abae3ed37f487440008a7d73dfc6f323f8a4c535b634adad46e2800de7c003ea

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.2MB
Sample260809-ndcfpsac22
SHA256 abae3ed37f487440008a7d73dfc6f323f8a4c535b634adad46e2800de7c003ea
MD5 00213d47ad081cbf4ec4585c48f0082c
SHA1 864c245ff53c1791bbcb93041b206dff4eb5cc5c
SHA512 3a88bb352487e2f6e44e20de55e4d6218dad9c37f582d714156b6a9912d44d6994dfd4db1db63ec609794c691e86f0824b33d763c2eed5fe2544f813fdd958d0
SSDEEP 24576:nVGGTWBZO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VGyWBZOLNiXicJFFRGNzj3
TLSH
T15255025131C080B3EAB7043449B49970A96DFE345F7549EBA3842B2E9E747D28E38B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4748	elevation_service.exe
2940	elevation_service.exe
4828	maintenanceservice.exe
2740	OSE.EXE
4128	PerceptionSimulationService.exe
4900	perfhost.exe
3236	ReFsDedupSvc.exe
5692	SensorDataService.exe
2296	ssh-agent.exe
5280	AgentService.exe
3404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\231611b583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\RepairConnect.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd82f490f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3c52f90f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c53492d2f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe4ac98ff027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000458dbd90f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093ae608ff027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab4b4190f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4748	elevation_service.exe
4748	elevation_service.exe
4748	elevation_service.exe
4748	elevation_service.exe
4748	elevation_service.exe
4748	elevation_service.exe
4748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	5280	AgentService.exe
Token: 33	3404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeDebugPrivilege	420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	420	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4748	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4680	3404	SearchIndexer.exe	99
PID 3404 wrote to memory of 556	3404	SearchIndexer.exe	100
PID 3404 wrote to memory of 4364	3404	SearchIndexer.exe	101
PID 3404 wrote to memory of 5976	3404	SearchIndexer.exe	102
PID 3404 wrote to memory of 2720	3404	SearchIndexer.exe	107
PID 3404 wrote to memory of 1372	3404	SearchIndexer.exe	108
PID 3404 wrote to memory of 500	3404	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4900

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b03fe3cab2c7ad1f9c12b5464a283eb4e643da224099732fffb555904576cf8
MD5 4cf701feb455a6881967697b491b9061
SHA1 ed56b98c3dc9803bdd9f9df92072a452445a887e
SHA512 5b7d4f6f8c32b4ed9364f41ba5c8600856b6a811f320b1ea330620ad7a85d9c89fdc9510e6e576c28a0a93539da8874066ebf16277ccea8f393945dc66624e3e
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:O3q6mjBf7wRGpj3
TLSH
T104D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 5adb9e5d73cd85f9bc8b17a0e43a689bfbe1d934824ee94a8192d3269973fd41
MD5 ba19dec3e4efe53b7a49334c5c0cc0fd
SHA1 70de0f8daab7687eff6e5442ad3510b594e37fe9
SHA512 7b90b74c88fa15a36c13b794cdab5afa70177ffa23efbe323392ca8e90f299b7834e6b0bb3f7095536a1be26738f666e34c3903e540f0e53ffcf489f3ee1f1dd
SSDEEP 24576:IXYfDtczAT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ftcGLNiXicJFFRGNzj3
TLSH
T18A55012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 78935264ec687801a6bcb842af887d691a720a2d40facc02f885365cab13bde2
MD5 41550783300c1eaef47ebeb2fa7a83ff
SHA1 a238747506738d0542747aaf3115b7351ee41185
SHA512 9f1d7db942835d61e9e5e9bd77961ea6251feb88a0030a0db119056eaa65f2956cf8185f1ef69d45e2924198c256e10016f791ab2a5ea3fff74ba3a471450ff7
SSDEEP 24576:T0Le5ji0hmxerMQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TPji0A8tLNiXicJFFRGNzj3
TLSH
T135759E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14108ff28ca4d27c054fefd37ce78751a78bfc0442a90d22cbfa19b24af788c3
MD5 987e619e5650320a02e2c2f370ad8b99
SHA1 ce29da161308aa7c7bb45079d97516c2102e3cf0
SHA512 70472296721092c2af08357a81356ba3c7230219fca9117c66bfc2892a42334a109d82aa070a534954556bde5ab05df9f6d5139260f4b26884f38e4cb29a519c
