feb80d0579c0a3f3ab49122c8e5d28762ef352c90c93c9ab65f1bbf28027c049

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260809-aden6ser5v
SHA256 feb80d0579c0a3f3ab49122c8e5d28762ef352c90c93c9ab65f1bbf28027c049
MD5 cc5c651a56d5c354745a565383a383c3
SHA1 5d44ae72bf8aa0b6614d162446c3d042704749b2
SHA512 82267e4f5b9cc7c0eb376d196589699f4d4c9de97fe6fded2182e819216defae5e6e702bc0d05145847f3e1e37364b285f412005825dd1f4e5d26a3f6d7af73c
SSDEEP 24576:GYJ9b7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GYJt7LNiXicJFFRGNzj3
TLSH
T1CF65026171C084B2EAB704350AB89671AA7CFD354F2548EBA3943B6E5A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5292	elevation_service.exe
3716	elevation_service.exe
4380	maintenanceservice.exe
4800	OSE.EXE
5860	PerceptionSimulationService.exe
1488	perfhost.exe
5492	ReFsDedupSvc.exe
5852	SensorDataService.exe
2856	ssh-agent.exe
1648	AgentService.exe
2376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cb060dd0c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b17f1d179327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b2e8ad59227dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022c9b6d59227dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c4f21d59227dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faffb0d49227dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b30932d59227dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000097883ad59227dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e71c39179327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5292	elevation_service.exe
5292	elevation_service.exe
5292	elevation_service.exe
5292	elevation_service.exe
5292	elevation_service.exe
5292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1648	AgentService.exe
Token: 33	2376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2376	SearchIndexer.exe
Token: SeDebugPrivilege	5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5812	2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5292	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4132	2376	SearchIndexer.exe	100
PID 2376 wrote to memory of 4520	2376	SearchIndexer.exe	101
PID 2376 wrote to memory of 1204	2376	SearchIndexer.exe	102
PID 2376 wrote to memory of 1704	2376	SearchIndexer.exe	103
PID 2376 wrote to memory of 4780	2376	SearchIndexer.exe	105
PID 2376 wrote to memory of 2988	2376	SearchIndexer.exe	106
PID 2376 wrote to memory of 4144	2376	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc5c651a56d5c354745a565383a383c3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9229e6325079833a9b6903eebe397cf3c3d9d4bd972d7f65250ad830d76cf173
MD5 79b4b55b6f2918b978efab2abc7784d7
SHA1 694474b13f409215100e3de163860aa3c52106bb
SHA512 937c6470f96931d415669c47dededfa2fa02d861a74b2a9bc18313285876c77eb31fa4a1474a1d28b1ccf1de5d28d70450e4ef31d5cc3220390cdd2e19d32e97
SSDEEP 49152:6b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnELNiXicJFFRGNzj3:s3q6mjBL7wRGpj3
TLSH
T168D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cdf467d4aa0837712b7b9100ff58dc318a7a695cf5819a905579d53aa5ce8536
MD5 4e4715fa3f8e60c7ec6649c6361fd1bb
SHA1 065ff49200c8ecb5f20bac7dadf8a04e8762143a
SHA512 1bd2992529a577426d3081bfc5bb9bd26bc6d18d1e605797a9d2ae91d006cb0e49cae72fb994f81537f5aee43a0239104e8c146efc37723263afbae640aee979
SSDEEP 24576:ZXYfDtczAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ctc2LNiXicJFFRGNzj3
TLSH
T1A875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7db7920c53eeecb9de2ceea269024c60863c0e73b8833f5d32bd66abcf6f4c83
MD5 150842c11ee3ad0a62926ab2b48bf6ab
SHA1 c41c67e05f98caf712f3181ab07337d90e2419b9
SHA512 7857bf176d503bbbef1c427249d88d180677e691f310411fb237894c824a62e0cb8cb757e8c0bfeade006ece234e56184aab170f53dd5edfaa2f586608b9dd29
SSDEEP 24576:O0Le5ji0hmxhrM8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OPji0AzdLNiXicJFFRGNzj3
TLSH
T1DA859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c7770b7f3f46513d97a0e416940f68142b760ea16f2d47c7ae3ee2c39fc0298
