dc9eca930569e1dfa9d53c9b8ba4b7c86c5aea781e210d8dc7e1474d091fdfc1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260803-fsaxesstht
SHA256 dc9eca930569e1dfa9d53c9b8ba4b7c86c5aea781e210d8dc7e1474d091fdfc1
MD5 5b09638c2949e816410bb27b3e143670
SHA1 cd2574028fc13845fd1f3fd889ae5d0652f674a8
SHA512 cfad9949225cab3f46205740aecda78930382ea24e4dd7ddd2b1103251d58555c3eaa92d9f3bc7236120ee97e1dec39a49c57249aba0ed51d5322c3962d46079
SSDEEP 24576:OYJ9bk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OYJtkLNiXicJFFRGNzj3
TLSH
T15265026171C084B2EAB704350AB89670AA7CFD354F2549EBA3943B6E5A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6544	elevation_service.exe
4672	elevation_service.exe
3636	maintenanceservice.exe
4792	OSE.EXE
1568	PerceptionSimulationService.exe
3288	perfhost.exe
3692	ReFsDedupSvc.exe
6920	SensorDataService.exe
2548	ssh-agent.exe
800	AgentService.exe
1208	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d544d22b957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007339784e0623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d95fa0e0623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d568690d0623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f06bd0c0623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccee40100623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091670f0d0623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edebae4e0623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f89a930c0623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	800	AgentService.exe
Token: SeBackupPrivilege	3692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3692	ReFsDedupSvc.exe
Token: 33	1208	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1208	SearchIndexer.exe
Token: SeDebugPrivilege	4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4280	2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	6544	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 6092	1208	SearchIndexer.exe	101
PID 1208 wrote to memory of 1680	1208	SearchIndexer.exe	102
PID 1208 wrote to memory of 4920	1208	SearchIndexer.exe	103
PID 1208 wrote to memory of 2928	1208	SearchIndexer.exe	104
PID 1208 wrote to memory of 2336	1208	SearchIndexer.exe	108
PID 1208 wrote to memory of 4104	1208	SearchIndexer.exe	109
PID 1208 wrote to memory of 3484	1208	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b09638c2949e816410bb27b3e143670_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3288

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 1640 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 1640 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d0d4ab840e9b05c796fb19c3ee4eea98d61cbe914e0147ead7f045e8feac300
MD5 5d07f221fa5d4ab6bc7e88e5966d4c87
SHA1 06a8bf321343a0e084bcfa0bc217ed6815ea776c
SHA512 e630598aa7edbfb4528fdba09cc6323e3e64585df0af526b311a72ad830a7f374f2306f9bb5f7df3eccaa050c4c14e4f96de23f5cc7b82708a316be9232e8927
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnkLNiXicJFFRGNzj3:Q3q6mjBH7wRGpj3
TLSH
T148D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 88eddba10ecc97727dbd0cc4641c34275c7825de72f76eed455a6e0f3e3b9f52
MD5 9963f6e441433a2fcddc26613eefce46
SHA1 81ae37dad93d9fcf2a4597408eed69ed146edf33
SHA512 640c9ee31d61faa6edba3f5a31da86fd68822e4fe65e1509339fd0c3d36a9f007d94e1f655bd8096a3f46b2a8937f2c6f4f7a85b4dbd5049bc03d9cd800bcff8
SSDEEP 24576:wXYfDtczA7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HtciLNiXicJFFRGNzj3
TLSH
T16175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 89acc5527ad87f2d08734db87671e4aa7499c09591caf41f6eb2422e7d4f7b8c
MD5 6f63f5bf13891e9db756edd6f237b479
SHA1 b23a7a04e1a82264619a0b9d1fdab79dba8300bb
SHA512 85336ba5c0f33b93efb50af06141cc852b572bc7b9e5ea7300addc1277f815e8e894cc8fe9be31037f40a1382078cbcd3ea5a748040387265f833889d9a4c64b
SSDEEP 24576:10Le5ji0hmxhrM8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Pji0AzdLNiXicJFFRGNzj3
TLSH
T129859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0f6ce25ebf9c9181fad3811b6d8e2faf22a435c9339da294f8d1099670e8ab19