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyu2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l/ezSC6vUzPv+HjyxLNiXicJFFRGNzj3
TLSH
T113756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a987920b8c5dea1b270fdb2824a419c45d29cfb2dbe0cacdd2d8c510f3dada11
MD5 9297413dcdae5ff19a232c9734cee9af
SHA1 134562daa391094873989f7c2b167f82f1f8f0ab
SHA512 816af97121659cb55f8a492e21c3eb5d8bc3d931ecd48ad18cbf2b2119043018dccd487f2676c0ee5f2a8dde0a0940b38a45686b1dab8a164b82693cde6fa287
SSDEEP 24576:KVbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KVO88hXl+NLNiXicJFFRGNzj3
TLSH
T1AC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 ffb0bca37165f93cd895d059b9b9640e4614e860d92e21863d41346748a44ac1
MD5 4a99d3a559eb74161a0d81a971250461
SHA1 1e210f0845fcb3bf3688ed339a486499b2b30573
SHA512 8997c5fae195f75ed53fa3d8246346af136f02f8359a8af8397dc33385a8562b840add783fcf93e0714e666c30a4c0e99ce6b91f77d6019d2f30b9f46596ab1a
SSDEEP 24576:Oes/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6LNiXicJFFRGNzj3
TLSH
T1DE3523D3468854B1FBFD003A867A5828B5845E2C8A555DE3D2543E5EA23CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 aeadce9ae82f6bb22fb5448ffd97c7d1dbda62578b91cbb17c04ce145f11a9eb
MD5 039137079eb9ad8a42888eb24f9ae7ee
SHA1 4afa4f47388bb2812a3c9e171194006fefd79447
SHA512 34887bf514e3b20609451caed4f8610fd9823a350bd2716f4f3e7bce91481d2f995bf58333276b88b04891f62c22fbc03c1058ba0cde6ce9c3878b4507c7955e
SSDEEP 24576:CJIUX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CJIUXLNiXicJFFRGNzj3
TLSH
T15165CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3d3c9132a2b44cb1d79758a63178745b427b2bdd7564f2d4cb857f90f6114ea8
MD5 8b1f3e577b27841ef1906cf99913067e
SHA1 a072bd6669c16e1228900fec236d6ef527a07d54
SHA512 55c3ff20fad03604f66f2f8174af34d944588ff363c4c2c843ac541fdf4abfa29ccf474b48f4580f6f29cd5ab57280ebff8a19971a789e411d52a0cc40c29b92
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THT:xQvGAdlCEL8c/WRNw5Cm7wRGpj3
TLSH
T189266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 e821d57dc9a86b0f3698ad1f488d9aeb9448bc3f3157f8cf422bbf5fea856e08
MD5 26916a0d737878a054c056562a18561f
SHA1 76b52dd65f79466cd842c373487f523546446dae
SHA512 696b903e7cceb346d9a744c19752989f89c35f5a9c7c7debf58e10b707d0a3c6b7603603d8277295b947cc07058bcf85a77a97f4e5122e67871b97927ce2bb10
SSDEEP 24576:kyewsAjd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DljdLNiXicJFFRGNzj3
TLSH
T1BC65E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f96d8f2ffadf1c8a4f703491f4e3e25f0849528daa7c5a086ef0976b20f050e
MD5 4f6f70b709720e429808fed2169c98be
SHA1 b2ab01ddb0eb7b45b3cf8970c78caca8db84c19e
SHA512 e3c6ae570046d0974c54710fd790c1da338f4afdb7c6cc2307228264e45412fd4a5ad2d74a13d106e164b921171df9c17066fd27f0c5d2fd63dd753f1a05b6e1
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJF9:EUEtQevvqc2W1cpV20I32P9
TLSH
T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ba5677d16c59ce7b5bb108d0088635dcb2a30fbc06ccdaa87082d4b31b8f2450
MD5 4c0689f34edd46e127462d02687c90d6
SHA1 d5e57678b2b941182c5a5b0eec0e9b03feb185fe
SHA512 c770021d2bcb82bdb1501db0766836af6c2d4cfbd7657b79baa917856b5a7a2b1201ae76d6e09da3a77bbef0a033c7afe16248372a9a0755d51b9fd50a4cc058
SSDEEP 49152:rCbRquA/m2yL5zLfFiV+XenmE3/z9LNiXicJFFRGNzj3:0oq2VjnmK7wRGpj3
TLSH
T185D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5aa2a0643df1e5aa5bc12b9305da8672614d2a862504ca6f4875849cd27ebbd4
MD5 144584c5ae89a7cf5d880c7f56e41535
SHA1 de69582a5235290695c2591ffaa7c500016e6bc5
SHA512 be865a57c48db5665e2ec01be0f4858a3d3ba51bf4777fe4f7153f010bae37c4778e3c862f3d53af376992e09853af42d897ea1860e75267943d77fd678bbbf7
SSDEEP 24576:QAhGL6IFoiwtA5l7S53q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QAM5Foiq56LNiXicJFFRGNzj3
TLSH
T1EE359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 b837b1352da6023293f55607ae6e953d4d75d3831fa9176e6b989dc11e855510
MD5 8a168be1b87ee24344ea047439a55678
SHA1 e88ea7623296c113b9d71fd201f87db695c629a9
SHA512 c7b3058e702054aa71491292819ab84143cfbb9976cd2c13314c2ede01a2fd80dd4a77a714a65442e400717e8b9dc724e1ed8cbdb2857209b4c6d010a109b12c
