d8b42d043d7ba47308c9d46e2a10a8ec28d24011bb7de25a2eb318cf24ba91ab

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Size 1.5MB
Sample260910-jk2lysga98
SHA256 d8b42d043d7ba47308c9d46e2a10a8ec28d24011bb7de25a2eb318cf24ba91ab
MD5 08b0a654459d2f8b33b1b0ccc2380f5a
SHA1 0743a84cf9336a513eb5e39660a922e7b4529f65
SHA512 0c0c3cbb0be851cfada2e9f612897a928e481b9776cf1f4eca29fa775722d9e79a42e05ec4cb36aab28baa0364d4d41ca581557c72d37c2fbc1bfddeca575ccb
SSDEEP 12288:BtfuNoxiHt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vWNoxiNyxknw4FYnshx8OfVe247
TLSH
T1CC65122436C2C471E57616331971BB71866DFD348F708A9FA398262E9E704D0BA3AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3188	elevation_service.exe
2464	elevation_service.exe
1908	maintenanceservice.exe
3396	OSE.EXE
4996	PerceptionSimulationService.exe
5488	perfhost.exe
2504	ReFsDedupSvc.exe
4832	SensorDataService.exe
1196	ssh-agent.exe
2160	AgentService.exe
1648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c47c0ba9e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\4c868cdd-ee00-4ff7-92ef-eeb23a460c1f.tmp	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\cv_debug.log	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\DLAWBTBF-20260709-1434.log	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\aria-debug-2828.log	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\DefaultAppsNew.xml	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\AdobeSFX.log	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\~DF0A989D6D10958CF3.TMP	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File created	C:\Program Files (x86)\8b8cd554-4b40-41fe-8fcc-d1de1f0d451a.tmp	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3808	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa737f45f840dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ee3a445f840dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092fa7185f840dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
3188	elevation_service.exe
3188	elevation_service.exe
3188	elevation_service.exe
3188	elevation_service.exe
3188	elevation_service.exe
3188	elevation_service.exe
3188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Token: SeBackupPrivilege	2504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2504	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2160	AgentService.exe
Token: 33	1648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeDebugPrivilege	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Token: SeDebugPrivilege	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Token: SeDebugPrivilege	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Token: SeDebugPrivilege	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
Token: SeDebugPrivilege	3188	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 5992	1648	SearchIndexer.exe	101
PID 1648 wrote to memory of 2068	1648	SearchIndexer.exe	102
PID 1648 wrote to memory of 1268	1648	SearchIndexer.exe	103
PID 1648 wrote to memory of 6056	1648	SearchIndexer.exe	104
PID 5596 wrote to memory of 3808	5596	2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe	106
PID 1648 wrote to memory of 5732	1648	SearchIndexer.exe	108
