431cb37923bd45447156c8a89bb4111f2cf1ecfb861abde328dff654708fe23d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260724-2shg6aef33
SHA256 431cb37923bd45447156c8a89bb4111f2cf1ecfb861abde328dff654708fe23d
MD5 a033435aaec31e2040928574955a5dc0
SHA1 2dc567359d89668e131ba91c2d4afb4d29e1e877
SHA512 447a6915758eadd243af280a24e1f2b23ea23bb7990ac604bdb60557a64ee2f349b4d5d9f798cfc010046d4e51082023c014eb4ce4f1be5f9d145558403b5abb
SSDEEP 12288:MUYJ9biBK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rs:5YJ9bWKY8fMCBTFKJo4IPpZThwS8o
TLSH
T121F4023136C180B3E663443115B8EA70AA3CFD720F1499DF63946A6F9D742D0EA39763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1308	elevation_service.exe
5316	elevation_service.exe
4236	maintenanceservice.exe
4256	OSE.EXE
3944	PerceptionSimulationService.exe
4344	perfhost.exe
4996	ReFsDedupSvc.exe
1572	SensorDataService.exe
4068	ssh-agent.exe
1712	AgentService.exe
2196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e5351dec5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd41b525bf1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000733341e2be1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfc8dce2be1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060fadae1be1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000532dfde2be1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000803804e4be1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2dcd425bf1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006168b7e1be1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1712	AgentService.exe
Token: 33	2196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeDebugPrivilege	5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5248	2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1308	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 5844	2196	SearchIndexer.exe	100
PID 2196 wrote to memory of 3032	2196	SearchIndexer.exe	101
PID 2196 wrote to memory of 2876	2196	SearchIndexer.exe	102
PID 2196 wrote to memory of 1456	2196	SearchIndexer.exe	103
PID 2196 wrote to memory of 3604	2196	SearchIndexer.exe	105
PID 2196 wrote to memory of 5476	2196	SearchIndexer.exe	106
PID 2196 wrote to memory of 5456	2196	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_a033435aaec31e2040928574955a5dc0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1656 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1656 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5fc0724976e9820f71c207157c345551d8ac4f4f859ecc6c37e86e3c354a3eaf
MD5 fafa0ec86123964df7e9c3725b745981
SHA1 0f5f88aa0941cb2a79585b62869cbd42632d816d
SHA512 187bc164500d8ab179e8c316fc39952e3bb3c1459283e7da963d9695c84765e9c1db282496a52f36a63d27876c1ba92468ec80d308e48fad4680a7e474580bea
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHsZBAqvpZlw:H3q6HjBhtA
TLSH
T1ADD59D03F2D900E9E06AD178D7469133EAA1BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5e2874f9ed2adcd0a8a78b032b744cd1ae12d47d0631accb2bcd37956ae6f136
MD5 6d616b69e817db03c048fe96cc81dfff
SHA1 3601e68c2f17e5126c88fd1edd821237964202f2
SHA512 169e0c117a1ebb6e2bf7778dc9b98d02ab5428ea69e7a44aaf241648c2da07ec56fbd11a9529f565a4b328c5501eb0f3a3779cef12af61d229a9660d8aa82ec0
SSDEEP 24576:5XYfDtczAKKY8fMCBTFKJo4IPpZThwS8x4:8tcpsZBAqvpZlw
TLSH
T15E05012977D408F5FC678139C9A2C501EB32B8910764E78F03E4992A5F372D8AE7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6c5a642a17a3641c4369f2a0c9470e856a56cd824a726c1dcfbb7fed9d05e1c5
MD5 fb8f9cb9c2c6bb164c6b269fc610da9f
SHA1 a4022a2a0dba70152012923ae3e9d6f2e835ef5f
SHA512 dd93b78194452df9ad64d06d81df26b1fe9cab64721eb0b38ea4808838a91f91c9738bef2bd09228bac678593c98e31a8407e40b4f518f6d4ee9759570409417
SSDEEP 24576:20Le5ji0hmxirMPKY8fMCBTFKJo4IPpZThwS84:2Pji0AcwsZBAqvpZlw
TLSH
T1A7359E66F6748331D073C0B9C5D2A69EED7130861B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a76cb6f34fa9738a99e527d29b2e0e7f558710b3054342888157efb7e63bd108
MD5 fae711e2af984f6cf1d7edd1da49ac0f
SHA1 19d1cbd3d55e8d07d1830dec759f822e5a5f57cc
SHA512 53da6fa62d212f36f6efa58243f787baaf144e342a98c0f8d555776233c46a6cb60c3c9d31369d505fb2c9d6d002041cbf27edae56b3310ac2de8358597e8b64
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyu5KY8fMCBTFKJo4IPpZThwS8t:T/ezSC6vUzPvxHjyssZBAqvpZlw
TLSH
