233fce7555ce096675246244dd2a9368af7bfdd123b5dd2a2c12f3d6f0ae7ce2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260731-tpvpbabm6x
SHA256 233fce7555ce096675246244dd2a9368af7bfdd123b5dd2a2c12f3d6f0ae7ce2
MD5 ed22ec78a81eac9373187b5e45ff185d
SHA1 753e0afcb57734a6cfbf5bf07eec980823dbf6f0
SHA512 9c92b01a39f3ff996da21c25806e73d300df48d58ac1531f8b5fa585f7724ea72a7b1ba8666c8061e16d8443c9b5c61cfb55afa2fd83a1fcfb0070a5a6dab25d
SSDEEP 24576:pYJ9b/xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:pYJt/7Oi8QW6j/FTdl90J9p8z
TLSH
T15165022176C1D0B3DA63083105F496B1963CFCB25F6459DB63A92BAF5D706C08A3DBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4736	elevation_service.exe
2324	elevation_service.exe
4264	maintenanceservice.exe
4760	OSE.EXE
5076	PerceptionSimulationService.exe
2936	perfhost.exe
2232	ReFsDedupSvc.exe
252	SensorDataService.exe
2588	ssh-agent.exe
2468	AgentService.exe
5440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\26e89dd783806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf571df60721dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000666251f60721dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e69f35b50721dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0249fb30721dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	2468	AgentService.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: 33	5440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5440	SearchIndexer.exe
Token: SeDebugPrivilege	2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2544	2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4736	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 4292	5440	SearchIndexer.exe	100
PID 5440 wrote to memory of 4780	5440	SearchIndexer.exe	101
PID 5440 wrote to memory of 6088	5440	SearchIndexer.exe	102
PID 5440 wrote to memory of 6076	5440	SearchIndexer.exe	103
PID 5440 wrote to memory of 6120	5440	SearchIndexer.exe	105
PID 5440 wrote to memory of 1068	5440	SearchIndexer.exe	106
PID 5440 wrote to memory of 1796	5440	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ed22ec78a81eac9373187b5e45ff185d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4264

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f6097d2b4ca15893532f29f41b673a77aad11d1cb60825d9122732f8e5f287d7
MD5 b19f5d05215173ad2f50e90407f0a408
SHA1 ab9e925855999b377a868daee28783ebb37996c9
SHA512 c4a6955620b685e240a35b0b9d06da5cc2e00bfccf25c0ac7741b93c811529de104e55cab7cdbfbb9488ff1f38ac6614977f71679dd467782ea66fa4e180b422
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnk7Oi8QW6j/FTdl90J9p8z:b3q6HjBH7Oi8QW6j/hd83p0
TLSH
T180D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e8f3336f6bc4dce5b94dd9807f79d59ef0dcad007dd4b779a6d260dd89c370d5
MD5 2527349e9028a955f9e702e40c413b39
SHA1 045a022d12cdd4f663615a0395f013709b977147
SHA512 9a36605f6a29bf40818f5e24db8acb9917ec36d642eabc0578e20a24b7e02af24b49d2a513eaeeb3900b60b21cda54800f14f0f5b8f6c0e67518303c22902d74
SSDEEP 24576:bXYfDtczAzxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:+tc+7Oi8QW6j/FTdl90J9p8z
TLSH
T18C75022977D508F9EC67817DC8A28511E632BC964760E7CB03F49A6A0F336C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 eebc41f6971b8e5c59ef7628ed385fdb057991f1f5e7fa1b8c088f5fbecefe4f
MD5 7623031589e2a47dfa42b6208abeedce
SHA1 187b5fccc9ca643f02e0b7ada6fccbf9045ff5fb
SHA512 109610af5076c62ce2f51becf962f658bf5378373029e8323f605e38c503b2613be2072bf5034353a0c841d3b542c2450e4fd2820bef322e3bc439151a2a0d3e
SSDEEP 24576:g0Le5ji0hmxirMsxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:gPji0Acp7Oi8QW6j/FTdl90J9p8z
TLSH
T19785AE16F6748331D073C0B9C5D2A69EE97130861B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5205534d8876a63ab859f402ce36d7555fc4f8a3da5647beb00264197f9a7bdd
MD5 5befcfa56cd411488ac425c08a326a96
SHA1 e540d90ddbda2063a12e8c5b3292b3f3ae57eb79
SHA512 0baf23179fbf67476dddd321d14e19c9a04aa8bac0751a547e99cbcc2a57e7cc6a429502c38086323f2fd0763435d66e63e0527186714eb9e58f6af7448b3f82
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyuOxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:2/ezSC6vUzPvxHjyV7Oi8QW6j/FTdl9R
TLSH
T1B6755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 19195cf39a425bd887b02df771b5aaa847c3ddf30c21c78771b1c5bae1fb50dd
MD5 18a4fca0efb1fec797100a345ed39be7