SSDEEP 24576:1wuSOWR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1wRO+LNiXicJFFRGNzj3
TLSH
T17255F18632980CF9EAB641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 a8b891d2bad6a4693624088ad11f3bb153235f86a22ae4da12be06131c459d9c
MD5 818ef219c8a2765d8513421e1b3bf1af
SHA1 0a5c37062ce1695b21fdced525003160f9aeec8e
SHA512 7f7285213df4c7dc4c66d93337ba0c20fbfbc525cd1af1fcf84858e414391f52e64d372a5267c2daa88c0f7a8dad1bcf76fdc911a5c326774c1e227dea89ac02
SSDEEP 24576:BZu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T12D45129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2516581fbd9101e02923b59f5fc70b80e4760274450fc1466ef32892b4357108
MD5 56e80cc8f81e9175f46c94bfedb31a3b
SHA1 435c71b2adac607fd4879eed9520ba8ba0e07013
SHA512 ee5a2bee2397c9550acfcbce90b18b1390992712d046b8f9a0cf49da7ad207a0bfec7c17d584d45d1f808f5efa70646f37ee632f50f4e905372b36459e673e14
SSDEEP 98304:3QRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:mQyiKanX+PNPF9
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ca8b2746cb9adb3d499f808ab046b37fecb987a28df79af61c098e7c042e7448
MD5 d625d9065e2ef40adbaa3125bfe6e183
SHA1 813f7051356a67cfc98aa6db0a5455e653748ad1
SHA512 d907e0cb81846caadea6ef2de6dea19bc54a4f367261f34a7cffa13e518fa5636171d582833e628f893606c6a3d60c81b3a787c1e0c99f4faf999b4567e0e293
SSDEEP 98304:5QRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:wQyiKanX+PNPF9
TLSH
T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 183cfefdfcf9d24c3acf0eb0110608a22e7fe088834efbdfbceee279c02efbe6
MD5 7420053042de8ce2532753dd095504d5
SHA1 0268630608ff93a1a550e2954145b2f093754668
SHA512 b147dd0ab6856813cc06b0f070818cd127fd73672df07b1467be89f1e11403819a483aafb7f18a8170fbf1c66096edd317114e037b4b112d39d63929316cde3a
SSDEEP 49152:b68Qg55nhkeWu7PNU3/tLNiXicJFFRGNzj3:lthTRc/t7wRGpj3
TLSH
T1D6B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4cbfc628bbc7e32f5714172a068d6857738e9875985973c9e4803178bd1398a8
MD5 51d09dcb1f6a42333efa413711c925b0
SHA1 35e93313ca212c3b87c327880b58809572f28e21
SHA512 c3ccb77b5b3dc8c80a029d7e055403bd86b1f4b774abd862507812d1496b8fb0ac8e32f9cdbd49d83c829a65d589b7e5a2a6306fb6cd436793bc65ecce044c56
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZs7wRGpj3:/LIHRWhmF9
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3032be9149e90a6fcd7a4b664bfbdb111a58ea51fb7b4003403f89b0da1770d4
MD5 cba1aa566d579535bdc61e478a7ea80b
SHA1 eb9a40d6ae7daabe3976728cbfb5610e1f49c07b
SHA512 c3cd6159ec80e3c31d2a0173c33d76293db84ff3f25de7a2a12fd8caf78a1a99d70456a94b63d0978ad5989c72e3221807ee01ba6f37b47dafce46f869f7de5f
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljLNiXicJFFRGNzj3:mu6JmIxd2dj7wRGpj3
TLSH
T1CCD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5b1717614728a2b9a468cce9d0fba458829411cab0a91ba1389675afd296c596
MD5 b96eb92973284efcd4a5b05d63d84245
SHA1 af23b7a81f3ab4fb923fc299eacda0b29ffe500a
SHA512 80016e4da8b7d1741019b7b82c0e67696a1ea1eb57d9dda608ec16c95e7c22394479d34b059d18c52eca4c80e62fed14284a19c74781e197866c8bace3795dde
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4x3LNiXicJFFRGNzj3:zmifPqRK7wRGpj3
TLSH
T108B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a427c204f72623e8ee2fbd111229412d560fbd8eb9f00cec9ed51dd6ff330f42
MD5 d74b90a7787c9bc01b4f0f90d747652c
SHA1 3bef7e7220108350375966085b76d041fd3bbef8
SHA512 591cd5354f2a56a985a28a981887740f3e8b2823e61e762b0221c44cde06464b65a3072b1ecbea5c861c109280258ae02fa11d914405fc4e7e725faef6103671
SSDEEP 49152:ISuZQIY0Be2KkRVtOnks6NMHq4LNiXicJFFRGNzj3:S5dKqi6147wRGpj3
TLSH
T148C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 92cd8efa729da35651351095732dbc600ac59fc21cf464ab67f65236a66a9be3
MD5 bccbee599b7c495047fbcce0e4855722
SHA1 89966a76550dd74dbcbb6fa6edc88420ed43a66a
SHA512 dac6d08983940d6726b73d9f160e54f464240924ce6a3c4f0f6bd58cd62d27dc1b2ca6b9a9cc7fb8efd3c9db7b48959c737f83558976e4f310fcbd2be96c1249
SSDEEP 49152:RhtSn8EApI0figjgiDn0AP5wTLNiXicJFFRGNzj3:AX2iWphe7wRGpj3
TLSH
T15195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 2628dd982964f101a860f0938702333d92b3f0e0f3644018bff4d3437f837b51