T1F6755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eb863346a1ed9066cfdf96fe7f593ce1105265d081fb7e267084a63d5581dcbb
MD5 a84b174fe26e9624b291c36c9f63b467
SHA1 0321762afae481cf9310c6429f9dfa1af2d748aa
SHA512 d0d69e1baff95658d7ebaf3119b98d4b33ef62c01688a1cc0858bea9206834d5b97b5e08c3fad335e07e1b3fb38a5fde7eb96f24c30b43cce82c78d8f1dfb39b
SSDEEP 24576:FVbqPb88hv/l+6uKY8fMCBTFKJo4IPpZThwS8I:FVO88hXl+bsZBAqvpZlw
TLSH
T1E2559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1528794c799c68f5cf0c16cab2efb19bf27282e6500ca54336f5eb6b03bb35dc
MD5 700f22b4cdf331e303fb40489ae06f62
SHA1 013e8c1f011136d070917fc5d947b48238b593a9
SHA512 62cbfdcef460e296e1999b05470623e93469183e91d557e0a696873ca9d1fcbcf271ceebc8fccb6da4f7f0968b53b7f5a03b1081ed41588bc4c0d9c95fef6caa
SSDEEP 12288:bRzK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rv:bRzKY8fMCBTFKJo4IPpZThwS87
TLSH
T1A6C423A61E495192F2478572A16EFE08BB70BD91084CEB081354B85FD8BC5DAFBF7342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d3870d3460470dfd01c011809ed51946067e9e9ea1eafd7403666bc76cf7ae1a
MD5 d02f18a76842995afd09717f0d88504d
SHA1 4cb9998b34b081f9137bfe0e86152579501af2b9
SHA512 dd0f3189b27fbe510fc6c5475b1c78e8257c32cdabbfd70d55e4adc7dca868916b92b0ee078d1f8772a401f688143af9f541e12c1e12161bba60689a7ebb93a9
SSDEEP 12288:9eBNUbTVO86U2K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ro:9JIU2KY8fMCBTFKJo4IPpZThwS8s
TLSH
T12D05CF3BAE28FCD2C27A8DB95791C600E77278704F21A3CBD164820EDE275E15E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 92eb00cd4b4891899f3bfba2330b810bb1a49d560d68aa828166e3f5377b83de
MD5 af55f86794c49a45ac0ef4ce5e2662ae
SHA1 f225985b73591a7c11d4c703963028985644fb1d
SHA512 f0883d929f4c4fb942b107ba78e808a3471b4b5f644255767ca3013afa69be811e193025fd877960224cbe06b7d813a80354cb7867ab3d1f14f983fa0718d1eb
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:sQvGAdlCEL8c/yRNw5CYtA
TLSH
T197266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7b20f30b2a815ead95719a257beb6030d2353e341df8408ca2d4d8a2d9626188
MD5 81569942472b3ceddbbffa167661aff7
SHA1 8507795809553dff4248ea194266c869f60a71b6
SHA512 7e2493aa988a995250f00d28149af689458430670b462833639f2f1b8c0f74fa824c3c3f0dbf74a8cd4486e1f0235b3bf68f8c1d67987dd336cd8890dd9b842a
SSDEEP 12288:wAwSfxL/2Dc34DLLmt0LDQewsAjAK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThw:FdewsAjAKY8fMCBTFKJo4IPpZThwS8A
TLSH
T1BA15E031FE74E032D27B0DB21B36D706683CB9600B511AC3E3A89D9E99742D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 24e406d8d481357b7db627e3a338513afee1625e446d0e8dab8bab39c9faaa60
MD5 63810031eb83a8e05a4ebe3b394ab694
SHA1 3651ba5f3f4cfaab01fe2e6b2755d452943739b5
SHA512 2814f44cc500d46eafebee1335191c7ce8f307f4ac48bde7aea3145e0352a10324aba3d128337aca04c80d9fe05244732a5922776412376ff8c5736487d03fb4
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHT:gUEtQevvqc2W1cpV2EI32T
TLSH
T103474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 83abb9d3c0d1d7ded551a8d83ecb4e307b740d8859aab4f10794d90774544e34
MD5 e508d56e7d431c2eddeb66a72ed8eb67
SHA1 a8f45fc2b596374e3c6f45b0848ae241152d9639
SHA512 6f07be75c4a9b33d48581a28b61b25e8dcf8d25cb75d37eb6c8e419afeeff813090f3fd1f62c2ecd729fbf4d192d4181dd47a22168bcabfca5e0107f527e4742
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zgsZBAqvpZlw:qoquVjnmUtA
TLSH
T158D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6ac88f8695a79d4ced8c4ea01719767b1f96824680cde5bbc4df4435b38e75e3
MD5 f4168f44834fee1bc59156c5cc32cb50
SHA1 6045b347ba670682cc23932041d747717dce7f32
SHA512 33879fa522692f936bc71476cf2c347bada3e73535f8da633fb8f2345e2d6454f1b492dd5d818f3e0500bc495356e263f2dc1bd332b5841cf86b9bbfd40e36fe
SSDEEP 24576:TAhGLJIFoiwtA5l7S53lKY8fMCBTFKJo4IPpZThwS8C:TAMyFoiq5VsZBAqvpZlw
TLSH
T160359D81EBF955D4F5B3AA7899B69570EA72BCA65E30C20F2150D11F0E37E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e9b18c92f8f59bcc923eb112c1fbef9b40a5a550dbd7968ccaba269e7dc98672
MD5 1a2425d57b1a7821365f5f8913813461
SHA1 9a324202bc3f591bab20d717052f2df47047ab09
SHA512 f37f1e651d147a4ce71c5adb5bdc6ce7b1396d088d98392f5516791866209f7610067f95cde7ee17e111363263c8d1637d59f95710baf0ee687ec9673c21b7e1
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+CZK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rC:AwuoOWMKY8fMCBTFKJo4IPpZThwS8u