SHA1 fc438bde3f072b6f302581ca2854d406df930498
SHA512 03b516766bfe0bb1bea054190a141fdbe138840d33f2aaeabfacf832cf9109a2ce96687b2aa5e0ae027bdece2c11ab010d646af2cefac45db3d48a021e75976d
SSDEEP 24576:OVbqPb88hv/l+6XxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:OVO88hXl+I7Oi8QW6j/FTdl90J9p8z
TLSH
T16B559E66F5B48331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 da6834ab24f48c143a90b7db691a98897fc0800faf5d233d5b22869d34ecf332
MD5 03571733d43c125f76c44e224d04d668
SHA1 fe9d2bb3c5af9834f6b10e3f15ae692780752046
SHA512 8af839915a6c7a14ff37d89b516732a1074e014b6fed1935c9606fa547eba8384dc8b908c020f2809fda09c1a97ca5628f941ee4e46678e7d802663507304245
SSDEEP 24576:0RgxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:X7Oi8QW6j/FTdl90J9p8z
TLSH
T12F552317ADCEA0E3EE134C7641D141E1E2109CD764B8A953907D3F8F88B5CC9CA5EA97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6f369a4cf03be285bb4ac12b449050f6b2ed929ab0c2ac66ae80631aefaaf0a4
MD5 ec5c45be475c9c9381c058447ab1872f
SHA1 4d7d1d0b5bc58a41f41112627d576112143ce519
SHA512 55eb95630ea92af7deebc5b1e7a9ab0e4dd7032fcde4028cb8f43ebb2a7f80a9b6bebe87c540e87e0b3db9143027468c07add208624ea6fa6aff1b53740bd28f
SSDEEP 24576:/JIU/xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:/JIU/7Oi8QW6j/FTdl90J9p8z
TLSH
T11575DF3BEE28FCE2C67A8DB956918240E77278714B61A3CBD175830EDE235D04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d71633701c5b532db0c7982cd3197ac04c765a4736529515b03c650035a60f5f
MD5 7319dd65dd70eccc6a7ba8dbde5f11a2
SHA1 1da5db115c12b5e4e8f26892e78202ab000a383a
SHA512 974926eea9c4d61d93e7cb5a3e00afcfa5076f1d946f16a0387a5cb0441dda2a8c95445a3dfccf79a2ec2bdffc1cb406e7de287512f6e802e1f5797e65b5730d
SSDEEP 98304:xQvGAdlCEL8c/yRNw5Ce7Oi8QW6j/hd83p0:uvyEYc/y3w8e7Oi51nK
TLSH
T133267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8cfd2fc31f50c0ad2c2886d0f5749dc714bf588ee1f791bc11cce49786e8feee
MD5 6c5859bc579e4a06cd43f889d81624af
SHA1 5a55780ba6c726c6a803071ba93a3475820387de
SHA512 4f71586cd4d658a3e9d5b1247819fa91ce8d0ccb02f65fc0ec16fa47f5ed8e2dbb69d95ecc815959e257c1bd2f43ba83578ab31e8232f770dd9b65c91fb116d2
SSDEEP 24576:BdewsAj5xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:/lj57Oi8QW6j/FTdl90J9p8z
TLSH
T1D575E031FEB5E032C67B0DB21B26C716542CBD604B611AC3E3B85E8E59706C2677AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ce8d9854b24fe05348fdd724bd261eed20119e0e9498ef11c78d0ee7d046564
MD5 bb3270f4adaee844e8285bdde8bc4ce0
SHA1 6771278fd1779e7219a835f6be58d6455cfac0a9
SHA512 1ef159dc87867dcc2373f5cf01255b3f97b2cb1ba3d9eb124f82791be85f3304c011de0a8c90ccaa25baaa9cb1b14c9433970bf495df756f33187de9833b85bf
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx7Oi51nK:AUEtQevvqc2W1cpV2EI327p
TLSH
T16D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fc68c88979dcf0e287c697d0ae619f1bb41471bd8288543842c02f57de25d97f
MD5 78abbb384fb088a944d7f033d1085a89
SHA1 5f0fc7833c0ea6fe178941d084aa537c67e246a3
SHA512 794a22f446e637183ffa4deacd3585756f6d562d12e21bebf601689f91ad63d7a81f2b73d512761d6562d9a7de0a0431ff0c4867ebf1f72cfd62455468a288b4
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zZ7Oi8QW6j/FTdl90J9p8z:8oq2Vjnm67Oi8QW6j/hd83p0
TLSH
T167D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aa971e4c0ae54cf0a8436a3e33d4e25ed3ec63d94bace127eb9fe29db2a9fb99
MD5 ff690e9af3399c13b624f18b554b35b0
SHA1 477d7f512dca3ec6d2faaa2508273e84e568addf
SHA512 e0bdc5c6a234fa8bd2565e2a37a9b2787fd8df6d5c6b0eec042a5a3fcde0eced344276b6aaf7de6c710ade20e8ebe545d42258320ad41f8b08dba9e486fb5cb0
SSDEEP 24576:WAhGLJIFoiwtA5l7S53axEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:WAMyFoiq5K7Oi8QW6j/FTdl90J9p8z
TLSH
T14235AE81E7F955D4F5B3AA7899B68171EA76BCA65E31C20F2160D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b09f88382cd076bed71e1234dbc78645559f21da9f7c66bd6d879116a2f3ae22
MD5 8e3aa9450d5560b244991af43b2e24ff
SHA1 a52807cfddf738968ff19183f96ec52bf39ccf6d
SHA512 a35a7f00ebc2cd094680d6cad2e6e7a79f4a671446011124ef398bffff22d248ef89cc12c3a5588700036e523702cde8bc8d551c654bc18710634c7cc7eca704
SSDEEP 24576:qwuoOW1xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:qwDO27Oi8QW6j/FTdl90J9p8z
TLSH
T11465F14676D91CF9E96785398597C132F7B2BC422A24DB1F0370C65B5F33291AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 84966b70c7e2c5c8b6525066b86179ab3b4ce21fc58042c2963cc0f457012eb1