PID 1648 wrote to memory of 5112	1648	SearchIndexer.exe	109
PID 1648 wrote to memory of 5968	1648	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\SysWOW64\sc.exe
  sc config asComSvc group="UIGroup"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3396

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1504 1548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1504 1548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5deec69900cfa2ac123b281c0e7c23bb6b9108ed15beb3c699e33639c917cdb
MD5 a2f117daeec5bb70270b58ca94b77f15
SHA1 809b786af1fb011295814001dffad6795be1d5e4
SHA512 d6e09255c5e4c124466b22db9ea1dd605cb1f0c5f1bd6b642e1ab4412f8f8d81fa274006de52fec53a1df0a6a1aaca5c87135462e1b6dc4bf92a01f2f3e9e91f
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn8x4x8EVep:t3q6mjBPix8EVy
TLSH
T119D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 cc20ded8ebceb54cf0a92d98009e09f5a7008b5aab8647652bc01d2b15db52fa
MD5 fc4b63f50a7e7af285de437a699ae508
SHA1 891d73cd28ca5ec516b5ebdbc2d1cb5993921843
SHA512 ac8bb923bd5032e4d2936e42525124f973449837efe5cb43d8c4b17188950b78eaf96c6392f074e5624c8d9a0d5c00c8d1cb6bab52da945ae3b85016cfb2b8bb
SSDEEP 12288:w1XLsswWkxy2lRq2czAY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:mXYfDtczAYyxknw4FYnshx8OfVe247
TLSH
T12175F12877D548F9EC6B8139CDB28112E633B8954770E38B03E4952A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 2204116d7884c70aaef304d5d27913c717435516e3631c779bc88e5c0edc8904
MD5 c90eeab9aca398b39d37d23c4ab7c5b8
SHA1 0a82b1c4f9a9441dfbb3ab4cc3eafee9a6f36ff5
SHA512 10a5bc09eae2096e82f110ce8a9543d7cc414b235bdc864e4b4f1e95ddac7a3c25fc27aad536bee17e0d2336d5b4501d7001e5b1a78f21939af608fac6af4211
SSDEEP 24576:h0Le5ji0hmxSrMRyxknw4FYnshx8OfVe247:hPji0Aopx4x8EVep
TLSH
T1FD95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49bf8312a1549b56a132da455f02a931102f773fbc078eaad235bae963f08699
MD5 99f7b46d09b75fb526e4662a1edffcf7
SHA1 db1a678fcdefd3ff947a790d8ae0b5fad1638fa8
SHA512 01eb0edf5e541ae7be82587f3fb038e68d4b9bfc221e8c2cfcc759c458965f256d44c23aa68aece8e83e0ed5bbef939aa6ca0bb8f24aa72daf289031f2ea381a
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyubyxknw4FYnshx8OfVe247:7/ezSC6vUzPv+HjyFx4x8EVep
TLSH
T182756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7e17e9a1d8ed9c3f4805e4de62603fc46f1f341f047cd3316372b2e72b8ecf9a
MD5 9b04d4b71c4e06fa1f32a871d172e4b2
SHA1 39c12e94d501e865456de62af73887888f518e96
SHA512 db13d1e69ace832e77f494a2b5a855280e82d7321a21fe6b736f9a6ba8306990f5462bd19b7ee404697d9e6b009e12c0abf75254ef14e51c396a70c8c07fd914
SSDEEP 24576:nVbqPb88hv/l+Bkyxknw4FYnshx8OfVe247:nVO88hXl+Jx4x8EVep
TLSH
T1B0559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dae94058c2e225047f0d35dfd11e342142f4fc2c7c6320bf7daaaa42ae1200b1
MD5 ae2453a40b97bea34659f48cc51d367e
SHA1 02aa2f679d83b10940f940755dfe88421ce712d9
SHA512 ee729a2f40d6de0aec3f44ccfcdd04a01b98e919a80f0726202be4dc104a0345c19264e15177e9931af12e66dd32edb3cebbb1d9f5ef0559e10ca035066700aa
SSDEEP 12288:baN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:baNyxknw4FYnshx8OfVe247
TLSH