TLSH
T16005F14A36A40CF5F5678139C697C535F7B2BC022A25DB1F1360C65BAF37261BE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6668ab04f1bebe181c703e662f566325b704d2782e3fb45e2db544af368a00cc
MD5 227aa0acbdfd12fc65f309b48163d912
SHA1 58029877baa15eecb1786f45273c9886354444f7
SHA512 885854b518a93c832302cf60dc89c9e343d4e69fe14c87872666b6d12990f313ecc20abba57891061cfe71597b12e780ded8c9ccd69de03d20faffc924e3e86e
SSDEEP 12288:uBZ1IyQK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rS:oZuXKY8fMCBTFKJo4IPpZThwS82
TLSH
T18AE422AA37D420F2F1538139C9F99A04F7707892173583CF1224556E5F7BAC6AE7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e815081ea0ad98297027ecbb5b062647eaf7cf4b4096cc3dc8c8b1988629b567
MD5 27e2798c69c448b1db267b9be091698d
SHA1 2c3f1209cee549f596251675170b66a66a24b418
SHA512 e580b9e0cfa561a3c96cc242b69c40baa989fc0b1012af586069e8d401489e0518aae3cbd5990a56160823c881d748e3243824f6138c35433a99e54da888daaa
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:oQRQyi36YOcPQLvw2gAf+PN3FtA
TLSH
T1E0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 814378939563c97f754876f658f219db40f7835b6c5c1ad864d773500ff187dd
MD5 2395465f3eb46f74c1a9c044965e1a58
SHA1 6675ded19f77a655d10b6e498799418c7db24b54
SHA512 9d6a78754ca925e528898a8f8cbb680bcb3e144701babc2c73388c3a8bacf88f6fb81871bf68f8e8cac6ce58d5cb13778a46f096501d3a33ff03c4e26972ad33
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:KQRQyi36YOcPQLvw2gAf+PN3FtA
TLSH
T160667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 06125c49db3a3687fd3128ba3e64bd118340d3ccd22b4ba1bc67a0431cc93250
MD5 69f2d80eee77e0eebcde2be5d923099d
SHA1 d2ed9cb8cf0a35f6dba88952fdffb1a83e8fbd7a
SHA512 d8378ffa8f608f10cdbf8fc4b53432d15a3914b9f7f1b35f6e588ccde44c25c06cf39353803dc860dd98fa35b1177e606e0c7fc74a213e538609c6fb2d6d3d4a
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HKY8fMCBTFKJo4+:g68Qg55nhheWu7PNU3/wsZBAqvpZlw
TLSH
T19BB55A33B2F60099D44DE1769F4A972196E17C718FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 984b8f445c86aed4593dd71dec8e979b82ec80317a4408ae9b45d7ad6d5e1f24
MD5 e6f7a2577374c2ba1b1081dfb9f35da4
SHA1 c4463540427ddea134ca8cbbc82992d74fbc3935
SHA512 4626b9a43e0fdadeb7ae5dbafb3947cb5f9e7e14fd3d2979ba4aceee83a91870134a9d970cc4baeaf8757ff99f34750aef2a17812edeeadbc996aad14d15ffa5
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Fy5112gYy5azzVvL69nLKnhZKtA
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0bfd19615382372acfe3602e702adda84ab2df71a08cb053cf7d8d1d98eda78e
MD5 97d7ba9ddcbd675176b95982bd8d1fb4
SHA1 78eaf148adb60483812848d21d0c16ab9bb67a22
SHA512 bc74994c0063eba9187ac9ee94d70d3f0d652318cef5c10124eccdfb26225d51e9ee287fa3c0eeb9b6a23dbc86b4ea02d74e6e21b56de11ad08e84f8c4470ae2
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6sZBAqvpZlw:Cu6JmVxd2d9tA
TLSH
T1E2D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ddbaa937d22541558e483b576af97920824270d4129ad14a076f322f6a532476
MD5 e9de02ee5abb085998af6c39246ea6d1
SHA1 4dd202300cd5dc38a8666490d0d4618bd0887e7c
SHA512 a9eb1bac89f69485d4281f3ea211a3f8fcd09c15af3718647d352375cc5ba30f1ec415db5989edf9f37864933420b9daa4883b029e7f68ea79173e77b165dc3a
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xWsZBAqvpZlw:NmifPbRUtA
TLSH
T1F8B5BE13F2D900E8D05ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9f4241ffdcccc8f263840630349f74c76e178d4d5fd979e5d068050752d9edf0
MD5 7005de93c0a27563004875a26a2bdc5c
SHA1 373326d9aefd4c8522de5f31f9df34a036e6fd40
SHA512 f4ce25104865807ca255a145026c5d229830b2b2e0063e48bc8b82e02c33efffedfc5be4343e1ce2950807ac269ac0cad9d6721ec54f44ab0268a00b61e6aeff
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqXsZBAqvpZlw:I5dKTi61OtA
TLSH
T109C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bdff033a1d93c6397e84ec74b4a21bef0e2db3f9b62f58d72087592b398c31c0
MD5 d592819271fd0666a852b636325a6803
SHA1 61416b341d70b05717b8cb23076c1efdb7594278
SHA512 10630b69560ffa4cff35122ba3703255efb5e8657b2da3cd6ca8b55b112ad6baa9b02ae5f0b9eeecef9ab4ecd8322b1acda4414b360aebb38700a89eed37dca5
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wKsZBAqvpZlw:pX2iyphAtA
TLSH
T14D95BE13F2D900E8D05ED175C7568632EA72BC160B38B6EF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9193c26bbe2f7cf01bfc83d8130a78998423fe9caf68354f77d24916f1cb82bc