MD5 bbc944d557ada7d5f27d9877c3e85142
SHA1 ce0f1802a72cf2fb1f1b514146285964a206f302
SHA512 b5346dd365dcfae5d2fbd45e0699136bdb9213560c6d8bd2575832e5e8d4f629d7579ca5c2feca4a05db1c2e0eaf082217709c507c6086dbf78f70357b8228f8
SSDEEP 12288:4SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:40/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A33523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 838c8afd19a318b9d1c7801b40427fb26a1259b2288a78fc5cb83f900c4e8f61
MD5 1ceee505a7867492381abac874d08005
SHA1 c689ec089bd5676c6738e34e0ef6193ccd6fae3a
SHA512 0e386af04ece43b23925e383fd1cb6e25202e6a58df701e2c3074067c1421546316e4ead7f896d493ac11ba8daccd7fcea45ad21fd210f1305f5c45e0b9f6757
SSDEEP 12288:CliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1723523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 5efd04f3c4aff0d03f7dc011d8c5645e401d223d863b5b3225c6423969de8efc
MD5 8b58bc90d8ba5e413ee80bcf8b048ffc
SHA1 ce4973c051c965200d97ae3544df55d8c162c4f4
SHA512 2563b0af9db75f33e33f97baa998f93b043113233c21cd1f581d8721c0f580892b06ff766387a2d9f8d19e133be9f229fcabf5468fbcdc215a558b2bb64bd2b6
SSDEEP 12288:PLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A3523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 0d2384f66c21fdc29cf18a884e700d87596216feeb1a80959e1d4529e8b73326
MD5 dfaac6b736f5e4a0d7212f6d9ae3631d
SHA1 b29995d89224a673a9baf55ba3ff1bcddeb26764
SHA512 7d2e3c4ba4a9d47558708c27bd42fec60631b72a53dfc610e5b193b211b0d72596409ce899ef37151e39d0dcdacca82100354b78a74cc011d891dae99cf4dbb0
SSDEEP 12288:tV4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T150452393168900F1E9FD8039CA764424F2947D6CD7325AEBD3003D1E5A75BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 8dd5f4c1e88e5f2741c4979c6c448501d54aa9a3e5876b64d1750234a785de25
MD5 3f2b7a18190a205475037dd087a6b286
SHA1 de24f6f230a6c2d3689665b0e4f444424c818a45
SHA512 4dcfb02f6ddce98ebde0d4c15cd169652664f9c97352ad60e0bf8b66bfa808eea9328d47ab2760743d64c6ddb583dba3afb576bb2e9986562271e543a2979e10
SSDEEP 12288:OwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Oi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1033523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 cb2861a1cea77b11e6ed819d1502e4a4454ca88d3b5134261f93b4ad62d17c3f
MD5 33e6283c68ee555e918c299e5b06d30c
SHA1 d9b61c8db217a32e2048ae2a9c8f682732bfcc71
SHA512 5f346b0740c7da54b363dffb987f1b6e5b2366f912aaf75ea4f09d4255da87b722c99a318cc0ca011accbd84af44a8105360dffcdbaaf33b2a2132d02300a7fb
SSDEEP 12288:W5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1693523D3548955B1FAFC003986754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 a042fc6f77b02e2f8c50886463657d8f67b0e71e0f80e91b0e5b13a2b82cb8c3
MD5 a782d2a223d5f2f6cb73b752cde35247
SHA1 9256f6756b3d49a08f59dc63230980a2c6424f47
SHA512 cf72ed0f849d606039e4eba5621e0a06464d5a815150da8ddf950411ce63c5e24c08deb80f268bda53ad7cf0aed8a54a3ff1f97d181adf54cb0d934424e60201
SSDEEP 12288:49iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1103523D3548955B1FAFC003986354428F5882E2DEB5659E3E2083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 092944be5cbb74a776fe4b7e7c6c7a444676079c3b63923fccb5bc604ce68710
MD5 e411d694b5ce734f0af7a7b2df147a47
SHA1 eaf41c12bf3e6f23a3936f8eadd99cbcf8e376c6
SHA512 8a39edbf3e5e837623079d3453280df08864fbbb5af17fd91a96e2dba34782e879f860f9feeac6a089f72364cc92e925f9b4da0bbf0f0250427951115559042a
SSDEEP 24576:YZMOzFVSOJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YZMOzfVLNiXicJFFRGNzj3
TLSH
T163650295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 9c2656321137bf9ccc5e3869a21ca281c85cdc03475fc7eecfe27eb91987961d
MD5 5d35d54b1cf27a25e80959ea3730bd3c
SHA1 24f764391635b57282bc8fe719235657b3041a12
SHA512 ca24598b07714fb8b266dc788bce20f2794317b71a999c0b5b7fbdb8dd89333f82e1c8378ff836db92e7cdfdc0596e07ed2ff485a41e000655dadd10275d09d4
SSDEEP 12288:IeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Io/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F13523D3558955B1FBFC003986754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 bbc6cb341386370208fd5fa9df8f8d308a6e786211dd42cf1e4d5d9d331e173d
