d271507db5bdf83ffc533aa40e8eac98f2de9cb08c7a5595091f70526fddddfe

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260805-1e8azseb59
SHA256 d271507db5bdf83ffc533aa40e8eac98f2de9cb08c7a5595091f70526fddddfe
MD5 28a28de8444c13f4a00ae71d92fc3848
SHA1 d8c2e6e879ac60878c9ba2fc6768512edfef5f30
SHA512 c276a6c23d5f74d415718130ac579c444f3e2ca3992f4b044dc6ef1ebacb0a1aa6fb6283c0698ca494d899cd2c111ba606be207cb1fa6085bd594d66948a8653
SSDEEP 12288:UUYJ9biHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RYJ9bW9Xozsr8zbhN6GwXOGIh4
TLSH
T16E750272B6C1D473EAB3093119E49AB09A7EFC724F510ADB2364179A9D301D0AE39773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1860	elevation_service.exe
2628	elevation_service.exe
3404	maintenanceservice.exe
6024	OSE.EXE
3528	PerceptionSimulationService.exe
5548	perfhost.exe
256	ReFsDedupSvc.exe
5752	SensorDataService.exe
428	ssh-agent.exe
1636	AgentService.exe
3312	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\173b89f3d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c0f584f2225dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000996f914d2225dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e830c04e2225dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005874c98f2225dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be4fad8f2225dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe
1860	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1636	AgentService.exe
Token: 33	3312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3312	SearchIndexer.exe
Token: SeDebugPrivilege	880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	880	2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1860	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4412	3312	SearchIndexer.exe	100
PID 3312 wrote to memory of 2292	3312	SearchIndexer.exe	101
PID 3312 wrote to memory of 3916	3312	SearchIndexer.exe	102
PID 3312 wrote to memory of 2368	3312	SearchIndexer.exe	103
PID 3312 wrote to memory of 5572	3312	SearchIndexer.exe	107
PID 3312 wrote to memory of 748	3312	SearchIndexer.exe	108
PID 3312 wrote to memory of 1708	3312	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_28a28de8444c13f4a00ae71d92fc3848_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5548

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2508 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1524 1764 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2508 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1524 1764 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e816bb80dbc2e8751b53063e0be88a961a3960bc31ab8a3f3e0102ad79f34cbd
MD5 b5dcee428c1cb241c869ae111330de58
SHA1 d32159fe772ce1afd9a836a4570211dab02f99f6
SHA512 2e06f92c26908aeaf221a6926043d1765678c1d55ca3737dc4552aa9ab6cdaa0d557cc577cc92fbcfed6ff0e97418207eb81646320bcae6953d4b62b33db9387
SSDEEP 49152:mb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnQXozsr8zlLwJIh:Y3q60jBlwFRKIh
TLSH
T1C2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b3aa591e2d5440d2cca102164626601a143c350ab5040a13daf4d381eb3cb369
MD5 929b0f5355253325e21181aacbc11469
SHA1 9bff23b38b9bd0169e66408a15c56c86fc131de3
SHA512 0baaab98ebb3e175b1d118f05e8ac5d71ebcf51c0a2dd23965c778051de8566ccda5d5a3e4d3230ee8a07c890eddb1b52c427aea40d3ec140540822d10b6a676
SSDEEP 12288:J1XLsswWkxy2lRq2czAZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:HXYfDtczAn9Xozsr8zbhN6GwXOGIh4
TLSH
T154850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 6e75f82dcb3d0e407963bb5d9db13b308726aa314e2dfb64b4e89e3ecc038ebd
MD5 235ed782e71b92152ee93a9189a6a89e
SHA1 55362169a00610f77f5b109b151a24e51a95958e
SHA512 d3670f2161e24b0f42b55763eee9a54881a6eebd541b6c1c6cfd462ee2cc639fbb90249da9eb406bf3c42b85ca0271c8c0a76bda76f8273b5f11c52a8d908771
SSDEEP 24576:K0Le5ji0hmx3rMK9Xozsr8zbhN6GwXOGIh4:KPji0AhfXozsr8zlLwJIh
TLSH
T1F4A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f41b1094270366b896598e68706c92da019d0a66c2bedb45884b15a3696bc27b
MD5 598f0e00dbee1fbc216017d9b3703f12
SHA1 25a376a91599ae9ae00b733cf38bd556ebb0b9eb
SHA512 015633c8fc0457826459373c66054c871da7add2f583627a38a7499626c2fc70130ef230bb3f090ae4a8be98f75b58dd4ba972885ccc7b260b3cd927c4f6e111