MD5 4b10c47ba585173e6124e5034839b57a
SHA1 f0aa1a8a5d48aa3536c24e05a0fbb8de8f9e01bc
SHA512 49d70f0f09cc473db670ba9ef61b0bcacee8869ac173bda3288e192f1aa81aea7d41bba42f6a22f9227322f24697a6c30014ee3d2002e5a1b5b32b9c85e580ba
SSDEEP 12288:3bK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rg:3bKY8fMCBTFKJo4IPpZThwS80
TLSH
T11DC423AA1E494192F1078172D16EEA08BB707DD21908E34C2349B81FE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3d0e9cb4ca5294716fd3d7a25777b76edccbc86fd2746813a3dc95bffc0f4ec3
MD5 f9a6b971ee1c0d08433078ddc60940c4
SHA1 7ad0c5cb056ae0a4ea1f7f50737ab2b0026bfd0d
SHA512 4df58cd94635e88505cedfca7258f908dcf5d0db6593c5ee73ac2be73ac3fe186a34cf049d3d7a8df821a58a550ae09af1cb9d8439bea5dbf5cfd0e2c0c41275
SSDEEP 12288:+kK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r5:+kKY8fMCBTFKJo4IPpZThwS8d
TLSH
T115C4236A1E494192F1078173D26EEA08BB70BD921908D34C3358B81BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e1e3d8434605204587e0f487f4b9fc6b5476555bb86e6b9704ff7172833aeab9
MD5 1d7a6e6625038d57357e6729d04d4739
SHA1 49d633cf7fedf28d842e24c7411767a164029b64
SHA512 62302cbd3027e317cfe7fbb3ed40aaa4e182c00e41352bb6c34a12a92454cb320d6e449cb05a4498db79331afd3320096c4d5362081998ae6c94187088c050dc
SSDEEP 12288:NeK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r5:NeKY8fMCBTFKJo4IPpZThwS8d
TLSH
T142C4236A1E494192F1078173D26EEA04BB707DD21908E24C2349B81FE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d24167cd212dde4473cc0ff5cd785e5961b7acc47f6ec956f3c47ab8f798ba72
MD5 f267c575c4f8cf8d292bfa41f20ebf9f
SHA1 6ed4fc094da8057c32a5969203068e08df13be3b
SHA512 7deb575c66972eab50ec59091253971089a0164732772a588c4731b603cde59ee16ff4cd102bb7a8e834cbcec4ea34775751ccf23efa4a12a64d2ead3bde6f4e
SSDEEP 12288:9VFK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rG:tKY8fMCBTFKJo4IPpZThwS8S
TLSH
T116D423662F5901D2F017C172D16AEA04FB70BDD21A29E38F2700681F9DB92D9FEB6741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 03fa37a5b18b04f41f86047995166cc47d50b487b6e21f4f9cdb8aaf461d0b24
MD5 7befb916a26db284fc2d3fdac61ccb80
SHA1 80065a944bb3fcdbe851b72c8414dd7517c764b6
SHA512 4198b0dd849c01cb18cbded007bd6115d40a37d90be06cf4b937e3598cb31f7f0da3a6eb2db0252fe4f4b15b0ff0ded0128d2168cd9fbc4ab087f9af1a3def86
SSDEEP 12288:V9K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rH:V9KY8fMCBTFKJo4IPpZThwS8z
TLSH
T15DC4236A1E494192F1078172D26EEA08BF707DD21908E34C2349B81BD9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9abd2e9ff167d01cf5ea642dfa5e719ac23dcf1a67aa4ecea3b11ada077553a7
MD5 25ac84d1ea4a9d14d193bdb4112eee0d
SHA1 de6c3befbd387af690a792b608b23ff482f7a2e2
SHA512 00e69b2b70ae16414c0a5aaa7182a66b1f5a122f0951b694a908ebea863079cc3c5365bd066c9591feba2ce1beff4911c99af123918a3e793b19f09018be807a
SSDEEP 12288:noK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rH:noKY8fMCBTFKJo4IPpZThwS8z
TLSH
T169C4236A1E494192F1078172D16EEA08BB70BED21908D34C3358B41BD9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f3a0be17792675424afc3263b11403507c768b95c2d9c1e01e42ff50de55954f
MD5 a5f830f8cd14ab5a13c9e5cf90659210
SHA1 20d266793a78d6c5b85fd257483bfeeb7ccda646
SHA512 8b258568e95fbd961041521b3a2b23ee65b3a6a2b97d8dbc5cccae63e13888881566fa3bb5700b1372445037cb49964c868a90fa71eab95b7fb4e52323f7cdfe
SSDEEP 12288:z8K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rY:z8KY8fMCBTFKJo4IPpZThwS8s
TLSH
T1F8C4236A1E494192F1078172D26DEA08BB70BED21908D34C3358B81BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d2f42ed8c4219cf9105017a325a5c2e7f2eb56ab09cc10e8eba7a715f6424e2a
MD5 911c67b1a90a85d408416736c73f8d79
SHA1 31740efb19d156bc0520d3e256f1130ce1973663
SHA512 7482ef64a46d4214c1114e04919aba6c0f8ee16a1a4d7ef9fcf340ae58de4b784cd4068c2ebdef8d090a11083dfee3b02c4ef2b5838e3015b4c8ec8ad023641e
SSDEEP 24576:yZMSzFVSOEKY8fMCBTFKJo4IPpZThwS8D:yZMSzf4sZBAqvpZlw
TLSH
T1F40501A5739018F4FC63813EC9259905E6B1BC5A0B60C70F13A8362B5F373A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 817a377b2133c61489b4b9e77aac153130cd65f2f44e4e90169576f178149245
MD5 97f4b289b50c80d9955129881d2a2eac
SHA1 f774c7368933a7bf9916ac502681934acfc39b35
SHA512 57d21eae5452c2f338811470cd48bb547c6efe0346fd12aac07f85be519c8092aa00e5605c28f6bf2e39532d3bdcf6cc44b24c688e3944de54352a743fe531e0
