601ac5e4ed9ae9329e7501d9a521c9b60dd12c1f9788f74c0cc9ec6b4b339074

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260728-xte17stdmb
SHA256 601ac5e4ed9ae9329e7501d9a521c9b60dd12c1f9788f74c0cc9ec6b4b339074
MD5 176896fb6f428c008af3cc8b7a31faca
SHA1 75185af51df50a3cce1693ef09e703fd339d5d4d
SHA512 9ff9f4e0e77a8cc32f9246d47d3ef908c867c1aa7fc4b217c0075f876d70785ad858ff77431987f477fcb491398ee9538806f9d6e21c5e63ce9b6a3511e17b99
SSDEEP 12288:OUYJ9bimrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/YJ9bCBMvjRA+iqMIjmJ8c+hE
TLSH
T19155013131C084B2EA73193409F8A7B2866DFC766F2099DB735527AB5E342D0993DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3140	elevation_service.exe
2776	elevation_service.exe
404	maintenanceservice.exe
1380	OSE.EXE
3008	PerceptionSimulationService.exe
2672	perfhost.exe
5896	ReFsDedupSvc.exe
3236	SensorDataService.exe
5692	ssh-agent.exe
3232	AgentService.exe
5284	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b538f1e209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ec2bc8c41edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005e3d285c41edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e426787c41edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1b4e3c7c41edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a1c6886c41edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000202438c8c41edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7f33287c41edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3d83986c41edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc5b8a86c41edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fa66b89c41edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3140	elevation_service.exe
3140	elevation_service.exe
3140	elevation_service.exe
3140	elevation_service.exe
3140	elevation_service.exe
3140	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3232	AgentService.exe
Token: 33	5284	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5284	SearchIndexer.exe
Token: SeDebugPrivilege	2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2380	2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3140	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 5300	5284	SearchIndexer.exe	100
PID 5284 wrote to memory of 5852	5284	SearchIndexer.exe	101
PID 5284 wrote to memory of 612	5284	SearchIndexer.exe	102
PID 5284 wrote to memory of 4404	5284	SearchIndexer.exe	103
PID 5284 wrote to memory of 2236	5284	SearchIndexer.exe	109
PID 5284 wrote to memory of 3184	5284	SearchIndexer.exe	110
PID 5284 wrote to memory of 5616	5284	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_176896fb6f428c008af3cc8b7a31faca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2776

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4897efc0b7df2c8147bca7c46bf8c9e0fa9211e38a4192a20cdfde06f691766a
MD5 61c07c05ccfc8178559b7978dfe94a61
SHA1 8952071ade0d5a6281a6690c44b765117e2047f4
SHA512 d4d75e70a365a8b58188d259d20f51b2c4a9d67472fef7e6c88c1a47906976ea844bcf9619e1cf9bd3fc7ff69edaed101d3557718c283af15dc4fe1a0e3171d7
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+v1PiqMymJ/+hE:t3q6mjBHtPiqk9+
TLSH
T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c237fcfb1faa559d8184f2894c70bae2dde77a3424e651d0301aee4485846c0b
MD5 cf9400c99e9302b5dd6dc8a5a96c9c51
SHA1 5e705f4075d03cbacdeea44ab732ccd2907bccb9
SHA512 6a32dd94e597e22f3a3792901fc6917bf8c15613f88733ded125bf245d5bdd6b23f599441106dcbf65a14e97a885166e9963eb69a0ecfc4903eae43754783cde
SSDEEP 12288:L1XLsswWkxy2lRq2czANrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:xXYfDtczAUBMvjRA+iqMIjmJ8c+hE
TLSH
T16265013963E409F9ED67823CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 082f64b5f81cad75425ae5f576daa76e9d97e0a03dbeca75e9e7ed253cd64380
MD5 0355cc1a67efc8f0f49edb3884fa1ca7
SHA1 7fded11c60c8bfda9bf510abefc3489b751b1814
SHA512 fefcb7ece87aec67d26b915712b74658b6f9d731e7ec3d5ba97c7c4be21dec9c5660c03cbe9fb0362206074ecca3b3c1535ec9d197321bb5dd60993c8243cbad
SSDEEP 24576:A0Le5ji0hmxhrMrBMvjRA+iqMIjmJ8c+hE:APji0Az5v1PiqMymJ/+hE
TLSH
T1AF85AE26F5748331D073C0B9C5D2A69AE972308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 20e131447adbaa9fc7ea310dacca43b7bad8a2fa3428f1b62c7fb28a6154b864
MD5 4cfa65a4ce266fc5b5a8762fbb10f1c9
SHA1 e9d2c729f74135a3f05518d6005557d4b4227ae6