MD5 c8726254bcb66f0aedbd9b5cdeca0088
SHA1 e8503b968cdbb3c4937225b257cdff17cad4802e
SHA512 011a466458b2b5547f3fd15979467a3f5e9433630eed4780f05f4355aa455667d007c73c005bb488daadb83a9ad72cb6f217e816e8a8906a26a6880cb816d0dd
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyuG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t/ezSC6vUzPv+HjypLNiXicJFFRGNzj3
TLSH
T156756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dd5707df34350796d4716a014176b3092852b1eb3c4d09b89dd4583cc2f86682
MD5 fef660336910f413d56bf6749ec4c24b
SHA1 c946bc8b7bb61f57f770353abb5e1b82e62bc9c3
SHA512 53d10e41fd1f8d50a8df36626e586c26e0da1964e2bc5623ade267078ef89edd855a2e81e0c64514c3bc76b702574b0a230bc849e7a6c1738f51e8f960f94e44
SSDEEP 24576:EVbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVO88hXl+9LNiXicJFFRGNzj3
TLSH
T1A7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 25565cba8c4ce006d7b3359bf4177297fe1598520f52559bf27d072c95dec107
MD5 a910e943976074aca3f0c1f7cc322ef9
SHA1 91914316ed93e493f47e14cb2dfd3559de5b00df
SHA512 e447c1c4e0ed177d0bd553aea2b4b12bb549c647a6ffc51110dafa4d8cc4f088fc4232e406278c7b8906e48bcc9f8ff325522845c19e4e8da628668b80d88f77
SSDEEP 24576:IGg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1CE5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fb372eda9ae4c4e119f30b1e205138077146071a19ab2a2b27b221916f16d818
MD5 ecdee6b50c4aca4f3b5b3abee35f8a2c
SHA1 1ec9c05f9b0bc4f23236cf91d52e06602e816365
SHA512 f90eab34250dc4f64f7636e3dba0647442416baa23898204c38ec9bec615c6f17e58156e67f7b7ed0f3bcd21fd20dff8ffe6f2b3a9611b60cfd2a38c892c02d8
SSDEEP 24576:cJIUz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cJIUzLNiXicJFFRGNzj3
TLSH
T19A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b1e471a9a800d51ab2a14cadacdb072991160a7e0a4cd2fb2400a7120521306e
MD5 22e97036c2c49c3ad015e08fd989b095
SHA1 aa7436d1fc3f0ac6b187f241167d80d7edb7a64b
SHA512 1299c217ea398390960ddab5fdd0678a19e45a2414f2d0d38472151247f3b172595f132c3491d53ff3dc95796a20887f19634ff083b28f9492418fa32937cbba
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:iQvGAdlCEL8c/WRNw5CW7wRGpj3
TLSH
T1D8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 60ed4529403ee75b9386bbf739b6e165cea6e576cd2c94262d4fad9711d60b8a
MD5 869e332f9240a11307c472979750d7f8
SHA1 4be393ee949d8c6af36c99063adabe9b131cb8f9
SHA512 13525566330d6a55fbd6649839b02292cdebb3232750e01b88a4aa4537bfd72d21717718191a53dacaad077e855719ceeaa1006d9ef4614d14354a4910ce3e5f
SSDEEP 24576:rfewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rljtLNiXicJFFRGNzj3
TLSH
T11375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b08e2ec1e8e1e113c61403e9c578550480a1a052aa7972064603b5c6b7171b53
MD5 42992dc9063f5c9aac813d01e7879d7c
SHA1 6064a1a7ad5edc2cc7d60580c1c128a85df1759e
SHA512 d4bb23757122fedd1c1c6699b62910502ba6872cfc345a6cb6164d7ef21a6ab5d21a2a9100aba66f573a5a1d84dbb13f921b106ab5c9bd713047be3188a9a667
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJF9:jUEtQevvqc2W1cpV20I32P9
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 adc9f4eb2c96dba9a34dee1a93fd4d12f7b082c78e4612c8dc625a0a1d32e967
MD5 e11d12e367aa8766e9a126eb308d290f
SHA1 2510136441595638b75bcba2eb5cf85167731346
SHA512 c00b2b259dc9e899355930196426b632062d18ce92f096f0307e26d19032ccc041c6177961e86dd3aae46f53fc09ef26a62db17ca2afafdea32fc28994b59f02
SSDEEP 49152:/CbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:Yoq2VjnmC7wRGpj3
TLSH
T149D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 34e28785b9f0464c49c5a954447668ae97f2b35d33e25391b847c758e2ed0ca9
MD5 ecf883203f40b8e76d97170e085dea4e
SHA1 ac9ab9708162cf686f03105ab44a03ae47bf822d
SHA512 92db3a6dc952cc658aa9676993abbe39aaed704e33d346253f5d8f97acb068d81e984445f6cb37df9f47343cc5a2a060754eeb3460df0479eaa1a63306c48332
SSDEEP 24576:5AhGL6IFoiwtA5l7S53i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5AM5Foiq5SLNiXicJFFRGNzj3
TLSH
T163359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f517a549d1795069232ae1f3255dab9986bb45945e276325a271e4179941e96e