SSDEEP 12288:qnK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:qnKY8fMCBTFKJo4IPpZThwS8s
TLSH
T1DEC4236A1D494192F1078172D26EEA08BB70BDD21908E34C2349B81FE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9bc24b0e24a183a31883b83b743721c95f3028934b2443b3a0b1b8b821fd399b
MD5 9794b4bf4fac7e329a1a13b769250dec
SHA1 b67c207ab3bce8ca25737bb02d8d84d83e04c038
SHA512 a7f76d5594da1c05b843baf2e304de6fc028f8d392dd59b41210a2f611304b46a68e791f6038339f0601b37d5f4af61ac997cf3bd551a4786cd0095c082b302e
SSDEEP 12288:hDK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:hDKY8fMCBTFKJo4IPpZThwS8l
TLSH
T1AAC4236A1D494192F1078172D26DEA08BF70BED21908E34C2348B81FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1809cf6c43878fe4cb95b6de8c8ae8b32945bb7a57fd7a7c2810cf3554e519b5
MD5 f653acfcd647464787c73ad4235ef444
SHA1 8c9a6e767de06a400125b166b90f3ffeac870086
SHA512 35c8c923d59aaa8644af2e50d643f58392d587d4edbbf376712e1a64e4bd52a9bc6b495d4a6d6ad2e7251bc70bd3d8bfc0d59b368990cb2ea359eb7fab032cc7
SSDEEP 12288:fyPz5L8QK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rX:SzyQKY8fMCBTFKJo4IPpZThwS87
TLSH
T13CF4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1cceb2085c41d80bc412e7795d142b09ad405c845452ab35febf8bbf71e59d11
MD5 57ea2db888da95554ca7e0636db5bbe8
SHA1 69d4941160faec8dc80307ed5764bca588ce8294
SHA512 1f7d94a08fba055e58741ca8f6cb047adb2770ab317ff1c2984c3e16fc8250edee9e531b25236f6f96cafb762bbd8900783a5cb738aada86b7c992e5fef25639
SSDEEP 12288:BnK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:BnKY8fMCBTFKJo4IPpZThwS8i
TLSH
T152C4236A1E494192F1078172D26EEA04BB70BDD21908E34C2349B81FD9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 56d9c3cb0f279870dff48a7aeefa4ab372e777f47a74a4a6911e9fccb4d982af
MD5 5727fc06c5953f195924c4ae37aa3adb
SHA1 602224d1a22c40a5655e64ac4ac7dba1e0eed119
SHA512 5c773d9a14ff77d115f9d6bb2160b189f7b15d285c5c4919a491e04a469048da226693e5b7d1a932e666c5671044ef8abc157bdcfd8b5b12435ef97442919cff
SSDEEP 12288:ynK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:ynKY8fMCBTFKJo4IPpZThwS8R
TLSH
T1C3C4236A1D494192F1078172D26DEA08BB70BDD21908E34C2349B81FE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f333893c2d046e49030268c81329011e29d0464504b7cb0be653a38e424f05b9
MD5 f5a1486386f51e07b56191a59a3881e7
SHA1 2b5d934cd68ac8529d90968f73793a8e13f1d09f
SHA512 006a50dc328fc2573261b04074589ca4c6559968780c04ef1e589e6e0957e3045dcfc42ae088ef750af35bbed0dbbd81019a88b4e1917a28b9c0afe5ab54d7c0
SSDEEP 12288:WyPz5L8QK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rL:rzyQKY8fMCBTFKJo4IPpZThwS83
TLSH
T117F4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ee275a2b0131eb3ec829a8fbb77a9066d844119c3689137fe4a353047ff863f3
MD5 b8fefc2d698588bbad519ea636cd16a8
SHA1 69d0ff0a2255b451c213dd0a19f622cc0a6e7a8e
SHA512 6a2893cb44b7ec6c85a5f4ffd9b6f577c6fa4ceb48de5ec9582034950e7c731063a57c0e65d0a2f565247a5d7552be804803d44f7d6a7988333572660462b8a8
SSDEEP 24576:KTHaLl3z0zDOKY8fMCBTFKJo4IPpZThwS8j:KT6Llj5sZBAqvpZlw
TLSH
T1060502A5735018F4FC67813EC9268906E6B17C5A0B60C71F13A8362B5F373A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e8f599a9261136d4f9b8df11745c8fa354b1720b6e9d001f2430a53f0aad33a6
MD5 2f40e439fa3230ac86566b5ad32da9b7
SHA1 60d831d9da6fb9275d467e2d1da165bb7519b831
SHA512 48be545ed62b7fb4adc9e33d32162a728d552d652ab803051802077d770656e521b96144611e4ee91ba8804b2b3836d01f251867d0de2ae229c2206ae0b31421
SSDEEP 24576:937d9CHKy7GZyKY8fMCBTFKJo4IPpZThwS8i:d7d9CHKya4sZBAqvpZlw
TLSH
T1D025CF90F3E410E4F0B7CA35C9769511DAB67C9A1B31DA8F03A8651A1F336D19E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 18fa676c58526258c9a53d9ea1af4c717ede1c2a481d1905ff2e3e7e72c590b3
MD5 33777d99e78f2c95cf0157b42d41165e
SHA1 3d5eaf1cda7e19d19b7282c339ede833ee96677d
SHA512 18c67c09f0402dc989063868b61e68314eb3ae691d3b6e6d7c574b044312329e03459a0cbf63e481e17a3f50134b7a55acf40b97f7c39a88962193c0b5c5850a
SSDEEP 12288:i+K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r1:i+KY8fMCBTFKJo4IPpZThwS8R
TLSH
T15FC4236A1E494192F1078172D26EEA08BB707DD21908E34C2349B81BD9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 34d2e1cea507be0cecfacd396b83c9cc5e8706615f6bd2d0a2c90145f9b5e823
MD5 fda3953333bf6363e37d59ec3e830745
SHA1 10e2eea0998d382b56aa3a653d19890f112d48f5