SHA512 b8d0da37f13cc7a1b052f8c2dfaa6eec287c27071871d87941f60c2fff1ab2214fe444c66f6c921321df4df6d030ba8d4fb8eef79df0bcd59e147e3ccfea123a
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyu9BMvjRA+iqMIjmJ8c+hE:1/ezSC6vUzPv+HjyFv1PiqMymJ/+hE
TLSH
T1D9755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9776441e98bbd4c0881ac79a19fcf1236b364e66d0e57e155c5e88c349e04bd8
MD5 2aebc794e2128b121be4813a6727b4ac
SHA1 7d3e90c9a765442a3319f9e482eae1bdd5f3df8c
SHA512 2af5fa9ca605c51fb34148f1736d056d48bbac1fc2bd57ba5600d53eda408fd317fb850544acb1771ab1cededc9537c9330b41e3ec77e1a9bbb4043b413a9285
SSDEEP 24576:FVbqPb88hv/l+B4BMvjRA+iqMIjmJ8c+hE:FVO88hXl+Zv1PiqMymJ/+hE
TLSH
T1F6559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 decf40e8d4301751645b0104d6023e462763b683539ee608e703d9217c9b63b1
MD5 6e8abca6131df2b040797c6d48e24b15
SHA1 60592ec71c52e3bdc51b54727033596326b3bc3b
SHA512 fcf5130ef26e38ef6333aeafc53ffc0b1ccd5f6579b965eb6df97aed16954ae9800d382110e2edb48e83a11302fbef048cade004359b18b85d32f46c00a6288c
SSDEEP 12288:8GmrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:8GfBMvjRA+iqMIjmJ8c+hE
TLSH
T1D645233600A80A95FF733F3C6DEB67A3C245EC7DB551A203B51676DB563C1E0A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6d41bea4dcf2fe4f8f885f441626934efc2cdf1414864a18ece035a679f16cb9
MD5 749e6563cfeadf69291e54853ec1ae02
SHA1 1a17617357c0a566db63ca0678fc3a83c97b2a60
SHA512 1e9be48dca4fec9925289db6f3de8fd0b2a41db73ad68b4b5de2c2e828cccfbd494b128233778639096b3d3f58250cd86523c36c672c978acb0ccc610be27511
SSDEEP 12288:beBNUbTVO86U5rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:bJIUgBMvjRA+iqMIjmJ8c+hE
TLSH
T1D265DF3BAE28FCD2C67A5D785A918700D77278304B62A3CBE175834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ffd36c4648e2a4c3283753862492cf8153510ac15e7103b37013e30220450d39
MD5 c1d88b8af412cf24bfac203b04da1d90
SHA1 27967514e409bf3716f3087b88a9b8c4fe8b14b2
SHA512 c9f971dd290661bdc2059bdbdeeeb383aa77ec4868657fe86af276ba414586012092c71f1a1af7b35305317389173c2e9a5bb460966222c34e91a761454f0563
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:IQvGAdlCEL8c/WRNw5CgtPiqk9+
TLSH
T1F2266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dd8aaa19764feac2ba14483287a1f753a821765888e14f440d1fa71f7dd0dc33
MD5 f891995fe9c5f5c556d2f5fc6ce70fb5
SHA1 7d83b23bfe6d8b43cd38d0d35d26baa28fb01543
SHA512 6f860c011ea98806c9f8f8dde6e920585cc913ae673db770499426651cfe111b96ebe5e9afccc854efe287e3dcad8348840d540e343531e5feffbf7008ec11c0
SSDEEP 12288:XAwSfxL/2Dc3mDLLmt0LDQewsAjzrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:wfewsAjCBMvjRA+iqMIjmJ8c+hE
TLSH
T10B75F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bc98e47e86999171e912563e1b06faf9ae684f2deac834f2e6f207f9f43063dc
MD5 80e0958779b84987bc2817b92791fd13
SHA1 c6b0e850e75b3e62d81f820a3eb307c7c45efd96
SHA512 934e976866d51da7c71f144fcf176d201f9a85f61fd6232a8fe513d6b783588c506e7298f2fe5be4fae2ab278a7deb6b22c23a96b1d6b1449355874e04664f1e
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHraT9+:VUEtQevvqc2W1cpV20I32raM
TLSH
T1B3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 630fda4562cfc12cf28f353cce58f2e0fb20584994188c2f80048dd01b575779
MD5 ac161e8e1fa8e64fdb72d1058a96dd8c
SHA1 ad3f34a981878c3243ad1ab702ad348d52e256f7
SHA512 1750798fdb82c9098bbed6686338021455e72683178b7114124ab805e6c5c87f33487af99bdf0537571061a440799d552fe753344af2d4fede1e940b4b96ff78
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zpv1PiqMymJ/+hE:XoqtVjnm8tPiqk9+
TLSH
T1CED58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 980f6be3b911f2ac65166e10e9fd6696904194e25b1033871202836550857d1c
MD5 ae6e3bde7b0f9fee1c4d525553ef93fb
SHA1 b303d3103400012a7185306cc83ca1e6346fa697
SHA512 5c60348fb0bd5122d34fbdd225eda198e3743d9d1da6cc21a46817794e78484a821d59664fffc0f7a048a01df7cce4eba3e56f134cf67b3fbc5efe79f4f23b34
SSDEEP 24576:QAhGL6IFoiwtA5l7S53JBMvjRA+iqMIjmJ8c+hE:QAM5Foiq5Mv1PiqMymJ/+hE
TLSH
T10135AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d8eea27932122b7a7d70a1cd02b8cdcfcde5f649b4d1dc4c7d05c6973b2f7151
MD5 245fe9c5694d1a3241e34a44c6ca8bbd
SHA1 1a442517a876bef3701bd7983c2708c0414d5a1c
SHA512 c88c18afa984ceb9f33566e03b26fc6f811ebfd2abd6de27f0d685d3fd2b4f8391b992ce130be7c6d215c499d4799f0292ba27d80c214dee6eea079c910f0ee3