MD5 9a260400304e5f1072583a3386f97fa5
SHA1 f03a6fba3b3ec6f1d7be714fd5db377b9e906972
SHA512 49c3d0dfb63847d9ed92dc48e43a641956eda4211a71089556895866d0a8684bc8d463c0b55b6a5b47d965cda6687244a6953783ce1e751fe5c7dbf53ea9a0ae
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+HjyRLNiXicJFFRGNzj3
TLSH
T1BD756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 da813e231ef559c6369db28c4bffc4554f044c142bb0dc9564d8559d0f1b61d4
MD5 d7646ca743a012a3c7ea3ffb29cdf7cd
SHA1 a4213bf67f674ca1ef24db8500b756ea44b3ab7f
SHA512 a90b64ae28d2635bb124495a847db996456234748b9031aa310df214944454560aa64c278827b05da184cb8eea5a581370151c990c404f50acc8be84ac3824cd
SSDEEP 24576:DVbqPb88hv/l+BX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVO88hXl+9LNiXicJFFRGNzj3
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bec3314f3b3231adfcb62fa69d9d74da17b9b225422ac4b020b04bc91746c678
MD5 42f66cb6d5398df9e5fbf29afd0257dd
SHA1 5dce7de7b815a655d85e40154e869544b6daf074
SHA512 e2f7f709cc7fbc56b50dc9a2a0b6e8ddb2925ea9baa5dda439372d7f811b6fdae71e90117abf4fa5ca3d55d131dc4a0cd99c92f3fd49a0d6b1724c162158429d
SSDEEP 24576:0GI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gLNiXicJFFRGNzj3
TLSH
T1E65523D3468854B1FBFD003A867A5828B5845E2C8A555DE3D2543E5EA23CFEBCF38027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 56f7f5dfeec6bf1a2d4c0d0c14586e724c2541884a7ff33e22e50acb6a7798ef
MD5 f345f7412cd32ce3757413f453a2c4e1
SHA1 e6570829b26fa3b285e26ed3c645e94230222c9c
SHA512 9de6b5bc23012484dc25aa354cc75f4f857ab4053629478f51266fd57cbd47cb345779e46fcf064012a544000cf28e83960c6807bc1821be0e7b53ec24a85626
SSDEEP 24576:KJIUv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KJIUvLNiXicJFFRGNzj3
TLSH
T17D75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b3d9df5f7b668963f69c664c16cfde1c1ce9af54c9ec322fd9a08b9f92738c91
MD5 83b8a0ae6eb005b13547b7a405ea2abf
SHA1 178c16fe88bee299f6d93efed7660e562f5fcda5
SHA512 cf679de6373d0fb914fa60269e8ec2c7fee2a98c48e6a6e7fadbc755e1a48d1c748a9cf0a0ca5ab0c7276c2615a830c0c4b607775d1e1c2bb30742192ad3b317
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THr:XQvGAdlCEL8c/WRNw5CC7wRGpj3
TLSH
T1DA266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 dea4279ae0be77e8b30c21ef846b2e5ed5c70270937a240ef2bdfad47fd72dd2
MD5 c18ad61c675e98421e5c14760b69890e
SHA1 00b8d7d1c87eb25940a3f5d7da6df000b66cfcc0
SHA512 09412b3dfd0bb2fdf5131f8389ecc63fc7dcc86a79b99c4b39b0b3daa623779cbeea167e458258503faee48fc0cf42a070a416815d717ac1a617f493c43d13d3
SSDEEP 24576:9fewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BljtLNiXicJFFRGNzj3
TLSH
T19175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b6e70322b6ef5325f0158c928881892c76bd483cabc470a0e3dc190c03503cdd
MD5 96f971a25b98b9d4abe9c1101bfe1903
SHA1 e8777e6a51cc12a3e405ff6fd836adbf505a3ef0
SHA512 118584fc3b8f99336a0a7b2a06377d2a44785627fd7aa1fa730810f718494c1b36149b5672f4d88aff3abca7678af593bc2c69393bedc863e0b4108b7362acc2
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJF9:DUEtQevvqc2W1cpV20I32P9
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 27632ad1214f8e3a4cb65b7cb049d533c122a35377f98530d9a68a8b99271e07
MD5 bb8f3d9a796fee09716a81de0c90c556
SHA1 660e43b0c5f7cc97fcfad15af433dfb0d3f24de1
SHA512 1bd34cf8a85e62bfe125e0ac982e0195d576bc9706259adabd79d8a1112a588f166155d7d6ad703fe7a4361b2e49ae1fe4acae76bbc7c805eee0b7b06ee77d16
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:Hoq2Vjnmm7wRGpj3
TLSH
T1C9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b9eada491c97b51d172d3248185acc6383a677ab729f81e62eb5c35cace5b595
MD5 56804953b0df4daf470e824072de1895
SHA1 3953790b00fc5510b48efb1b9e0c4248aa7dc068
SHA512 84d3c40ecd910593512f7f79d454cac8a42b89a2bd5a0abe7b1ba981732de686d59e3ed14c05081dc12dc25a18a732d5590e79e7950d5d2addfb03c096762184
SSDEEP 24576:MAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAM5Foiq52LNiXicJFFRGNzj3
TLSH
T180359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6bc0fb4d174da99a6b522fc96ca34e9506ac14e12f197406ca6adf6b7def301c