SHA512 0c56b3691ad402712bef87135666fa297989595dd42b91ccf6552eeab074f81b41c32a2f9820c2dcd3678190cc274dd59186c05c3486f45485f308bac15ec6a2
SSDEEP 12288:gwK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:gwKY8fMCBTFKJo4IPpZThwS8S
TLSH
T17CC423AA1E494192F1078173A16EEA04BF70BE921908D34C3349B81BD9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f3a8029405404ba915f56c6ea75e70bcbf15cec74ea936e9824cf3ee4a00c036
MD5 002fab985d8ea81ae30981ecbc6b151f
SHA1 8cc39c1c7f45a312e22b23a69cfe3f9f2fe823ff
SHA512 68fe89cb32f5f4c997f4bab0bb4b8e774c6dfd2949a011823be28293c2deb50e10bdde209e5286440ca939520c04774182ed752d143e98b6b6f35af3e0841b9e
SSDEEP 12288:wxK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rC:wxKY8fMCBTFKJo4IPpZThwS8W
TLSH
T17BC423AA1D494192F1078172D26EEA08BF707DC21909E34C2349B81BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ea243f55273947c04a8d3229f8e955965be487a6b2486868ece0b72a5c41d823
MD5 5a226be3814d5008b65b680195e444e5
SHA1 9f36fee5e3b7baaa0ac652b850a973dd3dde2a15
SHA512 f6b5231498ddff08e98bb821902b8a82c8197ffd792251d196583b9aca6814038432f488b518c5c36c49a4540db1ad28e387a062fcd319aec738c6aa74426a76
SSDEEP 12288:tnK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r1:tnKY8fMCBTFKJo4IPpZThwS8J
TLSH
T1D7C4236A1D494192F1078172926EEA08BF70BDD21908E34C2349B81FE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 194cc57dbf340ea535029b40d0d24bb4540a6508b45b27cb8736de5fd922611d
MD5 553368653c2c3ffeb5e257b36a20032a
SHA1 820151db700da0dc5a1add86e6faa10b434605f6
SHA512 6d23d9688e84d0425761fad77000a618de0c99700a3ca1f4249d6a66a42bd17bdc8e3cbef1ba105d84c7627b3999a3b083ecdc76b57a3a50506573b73dfa0de2
SSDEEP 12288:A+K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rh:A+KY8fMCBTFKJo4IPpZThwS89
TLSH
T1C2C4236A1E494192F1078173D16EEA04BB707DD21908E24C2349B41FD9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 18bbc716583ec32b4d9a742d952ebce96c294b237afa5a95036556fc0ad42825
MD5 90c61b9e6e4aaf9e37f21bfd2b47f12a
SHA1 30d2ed9733e7e078418aa65a25eab1953c66052e
SHA512 8c567ad1cbb4124920f50f04eae1f8135af8856ec5730089f728a61d1dd67e536d0e457746a8791279ebdf86d37088415a78fd3077d04aa3a01e9548ecfdb59c
SSDEEP 12288:1/K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ri:1/KY8fMCBTFKJo4IPpZThwS8u
TLSH
T108C4236A1E494192F1078173D26EEA04BF70BED21809E34C2349B81FD9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 49bb053956b4ad7522a09a806d6408f484bcfe5b1c080556b1d3d6095f150277
MD5 9faffa76bb505629a3bcafe93cc46527
SHA1 5d205146777efb1a6e6e68f575009d77725c612e
SHA512 2fe2e7800b8d3dd31329b6b9cc4329cb770dbfa69346f9cff5f1ccd20a1a3767d6cd762591141f7f92002c5a6bbe23242594f262d9570312aedeb77c1291c345
SSDEEP 12288:U9K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rG:U9KY8fMCBTFKJo4IPpZThwS8a
TLSH
T10CC4236A1D494192F1078172D26EEA08BF707DD21908E34C2349B81BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 357e50330741e624de1bbea4429f600f7cf8b538a813cc8af3dbb54a45d2ff95
MD5 b2cab7f0ed46d41026cee504ea539960
SHA1 c2bd686513d491704d6ff74467b43a0f68e1df2e
SHA512 d2f50d6ba272c7be1d47893b1036dd73a402b7236cc2cb173ab45daec242d6c46d8a309db3c683ee3ae0a9fa7f508c95f58277d0e7dae28fb84975f7d7035ebe
SSDEEP 24576:2fwvok9RX6wkyAITKY8fMCBTFKJo4IPpZThwS8E:6MnYITsZBAqvpZlw
TLSH
T12135DF29EBDC04E1E177913C99B7460AF6B178591B31C2CF129A536E0E37ED4AE3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ca573da517213e82b4373cfb2d052ea46a20cd2ba125303813cff35bab07dbf5
MD5 c8fdc2e209840918c5f835ecf72f1076
SHA1 f4339d9f7ddc82410ca7c6406ddb9d27ae588d4c
SHA512 8157017af7fb30c9226919e787f62de7688f90f9cf48af97094753e4c29c8e3972242841beef27df28eab4e4d40a0e4e61505f6fb4f5a529c747d3b33558f7c4
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qsZBAqvpZlw:OySzPltA
TLSH
T1D2067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ea0f8d0468a31ea6d727e33e44d21615be288bc217e9cbc8ba1d1ee272a3b20
MD5 749160e4ef95211e9eb34be6725302d6
SHA1 694a33b9afab5f6ebe69b3dccadf1e66266ae45e
SHA512 94e519124642428979944e22957c5439d061d58e1448de0eeb7cfe9d3aa38902d314394ef68b45aec5acde3915324621e7c5f29d64f9f51c17afda4a12a52f5d
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUKY8fMCBTFKJo4IPpZThwS8y:H47JUQj1irIhCnDHUPfF/6sZBAqvpZlw
TLSH
T11665AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270837D6F67ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f99829d9faff6606465fbb193d98f194814965793656c4770d78e35212f98509