SSDEEP 12288:Gmw5HEjsChNEBFgl0WDm+CkrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:fwuROW+BMvjRA+iqMIjmJ8c+hE
TLSH
T18565F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 178e1dd4bdceacf1af25f22e2aac7aeba1e838f5e83f07650637d59c39646feb
MD5 2d77d1896d6327ca108df2053eb846a7
SHA1 a9c411e019b1ae9cbfc0807eade13790f1e129e1
SHA512 830e2564100e2f94d83b229b40459057b812d1ca7ed67e6185ba98cb826e15cad291a4cf3759850607dedfb805c9018e3d05e21c32785dbb8616512b3665b73f
SSDEEP 12288:myZ1IyDrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:fZuzBMvjRA+iqMIjmJ8c+hE
TLSH
T18455122A22E811F9E673173CDCE65742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23f42dd5838be03bfb44b1dde0a0c68222c2ed8bb3c4b06612f689f3ef89906d
MD5 07d006282ea64fc8fa597788ef901447
SHA1 a695b62da55d50c3be0a3e74c1955b7b0da0d9f1
SHA512 1ce69bcba732a6f2c64c7fc92cdd530e7cd69e3a8b3ab9e3f691e58c3b46e93353acf59bea1a8d5e59569e3251157b9bc187ce258b83483c705f3540b587eb3c
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3rtPiqk9+:CQyiKanX+PNBaT9+
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8766d9c8eee6ae4bcb803126a2b1da7ad7db3aa0e8bc677028970e9ec6b5322a
MD5 4f015d9e829dff59c32893fb867cbb88
SHA1 53ce1d34b3255f565832980de99068368af509ed
SHA512 fb03ba1cb89b2c5fb3862948dfc74122ac513caa12954debd7ef264546ff16f9b85dea6e35d819a84a956a3e8ad7db999170f1d5132a4e2b8218131a137110a4
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3rtPiqk9+:9QyiKanX+PNBaT9+
TLSH
T164667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4671d93c59b1715e99cb58ef99b5e8c0abb646e76aee8194e25df56851617996
MD5 cfae403efe963c8e5a1b77bbd2ac6a52
SHA1 69033c38aa769240a7bb67b451a4172946df9ffb
SHA512 b7ac625d91864ac009c2429d8a8063796e1f68907f9a6c2283fc6ec86104dfc13017c9127945359492697e235f75976e93c60923dc69902a756bbc11d95f4bf8
SSDEEP 49152:u68Qg55nhkeWu7PNU3/5v1PiqMymJ/+hE:8thTRc/5tPiqk9+
TLSH
T195B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 475ecd2a90a909137b185865f504b5158f4869faf6e50da505999886d6cf3821
MD5 d414564a560de67434502026c3d60a18
SHA1 90b22b8fb9acee7cf39488e84f97cd4b56c66b96
SHA512 88e5e79da134cc169df1c63dccb4e385aaf2f7425b8ebecf7fec4b18711c7534b7d21d1315d44a17f84cbbc53dda6ef19051e755ac408e9a3b4e3528436ea0d3
SSDEEP 98304:Ey5112gYy5azzVvU69nLKnhZatPiqk9+:FLIHRWhAaT9+
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c301f6fe052e17a8573348f545a92b93a54dc60c4f0c7c1fb6774ac8ef57fae2
MD5 cbcfb80da668a50b2c8a8ae6e7774356
SHA1 c8095669e66f171b9a9cb9bbcd2c912d221c2e86
SHA512 9a8a6acc41714efc87a348fbec095afc1ecdf0efd98e7b01e354b7d873d6b72e9fd85185411c6b295d93da8a184de0da400eb3c72524b90b414f56326653d30a
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljv1PiqMymJ/+hE:6u6JmIxd2djtPiqk9+
TLSH
T189D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8251f7950d9a1640ff3ccbe4c98db2e4930bc825c282af2e7b0fe90497724fb0
MD5 1911b00082a1439c172055f09af65346
SHA1 9542c3f1ce319124b6f03d1cde0bb1a1a624005f
SHA512 00970f6afc2257a27fc2bfe27e8145330c1c3789968df0692bb930f5dc78aedfc182c9b5fb4de78d15cb9d60ec2e6e31696db8e1bbe6245e82daf7ac625e6570
SSDEEP 49152:E1hpsNoJpF1A67U44CwH7R4xPv1PiqMymJ/+hE:EmifPqR8tPiqk9+
TLSH
T117B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bab7f2f824722f72e92ad316da4b91b9728ce2b392dcc917580407527d97f4fa
MD5 b1194235ee7276ab5e9c19aaa2bd734e
SHA1 5c0f5159035a88d1740c12b5a73fb6dc43fbc690
SHA512 16b036f19ea33f165254202fd18e8952235237538240b0fc11909f93b18ee819230ccb2d2b40408d6e81006597b9df51103150b794d894af6d71646675cdb94f
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqOv1PiqMymJ/+hE:65dKqi61OtPiqk9+
TLSH
T177C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c3168e71b0d97a3e12a4d0168211a574312bbc8e122bfa71cc0eb551de168945
MD5 0fa475a53d18e6ceb866dde0fef58910
SHA1 e61cb0e5c754f0b1fe19f2b0b320f00debcf4fff
SHA512 14521312b203ca248ed41c02f3f1e0633c74df18a8382bee8b36cb17815c81ed874c070b9bcd72f231239d14805e5c012c7c3fcb51636551f049e85b910d043e
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wzv1PiqMymJ/+hE:iX2iWphotPiqk9+
TLSH
T17295BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 63c95db98be2642c393b571a5aeac52ce6dd3fa946cabca29346cc768f45196e
MD5 3d4d901ca69a730087912b7cb9e54514
SHA1 3b3120f937c2680ab81092bc20e2700d3d71e6f5
SHA512 206a2ac0f44f23db015eba68b53b9e1b51698edbcf356c93470ab740eee2ef58ecb7e8d5669eddfca4c27c5d63b4f54338ad51008f7d08cbb28e85a2abcf7a98