MD5 b1d677df1e3e4f1be2597b0e53a234f9
SHA1 97176fb4302b4e8763e98d2d45caf7abdf58bdbc
SHA512 155be2b332c11669afc3c6065fffe5116f3c552dc3f9e06e5b203477c2dda7f49cf5a7bbbdabc4d91425eaa54313b4e97c974319af3e1280bc90d5932104e22c
SSDEEP 24576:iZu0xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:E7Oi8QW6j/FTdl90J9p8z
TLSH
T1CC55125A36C860F6E5538579C9E14285E330BCA3237583CF11791B9A1E73EC68E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5645e1251c7208d86bd20014585c7aaa243dfa5a173eed9f72178cf912f993c
MD5 c613d2b8a1d6f792a10d5c4b31fdd4b8
SHA1 8c1be6e1f3ed060f31e7d68872e5d086462c87f0
SHA512 93f1d9348af051dca911e312289fea45c17c1cb9e779ead08d1d83cb45765c735a4968076f73bfba390d8743c3a01082fab24e09e717ef8864bca751e20fd245
SSDEEP 98304:6QRQyi36YOcPQLvw2gAf+PN3b7Oi8QW6j/hd83p0:xQyiKayX+PNL7Oi51nK
TLSH
T1C0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1dc12a5fa99e1b0b196722e1fb2be5304b615f030531048f0b15c5ea69f5f60e
MD5 913d134ff3a2ec2ccd9c9fb19ae6a90d
SHA1 ebfe5912557063c283779e5214036f4bd0bbd87e
SHA512 6c74d17d0b8c5b03fce8fdc6d65fbb492c84ab71544054072ebbb1a8ee9760c84f189b863dbef98e2305c12fc0aa1c4e5eeac03b628537ba09754ab83a0a1741
SSDEEP 98304:hQRQyi36YOcPQLvw2gAf+PN3b7Oi8QW6j/hd83p0:4QyiKayX+PNL7Oi51nK
TLSH
T1B7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7786dbc33613e02fe4795c74578799d0fce28c9b78eb8cc5a045edc058a3086a
MD5 5128bc7a2ef416f4586bc8ccb68a364b
SHA1 575ab793e65a8abda53a0a2288c436fee4e135fc
SHA512 e4b09027b87e89f1ab502f2cc6b3b9253e1a14d6f8cf8bd05a8a06814908b9079df686c959e6d1702e50774a6deedcc6242caf7fedaf864a686ca2b858155020
SSDEEP 49152:B68Qg55nhheWu7PNU3/p7Oi8QW6j/FTdl90J9p8z:/thWRc/p7Oi8QW6j/hd83p0
TLSH
T1F9B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1f48cf84a20a48ef2287c87b7f8b9ef84d98a535c9d9fffec85b9039047f4bc2
MD5 e5ee852601be7bd027d3cbee6fc82f05
SHA1 38a1c016838246fd1e7ce993f88ddbc4dec6de86
SHA512 dec75dbd9b911fc490e480cd182a49ff9989feefa282b567e9f74a10e7364ae9011d8ce2976fcba83ec3fe4f2d6c00d21f1ddbcbc4dbafa36cbb71eeef3e3096
SSDEEP 98304:jy5112gYy5azzVvL69nLKnhZg7Oi8QW6j/hd83p0:+LIHmWhy7Oi51nK
TLSH
T1B1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 129b5693d88b88de412a9eca9024196f82cc0d1bf555b1122cd9c8b46cc5f296
MD5 0e2c93a1bac2b387777244e9363be123
SHA1 6e18c4911f3e6b3f718da43aafc489217df472d0
SHA512 d2ed70993202fc4640afb81b91c524d3779ed897605cfb1a42ec3070bd5bb3c70e69151d1c6aa0c4ba78e0e842937af0700064c80669e65377cbc04b3c952f2f
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glj7Oi8QW6j/FTdl90J9p8z:xu6JmVxd2dj7Oi8QW6j/hd83p0
TLSH
T1C6D59D13F1DA01E8D06AD478974A9233FA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d45cc6c8836a313439f59ddcaf71c79acb4b82ba8b6193974ef514b023c3e57c
MD5 28120bdf4a2c64e85035d716dac3fc22
SHA1 31cb16121a42920bacf856faaca5972389833d36
SHA512 874c036e344d7b6b1436992195a19948ead8bebc7a9228c125b52f115ea1af4398d2ad1693f5c90f00f858fffa580b01227cb8f962360d33f21b464d645f84df
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xf7Oi8QW6j/FTdl90J9p8z:4mifPbR67Oi8QW6j/hd83p0
TLSH
T1CBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 397dd54c0cd2c8c425a123c61fa168fc69a789bfdbd898f5eb30bf775a777915
MD5 a553d1f56fdd910d07422295bf3bbf8d
SHA1 f3d227d0bf9b90488932bcc6b87e433367dc4409
SHA512 7fbb6b666901355fd4c759bd3624c4bcc4deb5055b8ce36bb5371e9d4913ba533306cc45539402a09b8aa15961e5d3f7d1c2c151fac5f162cf0c58d3098d5757
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHq07Oi8QW6j/FTdl90J9p8z:A5dKTi6107Oi8QW6j/hd83p0
TLSH
T1C3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c5f3b7a546d431a36d365735bbc7f07704b22a18f45b3f23ec7a39010a96356
MD5 efc8ae36109ce2e752ebb945c92d9365
SHA1 644b4a1cf6dace29aa899615c7e0a55b4cad7c1f
SHA512 c9b9e189b79d8eb538716a9413809189861b18c150159510af6e2312f54cadbde03b846de8fb0af8542b592722268e8e008684109764021cfca7d89b583a8150
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wz7Oi8QW6j/FTdl90J9p8z:GX2iyphW7Oi8QW6j/hd83p0
TLSH
T18095BE13F2D900E8D05ED179C7468632EA62BC160B34BAEF0A9077561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a9c456870e5bcc3fde71f9e78b7cbb38a1802688fd8ca18dcfae0bbae985c26d
MD5 a1279d98bcfe6666c8831ad0667abee7
SHA1 73b57aec51c2f233a63c5c42c162ee9b15870978
SHA512 ff47ed9218e16f7928da9e1b08b8c454656b8d3e4c82fbcdf8a2ce8a11aa509c5d49b45a261645e44b0f734a0cebda7d8102f8143ff0e4b565251c79bdef1cd9