MD5 d0b2b40aa82449ec4b9bd2a23e4a5aa0
SHA1 08fd40506576437fdee4b22c82f3b246010dea0f
SHA512 2154233b46a28e710edc4575459d98fc2b78d208c1ae41a50ab105f375b7f3843b00f1bb2f2a747385c5a5d7f83749577d27417558f12311c0f6c56a0ed50f7e
SSDEEP 24576:YwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YwSOKLNiXicJFFRGNzj3
TLSH
T1C465F18632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e42caabdaf74d96aad497c9f501cf26112e536563711ff7206a71c1b840ad8fb
MD5 9cc9a044d2a382c48dc9988060e17eb7
SHA1 33221a0d5ef77e21811b67b69d0d52f0b86dbfdc
SHA512 63f25a11df0f0c6c79a99f1c34c09e81c721b275fc5ffbe0987b504e425601cba797bcb7020f0e62a2e70b490c0489ec99c1baa456197b7290a8190d62ac31a0
SSDEEP 24576:fZu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLNiXicJFFRGNzj3
TLSH
T12355129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 72328c177a9e0ac66ad0a78a0dc8ab015011fdd313f98416ca7283986c565aa5
MD5 0e7244c8321622b9668c796ffc41b3d9
SHA1 20ba91609d8904b2a22a3560802ec31e52485f9e
SHA512 ad5b8d5fe9738a933b9c5312f90ece679ed8f8d524b222a9d5152ab3b8ea9993f6ea54e54a2c8556ae127f7a96f6caf00e968aa80a8b3b76ff539c2902dc789f
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3z7wRGpj3:pQyiKanX+PNXF9
TLSH
T191667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91bca2e8a2c689121dc80841feef02710f49631f4e91d9aabdd32e988b9aaf3a
MD5 3ee1e5be023ba6ce4f83393688d2a669
SHA1 81d6fb69c7bfb493e008e5fe7fee3bd863c15e3c
SHA512 4a4d2f13e33fc2987c438203e8053571f7fd11cd9321f76f2b70879a093d84b262d391d93d4f35dfa003697d1d710b8c68da620a9630b55e6b2edc0dc6ee16d0
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3z7wRGpj3:vQyiKanX+PNXF9
TLSH
T1C2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 29a612e3a612067b20aec4405f7c46edac9efe7fe526a76039f0200c66e402e1
MD5 7acfb114f4038aa858f0cda8d44bf70d
SHA1 a9d52fbaca8a7b9676bb1c27f1f04637af1ce1a0
SHA512 476868d021003c0f1aed8730e8727cdd9fc2e1f630137782c4bd2ee5dc36c5f4064616290cbae274f495fbb5ffba28c3536b87782d0e6a157ac76b22073519b4
SSDEEP 49152:s68Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:mthTRc/d7wRGpj3
TLSH
T152B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 688414c8a4145c23dd0fce7afc67ac0b75db763f43f81295ecd934f32d1f13a7
MD5 efaf344fe7d023c5a919051c8056e612
SHA1 85b3af70e8343fd1de520c04f2c1ffe36ada17c8
SHA512 4c6b1f4a73c1fe2b9724b9f11a095b5f6a1a711f39a2bd64f43e8b105e95ae4c2163003a44269e5b1d31d381450f75bf289cf70dd7e0500512a4d34da8016217
SSDEEP 98304:Ky5112gYy5azzVvU69nLKnhZI7wRGpj3:zLIHRWhiF9
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 12843aa0e1e27ea0e7dbbd3b6bdefc01f57e8b807a2d141d4387ee729d26c836
MD5 0ba19329e2c0743319e49db24867d124
SHA1 d8f8b1f96da9a85d6cc6b58f37f6c3e6dc3bfe38
SHA512 51e5c941081822e7bf905406a3fd14a60180a8eb1177e8505333f1f74c6bfa34dbbc5d51d21aa3ac7d04fe6efd2eb0a82d4a07f621b5def6b924056e1ec3d8d2
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrLNiXicJFFRGNzj3:au6JmIxd2dr7wRGpj3
TLSH
T150D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c60e6386442f47620fe3e4ddc4f6b23973ecad4ecea600ce706ddd16ca0bb918
MD5 5e1efcb053d45ac655f3cc99086ffb24
SHA1 5444a0d4a618acf4f77fe4b78c778654ef694731
SHA512 0117fc524411a8ccc6b9297799f7dd6ab8b3f61f1ee171c06709a77b50f6014e71f5b2a78c1f84c70f63de22ec1cb730b2de8aca0d452855fc6ebc416b258fc8
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4xPLNiXicJFFRGNzj3:lmifPqRm7wRGpj3
TLSH
T1E3B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 06a9a4c7b0a28a01fee475544c15e858fa3db98ee7c7dd0b5ce0618d7e7595a9
MD5 dcdf3472ed5bc868cd325dd54f6c4e4a
SHA1 47309b1b751498aca1b219ab3d7dcd4d3f332f17
SHA512 761c719b7d0b69754b9c26802c245dd6418e77fc9ca598f1e289b381003a6743637c4e195cc13253de1984402c65c82bc5c6066cea94951950114f0495086b49
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHq0LNiXicJFFRGNzj3:15dKqi6107wRGpj3
TLSH
T1B7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8785add0b3d761c7fc97e2cf44c47ad3df67464d953b5188eec8ad8a88c8ac65
MD5 71e9d6a9f9558095aaf36e728be67024
SHA1 c9b6a4a65ac559bab5643724b9ff31f3d7bdc4fe