SSDEEP 12288:S+rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SHBMvjRA+iqMIjmJ8c+hE
TLSH
T1D945233A00A90F86FF323B3C9DD75392C285AC7EF652A203761A719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1dabf39be0189237892a3c980846f9e88771e67b97974d0a4180fa803e92feba
MD5 660533c9c45182af9d9e494d80091533
SHA1 b3e7b4acff4d7f0f18637c597b2ec60e83c20879
SHA512 f33fea94a0725cd1eadc92c51900886349ec65578838ada2fceebe3a7f093955ce32872cac2a8d09cb40f3f092b13946c8152d89f9f9043a6053e8df35c6900d
SSDEEP 12288:GHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:G2BMvjRA+iqMIjmJ8c+hE
TLSH
T1D145233A00A90F96FF323B3C9DD75392C244EC7EF651A203761A719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4f00226ee471e6f77fcd742482c152cd20ff986e3f8705d972dff84770a80bb9
MD5 3b71dca1f176fae0005fe5cfb9e4127b
SHA1 1ccda562f3c379b8a9f3e9678811244edaf7e7f7
SHA512 04167d2518dbee6073dec96bd40deaf68b8d504396810daffd61004270abbe98ad88944dcd72c04ccd588b36d37da7c7dcf67653985abc2dc0a59a23ec367305
SSDEEP 12288:/xrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/oBMvjRA+iqMIjmJ8c+hE
TLSH
T18845233A00AD0F86FE323B3C99D75392C284EC7EF651A207B61A719B573D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cf11a833253a32cfb76ac5d598806ffda8117fec0c87027bfc71ede346d34896
MD5 8ef551f2d20f0180a7a1f334c61c98ba
SHA1 40c4a0a8a8c3542f8057cf571cfaf416b4eb4d77
SHA512 4a6565c9720103e9400f9fe7cc7a5443e352f91bb193c7eb409e469f432cc263d2a55320cd65fd9e782e1801734efd4536087bda36db4431cafc17fcaec48191
SSDEEP 12288:8VQrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:UBMvjRA+iqMIjmJ8c+hE
TLSH
T14945233611A906C6FD32A73CC9A75352C3A5FC6DF732A30FB605259B0B392E42869F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 de4720da1cfdf1b60183c99a9bba32de9021a105216a2a3773e7ac7fe7b4e0af
MD5 60be2b2272899302a981a2ba3b721877
SHA1 5b3fc4d21551244e33af012d170c1b3d514db4ad
SHA512 12dff2c57542e50b0ff06d414ccbae7b9f7c825ff9f24c5a143cb2c2fde5cb0e6527c1fd81ba926f6c162534d2e3dd7e90df609d801b078406468260b4c380ce
SSDEEP 12288:54rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:5hBMvjRA+iqMIjmJ8c+hE
TLSH
T17F45233A00A90F86FE323B3C9DD753A2C284AC7EF651A207B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a74f679e22569410e66c541b8d25f4ea805329b58f1eba2158bc1b1b5cb4ce00
MD5 ca23bd378a47204e522d8c43540c87c3
SHA1 0474c405f1ca66e383b7d56687bf7e71d1b15fd6
SHA512 01c4c5ce02979a9a54d02df63db909a04dfb631539210a8e2db34b38d38187efa6c441e6ae6ccefb463a05883a673b8db9a87f2d06b3113e4efcfc14172323e0
SSDEEP 12288:GLrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:GqBMvjRA+iqMIjmJ8c+hE
TLSH
T11845233A00A90F86FF323B3C9DD75392C244EC7EF652A207761A719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dabd062d2861a9a1689e9e83039dae1e45e117a4880bc5afcbd141d7a5ae7782
MD5 e86c034663d33cc11d6ec4925992c2f7
SHA1 9c0f4f1042e5ab88fb87f6bb753897992d3950aa
SHA512 2ede9fb75b323f9a035f15c9adb9344f11469cbdd5f488e7d57a5eb4db84d2209019a4d4b877bf03ebd37add70403267f9b7c1cf6a2f17f347b995830fb76d4e
SSDEEP 12288:fvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:fuBMvjRA+iqMIjmJ8c+hE
TLSH
T12545233A00A90F46FF322B3C9DD657A2C284EC7EF651A207B61E71DB533D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f4c57953b5df8f27b9a2be23b4b4d7993fb126e66fc106f78d802acf855f87de
MD5 51abfd46fc937e8c999f8767ae2f6d0b
SHA1 9ca289218827853b9a1e9cc92eecbea2dc26c72c
SHA512 0b30822f8c278675337f0459b946b4c0b70c6de329bdc632602e2c22b5e8638725fe5aa611713c6a8c1d2b6db184dae788b145c35ef67d1ca52ba12e8de846c7
SSDEEP 12288:aiZwbDzzFEoS2cPvynrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:9ZM3zFVSOWBMvjRA+iqMIjmJ8c+hE
TLSH
T1F965016573900CF8ED63423ECD568A16D2B2BC6A5770C60F13A4366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fd4c99936bb7779173285b405b50b209c23c74bd9977a09d01950dbb92217988
MD5 f99206985c1e13f404034e7b3a5c3777
SHA1 0019ea4730072fbdeeb45f5c94b4c8d87ddf5774
SHA512 f21e0b906d082ee1b5adcd8e886e763f7d520d98520f38f5246caf130bf281b9f905c9900c60c14fce950aa80acb28cb75640d5b97a2285151d0e0dbd31b8240
SSDEEP 12288:yarGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:yDBMvjRA+iqMIjmJ8c+hE
TLSH
T17545233A00A90F86FF322B3C99D75792C284EC7EF652A203B61F719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 13d5712c082782b77d831e84a55a40f01a0a5fefbd0f854fbb6f1a11f2c62893