MD5 e56260387bf4c0b8504753eb6f02942e
SHA1 b855bd56ea7d392696b14510ce9f6dc39f4f71c9
SHA512 81685d0f07b1d11680f1e9c194a2c52b76432eb5f1fdb9fef04eec3dfdec6b103b402a699015214d6ecfc6b0dfcbfd092ddcb4ced91eb29479778f77622007d2
SSDEEP 24576:4wuROWJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4wSOeLNiXicJFFRGNzj3
TLSH
T18165F08632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d1ff5d28ef3a9fdf8e80ca5061ac8af8990c8dd28bc06db7e4f1b363d0a7cfcc
MD5 61e1e5651ff9dadc3ca98abcabb302d9
SHA1 176c19c3433a8d566acd97f920a81894c93ec6c9
SHA512 9ccc0fed12ea234bf6c6f936904a15d5d14ba4957210e201b9ce49eb087392b276ef4616759ac27df77af8979b66a164db45a95c249595d5ff18e6ce5c3741d6
SSDEEP 24576:mZuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T17855129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e601ef526574ee4d1be146d7160ba412c9ad0d0fe2e9546b48c8dce0991b57d2
MD5 c178092cd89e0a68754708aad85d6407
SHA1 6c4d762f9cb5368e8a666802ebf7aa412574ce16
SHA512 1fff3e6d31c4858e0abead2343a2168543293748998180c7f404636e52a350def0fcea42f71a6d9896230d95790440db637d8c30d4a058149bc0bfa7d665548e
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:dQyiKanX+PNDF9
TLSH
T1E4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8268441acdb799a3ec462b29fc101cb963b9abc3df4bb97cf9fba87fd378d3bc
MD5 a1757a3e9b1e3d59786cf60022902752
SHA1 d463ac2709e78a580f11b750dfecccd835883cd8
SHA512 95d3ad6d06205ea44f0f281647ca55a98088ed368fe3da31b24f48ba51f69d2a9cff3318c7625d20df8387b02358e0a397bc521fac4270423cb75eb16ba11e07
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:aQyiKanX+PNDF9
TLSH
T1EC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f331d4e32c161a25994aab0471ca01120312aa525435776d47a32649a3eb228
MD5 63d4cae5bd487af60fe291f1d757d14b
SHA1 a41bba00190581a49d2a195f610ce046d8b0f6b7
SHA512 d20f2c89c9485c84cec8399564cf80da16a30cfc33527087b32050904b67f2ce0811e2ce6e5600916eaff6fbeb18e9f2a84009a86a1c7aef301c82cac6ea55e9
SSDEEP 49152:I68Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:SthTRc/d7wRGpj3
TLSH
T1C0B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 262ff49a2af35a831eba6760a63c4017be80d6f728106e18a353d257d1da42e8
MD5 729a28cbf1e60a22fa2b5c7479006312
SHA1 2d4a2006b2caae35a8b28e6fc81b2e9bba8f10ea
SHA512 932206be0339b54377649cb256a325c20d47f187ba178aa05ef73727536101b8cd1ac16f56a9fba5169e390535086d7bc5d1c2087d490daa6394feec33dafff7
SSDEEP 98304:ey5112gYy5azzVvU69nLKnhZg7wRGpj3:PLIHRWheF9
TLSH
T1DB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 72c9a88f08a8a60634ac5a2a9be4ac4b6a3c57f354d77907c21cabdb7ff73083
MD5 e435dfb5bd899e735433ca79273bfe22
SHA1 6f0f89f46f2c4a9379c4fd6da8f5dcb9db80c75c
SHA512 cd7827c73634fc7f9a50421c78c0153b5bd6241dc1199fc686bf5c182fa5ba65bdcabf1e346984e489912a5d24d07ebeaa2702b77e89e4cd0caf6b96b4549f50
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHLNiXicJFFRGNzj3:Vu6JmIxd2dH7wRGpj3
TLSH
T177D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca2eb884103db22b7b7c07a87443619f9dc827b9c188d02758371a70b5456135
MD5 918254cafabf02eba0eb45e543195d4a
SHA1 aac6f448519b3d26de2a4a3715eafaba595683de
SHA512 62aac766886533e69e272c80fd6e4399f7d5fc6ff231b9fcf65cbecc52ba826082424bf748754d6260ae087057e928669817564bf8ec90dcdf4fd7cf1c4148ad
SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xTLNiXicJFFRGNzj3:+mifPqRC7wRGpj3
TLSH
T16BB5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ad35b654cbd5a0b99b5e2fefa548ff3efa0f424cf7661a86414cc64344d3042d
MD5 7df2a65146320e07b0f64d09785ef68a
SHA1 87c34b4c2a52bc572477f4eb30a1039bfee8a496
SHA512 1f6cb05f23f42c7088dec50939ac63d42cd256f38fa28100391a6fec3976942c5a52a8299920fd09db31a5b13c607aca2398964afd02fc3ba0daeb38bf5aed06
SSDEEP 49152:DSuZQIY0Be2KkRVtOnks6NMHqULNiXicJFFRGNzj3:h5dKqi61U7wRGpj3
TLSH
T1EDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dc6ad74da11eabe74d4f1e721cdf0a7f88efd9be82802b9b733274fadacef575
MD5 aa6cdf8d6b5e5e5ad2cf508e34e15b93
SHA1 6195bd41f08868e6d4ca81228770167aa81d4af9