SSDEEP 24576:ZIxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:+7Oi8QW6j/FTdl90J9p8z
TLSH
T1A7552316ACCFD1E3DD0389B6819142E4E1109CDB75B86593A07E3B4F88F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45bfd4c5d630e32fc19cf62b10746fc28130405988f3f686a8f6a0297f1291e9
MD5 d05e640cdd8cc770e9e240a5935f3160
SHA1 adf30bb776d5355f0868d9bfa535adb9ad768264
SHA512 bf7669f244414fb65e2a5a21e7a2db7264f90f9e62fe9543c6d08fe0a97e0635eb52912d315b41f8b6634d7a7d32645937458431cf6e2ca17c63e8b51a27d1ab
SSDEEP 24576:2NxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:W7Oi8QW6j/FTdl90J9p8z
TLSH
T1AA552316ACCF91E3DD0388B6819142E4E1109CD775B46693A07E3E4F98F2DC98B1EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3159969ed48cfe9927dfc8d12c2a3ad0d073a00d86ebdf008fb620b663b1b1f5
MD5 b371b9f875d2f6d393ad74f0ac1077a3
SHA1 ebba9514f6aafcbb25884a5387d7838453019194
SHA512 0106a955e95e337dc4e43b9da8d4ef83a8b7846cf45040633914cc016d91ccd2600c4bc826f2ecc89128315ab830582df91b79d6874b84093c0dc364f5607a24
SSDEEP 24576:GHxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:A7Oi8QW6j/FTdl90J9p8z
TLSH
T14D552316ACCFD1E3DD038DB6819142E4E1109CD774B46593A07E3A4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ab3bb5de00b76000d353313044c59d2bc65d2e1b881b25f22508212a00704bd6
MD5 7a0d9ffcf526a22b3bc852a06d2c55eb
SHA1 bf88a577cd0cd06937d52a5a11536b13c746fa2a
SHA512 9cd0a9a535b9d2558d5f932dad36af6d23c2a6f9741aff085e1a9c9e87af9657e245220ccbe2634e2b8fbc34077a0580e818ab9e70785f2d6fe85d061aff489a
SSDEEP 24576:exEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:e7Oi8QW6j/FTdl90J9p8z
TLSH
T19A5523167ACE90E3DC13C976C5A141A0E220BCD7767467DB90392E4F4CB2AC49E2DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a414ac4ba9915434640a6e879ac51b5a76c73a62fa1271b026ba2ee0acb4ea81
MD5 4b9f20bdccbae351515096d6e60bd582
SHA1 f232574f3028c9492464088650d1b5b9221be699
SHA512 1004cb87aace64d9a9e5422b7b98449d838ae7578ad62603bf3eea0ada1a3fc00260cd4050ffcf3b0873790c06212bab1009122d6a7f1656c5aef72221fb98aa
SSDEEP 24576:ZSxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:c7Oi8QW6j/FTdl90J9p8z
TLSH
T146552316ACCFD1E3DD0389B6819142E4E1109CDB74B86593A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cc17c3297d975643b66362dda3fd037798b30c9aaf9d53a3f2f9cb9f21d3151a
MD5 f9e517c6296a71d4af6e92d56aca1a50
SHA1 b688b004ccec424cb5759bce9ca5b4ec92c2ca43
SHA512 4d95a1d9403ac83154fa6d103abf38e8d96f1fe835cce153152ef766b5b634b2953368d47dfe398b4b98748d8c6f3c1ef852ca73eee5acbd3a039a005007aca9
SSDEEP 24576:2BxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:k7Oi8QW6j/FTdl90J9p8z
TLSH
T1D8552317ACCF91E3DD0389B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2ffb528bb658edfa4b9826d3cc105cef2aa3c497b9b861e009c061d965027e83
MD5 518af0de5a490156ed242ed8b22f1ad1
SHA1 4846c9ba7b462f1b37686c66ace559d0dc0179a2
SHA512 8104c9774a5faf9d6e32456eb234432dee28bf3bad2e340b6411c8a8da6c0f46f3f6a6618a7d8a323fa1b620f0a7bf23518620c415c18b009137a867053972b7
SSDEEP 24576:8lxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:w7Oi8QW6j/FTdl90J9p8z
TLSH
T1DE552316ACCF91E3DD0388B6819141E4E1109CD774B86593A07E3F4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6a196b50fde47d6bfa8337f57e7f57748ba6dbad5c71e292a66f5f5258a9a5fe
MD5 3e9f2ae401177af69bf1e64255de8023
SHA1 d6d2ac8573d44c6d69e48a1723250d75c8bbf97d
SHA512 da1b46488477535b9cfbaeb3eef4325558b7c7fc8061eed14b9d7c8d12dd81d82bd7b9f944c80d9e71ab369574f3c4dd5593886e560c9b7e1585192b005f9893
SSDEEP 24576:gZMSzFVSOtxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:gZMSzfR7Oi8QW6j/FTdl90J9p8z
TLSH
T1B67501A5B39018F5EC63813EC9618916D2B2BC5A1A70C61F03B8366B5F737D10D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 433c1858603eca6ce8b70a4d27a71f5d5f74377db833f14b1fca6d8e63e02e4b
MD5 84faa6a6de9a3dd09d13de78aa24f6bd
SHA1 96c1f55cd14c2d4296fd47a4245184a418c4bd18
SHA512 58d2441bf57a1e670ed6f853a7a0544cbbbcae41960ae7488d4e210b038547275d91dbc11682e063c0c7cc461fc8bc4999ba374e5a128de79865c0b063f7c22e
SSDEEP 24576:LExEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:A7Oi8QW6j/FTdl90J9p8z
TLSH
T10E552317ACCF91E3DD0349B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 046b2f52757261ea712ebe7ec6dcb07562af8339d276f9557efcc2171c377973
MD5 a33d844b3e10845bbd17b4d6ab0fdd25