MD5 58875e6b48a7e0ef5075a1a61c70e691
SHA1 6cb42a7b5abdd575e5503a40c11f6439a684eefe
SHA512 1cec4a0f0e8c053e6b06ac1f613563dd01c598eb4cf0776047826ecb241843a482ada4a4fff442b86309316b71823604a29ed84c246911ec902facec15187d0f
SSDEEP 12288:u2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uvBMvjRA+iqMIjmJ8c+hE
TLSH
T10745233A00A90F86FF322B3C99D75792C244EC7EF652A203B61E719B573D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 42412b86442062dd181e9cf03b59aee854f8532e8167eab1032477a848265360
MD5 75ee4e7903ddf3f0d70cf4567b0b8cc8
SHA1 d9eccd96be8af70d2ce9c3da10e401d71181db14
SHA512 cbf5a89e92b3fb077eb83c338670e5f4697e3d6bec5a85dfb2e27dcbdcd05097a95a08be35cb636ecbf4cc115689841f9e57dbe60cb01c6b0cae5327b3c935f0
SSDEEP 12288:dyPz5L8DrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:UzySBMvjRA+iqMIjmJ8c+hE
TLSH
T1BB55121722A521F9E5335238CCA21B52E372B83657209B5F676417BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f3b805d929574fc1bb354446f14ef047bbd59a2158f7047f199429bd65bcbd07
MD5 0d830c0b30b9d9575092dc875ee0d4db
SHA1 8687c426c480804d1c6a88dddb1ff194448a5ce3
SHA512 8f072a9bd7436d01cc950adb3765af13c1c5505761fb1fe990877305f8f951e7c67f6f68db160d938fc60bdd0381b2d849266fd6865dd18e8002158ac4c40636
SSDEEP 12288:larGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lDBMvjRA+iqMIjmJ8c+hE
TLSH
T1F845233A00A90F86FF323B3C99D75792C284EC7EF652A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4d151637c782300bc8901a80d97e1589767ed54a9189a4982f973cdc4507b3e8
MD5 0fa07fc5e662cc6da913719b88c789ed
SHA1 4fcc281156dff1bfc438c9f3ffe7411e310e2cd7
SHA512 b0cbc0d5cfd5bb9235948223b5e993d80e5d48c5a6cd8d0580a29dd5a676d3d8deb4c020e4e86d0407190dba36e5a6b8dbb0f835480bf9d00f4fe2eda9dc9c47
SSDEEP 12288:0arGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0DBMvjRA+iqMIjmJ8c+hE
TLSH
T15145233A00A90F86FF322B3C9DD75792C244EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a0eea51caf3793e9621b826a4875922c5a3a2840228c5b5ae77b0550c698f66f
MD5 79f41e0d799c35e7c01b446b97c952bb
SHA1 0aca2c7c01ea7b2accfb160a83816a985055e664
SHA512 9e86cf2f88a1010e0226dabac9e845d048db784c42ac15d3eca00a312164c78c0065452d3d8efd69ec2c808dfdd0a2563ef391a736b0be3a28ca98dfc0e6c33d
SSDEEP 12288:jyPz5L8DrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:OzySBMvjRA+iqMIjmJ8c+hE
TLSH
T1C355121722A521F9E5335238CCA21B52E372B83657209B5F276457BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b74488eba83dd0df04f0c263b30481db2069f69e7e4ab5e1e396e1be478c53fd
MD5 9df5e64fdb68e841c75ece0f776cefb4
SHA1 a746b51a4b6086bd6acfd558a339c7b4d0f47d2d
SHA512 47c6e07a702097542eac3f83f9b72935800969e6f7a0752e792dfe7e5123d2b398447c35983275d28d49265a8fc744a6996efca681cf9a330b3634e5754794e5
SSDEEP 12288:ICd91WYoaLHF3z0z04PDvhhrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:RT8aLl3z0zDYBMvjRA+iqMIjmJ8c+hE
TLSH
T14165026573900CF8EC63423ECD568A16D2B2BC6A5770C60F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fa0e7f0da8ebb4d5f96c51ee9c9e9c6e932c9018c78956b66ca05e9cb45963fc
MD5 e15b77e8be2f6b6e94e6ad3879656489
SHA1 8b57efd995510e32f9b8e25822c347e92aa0b528
SHA512 aa1aa7f5cbd4005aab589a321b7195e322e89e73df507f0e33c9b73968c8d59473e06ccbf15c010b8792e1380f2e1e867c43dede86a173aa560ac5b29f5d548d
SSDEEP 24576:+3rd9CHKy7GZ8BMvjRA+iqMIjmJ8c+hE:Ard9CHKyaxv1PiqMymJ/+hE
TLSH
T11375DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 80dfad88939940b297071548393b2e10f1f7807722ecd37fe2fd658be52430f9
MD5 9d2458d3e6ac5b58cd43989ed38d8c30
SHA1 95547321686c2c7e3ffc93de4b658e0f65b084a7
SHA512 f16884b78973c9bb8f914a445b87abed04d4ba2e7e0626fe2644e9d1710539c2f7042f0b57faae98a92eb3644e06bd23073576bfb7aa7e39648377a6edbd6eb8
SSDEEP 12288:NRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:NIBMvjRA+iqMIjmJ8c+hE
TLSH
T16045233A00AD0F86FE323B3C99D75392C284EC7EF651A207B61E719B573D1E4284EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3310d2ef377a5aab55c0c0e3540eae9de8be7b87e4ac5c78e7d8c8e1bc131528
MD5 526fad544af94578f27e22df6eedb4ac
SHA1 f8db11fe972278dc182869c3cb77d5be5ef65a2d
SHA512 a5e8e0e343c6de05bd795d1f2cd09ee38561ea4a737a1260ab8febb7225d7f3917e88ddefdb604b7a3aab0735b7193a01edd588c021c266802ba6ddc8320c7b8
SSDEEP 12288:ajrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ayBMvjRA+iqMIjmJ8c+hE
TLSH