SHA512 cbdd178bec82caa310ff12a295953c1f70b1ab27b96457e3831fa5a76d8c67fa97e401b14f82ba7838be45e2f5908117734756d8968671a60132c41e7b4d37c3
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5wXLNiXicJFFRGNzj3:QX2iWph+7wRGpj3
TLSH
T12395BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 51b3d6f3210d17f894f7b5d171e20f615ebf2f6d3951c1cf0b82ef9c0931e55d
MD5 f49e2f1cccb3223a5d0df5abbac5d69d
SHA1 85a1d3bd2a7b6b0fe7380bbb4753af6df055b6b7
SHA512 dcb0538e8eabf8c82c8f86780a2bef9e2ea4d04fb1cd22d24b9e185d9ecf8a455c1928b458451c75eb072bf078b4717a32ff431f99a08f7d3dd1ed9d20a7a9c7
SSDEEP 12288:cuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0a3d2d7a086fad5aa1cf43eaeefea5b58cc099b6ebe286bef9a8bc72010d24d7
MD5 f8447d8f1db03fe349fd06060bcec280
SHA1 b4faa806e5ae09c70eae56b70865c6900ee5aef8
SHA512 1d63cee4348724fafc1b756e070db7092018c7353a14782792f14aae9349730baa5ac3921e87c414b7d24723aaf2fc209393618b712f8c2805d8009063596648
SSDEEP 12288:tNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3558955B1EABC003986764428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c60decc2aca44eaf01cba739a525f99bee3f1e1d0a0eac3e1ab344616390273
MD5 73134331eaae83820d7c68627edd91b4
SHA1 6cc6582480947f5c6110ec51089c99e217569888
SHA512 e13a0454cb35cf675fa0151f33d34c422fc5f3b79975ba99ed361f4ec4ced5806f5c9b6f2c0007e579a7599851f3d862f3dc81fcce6c609789d058510a7b49bd
SSDEEP 12288:+/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5a8d28f5d57d1acbda3f73da0a9c6318fa65fb450ec9f36b9fa2e68a1c5573a3
MD5 81beebb0c25c70b934db78fa71ef9fc4
SHA1 51dc06379e86f1160d8241e550f195aebe603710
SHA512 736049a8b6811f8171e73f74d7071f92f6b7566282f58d1fbc0133265c3eb8508ff94ce50705ccdee90c1faaf4affc489527173a199ed10351a17aaec89f2478
SSDEEP 12288:cVQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T145552393168900E1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f7f2d6f569b1d2b3bf8b0158e13c4136bf870e4f629d4a17bc308ac58fd104c1
MD5 1a242e683fa3b80f65431115c1032d59
SHA1 daf814560f72fdbcf26812484f2828f62e9cdb47
SHA512 d3c7c49c753bd44f7d770cc3aa753f410572759d28a9303b9dee02b43f9c1fd3e018e9dfafd40c3bd7f020698ebdb240bffff9072eed6a115141b383d48591e0
SSDEEP 12288:DYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5fc7432eabcc7a9f4d4b2d61dc9225422466d40b106ac78805304054d08ed2c8
MD5 d050d3e119aac710fc905b7c9f4e569c
SHA1 6c3a7b8866d1e3d9e99a58eb826bbf0aae06b2c8
SHA512 3477d974f77fed464c67251bc07e418bf597d478bbaf1fb8c5872a14dee2ee7aed485cb0a84e5bf41fd71b3a25a2314fb17cf9fb64343f05f0d487b73d1822f6
SSDEEP 12288:zZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3548955B2EABD003986754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 97ffcbc234bd44cea7a376a76ecae322fe2815d4bdc736d4ef08125fa9d131ee
MD5 e35ced7d7f4aac7db593ff6eaeea583e
SHA1 db832a4efe9338b9316008969de7675cb6c14ec6
SHA512 71bea13da9a64145a0e11b07835ee56166641c7fb57b5ac6a83eb037b3e7961db85529db28f65110d0bd662bb506439445b768cda93232ce53c7518521f106ac
SSDEEP 12288:dViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d4743f631b9ed9d1b67da4b5a3b30c396c0971fd48c91d67039b80fcda1b7227
MD5 f5087f9e621d230ae58bde3bf426cd03
SHA1 122930a70b181eafa2806d5452afc8afbda6cce3
SHA512 623e39065563aaf0142d95355fe9ad081fa77e31e47fac310d26bf855bcc7758dccc99aa2eec27732575bdfd9feea727969ade5c28fc4b9853c5ce5cd66e73b0
SSDEEP 24576:pZM3zFVSOx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pZM3zfVLNiXicJFFRGNzj3
TLSH
T1C1750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 032e3c4552e03076f79a08579fbd98fd4082d78bb93c581a1acaaf542842b9fa
MD5 aac8210474d08aff78a09d060a762961
SHA1 da419130015a132bffb2be7e82ef80bfae5e7ede
SHA512 3cf28d87bb026ba88bcfbf8be7646107ebd4e7367f03f7c594bad200096fd3d5fed2a5f40db8ac2dd274905f0ff24965b232a5924f8d34ca5adc89c29f99cca5
SSDEEP 12288:miiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3558955B1FBFC003986764428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9becbbddb9ace88644af2d47b925d4b9e6310bcc6b03f39f10514a91247b6b26