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyuE9Xozsr8zbhN6GwXOGIh4:+/ezSC6vUzPviHjybXozsr8zlLwJIh
TLSH
T1D4755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 797025410f8383ca6d5d42039d83a27c2c7d3907523607ea414f8581fceeab45
MD5 b732849b0d4a304fba0a98ce28fadf28
SHA1 36a82cfcf62587c620a122bce2b99a6d1fe6fd17
SHA512 3d4146f5df30eab3213b48914a53bfe614a53c1bf0952561ea035de39a544f13c8a94720459b568b6f888657d16ffd8baf6f339d8b7479d066ebc39a529cf63f
SSDEEP 24576:sVbqPb88hv/l+b79Xozsr8zbhN6GwXOGIh4l:sVO88hXl+lXozsr8zlLwJIh
TLSH
T10455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 d8bb58364d5392f4c77d8352b54f24d89e813f9d450e32431c6ecd4b834021e8
MD5 5d96c9a4cc9c081fc3492e068565325e
SHA1 d359bb83fac868c9812d526b19918229331afcff
SHA512 5cefbe3f047a945b5e792e24c5458eedf33996568a74344f3244e947e79f325acf07ad212ad3731a7d4fdbadd45f7701fe5cdd21034c6016a3b217f24be9888f
SSDEEP 12288:DRqksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DR+9Xozsr8zbhN6GwXOGIh4
TLSH
T19D6523B7E691A442EF671F3139916AC4DEA3FD9E49811B9112382186CC7E476FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ed866429aa1596ef8b19e63379d7be81964b023e43301c26a0db455d0db0b9ff
MD5 f17acfe1eea9580e978c94505dc1073c
SHA1 c064517842ad9d36a6d3043e9e3797cfcc815cf7
SHA512 74e0931a40d488c0f9a9362ba5f0df4d84eda097d47728ccb1e90265e7506191f8d66e82d6c10d4cd8ea25fafc1d2d32e5091faa23758c6ecac0a1e19e9ba381
SSDEEP 12288:FeBNUbTVO86UFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:FJIUj9Xozsr8zbhN6GwXOGIh4
TLSH
T1DA85DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15c303d68cac454a8cf64e37195777678a5f72a21784f1afbac33ea901a355e9
MD5 6c0ad606f14a11a4ddf5a5f935b8202e
SHA1 1e952d72db7466d930832494cf652a5d6e4d0fff
SHA512 43af100e670a015c4a634ef283083ab0d5dddfc8ff3b3090cff184b642403a18bda3780669e92ac151e4dc730819c0a335feede533094fe30a0d6c0d51b35d0b
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THW:oQvGAdlCEL8c/RRNw5CKwFRKIh
TLSH
T189267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7be3675507a8d3aa6c221eee4e88c8ad3604968081685e3c0d06b0631e3470ce
MD5 fb69bcbf64cac3e7533ea65fbac48a69
SHA1 5927649b64b42ce9567928b302d69b6542a074e0
SHA512 d15ffa4ad8bdebd7333dc1dc6676d38c7d6b97e806cd575f0258dc12c3e4eeb664a04e1e97aa29b7e344321825ef5d71b553fe11b96c2c1a519092083e8c68ea
SSDEEP 12288:cAwSfxL/2Dc3VDLLmt0LDQewsAjfksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:B4ewsAjt9Xozsr8zbhN6GwXOGIh4
TLSH
T1B385E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2b316d4e98aa86c07a05e04f687ed64067dff362fccd10905ce20c23b6e196d0
MD5 0531ef2863b16fca03d2e9db49d1efb1
SHA1 adcdcecdf677c567df9b2ecd7a9d50a3a3b18585
SHA512 f7ed3a783dfe5a0861e0526e8644bb1fcc6c8dfdd15bebcc1819aa65b401770b90e43477bf2a60d7a317a145e420665670935c464e098cf97083e448cd746fb5
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHwDKI:sUEtQevvqc2W1cpV2RI32wD
TLSH
T11C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6527f56073fb0f40298c38faa9aa195fbe24ef81919e08d104027042ba5a1e55
MD5 121eeb07f52593401d2d3f0839b7a045
SHA1 324270210fd7e5afc1c27ae27f64de404dfecb16
SHA512 090fec6fe4aecbac0e2f3970f8bad350128cdce5289babe54493f5b704b8d9b9500f210e086c44a9f66d5db87fce7de4344b289b9d1a6b38315f587c201c36d2
SSDEEP 49152:dCbRquA/m2yL5zifFiV+XenmE3/zvXozsr8zlLwJIh:aoqHVjnmWwFRKIh
TLSH
T145D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bdbb8f41f5b85d868d08acadab82b25a1fd5a305a4be02fc45aaa77998d01052
MD5 497450a897b992d1567b32fb2e84ea7f
SHA1 db5a0adcc52b0e59f82af2a8d2366b21958bf818
SHA512 16b95f25b239e43da0beb4cdea735ce0adde1cb3bb3b10cda71f67fc30e8e327a4083bd4fc2ef6cc16b8e57ac1d2abe5d1ed3820a9280f25228f65cbbebf0338
SSDEEP 24576:2AhGL2IFoiwtA5l7S53A9Xozsr8zbhN6GwXOGIh4:2AM1Foiq5qXozsr8zlLwJIh
TLSH
T167359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3050d0326c2472de625d87ddaa834b3fa7306e304dfcf91e159c079372cbc1ff
MD5 a0df73a4b979d82536fce369ea14eccc
SHA1 07d450be236e234c10a7da5140cf82674a1119e5
SHA512 964311373f56dafa503af89b7115f8848fc9ee096243d232d3f563171d9364414e1af246c73be18b80fa52323087a235f543e5d161ea5127d1d402d6540f7fac
SSDEEP 12288:Smw5HEjsChNkBFgl0WDm+CIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:LwuVOWZ9Xozsr8zbhN6GwXOGIh4
TLSH