T1E245233A00A90F96FE323B3C5DD75792C244FC7EF661A203B61A719B573D1E4284DA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e9266133edaf401392bec45a961284793ce65f56928d9eb24568c1ac002ea53a
MD5 79753aedd3bf3652d52c6b1e7441e58d
SHA1 1cce6f4defb2d626874c4ddae20be1a1598485ea
SHA512 76265d0ebc48e08a36b3911d37b28768fd5c0c9dcb65a7e2108d04d365fa43701b69653f9b2529926f04bf52874e2b4674367e4032fd4cb616d4aef17d118cf2
SSDEEP 12288:XsrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:X1BMvjRA+iqMIjmJ8c+hE
TLSH
T12645233A00AD0F46FE323B3C99D75792C284EC7EF652A203B61B719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3636977f07ce768caa979d7d851078f9f12dcc932a7e379b0d0978475ac3d1be
MD5 d8ac5de9156d8df5d742f9e3b8783d1c
SHA1 c28029b8d05c5bb2a13b51fab9d38e70d3d73d51
SHA512 4cf9ad95ee192151837f239cb85d4027169cb632b748c20db2526a45903be50e3d272afb7f47948b4539f1791cb15d376c28dcaff7bac18cbcce3f5a097cd231
SSDEEP 12288:parGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:pDBMvjRA+iqMIjmJ8c+hE
TLSH
T17645233A00A90F86FF323B3C99D75792C284EC7EF652A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f13d48109aa13ed93f334887aa70f7d05a0c7cddd572e9451bca34bf33a1d6af
MD5 5b680d36ed2ff4301659a5f0ab0fcf7c
SHA1 6e31b047c6095256d54b9d14fdf5358ae2035adb
SHA512 e0da772c4260b97b9d952f2205a7fc5811511e16263d4d62d13f48a17830a535848ff0df26a5d307b7618cdb227e2edab5e7fbc834e7d2b4ffa35521bc6ab9e7
SSDEEP 12288:URrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:UIBMvjRA+iqMIjmJ8c+hE
TLSH
T1DF45233A00A90F86FE323B3C9DD75392C284EC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5871944d40450d0973445cbcb4c03ef59cafff1722e0bd56c59ed461884e7776
MD5 a1a775c63c3ba1623ce0b3c5be819a10
SHA1 45cb524359ace5eb7f6ade92de1b386035b17c73
SHA512 0c24d2f7719a91ea64d42f7694a43d23ce4a6470df5a93090d8364e24c11ca172a37fa18f6619a711c01b7cbc2ad9d282c88f9b1cedcf145bbc60082fcaf443f
SSDEEP 12288:mCrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:mbBMvjRA+iqMIjmJ8c+hE
TLSH
T1F845233A00A90F86FF322B3C9DD757A2C244EC7EF652A203B61A719B573D1E5284DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b50bf1289215d4932d3cd4d1672c8edf5c1d7c9d9a51a070917b3c2d4389f3b
MD5 d92131cbc59871c248e0d55b1b9306fd
SHA1 b7f245c9cce6a1a800f54b456ce95083a485e883
SHA512 cffdd6578e550825ee95a45d762a6df158f640e6b475086de3637e169b6f093b31c5f721574a8c6a32e7d5e0a9ff7e9784013807dcee2270808db67c6cc042ef
SSDEEP 12288:N4rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:NhBMvjRA+iqMIjmJ8c+hE
TLSH
T1DA45233A00AD0F46FE323B3C99D753A2C285EC7EF651A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0424463ed911967a100810a6dc8fa040c8693aac09e9ab20b8ebad655cb3bb16
MD5 fd13174f6d198d25e4f7ad11919e8874
SHA1 f4425429d873708787529bb203cbecdd16f46d4d
SHA512 d483db718cff4c306c07c3dd5cd059d58152ca564f45cd38d6998a081d44fdb2e0cb6cf0cd41308c8e1006f332e005d724b74ea35c4337514454d10be818f277
SSDEEP 24576:Zfwvzk9RX6wkyAI/BMvjRA+iqMIjmJ8c+hE:YMnYI6v1PiqMymJ/+hE
TLSH
T10285CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4c089f38461cc8cef6c10cb476cff2f8718689d2e5e620bf91ba8303888899f0
MD5 853131d9ea7c028e879bfd8b95c221f2
SHA1 0c239e9aca81f76bbde945a65add93f33dc1fdd6
SHA512 4a798249e0f5f1d23c1c05677c3b8b3f76ccb1d972cd414be02bf4a031119862cd60894a2e021d8f0fe17ccb91df2ce33bd1cdc03e72516475390e77e9ff8120
SSDEEP 49152:PYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Tv1PiqMymJ/+q:yySzPLtPiqk9+
TLSH
T1AF066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 53020fcf77900d42b8364130639677a36b9eb7329cec71676a03205560877008
MD5 2e9fc234b7d9bda5cf8917de77aa6d0e
SHA1 fd9d7e424acc6d1ea378c0fa29ff6dc52b6e8058
SHA512 b33265f5c1ba2301a704d2a374547122b1e51b6353f3488b2d096aab03b83b75ca1c16d901888991f910804996211c86f860741a82221a13cf7e2445d6bb6df7
SSDEEP 24576:S47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYmBMvjRA+iqMIjmJ8c+hE:S47JUQjqirIhCnDHUPfF/jv1PiqMymJJ
TLSH
T18665AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c0687a4396c2453d5518f7d2c6b025caba2f20513273c1143492e327e54503f3
MD5 1ae40647ddaabac5a5834aff86f6e1ed
SHA1 aef018535f8d646f42f7973479b7705804feeac3
SHA512 b304a7a713dad6b8b11dd6a52866d5ec6437326150d869fb6e6796920340ea3cee3568341cca0a1c00a60b0bae6db79f0cb3c221c7065db89f71f540195b135c
SSDEEP 12288:jpsfKrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:EzBMvjRA+iqMIjmJ8c+hE
TLSH