MD5 2b8cdfb35970c4af2944407591bec772
SHA1 c0ebeed0943f9495ef6ea5ee80380c01c2f34604
SHA512 b26c0187476375ba01f9578657f62b20eef3b3c21a754bc4b61d9a2b12abe2e31e34bbd65db2b1e73840445782f9e4387f4320050b2fbcca773841d0fa95d35e
SSDEEP 12288:z6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1753523D3548955B1FBBC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 43f410dd329ab7420f3b0ec6a55dc2dc0578ce82edc32f1835bd3fe46678bb0f
MD5 f7f11fd22dc88f000c59a0427b8606ec
SHA1 76950274e799f20b65d2d84b0ef0a604dd091254
SHA512 f10a229621154b6482e4b152ab4a10c9ec3630d5b814fe234b3dfeb252d4a4b65c8394db03b0762d06ab8677b90bf73c598677f795232219c290e5ebf2f11347
SSDEEP 24576:GzyN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GeLNiXicJFFRGNzj3
TLSH
T1F3550247629530F9E17A4139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 6d17b15d04d827ea76def6100b0ec4862f43094093c14d04c3ad55e4c925e05b
MD5 463ee8b06c9582f98798c72ce7190c84
SHA1 1d395bc932c2e0ed7bda8581f4b8ac8ac03a6a9a
SHA512 419dc7a382b43db79e3b1f3aa3edc75f479f7e706b79d4fee258b322b04de261a05f85dbc6bd6645d0d2b84f8de58fd1d12003a759b5d3246429a9d4b4453550
SSDEEP 12288:9eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B3523D3548955B1FBFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 3648efe26b7ff0512e5cbe00be080f219af4811dcec77945fe16b35eaea531e9
MD5 9a4e2858306512d148cc2ea82d1619b7
SHA1 a6f8ebf57294e311b195ab4cb0a47956b6a36ec2
SHA512 19b9a2991e510dc183c6727ebc0ef0dec0dc2363177229b2f7ea0b49c0cdfd35f4de4b84dafa1882a6387572ca6a6202b220864e3a2ec28c721f531915055890
SSDEEP 12288:yeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC3523D3548955B1FBFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 f86ab7d3eb23b4a607898456f7fef629d08f49c54c5722547449a37611e9392b
MD5 6b450a5e159c87d45b13971af07750e8
SHA1 614b32a9ed0f40d897f17b923abe3df3d17e4eb2
SHA512 cbb7561281314fa13a9bfdddadacecdd5112b63be1b5a4ec0b88ae860764b67a9f5080e2b8b52552bfc8966c01d6074d0c14c3ffe59ca7619561e90e65660877
SSDEEP 24576:vzyN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:veLNiXicJFFRGNzj3
TLSH
T10B550257629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dafb791ecec7b100d16a17429e07ee22b619642505d91c77b12b3a1ffb36eaa9
MD5 e53ba762db8fc92c8bca03702ce19e1d
SHA1 3b1d29ff54ae028b72e289b7b828570a36aaa6fb
SHA512 2c2035a552839ff7b25cc993f3183426e5ab2a50bc6a265738e52be8b3f643df046f768e806f431d2f00ba71a798785ad6db7f67f5f932c46d8937fcf432ef58
SSDEEP 24576:ITzaLl3z0zDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IT+Llj2LNiXicJFFRGNzj3
TLSH
T1376502A5B39018F4EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 ea7532ba5b512214f1804454841c9cc859cc03d7b3a505af4cdd09b547403a92
MD5 1a0a747e66de41504a911db8f712180a
SHA1 58edbf2c8d06e4d6b077dc7137e755599b879877
SHA512 fe56ad0403866c32c82d5e628eb1db40f1d9db407530502297fcc8e9189ca8b18804e81e1b08511b0165a8c0fd3d1d31a91d179d27bf39aed24abdab4279aa6f
SSDEEP 24576:w3jd9CHKy7GZ7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6jd9CHKyaVLNiXicJFFRGNzj3
TLSH
T17475CF90F3E814E4F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 2d2cce403368595f8b309eaaa58910277c5cd8065869cdd44055e69158ce2d5b
MD5 30c6343b032cfba29734a45d2ec05e82
SHA1 bc1b99bd7185f537c0a243b168d5e5e144e040e3
SHA512 b4cdda2d8b05a1f06c564ebc9ed55c2514c91b8426e70902520db989dc2fa90df06bc23a9a39bad8cbbca85226b6d932f317ce6663196a55e8ff0e8588564492
SSDEEP 12288:oriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F63523D3548955B1FAFC0039C6754428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 627ca429313775d74ea72dbcd3b70b73036ee4c1132ca1e4670a92cd17b40bc9
MD5 81c65eacd9155d636c6acda4ca318d26
SHA1 045616bdf917c0f3fcf3de1d1ac7a29c5cf1d916
SHA512 fd992a4bd70c3f70e6d2bd428dd280f214cc2c1773e9cde64c60972f98cb2c8600283a6a970d721bb8ce5a4206009315a71292e03b899abc4e545d3a5d98df82
SSDEEP 12288:/BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1813523D2558955B1FAFC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 65238d63f87a26acb2b6890d0fe0a4aa028cf03454e4a279c6ae08642014d24a
MD5 7f220a53aa8a14b1d66f0950e08af6c9
SHA1 09e077e11246acbae6cf0516bbf8a281c73d826c