T16485F14677A41CF9EA67863985978535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 71998ea5843813c5ac8c9a662ebc0857d9efe081520076669f4538d681e102d0
MD5 6c64c629f8e0c383c955c8b6f7c58abe
SHA1 ed33b2cd7023add8e660015d7e6ccbd751c4f71c
SHA512 c939bb6d95237efe1bd42c3232079204be40c528483d2f6c7f886fbac00bbdece71143b7431cc38f01d7fc6ee1d0eba3c4388130d8cbb6bba7c1ffaac99e82e1
SSDEEP 12288:XZZ1IyPksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:pZuy9Xozsr8zbhN6GwXOGIh4
TLSH
T1047512AB73E030F6E6A3473998E15A44D7B3B856577203CF123802965E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 006ca43f55ad87ba0697d0feda50feb953eceb3b522f7a2726a9f6b8f37fa65b
MD5 9f93c05087d2d57af78ffd01aad66feb
SHA1 52d9e9619576ae3be128015a5d1a9d01ec3a31ac
SHA512 e4e20d305f11555b5209bf4beea1a607bc460f0c8d9606ceaca8dfaf58aec0c24ce902e81c4746f16a519b692780a494ecf2d95a11950fcb066b32a7c54715c6
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ua:pQRQyi36YOcPhLvw2gAf+PN3pwFRKIh
TLSH
T199667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6b479edaee3b654a1bec88fa96b019f05d99ec580ea1560cfa8c4293a56de10d
MD5 c62fb65e7bfdd48fad18a086bdd06a6f
SHA1 eb3af20429e4e9a214d2b1aeb2851d0859a0e0ca
SHA512 90aa77d37ca2723b69fd4b21b85185d28bf1cc3ab56db13bfc2988795d491556760f29b519ba4046c3d04e7cea5f44b90f3d48aa7f98038299bd009f6b0d79ac
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ua:RQRQyi36YOcPhLvw2gAf+PN3pwFRKIh
TLSH
T1D1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d8096657d1e44126623d03faa0cdf2fb88db7f8b288e5215ebfc78d1ae2eaf04
MD5 d9e628a8f308eba24cf9b3946ca96fbc
SHA1 a05c9126ea3f7c8ed5ca0ee8c26a69cd0dbab9c5
SHA512 cd0e9e92397fd0645726f31e5e993fabd682f761283217c2a890b9d452145722cf6fffbd51b9633cc4b91b5fbd42f888bf336b3d80e1a5920322030838d3e1c3
SSDEEP 49152:Q68Qg55nhceWu7PNU3/fXozsr8zlLwJIh:KthLRc/fwFRKIh
TLSH
T1B5B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5762c3309a6160398a7b4cb3f21952ffcc2f5e69d40e048b11497471579cf3da
MD5 723a6f4cd35cebea6885f87a16f28361
SHA1 36b06b9c6ee93355790d52fc4d75a399043e4dbb
SHA512 edb4760ba31f8df2754be59d746130aa423e0c6aca24974bd34e9ed95157dd2c1df86add5b0dab50261eda19f90df4506909e4e99dc43465635307cbf9f49242
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99Q:ky5112gYy5azzVva69nLKnhZ8wFRKIh
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 14bb148fe81e6a2de5d9c8f9d14ae8f0bf59a4f07a94b6e7b9c8095de32b8a35
MD5 a8c12a1c46d3a2ec8f489fb3d3ac6d0b
SHA1 f4dc87f81f14d280fa4c0b702f8895ca5513ae88
SHA512 94b905ca6d3efbf2602762c8456097167ade7ee5d696929a56e41141706ecdee7f546b8a707fa4fdcafd95a5972c78bc432e463a6b1ce06c3c80b79ba662489b
SSDEEP 49152:aB+taZ3usBWOBr4tEG20bqx0z+n217aau1glNXozsr8zlLwJIh:Iu6JmUxd2dxwFRKIh
TLSH
T1CCD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1329b9ab8e18a25f936be4edc25e889b16977a69407db689bfc0879ea97d9a21
MD5 7ca024e4143a3d8dee7d03710e990497
SHA1 34b1af3bd637929f809ada5581a195eba4666ff4
SHA512 df0642eb044f77e619f3455f9fccdc0b511627467d70c6dd9581a01bf445b37c581a65891ee7292d9fdfdb13de6b820385fd8a6ca5b60e0f3ce4b05668e3f8a7
SSDEEP 49152:71hpsNoJpF1A6BU44CwH7R4xpXozsr8zlLwJIh:7mifPkRWwFRKIh
TLSH
T106B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f1027ac92e302f76aba2b874aa554ca10333db1f370527767332e9ba2d0f0170
MD5 c03a5e30176d4749f2d6e5e49530a075
SHA1 148ce8c11d21f3448539282cf53d706e1af13357
SHA512 0fe69d25b40da95203d5a51dd6adf11087a49f7b96d2c66f16663f71988ebea3fb9efacd2fd4aef91f750fce5ed257c9271a2059c5809c365119592199fae273
SSDEEP 49152:1SuZQIY0Be2KNRVtOnks6NMHqAXozsr8zlLwJIh:b5dKvi61gwFRKIh
TLSH
T142C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 62bbb2c664576438ac23f9feda51cccd1251b2537d59370c22d5b7a62508c2e7
MD5 8ec286dc723bf039a9186c0ff5cdeb5a
SHA1 143b1abdb33831a8b7e49513cb7a933836b09330
SHA512 f957c7e93c8ddb112186622aaf45e4358d41205776610a525d7b43c3aed0735e6e4a2ede03f2dc04e4d7b1424426e3fb437d9e526fe86c465c7e2a06fab7789b
SSDEEP 49152:1htSn8EApI0figXgiDn0AP5w9Xozsr8zlLwJIh:EX2iyphiwFRKIh
TLSH
T1A195BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 8ad3a41412f7a9cdc8ab8057a9eb1bb05ac72729ae1d41ee027c126e7dbd638c
MD5 0d46e979c83d502789a3b344e3dc6262
SHA1 f7dba84866eb00f0b5d48f44b1c562001e43bc5c
SHA512 95025254da25ec413175fece7892922453a30d2e65e3851064bc5fd9557e793655d136848e41540390207adaeb3dba02427bee15a342e30e68f8cc1dad6fea6a