T1E855F11AC29802D8D56E6239CB964641F3237C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 3b12630bcbbe9366b5278fdba24fedaf778e5b449499882e513f05323c9f3086
MD5 daeae3e8b35a3a79e06a8d98f3155626
SHA1 d79b91e0d913c6cd57a7f5e11a15a49e16cb76cf
SHA512 0b1b40c73ab47e6bca4a442af69fccd6cc965945040d4efa4544d55888e15e4cae3cf89bf2602bc4198f8e9231ef5ab216af2f36affe81140895ba6329b4935a
SSDEEP 12288:41kyU3fnbp4JswBz0x3wSEwn8Ry0pXSTa4TklOE:41bUP2JsGmxf08Ogkl
TLSH
T10A250740766BD75FC6A944325E32D1CCAB707D01EE056F0772C88B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d282284cee51e9b3cbb8f401478c3405273c07437559cb59e007463ef8d3a71a
MD5 d79d1de9b10f1979ffe2ad0c46d1fb3a
SHA1 c29237905bc3e86f930eed55e49cd4941356179b
SHA512 b0b9a3054043462b7b552f156cb3f7d5268e4f5c50c2383135a3a5a8fb6c7e66614efbbb86d571b0126af3ec9c1257133b8624a2f8fd9411b7fff70c7d1a964e
SSDEEP 12288:lTR8uFAuED/giLlVTT3U/eDVSyByXwUOHd:lTRhWDxUOHd
TLSH
T1EE55D8819137A38FD1F76031072A6B4CB7A4EC07B7096F2673C9453AD86AB15A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0a219418997cd9b659d2baef9871783a630a3f94c9e9d0bbde1250ed2b815f96
MD5 b4a0555fb1c31695a4d4615564141f5b
SHA1 439ae2a105f70221e6a6e76aad8222ac69e7760d
SHA512 b1653484e9476dcfd95fc2bbfa1ddc3ccc35cf3c4de8634a03220ea6a0d9521149ecbf8af1aa1baeca3855a55ec4aced874d1898e1496113224a1d18a734a35e
SSDEEP 12288:kM7yrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:FLBMvjRA+iqMIjmJ8c+hE
TLSH
T1BA45233601AC0E46FE723B3859DB9332D209FD7DBB10E183B50A72DB56395D46C69B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2a4f7a5bbd9fbe7768a0e4c7b8fe8c8a02e013ba365441a8e68439dc688cb192
MD5 1120c121c05360864714afa8635cf157
SHA1 01b156bb73ad64b25f08f44a9dc5f2b96a5c5d0b
SHA512 0487e7513946336b59133a5d1de929ef9b677c17f227921813aac341b8d9886bf51dc037e49ed53aea037694f0a213fdfcda9a4b382c022c9ce12b4866da2072
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bY9BMvjRA+iqMIjmJ8c+hE:Mgb4mBIBhGFdv1PiqMymJ/+hE
TLSH
T15465AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 276e8fc86e47e0212fafb568fc506a7911db8f354f9fa0f187efad02584655ab
MD5 40f2f86ca963904287e28c1bb43dcb7b
SHA1 9e1954bb30feb97ff1929b9339df470b4a96865a
SHA512 ae36776da263dbc16064b9d9fb933f14da77e4db178073f98058bff632499df7b24f40017ad460164b6c56cad59f3ccb8cf9789c8211a5e86f45fa9823cb03a0
SSDEEP 24576:XG88u8FpJqH1vzria7/mWBMvjRA+iqMIjmJ8c+hE:W7ZFPqVya7/Yv1PiqMymJ/+hE
TLSH
T10085F12566E102F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 804c51c49caeff393bd079ec552f1e20db4931f84656628f474eb12197cf64e4
MD5 8eb6a1646624e2efed2dad0622fbf6a4
SHA1 79b0ed7b8296982b0297784268b9f622a9613dc9
SHA512 e00af99c0ee56827df90da1ff1e8906b33c0ac4a8636257917a632058795083da9b4641e6ab63c80bb04b8e50439f4f3a5cbf094b8cd3e58d5cc9704d3c9c646
SSDEEP 12288:EHvUrBFrEjwaQbrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:EPUr+NQ6BMvjRA+iqMIjmJ8c+hE
TLSH
T17965E12F21AC1CE5E676A17C89868719E771B8661712D2CF02A1817F4F37AE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 afb03e3e920159bb32476619b333dae9e7d76a2065511548c0819e4ddddfaec6
MD5 d16bd016541dddde0cff3464823497a6
SHA1 e6b4c6ea91662e2883eac08fb0024e77e5fc1e5f
SHA512 fae9c3f8161cd9998e441e1dd5543b07a4b6ddcea404ebd562e9967f2abbea972366c886760c22268153d029b4f70cd8f1380427c6a2a17bcc9dd4a4039c056d
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhv1PiqMymJ/+hE:tG05lO43bCtPiqk9+
TLSH
T1C4D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 24783f48792790eed1ca6494806b539440dea7733789944b9d88a0f668ffa627
MD5 487230087c8fde9ba480d28496c195e7
SHA1 38345dc274e191bc6fc5590fb7e7d613fea17fa4
SHA512 2ee8f0c28870061493feac19869f3bb2be7a5bdd4f619362e6421d3a66f4e15968428b7ec6b24a59df9a6fe0f04af33bfca57cc946db190bd14f1211c0029890
SSDEEP 24576:yfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn0BMvjRA+iqMIjmJ8c+hE:aa5POZ3lJt2pasx2+m5v1PiqMymJ/+hE
TLSH
T11365BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aa5f111b530929bca5f2976b3772c0eb1bc0131f505b11c838afd5a050c6e567
MD5 acb3de464e48c6556b7205f9ff1d9845
SHA1 55fae4e4c051a1fc8681e459123b7e99148eba5f
SHA512 844e172da42d94f12fd502ada40e8480810e81382063297c28a73b258ada7ab9133a18a0fb4e43cef908b81c1a3116e1c5199f7d3598b2484c57aba208155bc5
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkeBMvjRA+iqMIjmJ8c+hE:oNc/zEOVHF4v1PiqMymJ/+hE
TLSH