MD5 a63d51227281e07ef2d8bc69a6099d9e
SHA1 a6c7f019fda486454e0ebed4ab0916bda5ee202c
SHA512 4248d29fde1a8cb42be5c715b95d32d75a556485a719a22e36695b9e02b25857f7b9a99d10d78ce9e20e6dcb5fb2886931eaaac014dbd7566a6a403fb2e1e7e8
SSDEEP 12288:bNsfXK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rT:YXKY8fMCBTFKJo4IPpZThwS8v
TLSH
T132E4F05AD29802E5E06E9176C7569A00B7337C6147E1D3CB23C0F43E1F7A695AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0ed282289600eeab79baccca1bf5debe45849668960a0a5d202648ba1db14b76
MD5 b3a60f01b7d72efb5e442bfb6efbfa6f
SHA1 beb26839fdd635a26571a36f85b75b20783f5dfd
SHA512 ab3622d368648ec4813527907142471cb15d5617af7c58154eb189908d7c9906fd7cff5ddb88099cb32ed846d6473da36cd749fa647d65600c8cb4f039e5e3ba
SSDEEP 12288:1QDPkU3fETgDPUWJ+N6flAyMi0nuLA2rh0Bpkmba:1QDcUPb+kflAPi0nus2F0BJ
TLSH
T16F350640762BD78FC6A944321E36C6CCAB70BD01EE059F0772C9573FD576668BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 e4fdd88b3d407ba4f2b9db6f28d91f37146d22407418e6740de0c65d49191ba2
MD5 d8a1a4bec51af6ba0bc553b4c703cbcf
SHA1 80ec7ec9aa2bbdaac90bdc2b4a4ab92d7992581b
SHA512 0a35c1d94de8cff24b85eab32b4870409f01f0819adffd584af2765fcd7926bcc25f9ff357f0c0a11a4854181456e5df8dd8e3648c80380d0d379e1517538dbc
SSDEEP 12288:REXwOrIDHxBhRQkOD/o2rWwP31uzc5aGfTBSMt7:REXPARf2Jd1ac0YS+7
TLSH
T13D453B40A4A7E35FCDBE9037473686CDBB746C07B7452B0573808A3C986767EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2ce574a3c0c5ee4b1ef63df2b03f8104b1c28dbcdb5c613a54aac95259ab2473
MD5 cae66ac60ed6842f50483baf2b97c60b
SHA1 30de376583ac517e1585027d2c9cca3f513e1b85
SHA512 f347f1c9ba6992ca7ba03af813a54d31dba521d48701a20ccc3438e02f25c6c93be75d1f6da955c301269cd2ce5002701c4c50fa2c57c7dbf3358a067dab12ab
SSDEEP 12288:007vK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rJ:JvKY8fMCBTFKJo4IPpZThwS8N
TLSH
T14ED423661F495592F02B8572916EEA147B30BEA10F08D2CB7208745FE87C5DAFEF6306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e2ddfa975aa9b9b670cd854cd469e0319edbeba0823491f6b5506899fa7bc223
MD5 61f9bad7fac72488ed72d8d9f5449504
SHA1 d18a25ef95262ee3137881ade9506d2367ee4902
SHA512 2968ec5c67134308fe3b9b413d4236845c2bc0d17b3a3ad471594f391a4b3ec04534091eeb552da85baca09ce626973185b8e8839db61e94f29a9a866c33c6ce
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY5KY8fMCBTFKJo4IPpZThwS8O:vgb4mBIBhGFUsZBAqvpZlw
TLSH
T1AA659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 265fbb425c8bec27e9a051e1dd15175fc85fe2190171cdd390730434b30a49a0
MD5 58f230e9d0d4e1cf11bb88a0aea3ab36
SHA1 16f3f57cad9dbc7d0566a2463e38ae99fb11336c
SHA512 48209ba2a572cc567e7757cc2f389a5ec9b400911e91ee70ffb91474cdf75dc5d445c5152dc259ed5e0fcfc5b73d2ea2eb5ac9d3795465546d33b3d0ae94ee23
SSDEEP 24576:AG88u8FpJqH1bzria7/mEKY8fMCBTFKJo4IPpZThwS8c:T7ZFPqVea7/RsZBAqvpZlw
TLSH
T1A035F16577E101F1E07BD1388A864663F6B1B8210364EBDF07A88A561F33AE54B7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 7677d9c77108562b17e9d70d34e31dbf60e15f4b972ec38f8652b13e1e943f5b
MD5 f4ea81248aaf274a9f1af9b0716d8f01
SHA1 8922f12fd1fc14df8ddd24e1b051729d6c8726bb
SHA512 0a2c67700794827772d7be8eb94e64d136c97304fdc5741e6f2340ab76b44f9ef388413ea37104f4a15b6fd725eec96f3d09a608e7655ed0661b2ce984dcef26
SSDEEP 12288:bHvUrBFrEjwaQ4K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rz:bPUr+NQ4KY8fMCBTFKJo4IPpZThwS8X
TLSH
T14C05E12F26AD18E5F676E17D85868709F771B8620711D2CF02D0817E4E77AE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d15f72fe74a6b2cda3452bd2831f47304fb50ddb0f34d0c82640c164dd91c108
MD5 b5dd4f4fdc7533d515d1b45f18aa0214
SHA1 7452806f7d3dc5bcb3dea8f128435fa5618d54d6
SHA512 4ee04c9d53c9d8d5ef128032f2b3751b3f12fb8bece93cc3423e57f8bd277d6f29670f0d0b14f6bd58f58ab6fefff5b891e7daa5db3e51dc049c0587b5d11446
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjosZBAqvpZlw:MG05lO43bStA
TLSH
T1B7D5CF6E62EC11F5D1BBC17CD9C68A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2f2168cc876009be747b24ae11c1e52b6157fd8e941e4e4ce35a09427ada3af8
MD5 8ab30a7d254d1d78de3cb4af262201ac
SHA1 9603615b6c56decaff2f350a3025f850b14d8b07
SHA512 84e72274ffe77eadaa369d7a417da2237a1d5087f24de46be74e89df2b27fa65d9f5d45b8472a20f02c2975b5517c403054d685d7d58d4b84d992d50121c272b
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqKY8fMCBTFKJo4IPpZThwS8H:ya5POZ3+Jt2pasx2+mwsZBAqvpZlw