SHA512 08923aa9437ba6e5fe0442a33a1072d8fc15eb2efd4978018ac9a4cc5459f80187107d143cb342ec6bb7a235ce41319a42131066af746b591ff9826fb46f8f63
SSDEEP 49152:NhtSn8EApI0figjgiDn0AP5w7LNiXicJFFRGNzj3:cX2iWphq7wRGpj3
TLSH
T1A295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e3a52e9d04b3acf66d66426559493957cfb9bd0d3a8025880b6610ce58cd18cd
MD5 44408713d5344a7601a87d647348d5f9
SHA1 47025db36e8e06922d683f2e8b2ae448e90a7037
SHA512 8c8ec518df02e45b8f6a531f25b684bd3c18103f98bb3be04eb36def57e0835bfc445ad2164213ccc7533eca6938a247d9b187858c427f4543677963cc606533
SSDEEP 12288:gWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3558955B1FABC0039C6764428F5881E2DEB5619E3E308391EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f1fa2b4885436fbf71637064d3e4e296d056288f39b267221e078bc41b4141b6
MD5 667533c1afeb129fe85104f6139fdaeb
SHA1 d4652a3a9c02bd154cbdbf6655cf7b1c43d7916e
SHA512 1c2511c79e6663f690568ec8646adf0d1a3fa1ee4cff5de460ed71682d8cab9244d4a55b5a4ab43a8d60dc2dbd03ef62996f6c4c1ddc0810b07ac7852b532768
SSDEEP 12288:OViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fdf300d397bf5275f20c5ac2c7d9bc89052b8ae2d2aeb1d2993a5e997b9bd7af
MD5 3ae8a85bc940454a5325a9808ef28440
SHA1 c43114c2241b0a6cd233b1dd691f946f2f0f0dfd
SHA512 005c15e448994f86e0299cb70fac291f833c8c020787f7e5d96faa4dfa21bd691db7b187e858336e0c688bf69812c980a4cfbbbd95329024224460886d794c55
SSDEEP 12288:WziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3902262b1ed76107e1affc4235b0cef28902be6b23f6c5e74c59a38bc36d75e3
MD5 2908ece7e5ea5ac937c331294f13f263
SHA1 5d2f206ebbbfb1787848483d6b69f106fcc239a0
SHA512 783df706c7ba9493c6aff8cca44a0024b29ea3cfc0d5a2dd92dd88cd4855dcabb53589a620f8022ef5748b81997d5ec6394574cac191d7cd135a16ad0ddc8c28
SSDEEP 12288:fVciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C552393168900F1E9BD803DCA764424F2A47D6CD7325AEBD3003D1E5A75FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 94efddf6f41dfa524ddfc8497099441fa96de358b4d81cecf5fcf645476608a3
MD5 902c03a2bc84fa9499c279fe9aec8ba5
SHA1 f9efed2f68b2933e06f5a90318d20443328e3d09
SHA512 c5bd9ea3d7c58761796af847273551d0c5cd3467af473a7c4b98dbf1de044d3954d53fdcfde53ac930c59c7d08ad6703f772fb4faf3cc13215afd8dffc1673b3
SSDEEP 12288:XkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D65523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a7f01d326a793836fdd5e32246dd171590a8f8f85891113fc5f388540edd1cb5
MD5 6786eac5745e74c6b5a591299c1066e1
SHA1 1367feae8976343bb40b066a5980b4cd589dbb4b
SHA512 2cd04af4a62f471511ef260f1f13736aae5cf5a242673c402c0ba33240b49c420078890db8b60082005df4d001a5c204c4582d9ee1ea73009692891064e29fe9
SSDEEP 12288:AZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1295523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7d0a0361098903fc6283d53d0829464b271e3ec104903e7bbd432f67b4add757
MD5 4c4366b42ae5ceaf62bc8775589dc9c8
SHA1 284227f54d8f7aae40d16b9138b1d2539afa22f6
SHA512 76ba76cefe6d5e948065ba557411ba5eb2b9e2d35eabc3786cfb93c1ae3bba665e9d44ae51921b00b368d9561a57969240c2e9d1566df94c0a41a9887128de89
SSDEEP 12288:I9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ih/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1FABC003986754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6fd692a9cea490ea8f952246b1d613d6ab5839542246241c6b6b6c6f3199e6de
MD5 adf96247e5efff75a5b7de1b4cc454ce
SHA1 d412daa2286dd44e76cdd12accf74fa561861a75
SHA512 1f502e44da8d8e72940c80fb91f006fac3f3bf770753f5a36698cdaa4e73b38903ac54c5af8d76b1b891900311ec969b27377b1c66b6006c2af8cb14f198131d
SSDEEP 24576:gZM3zFVSOZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZM3zfVLNiXicJFFRGNzj3
TLSH
T12A750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c57cfc624a04529827a9f723b417f38acb5c3299623e72842822718e029b74a3
MD5 169a70d585124e813c8259d9294991f0
SHA1 5821a50fe02a46ed8540d471827221b91fc4c842
SHA512 c4f6cdef618ed888f61f7462aaa48164722279e68ee8b3b35f90f36cd9f0c85d90dee480071e6e62fe5b9c6db634e1da4446aaa1784102f2bdec8b52800478c6