SSDEEP 12288:IiksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:IG9Xozsr8zbhN6GwXOGIh4
TLSH
T14B6523B7F992A442FB575F3129811AC4DAA7BD9FA9C20791333C1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 aa875ce4f308ab348615912b40af508b55974a30b31b58acd1e4c8f4bc598cc9
MD5 3a68a82c435bb945ec3f37c911b5de62
SHA1 b5372b309b0cab5938e0a82a8325f1fd5a035513
SHA512 8b5e4d0ad0111fd07e7490a1da195c1ab80dba74b998c9501ee59749c321183a7aff6978fda9afbd5e879a43ace22482a8607887372d2b8288ea73cfa4149376
SSDEEP 12288:TTksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TR9Xozsr8zbhN6GwXOGIh4
TLSH
T17D6523B7F992A442FB575B3129811AC4DEA7FD9FA9820791333C1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 d1a64c1edcf5cb7cd4ad1652021064327b8e1779ec0a874d7bca433109326d24
MD5 e4c507e934cc3174a0fa17dea376769f
SHA1 fb7555aa4ade8845e192ed5b92254ebf288c4a58
SHA512 cfeb740decd60b5e0baa58f718c5aebc4c43d2fad763e96c9cc75399201789627fa1729190cf929dd26de54b6502fb412e307363d7c5dacc92a969b267087cf4
SSDEEP 12288:DdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DL9Xozsr8zbhN6GwXOGIh4
TLSH
T1376523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C20791333D1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 36a5fb8d80240eeb0b936a12997f34bf3c272e9cd4c40fadd1fdd68a9e98279c
MD5 b4597e10c427220677f951d6bd064205
SHA1 b30f38686ebeacabe7b66e51c41247e847e46314
SHA512 6728c3023753acaa822a878cb859c3b1b956848e58f968cf089acd594a71be932d86616170bdf98ade90906656bca883591ce2c1c1a7d7f4ae66d4790dd46ea3
SSDEEP 12288:VV0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Q9Xozsr8zbhN6GwXOGIh4
TLSH
T18A6523A7F7A550C2EE639B3198915680DAF3FCDE9B5207DB232800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 f1408af687542dd8b6630f21c3dd6644f5b77214d09f57ba1db78cecaaaad78d
MD5 8b47a3081b10b9f99477d961a372f348
SHA1 eb0bd01bfaa08b4eb70f5fe318f6649e8b29411e
SHA512 dc4d1ad2306802495680296039e7768a8825f0785ad4855b24494b1a7679c3cad04712e33e1f1dca61e7f6055f6ec9668d3b631ff78a699dc896a1c2a543fa1a
SSDEEP 12288:DcksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DY9Xozsr8zbhN6GwXOGIh4
TLSH
T19C6523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DC7A87A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 7b891c8abac05706799349a261d63bb2ad08eaafc58286a5f967ed50e12e44d9
MD5 a46f6e8882d04e3f4e7e5121c03547c6
SHA1 48655eabb9387fddc563c0feaac6351f8cd5096d
SHA512 ac963af3f7d55cf63c4aeda1568ecdfc9bbe94207bfb5371dc5af93dde8debb5dfcd3594bd88542706a9783309e221cf9bd044976984ae2ebac4485ee8879417
SSDEEP 12288:O3ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:OV9Xozsr8zbhN6GwXOGIh4
TLSH
T1526523B7F992A443FB575B3129811AC4DAA7BD9FA9C20791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 0d7598551857006f6b882162028e6a981bc8c46d3fdaaa9fdc5731300d47b2c9
MD5 6b3d30e8bdd08feafa3fc1cc47b58b69
SHA1 d0ed222302448cd3f0b9792fec9081c8e0482ae9
SHA512 32d8a14b242b3f91f4266cc91d759a0dac2785cdc1c30535d555a3fe780934b4b3e523c01c83bcccaa85a05cbccb5e6096bc0327ba0987f3e55714b5f1bdd3a9
SSDEEP 12288:rbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rp9Xozsr8zbhN6GwXOGIh4
TLSH
T1ED6523B7F992A443EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2bcc416f313353ded6b6792bacc4179eb23bb76b768cda10ee93f998af881f79
MD5 2994ddc4fd446bb1f2c1c8fb3c89a111
SHA1 c2c1096bdce1dfd31c8dab65cb8375f97fa3ba78
SHA512 927a8d367f75d42e1b0e6689060a1aa055296034d1df945cbe3e27f7a04c78e78401761319542e11ec705e237c32ea22dae411106f494afed3a5f86eb792ff66
SSDEEP 12288:8iZwbWzzFEoS2cPvyzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:fZMWzFVSOx9Xozsr8zbhN6GwXOGIh4
TLSH
T1F88501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832575F333A11D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 a2cf4fbf64ab93d86c642869654a11183fcbd3b3e3832d707e8f86fc5a87f470
MD5 2c6b94bde929de3c4e8fe5e1e5c63482
SHA1 294588cf2ae62a2615e1c28d372a74d8d22cd59d
SHA512 5b86bcf65694b377965e39d768d4f1b23be9e9c7a41c3a86010106b72e26835dd12aecd5fd52c7ec6af71266b03926325dcfeeb1e294f86594ed3f910278e813
SSDEEP 12288:EuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ei9Xozsr8zbhN6GwXOGIh4
TLSH
T1206523BBF991A442FB571B3129811AC4CDA7BD9FA9C207D1233D1042DC7A83A7E25335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 dc0c02f82efc987401eb3ecb84daba69bf26b873ad266cfa60fc6c315f9612ad