MD5 3842a516dc6cfc9f4eac8621004304f4
SHA1 0c1afa581032f479b829a70f23b6ba61b9f440f5
SHA512 6f36b185b99eb363a4cfc87f555d831098ec771eb4910c85620521c06642d31e27aaec0c9fd8c5dc02dfe6b587fb935695127ef7b4a34f4388587b6915f55795
SSDEEP 12288:dGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3548955B1EBBD003986754428F5882E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0ad900e0d150349728965f83b5aec3d36d4e5df2d4de5700be0f2404c2c3b0a4
MD5 0975ce883e451658184d439709ae9927
SHA1 72b6fbb8bfa95f69be360c4cb34978d2ab4402c6
SHA512 e6b02d9c26e6f26db5ee5c4fff70d2659ab64fce7e8a5757f4d370759d5c5ab2e8d5f490f0922af44e11c83354feee0f75aefd6c4887dd9dc32b222f23caf379
SSDEEP 24576:Nzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N+LNiXicJFFRGNzj3
TLSH
T13B650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b3232aaa2a01465b25856e1063b6cd532aeb80d264a5f465534baa2e32e846a3
MD5 131336543b4093fe73db19aaf97555cd
SHA1 d2aa8884410aff6125d99c831773f47d58e6a071
SHA512 28be5c73c85ff2688b3e76253fb8718584c9c475a5176ee90c8a8797b93d3d2cea9e2593d69a82443f263210956133022ddfc78276b5f7de9d7a7785e752f62b
SSDEEP 12288:8iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FAFC003986764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8e08ce818ed04490d397d8be3b3de23f4780f73cfce7de917487b466b00684f5
MD5 006b9ff72c7c8f2c712ff3d10916444c
SHA1 4fde8d7e8013af04ae1a1c66149fdb2b77fabcbf
SHA512 ebfd64b46b7b1d3079141f485bd128e1a8e5ea06efa9fac9ef967dececa3ce32efced0bb7b3ddbf41a7beb3e643535535f2ca26619651c89edba1dc5bdcc61cd
SSDEEP 12288:OiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ok/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3558955B1FAFC003986764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 34622484bcf0a0df55a8f0324a4cab30c9f4640714f5fa47ac9ee496d4d183d3
MD5 ee1cc788a2d5f7cf0bdef3698bd84d79
SHA1 eb21bb9551a68c36acd86f55704c62c2d3a2e1a7
SHA512 92d4be0e977421014f81acafefbe4624b8ab82909c0beeb214c36227046cf8de4dad1a4f61d6d32c6c2cd5dc45f11fcc454312b8e536fae290a5a31100a4f794
SSDEEP 24576:yzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y+LNiXicJFFRGNzj3
TLSH
T197650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c333c2fa9f6f4f951c550a7a249cfdd66794ee14068fa6521102655a6d7ec768
MD5 69ca864a38e59088163efbe80d62a611
SHA1 abf7035d4d4e0a43dc8c20fc02e20b5bcddf4e31
SHA512 50618f65253f723b9022e07a2820d0b903ab119151f0c5d67a8c7438d0fb0eaade62bb6ad91033cf64e46698708a558be54f9adad4a8a65adc899c170b43e5f3
SSDEEP 24576:6T8aLl3z0zD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6T7LljGLNiXicJFFRGNzj3
TLSH
T1797502A5B39018F8EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2986698875ed87c701c91423db246be052142bc2f1577e052fed49e15dbe894e
MD5 47205f74a3c401b779bfbe0a342008bf
SHA1 678f4d0cf3c6853a5a336ef9eb257e08d0c36a40
SHA512 36ab6623b031a25ebba912335d01a2552e0d8d2a19553e3dd8f6e8203157085f6a419395ac8374155970618247571d079a2ce6b4a2ee221e85c11e9574fee86b
SSDEEP 24576:C3rd9CHKy7GZP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:krd9CHKyaVLNiXicJFFRGNzj3
TLSH
T1A385CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2cab8036f4033d92946d6f5aef9ba4a14e57a246b48595c8c9aef1f5d74e2e34
MD5 bedea391ac9e7dcc99a65218e66d8390
SHA1 bc782adae840df255adafd7c70977c59358100ce
SHA512 2bb505d09c8fc3aea6add8aa5c33fcc4dc4be93999e6ef8f9c69001ae0ee3914e334346961e4c3a7923c50d20660745641cdb3a2dd2872abd18b77a40bcc103d
SSDEEP 12288:nfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ca6620a8bbc3586767d4fcd7d430d3925a63e6039133e254404174839873c06d
MD5 da2b0bd71f6efb33e20149950e4ce78c
SHA1 a1aa8bd66685aaa9a5dbda4fb72ea13eb1f092f9
SHA512 70d2e6a7fd9a372b375b86d847f9bb49af878713884ab60912c8a66259fce4727737cf89cfd14659fd3ebd281eb2c4efb6d5841aa4956b3a234bf84c46f81717
SSDEEP 12288:gRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523D2558955B1FABC003986764428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a2d16feb4766336f8653d5ee52928b4cf804248b0a69a245d18e191573f77b67
MD5 7d1ff293363a9afab1d319f7a1cad30b