SSDEEP 12288:0CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1FABC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 665d8cd3a56eb1a0f91db2a04c20b2b14d2466fe02c79303082250f0a2b59d9c
MD5 4fe720ff072e6a99f545654ac9bacc39
SHA1 1910cb5f88628e5ef4e1b627806c89c21f4e0133
SHA512 31134d2b6d02885e5f0782d53097a52ea2011a8706c85edccd296be1c27a239b252825a33163a95e6c829c6ac0dbab4b441e2f3938bca926f2fdd55ab25acf45
SSDEEP 12288:cuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3548955B1FABC0039C6754428F5886E2DEB5615E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a63d794fafad4e77a660a2246dbf377ce407f51d744ab393531e85cd3826ca39
MD5 68ecd07509e8746bb5bc45c8c6e09294
SHA1 ea8e89a6f542f9773a69bea8ba984d3cbc41bf42
SHA512 ba5f2829c9b69cf67353decb1d67bf6baa2c17fcef8d6eefd52d0c87a771ca299da4cca771a24a477519f46fcabd6a9e99f50e9b4407b8f3451d4135a079097f
SSDEEP 24576:nzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nqLNiXicJFFRGNzj3
TLSH
T116650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 22d72ad310aa5e1a4a94261ed6362c770fa8ef61fd812f1adb1879b319b80826
MD5 e17c8b4c268a66da55e555bf04ada413
SHA1 c8aba740406fa6466ebf0d37db4946ac1fc44776
SHA512 f08d03c3a82ce661f5b6c8e362b59021e014929499384be66346237677ac05e022169c7324369f6627e09ade51c2b42aaa04a4c6bd7bf220c30e0c6f40df6471
SSDEEP 12288:jCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3548955B1FAFC003D86764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d45b7d9dde39d7c50269943e15f7bba9fa9fff5e3abd470714e56c7a682b8584
MD5 da7dd8c9c84112313ee83d04a24dcd40
SHA1 7546631633c465c44a78bb361c13c7309fcf5d89
SHA512 8b158324a52a02cc1a7453d5993ca03070099466f606607c0f9fdb084cff38fcd73ae9bb01a2c0a31b7f89e217069e65d47c6402d820837e49013b4764da728b
SSDEEP 12288:nCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D3548955B1FAFC003D86764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1988bdbb7e95008f7e1596b8f481535d7a86b0925f72cab8bbcdb51ea778d8b4
MD5 cccb76a2f489603efd54ab6b671749ad
SHA1 0c960d901c9214ee8f3a2eeb360b32e33d366e0b
SHA512 2e3fdb88cd5b1fd985195f02719a247add7e655d2751703c357baeb7cfda5aa259d4ad7e1989832cc4cb29658eb292b5f84e5c10a999c4ec14aeef50d929fa96
SSDEEP 24576:gzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gqLNiXicJFFRGNzj3
TLSH
T170650247629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ca2ec93349f763b133094ae33be9364c685ddd249607d071a664c310b3432af4
MD5 43c51f908ffdea5bc5b6ca8daaa56f7e
SHA1 033774ac5913fab42087df6ee56414fbacf0473e
SHA512 833c5c3955f47192eb3f901097f62bab5198bbceda717dfec20efd187733562d9f0240a370334334df43f352db0aec8d6c8a27f6f55e871561e2fc27346f15d5
SSDEEP 24576:RT8aLl3z0zD3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RT7LljyLNiXicJFFRGNzj3
TLSH
T1A27502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8a3a864a3603c95e720675146aae2b90164495eb93fd886c99daaaef857e29dc
MD5 fcd7fe7d0edc6337486ba11d524ba6c5
SHA1 12f922f77b70ecdad6af5c5053faa30c3d05ddf7
SHA512 0f9c6d5db3776ae52af2e4fa2f0befaea80751da5b8f4557a9bc16be2d13c21d6bcaa2780ac68f8e54e69ea4fc261e029de90c13af306af977b4809a2bee4e18
SSDEEP 24576:83rd9CHKy7GZT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrd9CHKyaVLNiXicJFFRGNzj3
TLSH
T1A485CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f45a25d3827dff8f4f28f818990b2e07d6967e5e72039678a2eeb88105523109
MD5 495588efc320d3970c84f83bddb75cff
SHA1 f8aa250f750731b13b0d1df3d798463d11819ad7
SHA512 7f6db3c3d942d57011120db70e24db2943bb167c6ad25c4ea101f73830db182460d7a8eeeaccc91c19cbb424252e5697a54f3d9bb9be98525f2389060e49c257
SSDEEP 12288:KTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e075368c8ea2a93e285914c8cd07817549c09159fd05317aa7c5c8ae086715bf
MD5 35d75a6127900e99b1811d2407ae1974
SHA1 6b20bba06a77858737b291e8fa39f260c57d334a
SHA512 cf677e70338ac2f9b0760b03d98e83ab67021072b5dcf177a8e0aa7b5afc91f95853fded3cf32d3f76119506ecd0ad1f07b69b064fa33573c0f3c387ef923fd1
SSDEEP 12288:+RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F35523D2558955B1FABC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b4c0f0d73853be83a443f36c33e0aa266cbfb2d8fd9b973b59c1ccd812c644be