MD5 a5c2e63101f88040ee2b09723750af2e
SHA1 7f44041e16f7fe5c12ca7efbd164e15ad06aaf89
SHA512 7c58e6f5d2a6ed3be4d6356ddd3c36b17ab674520f8a5273d5a542f6a545adb3b2b4bea42ead07d0281423b245c4696ecf67f3fa1e115298337f02c99ad75158
SSDEEP 12288:eaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:eu9Xozsr8zbhN6GwXOGIh4
TLSH
T1B16523B7F992A442FB575B3129811AC4CEA7FD9FA9820791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 8fc91e8a3dd13051b3248939fffe66979419d9c6e6ed332127816a09ae94f731
MD5 12a86a5c0d97908572adfe9be35bf02e
SHA1 b8543cee167ab111f0b3639d8632eaa6a39e89ca
SHA512 b0e1a7cb98ee73a58ed94963611a5ed9bdbbbe05e34049d09e9917f2130240676a31732c9e685f007d0d28c4d88b557c91350b9579054964ab0cfe53c875e02a
SSDEEP 12288:lyPz5L8PksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6y:szyd9Xozsr8zbhN6GwXOGIh4y
TLSH
T1F1751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b75ae307fad7e99193f77adc8f57198540dc330850ffdeca3c9ec9c1c79c91f9
MD5 b911d9bc9fba9a1ab0beaa836fcae5ef
SHA1 c1f35eac4751c6461a09a2cdcd83205110098cbb
SHA512 d9253bd513eb993f96f1acb0c486c91ded333e48c2dc7c5ab645c2c1aec8cd3dd2d4a2eacf74f01de751286d76d3c374354784650f131864f49dbe47e8129777
SSDEEP 12288:luksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:li9Xozsr8zbhN6GwXOGIh4
TLSH
T1016523B7F992A442FB571B3129811AC4CEA7BD9FA9C207D1233D1046DC7A83A7E25335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 71ec0ae7e4d6017e90c92c15838ad33ec2662c656e96152534314861c66dc2e9
MD5 96c86dded59495c57bf526047442e4c7
SHA1 9a0d119f5b0d501602b02161d93053d5ef4959fb
SHA512 5c3e2af54d8aca99e430a13327a9a8e2c26c523553cecf924d49c1e20d9b6c0a75fbbcbee66290a9466dcdb5130edd95c857cb04a3f6e96af25da8561b0da78e
SSDEEP 12288:BuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Bi9Xozsr8zbhN6GwXOGIh4
TLSH
T1E16523B7F992A442FB571B3129811AC4CDA7BD9FA9C217D1233D1042DC7A83A7E25335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5d76ed682c09930cdf56e0fc59b9fb3dd30f54d149fc129ddf0a96c5a593345c
MD5 39abaedd089e48437dafa4aa5db093bf
SHA1 63bb97c6945880a6204cd0f9b63a174529aa249e
SHA512 5aefa5654af8c8af121a9225793e12b1a227db808eb866477049efc518acda522f7b2e04c065089e3bcc76da8efe62af95791053ee0676caf31a32cd8268ff52
SSDEEP 12288:byPz5L8PksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Wzyd9Xozsr8zbhN6GwXOGIh4
TLSH
T1AD751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 427cf943c12a82c0785bb9efbb3f41b60784126ec84a9d03d4c5398d9879551c
MD5 308d719bc0283fb98ded3fdb31022aa8
SHA1 e346b1bc786a0de9f0f49adae232d0c23d587d1b
SHA512 43cb455a872bc2ea431061fa999f9c09cb1a648d8892292b99445e24ff77cf1a78a0077b36e2060170bcd1c8d194a0e2bae11654af4485830fd494b300920e10
SSDEEP 24576:2THaLl3z0zDb9Xozsr8zbhN6GwXOGIh4:2T6Llj+Xozsr8zlLwJIh
TLSH
T1948501A5B39018F8ED67823EC8518945D6B2BC5A0BA0C75F13B832575F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7d3f7579fedcebd3b6d4544f15ad0b1abf658b4f856d0fba728674ee65284878
MD5 4c18fc38752dcff440bf987ac7b534f9
SHA1 46261fee73bc2abbd7b26261fec1eaadbba5fae6
SHA512 0653835849d1d23186dbe8f2f85011e0699111df8e58b29f0f28debd70b6180aecc2480bc8ce43cfb4d7f8aa4e9d94f18febcf5e0f40b0e25b6b1f1a6bc206c4
SSDEEP 24576:b3Ld9CHKy7GZv9Xozsr8zbhN6GwXOGIh4:7Ld9CHKyaXXozsr8zlLwJIh
TLSH
T16C95CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 2b3467f2973adfc9f847c4cbce2624fef0774a1f238520f7753859ae42cdf194
MD5 5acb8bcb72d23f9020bf843ffb3deb71
SHA1 ee914294015139ed1178efbb49a68d7e3548b69c
SHA512 ed868e2271059ef6487fe2b877a7b000617fc9e54d8ea3a3ef533adc57ea519d49d20f1f2e14a2d0f7abd9d88736a7dd8f4c7bc0e933e6ba44f3de738795a495
SSDEEP 12288:N9ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Nr9Xozsr8zbhN6GwXOGIh4
TLSH
T1D56523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 256318dd38dc8af67e9372cb235c3daa8e4358926806d0d9688c6fa64123f457
MD5 bd5a0dbf7884c13a48a3313730459b65
SHA1 4307ee806d79d22c1c56e12785e8c462cdf960cb
SHA512 dd00e98f7cee9554606afbcd71cddb982125bcb4c013cc163005259810d83688354b66822529ac5b536f4e7eb8f3cb3f38ee6e316a225bcb225b494c63daf92a
SSDEEP 12288:8vksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:899Xozsr8zbhN6GwXOGIh4
TLSH