SHA1 5611288f06e3f6e712330f08afa640438c4cec01
SHA512 49683fd7e2fcdd17ce4b349069caae1ab06f715aa8bac5f533976b1618dff2a96a628f317d84457007bb5ba3b18c837da36dc22c144a8d45fe964b3d7efca35d
SSDEEP 24576:bwxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:s7Oi8QW6j/FTdl90J9p8z
TLSH
T1EE552317ACCF91E3DD0388B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c42de63e693ed659b27a0b26bce239fecf925e3372952e23a0d8c45ea849ef42
MD5 28ce709e5bc9aa1977b0f564c6b89e3b
SHA1 6683fde34a793f38a739a806429fc62da61fe107
SHA512 f74a3914a6ea6a2b217be28b226903f586ae62c9b3aba86b6c33cbf719c36540e9a648f3434e120f68ec3a1e7093c0bfe67e0e66ecec2bb722e4e348019a4643
SSDEEP 24576:hzyJxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:hW7Oi8QW6j/FTdl90J9p8z
TLSH
T10E65021776D630F9D523823988A20A51F331BC7717309AAF52A4177B1E73AD09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 58ba4c579b4aeae3d210e563359f43e982396dc74f6147c50efca30f61da89d9
MD5 c1f8dfa0101aee9a9401e24a70fa9f88
SHA1 1b77dac61f3fd6b668801717b2d85c85204ed29a
SHA512 8f7bfe7b0e3c4dc73ee45b1ce4627fd8bb7a689dda3e4306f061169a2a89d20be701a12c6330a1ff9bd4c3242e008e4698b8c114b0c4557bf3a75980f132ceb6
SSDEEP 24576:qExEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:97Oi8QW6j/FTdl90J9p8z
TLSH
T1FD552317ACCF91E3DD0349B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b588059568f5141d45e52ee89da1663ba7b70dc7f62b75377ef4139140c7418d
MD5 b30860767c764220ebdd660053525a21
SHA1 d3686619756f41c0045d62f5a559d05c1d44f0b8
SHA512 bb71612346e3816b4646f79d71d641260092ed21ba5aa4415aa803785708e68c7190c242af09a8f247c5c873ff6d50b41d5c5d607fe39ca15bd396a2d0c56919
SSDEEP 24576:6ExEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:N7Oi8QW6j/FTdl90J9p8z
TLSH
T126552317ACCF91E3DD0389B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 34e6e34600fb599f2ec41baae32d0d4e3da95bbce971f95259654af0ea191475
MD5 cf1e215b173505c4dc81ffe014ec0a99
SHA1 3458154d6e71918d748067e1aa1e61bb1bf5cb05
SHA512 6de463fe59718ded0831e5abdb5acfdafa203141f73e6f94bc9ed64fb3c925934a1ff2be09c6b26fc84717f2a7c960b6d80dc4557d45c8b34951fac77e571aca
SSDEEP 24576:wzyJxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:wW7Oi8QW6j/FTdl90J9p8z
TLSH
T1AC65021776D630F9D523823988A20A51F331BC7717309AAF52A4177B1E73AD09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 fc6508eb5e239dd55b5f9df7465ea3ea3bd07fa98137fae947ce8107d3d936cc
MD5 4980a1f7f586852191c1131659caa5c4
SHA1 fd3fd7a869e3b79fd324217b1aea96e1d13f6baa
SHA512 6251e15b563b6027eae216575ed2cf1353c90610968054c1ef07d14222539f7a978b567775ba92086af22e84695b281fa7c3b472f62000ccbdac3e88d284d126
SSDEEP 24576:HTHaLl3z0zD3xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:HT6LljO7Oi8QW6j/FTdl90J9p8z
TLSH
T18B7501A5B39018F9EC63813EC9518916D2B2BC5A0770C65F03B8366B5F737910D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d174779aa0c3b96dd54151ad3c2c666ff6c40c800ced643efeee35660febc855
MD5 892cdaac62686eb00859c6427d933b5f
SHA1 cc4dfb366d1301d91d6be4c3264f569e68d3e354
SHA512 c50cfaeb355c34fdd60180e1532e47689af0248b8f7a2178ad6c585fa5897592ea6be6fd350d6f96fd1e5fb4a0a80c80c2c9f21e7e6e0b2adbe4549811eef456
SSDEEP 24576:H37d9CHKy7GZ7xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:X7d9CHKyaR7Oi8QW6j/FTdl90J9p8z
TLSH
T14485CF90F3E810E5F0778A35C9764511DA767C9A1B71DE8F03A8265A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1c6a17bee20d51fd160270ff83b5b98185b43dabe8f3adfe4acbdd9f067f0206
MD5 f62ef71d360ae57d98da006bad716a19
SHA1 7f145a82a512922d45bea765a47e5401f72a2dc7
SHA512 4581c1fb7bdbff7d7805821f75085590690fcd784550753f8f2644c327e18e17730c4d75e44552e2416ae09d584ac76e06b2e9e1a10a17583a2eb97dce5bfe03
SSDEEP 24576:vnxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:/7Oi8QW6j/FTdl90J9p8z
TLSH
T1BF552316ACCF91E3DD038DB6819142E4E1109CDB74B46593A07E3B4F98F2DC98B1EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1225de9284f5b35f1e56d4021aa8ec56064a9feeb4eeb4e0f4f8a8ffde7f99d4
MD5 e3fa8de8206f5cdc4ca4217dd72ce32f
SHA1 38e58dda1551517a92416fbe1fd5ffb0cabb4851
SHA512 94b2de4c1fc3677754eb35a93961a8d0aa59108c3d6ced5d3887e8216e0d570095845704f1731dc1690a4c3564a4be2cf0350958d374d5c3465dc490af45557f
SSDEEP 24576:opxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:Q7Oi8QW6j/FTdl90J9p8z
TLSH