TLSH
T10E65AF5EA6EC01D5E179D17DC583861AF5B1346213319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 82c339c193e11c44aec518726be63b6233850efd0f5403c152ffd8bde2531faf
MD5 cf0a82c523d4d522d31bb7f185cbc374
SHA1 820b81746fa822ca22718279dee15d83cb712579
SHA512 55fba19d4657db7ce198714e83196f76ca6e3d3bf2a74753139400e382117a763323d86c2948c166e33f805a3ff0058a3b606c84d668157a155a213f983145b3
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FksKY8fMCBTFKJo4IPpZThwS8t:DNc/zEOVHFxsZBAqvpZlw
TLSH
T135857B2623E901E4F1BBE1BE89679546FA717865133486CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6a00f26ed60cee96a5b2635897bc128450ca3d3f01cdea524284eff1bacd024a
MD5 780ff38f332e44aeaca864f37b26ee8c
SHA1 e485de63be26ffc9b7019145a55f96116e180269
SHA512 794b0e9e57f95c4e2187fc66aa72bb6a3de89aa14b23ef0a7822f901db5befb6974d5ca24ff2262a50b7b9643b48011a1e7553fab6a92d9f046ed060f26937f6
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmGKY8fMCBTFKJo4IPpZThwS81:m8MwBtOmGsZBAqvpZlw
TLSH
T1E155AF6E7AB806E0E1FAC675CD238512F6727461073293CB5290C13F4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 89a261cb240f395629805ade48061cff81433988eaff8ef6a19963fa57aaf840
MD5 8705ab3e5be9c7efd22cc5242cf4eb1c
SHA1 d8b62e6b8a20aaa45ce359301a7e88a723fe58d5
SHA512 fcf92cf5e9c2300475e20f49453164c4fc8e145b087b06ae182be88141fd93ce5e6d8ec4625d956eb7ef34136d29d76bbc14252d582348112e2ac243432920d1
SSDEEP 24576:hD3FHshBIYQgA7KY8fMCBTFKJo4IPpZThwS8B:hDVHeBIAA7sZBAqvpZlw
TLSH
T13B25E17DEA5C04E0E57BC1BCD6638A06E77138A9032156CB12D491BA5F6BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1308-13-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1572-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1572-305-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1572-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1712-120-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1712-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1712-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1712-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1712-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2196-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2196-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2196-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2196-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3944-285-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3944-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3944-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4068-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4068-304-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4068-105-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4068-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4236-44-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4236-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4236-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4236-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4236-38-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4236-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4256-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4256-54-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4256-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4256-269-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4344-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4344-298-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4996-319-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4996-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4996-80-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5248-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/5248-76-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5248-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5248-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/5248-7-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/5316-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5316-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5316-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5316-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download