SHA512 bdf2f95a8e6208c9c11baa02c38631c9af366e0d68a10b5a6d6cefbbcae4fa04f895c7abe5b8b64ee249bc3f2bd260ae6ecd144b219149bdcb9aa98e2f7d5b86
SSDEEP 12288:xEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD3523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 6bb3dea7da2360544fedff6fea9e1c60c4cae2d8a68de44b8c649e0e552171c1
MD5 93090db0c4276ae2929648326925ed43
SHA1 b300b3a00fa260faa044d66e55cc10c414b4abea
SHA512 b2b88962013c1cd87b3a22245fcf7919d245126c57c2ade5c66755fe79237fa5f6470341818a71a1e8f96f3e919da01b0534f1d31b99aa9e407bb1febd18c075
SSDEEP 12288:ueiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1593523D3548955B1FBFC003986754428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 8baa04496644c60dbe6c7b7f6dfdd842125fbae4f937ade4254d588f5cba3d7a
MD5 a15e46b6cb20a6985bfb5920c9d0ae40
SHA1 e8c68c7b5ca6d6100ecbb54376849f86c4022789
SHA512 a8dfc17468c318016235d4bc078186c576b51694385c0a08b1f545830f3d7f3177206f05647b6004f91bf09d8d16a77aaab1604dca7efd1aa79f8274943a2481
SSDEEP 12288:+riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD3523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 7cf8e5d314aca74ae130d39918fe3e5fecb80e6db19f16ab9a39c86dc7005a6e
MD5 5b0c18bfa72ee1ac2bf21b4b2a264e86
SHA1 10cc69fe90b8ea38cb42a6b6f4acc9bd62076ce4
SHA512 a78419ab3a06d7a1fd6f33da8979895344a4087f649f89da977b5f8710d7a93e9243b128a510e956fa54347bbe6818d08fbb985d3a93340f7181885ee612f54c
SSDEEP 12288:/WiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1883523D3558955B1EAFC003AC6754428F5882E2DEB5619E3E2043D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 80f79172dbeea791a8f58301cf6ccd5a62608fc48fe41871899e23932fed4709
MD5 80b0f7a59d60386060c6d8e2e75f151e
SHA1 42de57cfb3437ea949cdfef6d55c64abdf9cff22
SHA512 ab8e969b6ef7e7a13aafc1cdc5389263ef1cdb7291a287050139813a1ce2fba9a0154bfa6803261ec223aa5b31d7a4eac1be775af9eac5ccca72f3966a3ff653
SSDEEP 12288:2wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A13523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 1e32c0657b0a68a9677bbe0dd0930815034e61a98022a3ec640fd97a2127dde9
MD5 a7814b941ed6a450438db1e59c6361a9
SHA1 5f1f0063ceee2a95d362f4cfb4131205828b5532
SHA512 f9a6270915270a6680e1dcf1e3db782f43a179f846587b351b72b2c2448c46fc25ac23a06e595b72e1b1e7b3fa2f7b404f936101f2394ad75f8622e1bda4c53e
SSDEEP 24576:Ifwv8k9RX6wkyAIM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0MnYIMLNiXicJFFRGNzj3
TLSH
T16675DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1865752500ccd719d7f51046c12b843f177b0d5ea855ad4658d5c42944ab8b00
MD5 90a630205c7219af03b2d542d3a99306
SHA1 088335426e0be5aebf6368820135b350129bda50
SHA512 958fec3e39c78d0db02e622d162a4206d47f0864ce8d4cfc733c2dc0343073f0335a5e3fbdd98c61e3d647cbbfc995d27b2f8eb444809213c0690beebfaa988a
SSDEEP 49152:pYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zLNiXicJFFRGN:gySzP77wRGpj3
TLSH
T1FA066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 86c0bb40561e283b3ae9e6e7c663a9e431da969d144a9443be7d4c61c195350a
MD5 1dcad42f0b1f5feb515e0ad163b6bb8f
SHA1 3d03a01389323c6785e8c39fc191059c8aa5139c
SHA512 23ce45683f3fe4dd4b8eb8d72c13564aca61da02e169a1198d470942c4e38e59582e273d976043f95cef1d9515badfcaecc2e52367e55b826c4ac2d3b23b5847
SSDEEP 24576:747Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:747JUQjqirIhCnDHUPfF/jLNiXicJFFS
TLSH
T1F765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 1cf7734e7e1ecdd1d526d65788341b1b84ebdd8396e18c7f5d979bc78370cf07
MD5 0e276ee7660a68265a904fa9d0daf8f3
SHA1 6e935f66d59bbbe78d0d65736b112809e8c236c2
SHA512 e34f3d73350d54594562407cb11fcd9585f26519069e2155de188a9ae0ba563eb2c2c912016219f7db11a037f4da9a1cab68ae7ceeda94c183c9aa67869b3131
SSDEEP 12288:xIsfOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B45F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 8b3d99a5259a5131be47de708358d686c9c309a1f72047f8311e686c0e93824b
MD5 8ed0c1b2e463a9304efa7fbc1b98e7f3
SHA1 9bb7531093a966e35311e31d79a7d9ff10d60b16
SHA512 9dfe5a95a1364b75b45a19c83aa09835fbbed7df35dd7a5b501fba9a825f1e43f973ea576c5f890fb6c472b5f7e9dc7aa0f98a4e92891ba9432889798bec617f