SHA1 a57ddf2cadc8574d275a2a1cf48f45a8dadfef55
SHA512 b4aa95e421b8c98f8cd6907fd261273479537100a8efdb7f97f153447bdb0609d7a47c7b553157565158be404bd67f01fc92c7b294a25cb8967902e3b4c85626
SSDEEP 12288:2EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3548955B1EAFC003986754428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 594334c93f47f8b6f5a58506c6be46b8dd119c923cd9ea17a7223fc456e8c42c
MD5 f24bbb4cecffa6e10e1325a9296f89cb
SHA1 8ffab5e5f1857d52886253d5f292782fcc4e898d
SHA512 1341ee73a016e78d9f16840440993808ea56e6cfd02033c786a3883d42155bb34ffc5645a95c5bab2cd9b91c7eba3c6e36b8bfd48af0431b0940a64a2612fb5a
SSDEEP 12288:MiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3558955B1EBFC003986754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fa7595e7925025b7641273a9411cb2767abc090cefc76f353560304558716089
MD5 f73a489242b8fb6ca9dce59f2437cec4
SHA1 4c4feab0b8e164e83b088865f231d15721b954d0
SHA512 90a9fdaca10de5a0ad64e92f2f10863aa533c792acb81f07c40fbd467317c53a1ceacfd0f94829653486fc73e7acac70c7bb18712d44f3912cc9b6f06c3f39f3
SSDEEP 12288:8fiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8e1038697f4cdfcfddb97d76146f1c6755434fb3a24c3754749a08c9dc826c7c
MD5 a014107d06609cd5de27d454a794defd
SHA1 28e08416c5f99e604c4e75e9601c3e551b860a22
SHA512 34f9d9814df1ac0441954e5ee7a992879f5d55b52a097376e3225b3fdcf291dcc8266a596b9b6261f09800ae755b7ff7a76eb01ad7cdbe47951f4fcce8e159bb
SSDEEP 12288:7qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C5523D3548955B1EABC003AC6754428F5881E2DEB5619E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f805ca37f26bc88ab3b26cacada8819c0244a59ee9723d208a84678ce58ec857
MD5 568052ba9fd17b78f3c1d6d6c17be912
SHA1 fe0c1742b1c401b0b8f4fca15906c08ac39dcd0d
SHA512 c92649ab71bd6141370a10242121058a17c5851d16a415f9d0e94bcfbfec72a27fbd48adcf00c70d16a9a09f06351de7b3f73e56cac45dc6b533ebd22fd5d49c
SSDEEP 12288:WYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3548955B1FAFC003986764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 712cab870bd3170a446c9861b561f62807672a59858d93f6aac2bc1c691f0360
MD5 b10bad6b53fa92d8d0e270399fc147f0
SHA1 ef2cb595a397c04a16a4afe5fa9f4bcf863cf23a
SHA512 7a4db41ded636c3858a65bf45c516842b5c2be870b3987e94cf60c9ce8492e1a73bbac51a4b1e9bfeaf2e535140677a3d5c10d766c196c94ecb88fef6b078893
SSDEEP 24576:3fwvzk9RX6wkyAIA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yMnYIALNiXicJFFRGNzj3
TLSH
T1D085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 16056510dde7c0a01987efab86fc41ccaeaf12c0af55217bd3835d4f43232c2d
MD5 7de5e9d961f2f2a5b45f345d812e938a
SHA1 463716117dd3622cb27e5fd2a3d4a3465af012da
SHA512 2004552cb607f1d44e97b2fc1a184a2f2542d18ddd40e6b97556cd080f6b51674963a50bea59e95312c952a174d1fd769ef178221b8f6dbe0e3c380cb9aea659
SSDEEP 49152:PYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03LNiXicJFFRGN:yySzPP7wRGpj3
TLSH
T1A6066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2413e462a67f022d2c159029a2ebdcbebbda79b446ba5a36cccdfbcaa43c2cbf
MD5 4906e65c647cc9def83a8c8647e68dbd
SHA1 2f4140c2019b8f79359499bb969074b2d7794b9c
SHA512 113b9a33f080922263be1472486b42f5e5d63b5ad7a84c1d65beb269ec4afe786c362b33e44aa6c35a5f004b70a2790aeb509a916a830fc3a3fb148df45bc806
SSDEEP 24576:D47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D47JUQjqirIhCnDHUPfF/HLNiXicJFFS
TLSH
T12865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a6fb17cb8fb71f99c924d02ae78a8b093d81924fd8ece679c7b8935c61ccdc2c
MD5 e282b6b6658dd187bbb5f9ab0b1f53d5
SHA1 2aa7bf173fe8f5b2bea334943e9266872baf88b5
SHA512 80ddd69d375b6145f5ea4bfc72b6566efc068e16c3e4f3f2133bf9e7c905b5cf57ae1b6808df3c5e5fd15a7e9ee2656399b22c0b1ed5c4e33d02e914ad53458f
SSDEEP 12288:5psfyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF65F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5093f3b8aded235da3e998aad603532d9c74e719dd10d128c7af9e6301e0cc37
MD5 7be2fd2b21cbc09c25fab20f4aadc0b1
SHA1 16503d70ecf74075a7ec0f5956e51831a6305734
