc6652de62322b6b198f4de9450632cfd00a66526fd73934c5dd561df
MD5 12d39cd47593aa5edf2b8bd6ea40ed22
SHA1 5c254cb242a3828a1c5b61e682f6a020c52a3a1c
SHA512 26e08c1e15352717e85aef817d744d4f0703591507c83430a7435159f4d0ee7818fe4ceea4fad7fe834a20a9d0802f07814c4252dafa343df1b99d70845ffc2c
SSDEEP 24576:2G88u8FpJqH1bzria7/m0atr0zAiX90z/F0jsFB3SQke:d7ZFPqVea7/xaB0zj0yjoB2
TLSH
T17485016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2bf4afa3030eb3b9fd00b5b85945285ba1f60f8a3a9e0f1903737eb0ab00796e
MD5 383e54ea299e83b1906fbb14379df6d3
SHA1 95342eac0082c0fe996318fabe4cdc6d449cc594
SHA512 73b1375c83ee39582e91cd417ce5365f310d18ded9e1a30984dab942ae2dc22522f44528bc0638083fde363ecf12fa33e231bd2b58a88e2cdaf5fdb046b1cdc6
SSDEEP 12288:/HvUrBFrEjwaQ4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:/PUr+NQ4atr0zAiX90z/F0jsFB3SQkQ
TLSH
T12E65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df9a9d55ad0d1a475b748f8ab25995ca36b6e458a257c6f47011653b114c03c5
MD5 0c630e5d8cc832d37e31c2ccd3fb274d
SHA1 b3bc1c0e2040c515ba05b9729606d020a560a6fb
SHA512 63a29ce478fa67b5a541f5891f8748fa80b3adf310346e53a3890aa35cd37ff3186b3a6c7ae13fa0eb3a3caa5adaaa961c63483e635b78af45180ab376d9ab63
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoaB0zj0yjoB2:lG05lO43bCB2Yyjl
TLSH
T1F3D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f5082a785bc0b806a33604441bc667b3dc44734bfbfc7c3b959c0213ef4061c0
MD5 b8ebaed700c815c35fc13deea1b924b1
SHA1 744d5c182353fa4efacbb18df022c4cb87991038
SHA512 b17b36250a1efdf4390f4b018d79429bbb6df88ff31bd2bebeae6d706422b630aecb16066cc117ae5b8ec7800779d246474cf5db63c5c2e40f08b7ebb75bbb33
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWatr0zAiX90z/F0jsFB3SQkG:la5POZ3+Jt2pasx2+mgaB0zj0yjoB2
TLSH
T10565BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99b6656ecf58203f0247295f6c138c7fe6d0828caa036095c78d1db46d29d961
MD5 a3060d4808e7c2e4be4c624f7eadad10
SHA1 0136e8aaf68945290e1c42ef26feb7534bac9649
SHA512 53bfa12c27d6c38114aa60ee72a11b9557986f70c94f8b86cec3f291058fa2b51d6ed4933214a38fff9925c8148d667fdd6ef7806d597180163e9bad447eb38a
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fksatr0zAiX90z/F0jsFB3SQkQ:SNc/zEOVHFRaB0zj0yjoB2
TLSH
T156858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1df45e98656781dc88b61315d25a798ca137c48623412bd8ca8400aa7f6efb5e
MD5 e76bc0c50d3bbd6fc81918b54c8084a3
SHA1 af8968d590eb898936a1403286549072ecd24fb1
SHA512 44faf07949a17dc731c72d4356aa69aaf153d9c70ab93fb12d67ba7f2873a825274a443ef51824e396f102fbc4d0d6b3a411edd8f32a9ce83da9aa29f198a886
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmyatr0zAiX90z/F0jsFB3SQkm:D8MwBtOmyaB0zj0yjoB2
TLSH
T19055BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a5b0ad42975fcfd256c3f295bb3aa4256fa13def8a0133ee17ff8ed78e64a3cd
MD5 a61c5303d0823e1681036c6258daba79
SHA1 ce057282f5e327cbe769e5389bd9f70b58078467
SHA512 d8e0bc3136fdba58c640a097b7a477af620562409c64e18c7ffbe539f1515edb34d9d4a7b570b56a5dc7ae77e5630c0e94dab328cdb06cc92911838ba98f0b4d
SSDEEP 24576:6D3FHshBIYQgAfatr0zAiX90z/F0jsFB3SQk7:6DVHeBIAAfaB0zj0yjoB2
TLSH
T19B75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/876-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/876-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/876-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/876-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/928-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/928-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/928-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/928-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1332-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1332-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1332-238-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1332-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2340-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2340-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2340-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2340-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2448-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2448-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2448-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2820-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/2820-76-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/2820-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/2820-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/2820-7-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/2884-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2884-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2884-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2884-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2884-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3344-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3344-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3344-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3344-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3344-328-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3344-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3420-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3420-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3420-78-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/3420-83-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/4652-327-0x0000020F36E40000-0x0000020F3700A000-memory.dmp

Download

memory/4916-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4916-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4916-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4916-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4916-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4916-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5632-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5632-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5632-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5632-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5632-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5632-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5640-65-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5640-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5640-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5640-278-0x0000000140000000-0x000000014020A000-memory.dmp

Download