SSDEEP 12288:aDqQU3fniUqY0oBDq8eiPmocR8bPtG9t:aDHUPpE8eOm74PkD
TLSH
T17A351750766AD75FC6AD40321E33D6CCA7707D01EE05AB0372C9872FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fb938e103c5e21a6784fd5583fa0e7daaac02a18b086e4c61f6a591bbd1bb9ac
MD5 f2288ee9eef5a3ebbe2847f42e98be1d
SHA1 cca29012a989dcf56694835940be374eeaf10db9
SHA512 4cd6424ce709cc340efafaa81c015d2a4f9aa8ea188840007eb88f2f091992f879eeba6444870200d14fc8a5ea6a18dcb6eb326a8afbfe81e1129deaa47f562f
SSDEEP 6144:yNLAElQ025WMtcjWLiIIGLyTyOMTUWPlr5tPcbVtMx/cbVtMxEKbZJJ1HihKNZFP:EWLiIvbCANXEO
TLSH
T11C55C7819537A3CFE1F72071071A5F4CAB64EC4777096F26B3C8457AD82AB21A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 4e63e05e06733bc04fc0cb7aa75d6863d680f321b5d7704812bdeaa7b23313a3
MD5 c5a635d6eddc62c70836cccd61bdf06f
SHA1 6d50de838b13d97de6148044c0c06fa2cc8b521b
SHA512 c0b9121192b356e3185400db7b088e5f62f42b176e888faa0ed6ec7cf7e0e42b9b2a3323a8ddd5d0706cfa4e2cc5e8c69307d44334929af552b6881628efa3bf
SSDEEP 12288:qt7GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C3523A3468C59B1FAFD1039857A8434B5487E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cb6de452cc95525f2f9bb9154e7d557eac97bad2310a5de2e3566de4bf3c5c78
MD5 1d78ea2fc01b3ec636c6c7d198239e68
SHA1 50bb26cf4033e0d5d73a16be9d5cf136d08e916b
SHA512 e478d93b6edc689378d7eefd9cfee451aa1d0a053da9736b179772068963d1889d4e54063f02d12e2612751f557d508e24d1603e6a659f1a2cb0a1f07950a1e9
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bY2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Tgb4mBIBhGF5LNiXicJFFRGNzj3
TLSH
T14D65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e9c4ae1460dc3d367c2f7f51e0e5e1c5cd36876782508da3cf497f017d6ba110
MD5 07cfdbbbeca4a553c18a1a8fabb694c5
SHA1 d292d79399b64fdfd33ea835f53591177f22861f
SHA512 f88c3e5ff6887d370951033a449fe9bae6df46b4ca4641d223a6d4a7b29640637219573cfb2018a5d848ecf268eaece9498d5354d0717ec9edd7c8d0a66bc407
SSDEEP 24576:tG88u8FpJqH1szria7/mJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g7ZFPqVLa7/uLNiXicJFFRGNzj3
TLSH
T18675F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 05f3804ce1b8dd3bfe35f709bafdf72f0299822bd7cfc18aa6d2526e5707f4e1
MD5 322e033322c22fb340d766b50713a0c7
SHA1 89474f53c7d13654c8ca6dbe26bef995afa484fa
SHA512 de07d44a1520619ff0c7afa70e70f54cd1cd3ab8ee8e82e496f108f4e2df6e8f19faa658c3987fed398dd62fec90f316d87719af80b31ceb94c5a0829c109ba9
SSDEEP 24576:0PUr+NQV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQVLNiXicJFFRGNzj3
TLSH
T12055F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 30f5248dc622cb9375de56f0f334a796e1138596a10bc5755814a7e76adfe9b9
MD5 57d7c198a0db5172dd13d1c9f3d739ac
SHA1 0169d74a85ac13e2717f4543d8992ab2a2a3d207
SHA512 f44eedbeb4bb5e6134d88711c3ec90697c59d88d98737e067921574be7728c55d194902cc21f22cce7269de907e88d261a649fbe63b85c7bf3a6d5ff7a541afa
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlLNiXicJFFRGNzj3:dG05lO43bk7wRGpj3
TLSH
T1EFD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 63680e08eb5ec74e6c77b92f082febb96333299b05535a4192fa6d9b63285bd6
MD5 01760c6cd3695ec8a1d0934f08efc075
SHA1 078b1cb2a5025f4ee68b8788635dba931f82c91b
SHA512 1f2087eb31c1904a40581369d5872d307cecec0d5605b780738927eb941efb47f66a821d8ebeece1de056624b1986a1225555baeaf786a90e65bd2ec52deb415
SSDEEP 24576:ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnz/TwSfVcYG3K/cJHlnFR+IGNe8jg:2a5POZ3lJt2pasx2+mtLNiXicJFFRGNf
TLSH
T18C65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 626b202e68e897997d84611f0fbb93f4cd96572c2486f6108b8c36fd49cfda7c
MD5 4197ec020ce383dbbf6e2bb06d484526
SHA1 7552d5f91073854511baab57ecdde702f623cd3c
SHA512 4709ed6d7ed95315f80e0c9b8296dba2d61791e66f290d7ff159252453adc30058537951d0342a561d131d6a5b73db6ab299d20588127e6d5b25e1694a42f6c8
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fkx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gNc/zEOVHFOLNiXicJFFRGNzj3
TLSH
T1C0858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cfb49e0b6096593953d4825d41a29939ae03eb01cf9e45c7c399071a90a7b163
MD5 2b3a9f53a4a6ec452e183c7cc9d3dc92
SHA1 74fe29522ea9b87bd30a36718d3ec95d844af722