T11F552316ADCF91F3ED0389B641D142E0E2109CD774B46693A07E3E4F88F6DC98B1DA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d62c969b8c9f115781a458c0cad0a2bd0e72c95f0b106ce53d99a2c4d769d7b5
MD5 fa2d2ab4ecc0fe06af98cac2c3c9adcd
SHA1 e1cb3c8a3d0d4cf586f3faab09941645a8de2601
SHA512 d27ad12e7d9e89e4ac3fa5c6389f440af34f5c01bf0ef2383acdb5d66f64426b2f8c1c9956e014e5c855162c9962f8e922e40e8fed92a3020ebdf4c621ab879b
SSDEEP 24576:7mxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:a7Oi8QW6j/FTdl90J9p8z
TLSH
T1B3552317ACCF95E3DD0388B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 69ab5c11c6c0a02e3c510dbb174c9492200abcc735f9b9284d7022c4f10ab6a6
MD5 cc7358f56e804ef9af0d4e803e055062
SHA1 bf221d9fc6b3d5b9ed5935c415089ab0d6ce17c7
SHA512 dd44378534eba08024a4d19482ad37e1ac0c3d55a8e83adc93984e6c94720ea26885ed36a7e1033f55f96b3a60f5449bf659e1d288de00d7c5741207ad0badbc
SSDEEP 24576:eExEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:p7Oi8QW6j/FTdl90J9p8z
TLSH
T137552317ACCF91E3DD0389B6819142E4E1109CDB74B46693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 185de485d065dd6b5695d937c14662e28dc405afabe71109ad06056eca7fd529
MD5 8be448d42a01a0d27f0c2736984d8cf3
SHA1 e25f9dd8764ef99ffeb8b320819046466b74fff5
SHA512 0cd4cc0267b66bbb90be4c1be3e12130d7d29e6c2d84316c593180712176e7316c8c5ce8adb1d26643fd3eae843ae68bfd4bd14c11088048863e11eec0fca4b3
SSDEEP 24576:rnxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:L7Oi8QW6j/FTdl90J9p8z
TLSH
T143552317ACCF91E3DD038DB6819142E4E1109CD774B86593A07E3A4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8648d2ed0994528ea137abac08639d1fd1f7e65322daaa03d1d5f6aeab068e34
MD5 f9c6e128d4eafe3a1fa9bad95c772c0f
SHA1 d5658189c03003be532f7234cd079319cf719707
SHA512 c1a8c149ab12738b111825055a1dc5c3ee39c60d18297da482a6f15ff7cef71d5548ddbc307dd32174ad8ed9937fbaceedd321d2a3cee7d131363e3f2dc4cf4d
SSDEEP 24576:LcxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:Y7Oi8QW6j/FTdl90J9p8z
TLSH
T1A5552316ACCF91E3DD0389B681D142E0E1109CD774B96693A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 32f3c0c1f0a721fa14aaa602275a382968d0486559fbe6b96aa6c83fa400c872
MD5 0a05c407d27de0599968e16c3c0e6bdf
SHA1 cb02c08b5a1f0b2b0b630b2710cbc7670fab4190
SHA512 6ef1265ea8f0079c291d84f2fae432f9a36296a4ccc8cc2ddbd8bb5c405ba1a4269e3ee37191f884b2a660f097272a40d623da2150e7432e63eda076883a1520
SSDEEP 24576:wSxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:17Oi8QW6j/FTdl90J9p8z
TLSH
T1E2552316ACCF91E3DD0389B6819142E4E1109CDB74B86593A07E3B4F98F2DC98B1DE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6e8db2bec364040f16d7bbca21b75b004071e08c0e66d9b0945910cd9f095154
MD5 d3bc68fc60eca3bce5fe0beb59e87ed5
SHA1 4b6dc1fcb3e22b84b8e21efe142141ebcbdf4b03
SHA512 c5026b1ea287ec4ae383d0b26303f6f1109e818c8c8bfe9570a2d83572df14eb05359b40af4461f3f13b0adea60cd5f447add717fb489059c631f660d8f44f93
SSDEEP 24576:ofwvok9RX6wkyAIAxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:QMnYIA7Oi8QW6j/FTdl90J9p8z
TLSH
T17685D029EBDC44E5E177913C89B3464AF2B178591B31C6CF02AA53AE0E33ED45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fb25b3b6300ba4f1b1d15c994afb860f4df2373f1a2980b3f0340f3e16fa727c
MD5 e79bb9b99aaca770e1e7b8b35c3b4998
SHA1 dc1ee33ad14ea0c69841c1510ba1cc5aab63dc13
SHA512 fc7b347c3def19effe9afaede38132ac690d583c3480db0bd6c2370d279659bf3d9d31f41f24bab853e3ed24e550c614504ffab73aaa8bf7cb059714e38e5c5f
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0T7Oi8QW6j/FTv:5ySzP77Oi8QW6j/hd83p0
TLSH
T175067C97A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 008bd97390ddb48ddf69cd409b92c6d817fa97f923f183ba5adb5af5a00ae0e1
MD5 1faac2767d1fe5693310dda9456d26f7
SHA1 941ac0bafab57ebed5f1d93b9786230581e22816
SHA512 414dcac0a1c4068fa252c5afcc394d0b26a4a089d8d097e2348593e0e6d8d28d4959b5a63756f834c0e549f6b6c2c33b8b379611eb37332f8cd74c05e0b03a72
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9xEsEvi8QW6j/FTdP/YM90lP/c1ogV:S47JUQj1irIhCnDHUPfF/j7Oi8QW6j/p
TLSH
T16A65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 212e148c3c2572b42d58f121274020f1e51896b65b123b9ae488f409e6fc7cc2
MD5 04e3c4c4d6f2811c227c8351e7c6c9cc
SHA1 3dd91bcafefe6f418fc053cff8793884349537c9
SHA512 ffeec4ff6942aafa9918344f6df96511593105a052e46d0c0bfb2e547c390f292009c34baf421bd55641d390cca3bc6f127b5927c26352c665bf0df9a79d9114