MD5 35bafd3955c0737597b9cf84b09a2c46
SHA1 94c3e1016bf63e2313e5f24612ab7fc2c8b62407
SHA512 978a092b6371847bb811edf2c944ef3a6158505dbc4381d55c2a66f42f8d04be5d9c992301df5ef13fdcd075703cf47eb9056e394dface98003fd0071e839b08
SSDEEP 12288:wIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3548955B1FAFC003DC6764428F5882E1DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8eb3a0a8e4fe39979de8c537b2bdf66dc046c8d53d93ea5cfccaff20c4e83700
MD5 3cfa197f5cd48cff679f3f4d315d0080
SHA1 84483d5cfe07562bfad0a2e7b282fb14f0e05885
SHA512 405e6a3edc93249ab0297b52866f9255fae70ee090fbc8b835504cb375d903218e3ba0d1aab88a0882842aefee08b031ee5c0df28159a0915309380319986e00
SSDEEP 12288:jCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 482e7c2409d22e37e45ac79c11c6b6284df9c10f22f701474296dc9f1f241aae
MD5 9abbe63926a2f146759a3062664ed2d0
SHA1 07661abf78ca7cb4fa4571b0f0173376c5e93cbf
SHA512 38836e5ab039358affe9030db7ade4c231023a2e1d683c632e406f6a42e6f09158a79dbe0b23c775b1bc2664ff710dbd2df3f64d5d188fc703590b0ad2dea172
SSDEEP 12288:qTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14E5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 60ecf961b0d2a70caa15b76e573d82768f5d6420f18f9314ab61b233abc65d0a
MD5 e9140d56d4c2d6c4c28e54c9513ffe1d
SHA1 632de8db165dcac303dd339a9ba91c7af1d51f17
SHA512 47cf1bc5e4fc61d235ceb81b9648adaef63618840e8ab3dbb1ffc3f03b198259085e75e008f298a0029460556ad7ab6b61c8244c36be4f18722ff1b400d6953f
SSDEEP 12288:4qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1295523D3558955B1EABC0039C6764428F5882E2DEB5619E3E2043D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e23ea5028a2a2e3bfa0314f9ef49b2bde85409c41fcd0fc1c79208164184a34a
MD5 8decbf105b52a694490d293f103e7108
SHA1 5154e8dab4fe9f3af0082d321ef83aaaf2d86512
SHA512 9cd13ca3ce40223446ac2450c59fac71cad83558338c8eb549c3af6e6c2afe76f8c06f6f74116ae354568d8cba87812d3c8953acb6f2d9d5fa18f46f2db9c494
SSDEEP 12288:PkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f4ff17213af88ee36b4df11df65f81e38e73ec426d59e87351488cdf81f5c95c
MD5 0346a3c5106bdbcc997d9941e36fb63a
SHA1 6d3bf4fd70526f3d6e17f3f460738813df241024
SHA512 ebc10b3739c080ca8ee6bc98bcb59c54af3b01622710ce08011cee6648af663f54f7f74c9171ddc8839c344a53647c09f2f958c570b695a9b1bba1aee23fe19b
SSDEEP 24576:jfwvzk9RX6wkyAIo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2MnYIoLNiXicJFFRGNzj3
TLSH
T1AB85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c37e69eda6fb0fe36bde1b771a66dca14c992a788fef9d215ffad532989e3df
MD5 58f82fb1819acb7226c116509284f73f
SHA1 711137a1bebb49f788adc93d79ef5798d97b7dc3
SHA512 3d4aa92b6d0096052cce643aaedd14c23dcb50c36283093278da9c3377b956e3ff223407e5aab9228a0a5645672be03c4cdacd46a6c6bef3ceb3b42a5b83067a
SSDEEP 49152:JYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bLNiXicJFFRGN:AySzPT7wRGpj3
TLSH
T177066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4217e07168826cb9d3f70522333ed05b6a5e5e2e59a4bedac035ece1dba50fc1
MD5 f6bc3045c7fcd3fd86a550c4e6ab05c6
SHA1 ee6afd5ac2f821167fcb9633698a221594edf2a0
SHA512 20235e440ac380611c4f4424ac65bc6312ead617bbb0ede1795da83189cbec0ca4af3c6591f58a3124390f38953292f53e17c77517ed07b634aaa3a1d8bb3f27
SSDEEP 24576:V47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V47JUQjqirIhCnDHUPfF/rLNiXicJFFS
TLSH
T1C365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b3940caca31503bb4e813d1f96e689567ca6e1ba5ec85a3911d1268d9631bc84
MD5 897acd610fc0e43b954d4a167c02deaa
SHA1 aa9445a26ba3d4745e92e272265ce3e790187394
SHA512 343a39d0ce3fb87d71f192e731e920643be98a1d3020e6ebfc25516eeac62adc9fc605ff836f65cf87a58e39312c85b63f3470ca3e65172ca3d1c7e55e8b1f29
SSDEEP 12288:ipsfSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12765F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a75466b72410ba35119b7717669c862c537ab554394a9b0fcdb05fb206e99c9d
MD5 587307287a90c8f17b363baa1730de1b
SHA1 7693dc82ccbab6565e775d293793bfdbdc3a4029
SHA512 65f8dde21a5cd4880c9e3e900e8f3a98295f4f4e348a4126aac8d96582b1fbd012fca571e03c7b7577db3cf81c17321e93b6b1b2765f3ec212d3b20cd681e370