SHA512 e2da26046a12f8afd2aeba210a227155d529998b83b086dfbd503b820dce27b297c3b029eabf1399a3128a7d87717600121bc6f0c7e0bc540cc09a23a280ab49
SSDEEP 12288:kntVzHU3fOoJU5EFxPPTolUj08/21RMqyVOLJB9:kntVLUPOqU5EFxDdI8/21RMqicJB9
TLSH
T146353950762BC75FC6A940321E33D2CCA7707D12EE059B0772C8873FD576669BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 20446eced6ac77a7d9124d30079463cefbf7dde40be94ee69383d55b30e33301
MD5 a4a08fca58e76ae5a7980958ab0a4657
SHA1 c6b63b1e88d696c74767890c42483e56383c30ad
SHA512 74823eaad12a52f4872f3edcd9fbb81f0648a5688e58f70a00f2bf7a1b101ce6d2a2373e0fe552d6460855a99d475351bed7a5498ec9abdcf78b97e74e26bd79
SSDEEP 12288:snrljugrO9Vmxl48tdw3q1g8kMzRN6HS1l:snrljuJ9Vmxl48tdw3q1g8/QM
TLSH
T19965D7816537A3CFD1F76031032A9B4DAB64AC0777095F2673C8053AD86AB66B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 62378eb6c9fe48c192dd4ddc187fc9695c9cc78b6ff7e099ce5bfa47d0067e24
MD5 c98c4a6a58221df435dbd997673ca80a
SHA1 7d2e2097783d555af875f2171a5d1592a6caac08
SHA512 21ec5673fb37f14a4da371646e2023f11419af6f37f7d240a800baad19d676badb0ce584ab9dfa81c97ce70ebc46d89dd7a6052024a0d4b7d63c0fb34d13909a
SSDEEP 12288:dF76iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523A3568C59B1FAFD0039867A8434B54D7E2C9F1594E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb20f0fe0ac7e27a04a4467e900e0f56041c07739531481402773d7d32acd53a
MD5 149da9c7327803ab187b2c6028cb2076
SHA1 c9d5052bc5881e0719061ffaaf1f49a50fb3c133
SHA512 23ed79555e01df4dd939b3c9a1296be3578c347c59ae5f3c3e798443a5ebf6abd5299905da928f1ed1f78604eb3f0ec4571dea65383dc6d6d6d740f9ad5364b4
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6gb4mBIBhGFBLNiXicJFFRGNzj3
TLSH
T16665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0456990948839f16a66d8e1943f2f0e47120fa550362142da4aabd4064ab6c25
MD5 3072f64c31d3f0c839b74d08d453b08b
SHA1 b9c3ac2fbf9fdf477642b8e9de750dd455c19a6a
SHA512 b3af2efdfdefed91ada79add6019cce0a23e636014e8a1b3d117e1078fad17e95416ecf78e4e6616836bf7e92a5f726938ea75c90bcf150fc5f9034e58ee6740
SSDEEP 24576:4G88u8FpJqH1vzria7/mx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:77ZFPqVya7/uLNiXicJFFRGNzj3
TLSH
T1BF85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3d4b65b95482924de554051271ed9c745385e63996d28d07f2a58eed4344b2d0
MD5 7be39c017aa35172ae464a5d59d01d51
SHA1 3f3bcc09ac11a3d82ef5f3cfc927adb5c6fe7916
SHA512 b51dad0b510781f9ead15048df36ef6dfec047861bdf36c2f487c875be139a81b1f98f117d4bff5460cd581f18c7e7ccd0e35c1d333387ec50802d15392f9089
SSDEEP 24576:IPUr+NQV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJQVLNiXicJFFRGNzj3
TLSH
T13365F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aac9df509ea89b4a2ebf8efde2a73a7f3b449104126e10b75666064c96f4ff81
MD5 50f82bae1a68bc102d22f0e03ff7fc75
SHA1 f4a445f453d7b28cf50f0272fa78b55a249d8b9d
SHA512 ac5bf12da4c4db545df0caf0b2d1006f42a4fa580326844ee79fed29eb56e1bb9be5806c2c4488699a3317cb240eb479041905367e7b4111b650cb5e14a9c7fd
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFLNiXicJFFRGNzj3:pG05lO43bo7wRGpj3
TLSH
T189D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 06f8772403a926131171404855e1fd64b3b5ecf2744e88049465e3cf4325ecd4
MD5 a4fbdea64f2142613194cf0bc00e1872
SHA1 c3454d848bed96fc9a26d25249fd141699d6b4e1
SHA512 2efc4c73dee4bc66d4e9b8f1c4d20ff765aafcc187f4b1f2fc194e5cac5de8d1208881487c4b85680087e40f2cece91f9f50d3c31567c87fb719be33f570a0b1
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn3/TwSfVcYG3K/cJHlnFR+IGNe8jg:La5POZ3lJt2pasx2+mdLNiXicJFFRGNf
TLSH
T1FE65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f02264bc7cebcdc360aa61624fbdc8cc103d9fccce2a00ae4a8e43fb9aff8966
MD5 62decb109ff7edc7d21a84d263707e3d
SHA1 902bf4ed1be103a5892c12b365eb978191c87736
SHA512 6a2ada8fc6d444464ef08b74173b6afde57e49df576a3fd0915d7562a0e0da12f62512d4b1656fd8a84cf06fc91e39594aa1d83a0ed533c58b7151546e713ddf
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fkp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNc/zEOVHFOLNiXicJFFRGNzj3
TLSH