SSDEEP 24576:s0xEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:H7Oi8QW6j/FTdl90J9p8z
TLSH
T17465F11AD28842E9C42E5175C7514680F3237C6697E1D3CB52E0FA7E0F76AC49EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 877516b42411e018e094511a8c6cdb9636fc9fc9be74eda9d95cf97b059c3587
MD5 2bfcc39d299c54bb7ebcc08a0abb9556
SHA1 750c6f07e147137d6daff7f23c92e5def7dc261d
SHA512 98facc9b42beac6fc2bf2bd10d7d7e0570a9f44bf0978a8f8be16e0fecc0aba7860c70c3ee84c699121ebe333e95a6da537d623009ad71fcc26ae0b3a37f6570
SSDEEP 12288:9lqZU3fs2I9n/yHbuqDNo12hby1RQNfy9Zhkz4LTu2uW:9lqUPC4iF0liQNfc/kzcqxW
TLSH
T11D351700766AD75FC6AD40325E36D6CCAB707D41EE056B0373C9873FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 bc0be2f6d8b052bf0072d2cdafe96901d1fddd8e1ea28dda27d04a8eebbadc82
MD5 b9b5dd1c240f6a8f1f0666533c604d7a
SHA1 1f77a7c1eee0eb3a677db66b157ab29254f935a2
SHA512 7be7b3d299ead34b9dd87d68a3857df45a66e1e118535537860bd6d138fb9776750940f31c93e4883fd85ee81c25e68de3854195579f16b4c81814be711aae05
SSDEEP 6144:zMiTb6DPcuMwZsSRxVOgUPeH+2B5p6uKrvcbVtMxDcbVtMxeXVHatvC9WeGAgj+V:zMiTbIWeH+28uk0W2G+MGTpZ
TLSH
T18255C7805537A3CFD5FB6032072A9B4CAB64EC0777495F267388453AD86BB25A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 00bf5e39a90a3c4a9d97846986d1d700aa6519531b20b67f92c241a0b1dacff5
MD5 0e61ce501df4aba83c3b4d9cb94c0863
SHA1 936ff0aef69ffa1a62eedcc968f2d90652859516
SHA512 048dd0dfec6433be8629b3f97c7625eb403620c899644ceaff95c7101a3b02099666b6d200130cf4854f1df5b87f4196b5508591172891e9f4c588437a7fc3da
SSDEEP 24576:AMxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:AM7Oi8QW6j/FTdl90J9p8z
TLSH
T19B552323AACE95A3EC23497141958170F214ACE76B6495C3E02D3B8F98B1DC58F7DE47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 24d346654cc045087ae8d694f55a4365c5a30f96156cc785836eda2503ecf6f3
MD5 f8ada80f4f394dd5c884683620cac53f
SHA1 dffd088cff63072e045ef1b488bf339cea8cd996
SHA512 b6394006d54a6b161fe7e2c8c18f52004389eaebab80d740e597a8b6066e62b651527541d511ef9b7caa8395a161a6b9792cbdb99bfb204975bb5ca21314495b
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYOxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:6gb4mBIBhGF97Oi8QW6j/FTdl90J9p8z
TLSH
T1D565AE1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d386c55553baf89b238e66aa6303af0d71d70896ad04d7253f424ffb6845614f
MD5 fb7be2c362866682c63bd6fab8cec610
SHA1 2574d232a1bf77be898a590c32cdc1d11405edd5
SHA512 ca50730c1e3ec44f6d103553e6710fe3d016d7b56588c4108d4621392872b9507b5bca8325a0430a4b5c8a6711caa815e45a6a80e0a6781b85d402086a187575
SSDEEP 49152:i7ZFPqVea7/G7Oi8QW6j/FTdl90J9p8z:itFja7/G7Oi8QW6j/hd83p0
TLSH
T11085F12576E101F1D477D1388A8246A3F6B1B8261364EBDF06AC8B561F33AD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 daccb573b8cc9640d0363b41e79215a62b70f3357628a749ca41dddbc2c69e7b
MD5 50369a9ef81738e4e68561ee924db33f
SHA1 20d31d8c7f28ee074547a210a5d01af8f018b61b
SHA512 aac8beacd331ab7da9c4f375e503a45de838042848aac4b13a6911c030b87b840e92a3c08e7279d3099746df461f6de19caae42663ee9b6f5868d59e4656d4be
SSDEEP 24576:FPUr+NQRxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:FJQR7Oi8QW6j/FTdl90J9p8z
TLSH
T1BD65E12F26DD18E5E676E17D85828319F771B862131192CF02E0817E4E73ED8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 645403a17b4f67ccabb220a3e0dff3338f4ccd742e0e76fea1b478a35185d5de
MD5 bc20aacf7260d219219688fa79b5dada
SHA1 bd0cce31629bfc22a11aa24e606d66638586d3b8
SHA512 f35d05972bab37ac0b1851841675d1203526ce3b62eb153dfe369c3220b0598d15b226e805a71d4da2c3a3700f280fbe5afc77affeeab1ef665ad452007f66e1
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjB7Oi8QW6j/FTdl90q:3G05lO43bY7Oi8QW6j/hd83p0
TLSH
T1E9D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c86098328a115a00e4cd07a1b36301fd6ecba31e55c5095ad333c0b0e6578a86
MD5 0f5037f7785314e9dfdc22d71108a386
SHA1 d1a195e4b33902f36af7c1c53b4d0d5537c7a254
SHA512 d54199fe0af118e156e15abff6e0b9de39fbc64e5b5135d567cdba1a696dc49befc710cd295ce69a7adf9285f22181a5c5961ac04c5d07ca4fefccdc98be1dd5
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTxEsEvi8QW6j/FTdP/YM90lP/c1/:ta5POZ3+Jt2pasx2+mp7Oi8QW6j/FTdp
TLSH
T15D65BF5EA6EC01D5D579D17DC583861AF5B1382253319BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a657e57e0e4e6ed2c8902ede4df1d376250bc9a71e54b315353cde26777af714
MD5 b5295bfdf25a94412b908ae27603e147
SHA1 6068e9b0721e0db68eaa86f1b8fda8f5e5e2b76e