T1EE6523B7FAA1A442FB575B3129811AC4DEA7BD9F99820791333D1042DC7E83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 c69c2ab9be45f07eb237000356fd97256b9f2b5869c2f69c8060a220131e0008
MD5 ed3bd8758acc2462659106dfcdd6659d
SHA1 6edd3995da8a433a3d089d6880b303d291968be6
SHA512 657f265bdccfd6854943b6b13c0779129cf37b37613525c0d3c3a04f0cad2377cb589a9ed81684349d19534a8cba270bfc4d7518d4e61f9b1475cfaec3748172
SSDEEP 12288:dwksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:dc9Xozsr8zbhN6GwXOGIh4
TLSH
T1806523F7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DC7A83A7E25335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 a19af14ff4898ce4c5c142b1c7af6c114a906d147c6a76876e662eec6174380d
MD5 a209992701f168c4767d39bb7816b52a
SHA1 d8e1f2a3c003df4165356c82e6de98fd1cd952f1
SHA512 0618f6e2b32e1b26104e4d6bf7a8d630a732d4a229c5c86d648f0a8de336efd750dfa0774a1d97e4a5f5810804ba213a2b31dd9f50aae83c8eae90e27ad9fa0c
SSDEEP 12288:3uksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3i9Xozsr8zbhN6GwXOGIh4
TLSH
T1EE6523B7F992A442FB575B3129811AC4CEA7BD9FA9C20791333D1042DC7A83A7E25335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 fd3c888a3a8f512a9c79f60cda0d1efcc0ba92dab48e3a67aa229b87edc72686
MD5 d01613b16db042bb521f99e65a6c6259
SHA1 aa1d18b60fdebc96ec01dc614a192705cab1c23a
SHA512 16a7fd555cab82fa434895ab9471783aaf2d99d37a637f1d6706742c80be47728ceb2fc34a9c676945714a5cf69470a02e08012ea56b1be66e1b40c459bbf382
SSDEEP 12288:09ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0r9Xozsr8zbhN6GwXOGIh4
TLSH
T1C56523B7F992A442EB575F3129811AC4CEA7BD9FA9C20791333D1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 e4436dfa459a82f43b5bdae194f6615da86f1c9a0c7383553823d0f76f6a7295
MD5 9dfc4a1689f6df47afc0125744f67471
SHA1 a0e0d1f31eb8bf8642005f1a4e149412b368d3b1
SHA512 749bec841a6d4a43159401a162212ca48ad8961a35bb6233152c68e0cf588f3f873e7477df0518483d9eb5ec60e52f6f177009bff8bfcadf841a987bfae7abf2
SSDEEP 12288:d2ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:da9Xozsr8zbhN6GwXOGIh4
TLSH
T1D66523BBF992A442EB575B3129811AC4CDA7BD9FA9C30791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 e15ce2e6f3474c59c4453f18603d98c6f0d5a42de967b014772da2cb4b62f2af
MD5 1dc9559e230be6ef4dc09caa759f772c
SHA1 860f1bc77e84b20d241d37557b8a6302a363b0a9
SHA512 4f9789a4d70ab4a8d06be3fd130397020314d71a60bf65d8620cadea88cc66e598d6fe912a7869a8b177b9b5c8f25b64f80f5a04be52bba30b338073ef90f54c
SSDEEP 12288:LcksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:LY9Xozsr8zbhN6GwXOGIh4
TLSH
T1B16523B7F9A2A442EB575B3129811AC4DDA7BD9FA9C20791333D1042DC7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 cb508f4ca3bd0b3368a9fbcdc54b08d68711151934077c6653566048e275cf2d
MD5 aeb3af8c97f9d3102f6c95a7bc960cd1
SHA1 9cefbbc1c367673c9a8a2ddf5b4b8cda98fc763b
SHA512 2d49bbfe7b301643c1ed8e38d01d0ff35faab6da594b1fdcb2289d7b5ae6adce253f9d00dc2e04753ca2a3397baa67beb947ba89f555a33fe77618b3c3de5698
SSDEEP 24576:5fwv7k9RX6wkyAIe9Xozsr8zbhN6GwXOGIh4:UMnYI8Xozsr8zlLwJIh
TLSH
T11A95D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 64b35398272deeaa3614073dda8fccf7f82fa428ff8f3a48c9f2c1da0e598236
MD5 ce9e0f1ba1b1ccdeb2bb565e6b772fd2
SHA1 56239dd688291bff01118ed18cf6e0817ef689cd
SHA512 e72765eac5153a964e6fee15354727b95d038681f49c52082f79c66ddaff628177965993bc012c11c5b381f85c6a7ab135fd0bbb8b12925d677ab51747950b81
SSDEEP 49152:qYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dXozsr8zlLwJs:WySzPJwFRKIh
TLSH
T12B066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ee23d9726c9de7fc979216c61f849726eeb1855f86f1f26f10313b2fc2cdfe3
MD5 67aecb57bdcd34aad03575d8e8365400
SHA1 fd9cf668fd9f4989ef25e728f435de48209bad02
SHA512 6ac9c75b34287544fdabfc62b6c48bcf3b4b5a877b317da5a792d32fd815e35f1de3f05e5cd39358b8bdc5309ab515683db8aa9374c17ce7195b31ca24e876b6
SSDEEP 24576:647Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYh9Xozsr8zbhN6GwXOGIh4:647JUQj4irIhCnDHUPfF/NXozsr8zlLT
TLSH
T16C65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 67166ec32bb8fe83455c5dddbad562c0226af25d758ec138d8a4bb975ea04ac6
MD5 87f2760563072bee428bda280b43b452
SHA1 852992e43b7e51a2020abe450527bad6319dc654
SHA512 54f2893565a61798bcb3555a1af0993d844bfac47e04d80dbe0505b9973b6be9820fd367f0153a13d301cdd3efd91e130f399c11c7870b1cfad61162b6c023d4