T1BB858C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ddea34601549a9af00455788c766928f0123156c5adf2ce33f97ebaa610e4e5b
MD5 7c5080d52bd800455ba2663bad8e5fe1
SHA1 275ca25b306387a88de67f2fcc5365be01ec4629
SHA512 3a311472aa228e8d93ad43b4391a1c01ce5d5d1ada3fdae0808ae397ccdaa6662edc6e8709b48a958f69664972d500646feda6109defe9015c8944fa5f6aa172
SSDEEP 24576:8zkNvNnaFeYhJNtmZBmwBMvjRA+iqMIjmJ8c+hE:8zMwBtOm/v1PiqMymJ/+hE
TLSH
T12C55AF2EB6F846E4E1FAC6B4CD238512E6727461173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4289e54c141f18f6ffebcb3999031c595fb4829623a1fc083bfe0f7384572d25
MD5 7fb29f6012581e6fc2098a3348b0db62
SHA1 2a2524d3d1d9ee33958218c7d200e6537f621b33
SHA512 44af250c1952c2199b4a30d0a2ce088e1413f85237950dd1c33c2baae43da511940aa5ec7476ae273a3bc2d5a7a85233411190aa0e70e9ba2fe059f86a2b264c
SSDEEP 24576:SD3FHshBIYQgAnBMvjRA+iqMIjmJ8c+hE:SDVHeBIAASv1PiqMymJ/+hE
TLSH
T15E75E13EE69C04E4E577D17CDA638606E37178AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/404-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/404-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/404-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/404-38-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/404-44-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1380-190-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1380-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1380-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1380-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2380-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/2380-76-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/2380-6-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/2380-1-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/2672-78-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2672-231-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2672-83-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2672-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2776-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2776-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2776-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2776-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3008-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3008-66-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3008-230-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3008-72-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3140-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3140-12-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3140-19-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3140-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3140-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3232-133-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3232-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3232-127-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3232-135-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3232-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3236-312-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3236-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3236-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3236-101-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3236-107-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3236-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5284-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5284-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5284-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5284-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5692-120-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5692-114-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5692-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5692-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5896-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5896-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5896-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5896-284-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5896-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5896-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download