SHA512 736f16c08840b9dc5f8aed257008945888a59d43440666975a9247f8927a5b2c3d4b6da9f88947ae4821a07fb145b527d7f113cb0319fc021e23bc85b123cd27
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkVxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:ONc/zEOVHFm7Oi8QW6j/FTdl90J9p8z
TLSH
T14E857B2622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b8665da4af5005d8ddda4e1b746b253cdaa34e8a09725bd9f64affe4091e084
MD5 348fd9eb03e7e3310c70c8979e09b771
SHA1 1248520f5984d6af816c1a3b14641dc2cb3b42d0
SHA512 98a16e74198cb0aa8512e353872afa37e647b22002026479c087641ed5d4ab3023b524f3c40c630f653df0922f900668a15b73e54e9c2b7acb9c4ad99f94c39d
SSDEEP 24576:p8kNvNnaFeYhJNtmZBmPxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:p8MwBtOmP7Oi8QW6j/FTdl90J9p8z
TLSH
T1ED55AF2EBAF845E4D1FAC6B5CD238512E6727861173293CB5290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b45ba9e94c5963cf04d74723286b95753de24f36a74c5fb7cc32ecf995754277
MD5 76de5879f149d39914bbdef68e43765f
SHA1 153a165a025d2d73287ee60705b924861b86d3a0
SHA512 fc8caf9bafecc501539e4a6e1a59a2a99ee083eb9d3590bcf1513e782dc8885f2faeda15fa9d0e63c742e4f3debcd80286d6d9df8c8d73284300496c032357f4
SSDEEP 24576:PD3FHshBIYQgAoxEsEvi8QW6j/FTdP/YM90lP/c1ogY84A:PDVHeBIAAo7Oi8QW6j/FTdl90J9p8z
TLSH
T1A975E13EEA9D04E5E47BC1BCC6638606E77138A9032166CB019491BA5F7BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/252-313-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/252-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2232-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2232-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2232-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2232-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2232-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2232-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2324-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2324-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2324-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2324-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2324-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2468-132-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2468-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2468-135-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2468-126-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2468-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2544-77-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/2544-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/2544-6-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2544-7-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2544-1-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2588-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2588-122-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2588-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2588-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2936-84-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2936-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2936-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2936-79-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/4264-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4264-47-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4264-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4264-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4264-49-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4736-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4736-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4736-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4760-277-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4760-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4760-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5076-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5076-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5076-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5076-294-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5440-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5440-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5440-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download