SSDEEP 12288:NQsf+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ly9Xozsr8zbhN6GwXOGIh4
TLSH
T1FC75F15AE29411D9D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A5A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 662b52442c41db8ff0a25a5d52049c728041bc8098ccac5cf594282236546ea7
MD5 e4cae2ff4812c8c7b00bc6d1278d617b
SHA1 45b425998ef236d12bc28a8b67b0efc99a65c89e
SHA512 c602a12690e2feb241465aac282dd0b610a8e6927ab13a8f8ed62428ce986c567a4914a8c1e647f4adc96f6e1cce5d889d804035949c3e4a6767a1886c9bf765
SSDEEP 12288:8NhpSaEcPU3fbwqRlWnDzNXEo851TOOp54n9U4c:8LABOUPbHlYNEou1THp549Ut
TLSH
T111351751766BC75FC6A940321E32D2CCAB707D05EE046F0773C8973FD576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4e4cbf8299cdf07d941946cbcc152151bdcb064ad92c0383179e876cf5c3cfd4
MD5 d975b39e908a4684c0465a4718311c2c
SHA1 66603963c420e74302c9845216f1fc59f1989b36
SHA512 fd9e0003e1b1711c2183212b3c78f9a870a067ab7bc6ee819efdd87be98c8f93546a1b5559c096248a6e1944f8e4b18720b5b00e01d44bd2470ed6fa7780dc96
SSDEEP 6144:an1BRxmx0KrSGEqE2EVNt0GloKHFW63EHcvPetMxGaIKrexiQhJzjHMngHPNBt0k:an1BRxgtH7Del+638t0oxc+/XxD
TLSH
T1B365E9819537A3CFD5FB6072072A9F4CA7A4EC06B7455F26B388453AD827721A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 7328601d2b703c2d287752433c0e3fe784b26373ab100ac833104fc83b0ab69c
MD5 2c19c6e02ae4eb51f3e4bed9a37312bf
SHA1 813cd9630c8936b8eecaeb9d30c254e0dfa07387
SHA512 5529f3e362ea0ed975cf58374c2e7559f66dfee693e9093a25129ddc292673acf41e9d18cfdef5757385bb7154346e36f5c756277b70e33c96d29619af44ddd6
SSDEEP 12288:Ud7GksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kq9Xozsr8zbhN6GwXOGIh4
TLSH
T1B46523B7F795A802FA771B30288556549A5BFD9E4F8107C3322C1186DC7A8E6BE31336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5b354a1c2e3b05ed70286006e755c28426b07ba650a3cf10094e76e3026fe03e
MD5 8c8a27d4ad2418203169a593ca63f43d
SHA1 f467d5fdc51c2494042bccd656203ffc077b0dc7
SHA512 96dafd803f7b4e3185f5380fb918b7599bb2553e0df48daf27db53c03fbe1675bf87531629cfa0814f53c2e91fb25ce25fdc9e0417c748acae3600bc518ee7db
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYE9Xozsr8zbhN6GwXOGIh4:Ngb4mBIBhGFTXozsr8zlLwJIh
TLSH
T15065AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 8c21fa7c6c7f54ecab94eb4b9c10c9eab1f454ed5ab497ffaa3b5893671eddd2
MD5 39dd5833de4d260aa15966673f3b1852
SHA1 822a690a35f76e5a8c992ca15fdc6bcfca84244b
SHA512 cddd998f2ea7ce688b478e8d3a1e22a327d3361f9467f73c70488e498d5cf4cc32b7a48749696fc98de9296a2b45dd69dd742d1e59b27ef29166c0bbe74f2260
SSDEEP 24576:4G88u8FpJqH1czria7/mx9Xozsr8zbhN6GwXOGIh4:77ZFPqV7a7/mXozsr8zlLwJIh
TLSH
T18FA5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 edc6f811f1612185e3529a5901d2df938e351cd680be7181be4489af9ad628f3
MD5 2247c5f26d7a88f88df76d1a263232a4
SHA1 996226064a0dbce0d96b36120fe6335a94ab00c6
SHA512 d56ef990a6c248382ffa20c23e9bac7d29265dbf3267ae579caf38114b9c00789f23aeb1d27fe2afaf45d16b5986ecc3fa8f979623123f362bcdda63d2ecba09
SSDEEP 12288:RHvUrBFrEjwaQnksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RPUr+NQF9Xozsr8zbhN6GwXOGIh4
TLSH
T12885F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fc664b45411403101c6c62d3a6056f6214f158fd13aad851f0e3f5c14391dc79
MD5 5478e22ac7312ac50d470b7d6e159bd5
SHA1 e9f208a24497143823c70bf781dc0a41900e071e
SHA512 25b57675205a9697d1697a8bf21e8f04a0739a80489eaa92a80dfa8864c9f2d643946aa4b50f60ba4c07148c3844dff0879e84ffcb7b93b9be027aeacefa3500
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnXozsr8zlLwJIh:RG05lO43bUwFRKIh
TLSH
T109D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f19e5abfa1f3a38dbecf08ab80d3754a3388bed406deebcecab6aea3cc079a89
MD5 02f9db35b2b1f0a501bccbb5a7a8681f
SHA1 29af1da52edabe76cca2293a2cae487398d6fc41
SHA512 7cf16eed10c2df5b6b9f9a97a6e37564f5311371959272120402344884a69cc24e91a24e94e9dafe03cafdda16f746a6ce49370a7e67bf6111caffcee8843beb
SSDEEP 24576:afa5POZ3dpqWVM50JicR2hG0lasx2+47eidnH9Xozsr8zbhN6GwXOGIh4:ya5POZ39Jt2pasx2+mfXozsr8zlLwJIh
TLSH
T1B865BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7f983c21d8ec2239973f6741f379f327bb4b62eaf3ff955b8df3474cb1feb74
MD5 51466f215f64a10c39fef7663db674da
SHA1 eaed1eefa1bbbaa7606d6d0153bcbdba06eeae76
SHA512 9e33b9a7ca19b320d4a0fdcaeda92e81655de267249602cdbe5a1c78e7dc2209e981ec4f7f47ad55d6304dbdddf9cb7894c4e1f592ab546055b1fa343ca5ed46