SHA512 f71d5c6633962588f270a3e8be1e8881d026caafeeaf209b6753407b84b235c681ee4018fd198c3a23762ad9fa19f8d4bb94e4620a76d130fe5c8354cbbb8054
SSDEEP 24576:czkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:czMwBtOmHLNiXicJFFRGNzj3
TLSH
T19055AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 61f5a8636156a4d4b64c60c814066f4a228637321e92b9fd22f9fd9ca15cb3b5
MD5 1dab460b5c652de8f4f2fa20553bd07f
SHA1 59bee2188b2b14552ca6daea56664bc7d0c32ce8
SHA512 568de9da1a5a42bff95af159c5baf32a01432c658fe05f12de190ea4fac567ee1796cfd6cf9a51060a1c6281f5f93b42090a45ab0429c5bfb04fa83e375ec770
SSDEEP 24576:+D3FHshBIYQgAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAAULNiXicJFFRGNzj3
TLSH
T16565E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-8-0x00000000022C0000-0x0000000002326000-memory.dmp

Download

memory/420-0-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/420-1-0x00000000022C0000-0x0000000002326000-memory.dmp

Download

memory/420-77-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/2296-113-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/2296-312-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/2296-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2296-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2740-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2740-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2740-54-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2740-291-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2940-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3236-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3236-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3236-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3236-329-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3236-95-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3236-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3404-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3404-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3404-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3404-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4128-308-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4128-65-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4128-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4128-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4748-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4748-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4748-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4748-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4748-20-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4828-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4828-38-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4828-52-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4828-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4828-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4828-45-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4900-78-0x0000000000400000-0x0000000000520000-memory.dmp

Download

memory/4900-309-0x0000000000400000-0x0000000000520000-memory.dmp

Download

memory/4900-79-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4900-84-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/5280-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5280-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5280-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5280-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5280-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5692-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5692-108-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5692-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5692-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5692-313-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5692-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5976-327-0x0000015E36D90000-0x0000015E37410000-memory.dmp

Download

memory/5976-398-0x0000015E36D90000-0x0000015E37410000-memory.dmp

Download