T18D6523BCABDDE4E1F65E14331A7172223606F9A4DAB4C11BCB78B54EE4B0C54D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8ef7e3aa45ffb2ea42013dd93aff1bc182dbc40d0ce313da609d91f58c41cd9d
MD5 b150fdadb8306b08ad514885ec69c99d
SHA1 82521752dbd943a4806446a06c3e207282a6cd47
SHA512 1ce59c0ab3da51911ac98cb574f57d94ddc2c22b46726124f67bd50049d136b5c44a6a46c34b2320b5ac6a7832ce08cfd78f422d713536f59c52638990e9f8b3
SSDEEP 12288:4eBNUbTVO86U8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4JIU8yxknw4FYnshx8OfVe247
TLSH
T1B475CF7BEE28FCE2C27E5DB95B918200A76274704F6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94e8277bd4a36b33df7c4cd8b7ba3ef57fee370f556749e885ac8b1cd4000bbd
MD5 ee45713fba368fa014fed8989455500a
SHA1 92200203075611261c5dd7c482919057187348a2
SHA512 8ef8ea5cf41206414ea3e7cd2e6617112826bda9e6048cb9901a86d87d54c56a239db068ceddb8d5c49bc7cbae778f7a1463a0ce360c842e1f0188b0f194be90
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH3:0QvGAdlCEL8c/WRNw5Cuix8EVy
TLSH
T1A5267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 22802b63835689699f8bf5d665c3311402c24b99664aa8ec5474aceec6af180f
MD5 f52652aaaeab739a0034b09c3f9121e7
SHA1 ddab8e6baea9d9b558b1b38497e87b826fef7919
SHA512 c072f4f0824ce772d2af1385877744207ec18c3ee69c70d7476f34b193b11cdab23451a858fcc31f2231fea88ff5c76c716a1085cdcf1a50669618f6355433c6
SSDEEP 12288:NAwSfxL/2Dc3zDLLmt0LDQewsAjm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:++ewsAjmyxknw4FYnshx8OfVe247
TLSH
T12E85E030FE74E032C2BF0DB21B36D716142DB9604B611AC3E3E89E9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fd77b43939ef3e5cd19483cd0d6f3e123c1e8d0a953a172144c4a2eeb0fc6579
MD5 f54fd31550ba3dab2c06362e17ac7575
SHA1 d1fb8ad9206596dbe32aafb19cd893b123e57123
SHA512 971af303833af131d7ddfaacf7a09c1cf0fe7d96eab82cc62db3692028224d52fd3d126297f147904ec398a2eff7918e5824a3e2205550434001ffd08dca0ab4
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHs:mUEtQevvqc2W1cpV20I32
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 991fee7cc6f9047827e3049223875b5cadd3ccff8db101a916980a84c2d81c49
MD5 95e122ab0e526e0e3101768feaeb461a
SHA1 96fb872778d5bbb7e5a3ecbbd05251ba4848d117
SHA512 ada528bbc4861fc5e486107943ed872116f5608e3cec49c721317f6aa23cc7051e71ac163dd37e912187b2630ab8ba3ab15aa9b8524a48e5e71ea89754df3529
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/z5x4x8EVep:soq2Vjnmqix8EVy
TLSH
T1D3D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 31c22328486cf22b9f228ced8285278582346cd56144532012fcd5402bc75608
MD5 2702169bfe80eb955978597c4fb9a7af
SHA1 c02de06c683af30054a303759fcc14736f87e472
SHA512 7e8e40ea99e7632f81b9cc164cf69425281f6cf27c7479216b32fe8b2c049e40eae9a09656a3f7bcfdeb7ee7317ba6d6686e594fca146414227cfab77302b434
SSDEEP 24576:9AhGL6IFoiwtA5l7S53fyxknw4FYnshx8OfVe247:9AM5Foiq5ax4x8EVep
TLSH
T18535AE80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a3a284e9710a4a1abf44164275bf4d0fa00883f0d0365e3ce9ab5be32c997e4f
MD5 c0c1b645eca91008fb54457e52c5b201
SHA1 0d824a1501c04f2e0dc47781fc8dc4431c2bfd29
SHA512 ee9f800d4fc85dfbece0d767624f18b497d9a1e79229cc20fcd9ea789972b1b0ec12d7e9a29448cfe3f4db031916984e9a2ec7d118b41e767f613b4d0b27dfdc
SSDEEP 12288:bmw5HEjsChNrBFgl0WDm+C7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:6wumOWKyxknw4FYnshx8OfVe247