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7Fk59Xozsr8zbhN6GwXOGIh4:qNc/zEOVHFGXozsr8zlLwJIh
TLSH
T1F6858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 892534b62661a2791c341137825f9d7ac29e378210e709269878d290e0d10c86
MD5 592e1d58e600319f32e2bf0db2cba651
SHA1 015ad60ae347c6c4d02eafb2c2998504f22a797b
SHA512 d79f9c6977cf5c10d5cd0bab69cdc8c8b2fc2a3a3fb52bd93634c358551eed7125f5876fa301e68f2c49896b529e2ab6c95385373722be2f6afeea7223cdfb65
SSDEEP 24576:etkNvNnaFeYhJNtmZBmT9Xozsr8zbhN6GwXOGIh4:etMwBtOm5Xozsr8zlLwJIh
TLSH
T17055AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 3e4f12479c367ab2c33de539b5237fddb8468bf48bbdf899c621351fc8cbdf92
MD5 95bfc93957f028920a343359b0e4d9b8
SHA1 0addacc25e7bde4d74154762616a8fe0bdcd568c
SHA512 9c5f8335f41c94a3300f81e4d9f3bab67a65b2a58c537835f1211e51d0ead3e951ae2c2aa4aca234f05528957daa7c6acc88b8e4543d6ff921eb62513b66745d
SSDEEP 24576:LD3FHshBIYQgAm9Xozsr8zbhN6GwXOGIh4:LDVHeBIAA0Xozsr8zlLwJIh
TLSH
T1F595E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/256-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/256-327-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/428-121-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/428-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/428-312-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/428-115-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/880-0-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/880-6-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/880-7-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/880-1-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/880-77-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/1636-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1636-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1636-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1636-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1636-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1860-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1860-13-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1860-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1860-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2628-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2628-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2628-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2628-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3312-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3312-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3312-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3312-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3404-54-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3404-45-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/3404-46-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/3404-40-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/3404-38-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3404-52-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/3528-254-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3528-73-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3528-65-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3528-67-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5548-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/5548-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/5548-280-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5548-78-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5752-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5752-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5752-102-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5752-108-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5752-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5752-313-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/6024-226-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/6024-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6024-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6024-50-0x0000000140000000-0x00000001401B2000-memory.dmp

Download