T11D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fe9ca9bcaa74c6615f864875f283715a11e730390d8713c83a19c261112caa2e
MD5 4f57cec1c309e40378f3040634b905cf
SHA1 4b51a73780af9101f054c6a89c9d0f818b6d9c29
SHA512 49cfe00ad38cd44fc39305b576465394b37e4790b01bc9e9f986fec1b2e911629772bce42ade2d56a7cd8cd7b395d8f34364fcff82f4d4aff7f9863352935df0
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OzMwBtOmDLNiXicJFFRGNzj3
TLSH
T16755AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d290038e3ddbe83f2ca23c8d0d0cebd9096d84b711c748df31ce32988987b1eb
MD5 a24de80d5970cf2ebdd36b32dd181887
SHA1 473d12fc8d5edf673b4fbab48e0d2418db39a772
SHA512 4ff1c0d5d65ec41c50beca71cccbf9f799113b5f9225481bafa0c3a5fdfa6ea8a46c8fd7f2e7c7a9d7543af46f9d598d1c9da13fdad8cd681efc07626ad66ebf
SSDEEP 24576:iD3FHshBIYQgA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iDVHeBIAA4LNiXicJFFRGNzj3
TLSH
T16175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1488-79-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/1488-84-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/1488-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1488-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1648-133-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1648-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1648-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1648-127-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1648-135-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2376-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2376-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2376-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2856-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2856-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2856-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2856-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3716-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3716-100-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3716-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3716-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3716-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4380-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4380-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4380-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4800-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4800-173-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4800-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4800-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5292-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5292-77-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5292-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5292-19-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5292-12-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5492-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5492-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5492-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5492-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5812-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/5812-6-0x0000000002290000-0x00000000022F6000-memory.dmp

Download

memory/5812-1-0x0000000002290000-0x00000000022F6000-memory.dmp

Download

memory/5812-64-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/5852-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5852-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5852-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5852-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5852-108-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5852-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5860-72-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5860-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5860-66-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5860-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download