SSDEEP 12288:i5BoiU3fIdyh8g+76G2mepUTvWRYaJPdUJQkRxOm:i5KiUPC6G2lpUL4YaJVUJQkRxf
TLSH
T153452950766AC64FC6AD40325E32D1CCAB707C11EE44AF0373C99B3FD576668BAB1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d9ddbf6b6c2608cbb97386dd53456141519655e3e823dddd313745142dcf35e1
MD5 077233764225994f6b4a9ce378e9c03e
SHA1 f7cb8f2d66309178eac574d74d7ae2efc62aafda
SHA512 4128003d7758c76ed464433498ac3e9603fe2d7ce0818cc5fc5777113bea070e78025feab4a2c6236399be2403e472b3ab9d7a3eeba4182fecdd10ee1a1375af
SSDEEP 6144:Dtrda5jzd6/6M6hL1q+CqWnLgE9KpK5I1vutX3AHPptMxiOyc+yLqvLY+8PptMxU:+wSh/q+EggKpKy25h7mgOWj
TLSH
T14575E9806537A3CFD1FA603207355B8CA774EC06B7496F26B388457AD826B25B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 21e53f5d610467bf7cfe62d210ec31106be96eb083d7fb5e99760ff304d6fae5
MD5 89502c32d353a57148823f7b98f7c1a5
SHA1 279bd19a14a63fc88b8a014468d793a550efef2b
SHA512 a9c68b98ef812e9f61408997d60d8b7a9dc0df55c27a5a4766205205a4ed7e573dd550aa258c71c2904b131f8e509c2745776082ce703a813ac7a8fcb303f86e
SSDEEP 12288:TF76iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE552393468D59B1FAFD1039857A8438B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c5a1b95416b9fc8cd787d28619b95aee80215a8016e768281b16153b2489ff6b
MD5 8a6f4e7e4ae8ff694019e7e755e3586f
SHA1 c42ece1f61865b622ce9f1c97e06bb199f34b29b
SHA512 74c9ff3547204e200cc260285727a52e2fb22b8fdc234d0b269d56d34e4c9d67a8bb281fe43077f751ed96e12033f6087da7468d5d7ba7f4b0589ee85cac43a9
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ogb4mBIBhGFpLNiXicJFFRGNzj3
TLSH
T13965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 89e957133ce54b3da8e5e6561ca29d6bf189723a906c2243af0d8255ca048707
MD5 6ecded29b6a89332e8119baa33d1e712
SHA1 87a50698c960232ff06209f0354edb99bc76f08f
SHA512 05aa45aba770cecd1633f597fddacb796741e81e04b90fbaa51eee64b8ff07976a3978e40d1a2af8500f8899fc6df58aa1313e9e0f1d6348c9c866548f979159
SSDEEP 24576:sG88u8FpJqH1vzria7/mZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P7ZFPqVya7/aLNiXicJFFRGNzj3
TLSH
T12185F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b03ffb737cdbf0edda5df52a3e73575b6967bc19b300ae735a93d7a81600dbd7
MD5 617437d964ea6df872540fef43d0aa25
SHA1 9cc2d288d95166f67fcd6ca83885db04a1811837
SHA512 e164ea9d9f3c3c2ac20213bd5ec505c6a009f695ded11490ead13e05e03fba428bd5c40a72e9a53e0958be3a75c8b0c62faf2e7dfc0cf8cee074d4dfd5c2b0af
SSDEEP 24576:lPUr+NQV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJQVLNiXicJFFRGNzj3
TLSH
T12465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e236f3c02b831b452776ab60a33e1cd0e4eaabb51cd7d09f423c7a495b793936
MD5 8cac8a027ede4bb8b87306f6d7b71cf8
SHA1 7e6fce6e3a37df89ff2e65aebda8b60b72de39f0
SHA512 0f2b4c367729e3412e1c49a62e36678f41062e472995e49d4c2ea4b92bf8447d3cb2e3337432e1f96915e02a96e59474c3db8d68e4336711e9d4b91ede89c471
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFLNiXicJFFRGNzj3:TG05lO43bw7wRGpj3
TLSH
T11AD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 96ec03d5155d052603dc7fdbdaa41275ea1e5de0dc780ad3306d8d63b9d61547
MD5 6f5c60e24c88b1d1cf68e7b347184af4
SHA1 92b0b85c65d1b2c5af677cc1e261997ebe34fa2d
SHA512 d84edf10b82c02d423bc032ba3e447d549110a8484583dfe386026fa38d249bc7bb83cdde9f942e0b27a7f2c0ce76d2bd28693a8081380b05478619f8ad7aaff
SSDEEP 24576:Wfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnb/TwSfVcYG3K/cJHlnFR+IGNe8jg:Oa5POZ3lJt2pasx2+mdLNiXicJFFRGNf
TLSH
T1DC65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9733bdc6cf35a32fb84314c868cd304a340f782fd4428cab6b19d5d2cef61378
MD5 5e0ec8d6a95a62cf50e26d1206b3f6ab
SHA1 437cdf35f371910fd92f865a4be0a857f2b35ae0
SHA512 063e24628c101ea7fd27421690c44f091891d8a2dc636b6dc6c9b791b31a73ce4dac8853c9d34023c792611dab50baba4e57949d62efd70abcd74ef606997d3f
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ENc/zEOVHF6LNiXicJFFRGNzj3
TLSH
T179858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b9a9c099bc15b345074e3ef113ac74ff61811ef3f4edd2062cf13e4baf67313e
MD5 cf160182c38433f59faf5d8674f83853
SHA1 e6b69a2927795576c7964d7a39a02fb1f9f86002
SHA512 457a91772a294b4b4a92b4155d9762de1ad0dfc84dca65f5d3c39f4a79884fc1a35e7d00bbaccb3e4032a747043ff7ec145327d193064ad77ea9031fe79b8ae6
SSDEEP 24576:fzkNvNnaFeYhJNtmZBm//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fzMwBtOm/LNiXicJFFRGNzj3
TLSH
T1A155AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 48333f6e9fb260063b8a3ec11c41ddcd93d2e2d0b2e1df3a750f90005de14a1a
MD5 43c92b3dae0440e714b2da14b6354a50
SHA1 05f35014ec613a2e78bf8957d5541cbe10996d65
SHA512 664e62ef801426424ce915062c41b223cb15839a4d95db1aa135e4b418fbdaa3c628250c06da0cafdfb6260cdb64906493b29f7d7a628627a287487f97619f3e
SSDEEP 24576:zD3FHshBIYQgAA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zDVHeBIAAALNiXicJFFRGNzj3
TLSH
T1B175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/800-134-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/800-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/800-136-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/800-128-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1208-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1208-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1208-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1208-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1568-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1568-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1568-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1568-281-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2548-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2548-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2548-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2548-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2928-396-0x0000027191BF0000-0x0000027191E38000-memory.dmp

Download

memory/2928-327-0x0000027191BF0000-0x0000027191E38000-memory.dmp

Download

memory/3288-298-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3288-79-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/3288-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3288-84-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/3636-46-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3636-64-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3636-38-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3636-45-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3636-44-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3636-60-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3692-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3692-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3692-328-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4280-6-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4280-7-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4280-1-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4280-77-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4672-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4672-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4672-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4672-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4792-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4792-52-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4792-259-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6544-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6544-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6544-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6544-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6920-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6920-102-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6920-108-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6920-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6920-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6920-312-0x0000000000730000-0x0000000000790000-memory.dmp

Download