TLSH
T17875F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0837b3df37717547969b576eac683740c4c81c36d6499135cdd611c26c9f412e
MD5 6da95b1351371b639b4544af8d98fd21
SHA1 bf383aeaa31af4bc21c382c4292a2f26897601da
SHA512 56ecfc76ba04cf80f8436d38d019260e46ece496281e8fb12e15f43f47e15473d7d3ef691dc0fdaab64c0786144f6920f27e8a653742883932614986c8c94bc2
SSDEEP 12288:ZvZ1IyW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VZupyxknw4FYnshx8OfVe247
TLSH
T1046512AC33E860F1E1AB113A89F15206E762B4A2677183CF4768625EAF71DD05D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ed30f4657799abdbf641b4b8558b224d16a6f139741351fb3a7d1f155b0ae644
MD5 bb2c4a089728139c3498906042c4575d
SHA1 7957ed3a7a21a5974efd4912281b73c14160c403
SHA512 f2c22bf6155cf680e0f1cd728fcfb0c206d046f50cbb663190ba17faef099db1f1dedad29e510d8bcdafde3e86842fc01c64cfa401ac499aa171ea1b11d88643
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:vQRQyi36YOcPDLvw2gAf+PN3Tix8EVy
TLSH
T101667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57a5875e60447ac6ddb877ea6a861210cc79df31d81f8d6a12c978d0ac0edb8f
MD5 1357f067b815ca41722cdef47cd74a67
SHA1 04404b5ba73a38c4e75bd63c88aeb8111070a90b
SHA512 2f58f2ab46e3b58f9f55acc2d9c5cbe0850c8f370876c52990c999624c883769686278dc574e6c997f670f8a12832c5c359e6d4ff9d0779023bcb3a70f558223
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:bQRQyi36YOcPDLvw2gAf+PN3Tix8EVy
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4907533791e1c360c0ea6bf41672988dde2cb1627eb22b75e06287bfcd149abb
MD5 06cef2c30adc54d3bb8c59e993cf77f3
SHA1 7023d086947decb5777027c89e3d5afb7519a0bf
SHA512 0571f55c051c49fbd5c55b7175d3d1b1cc17fdc044d23a69eec3c816de23333a1cecc471d1472ef6fb7b1b5c9d2a50392e34394c76b5dd96d3332bf408b0e1f2
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL05yxknw4FYnshx8Z:r68Qg55nhkeWu7PNU3/px4x8EVep
TLSH
T1FEB55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 34d5810ff0bee5e94f627faa599da2dd9d99b830a7adf5e92779f62372c0cf04
MD5 c97c1c35f9ed0345ae3c6fca50b016d5
SHA1 111c6d23775bfcf568b6cbc64a7f022764cbcd0e
SHA512 54a76af22bb3532d10a4033f9163b93261b700f27512444edbd6bf9340c4c2aed4d3de0547eec9c8789767bb5ba19800621c7c6ce67740eabc20d7f715a09323
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:Xy5112gYy5azzVvU69nLKnhZ4ix8EVy
TLSH
T14B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0588aa4e289cf5fff2f53227937f9136742fddb875b8a45b9355c746ba6ab41e
MD5 0432876d773cdbb0feabd7ad5acdad0d
SHA1 0cb2a151c1b85eba540c2aab171feeb344235031
SHA512 162f00aaabe5679872f6393731152220a58d1dfa9690fcb6a82d016f1ccc5a1701224c42dfe3b1d6044ebc5b4ced4c79f093440f77f5e1456d0a9b5b928e0af6
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLx4x8EVep:su6JmIxd2dLix8EVy
TLSH
T1B5D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 69e07639dfa959fe4519497a12b925cd4b611d48a22ae416b35540773605413f
MD5 8a6192b8691a7ea257db2d9e2972904b
SHA1 e16552a6c26e7d564bbf5ec82e933a4962dad2fe
SHA512 4490a91141a5646d10204f28e038270d0f8b6a7cdb07f1de9a52c0002ddf2dbef922120d22d1b33f8dde03bc9bea08f205b1fbc8b2eedd98586b3f3d22b997ee
SSDEEP 49152:V1hpsNoJpF1A67U44CwH7R4x3x4x8EVep:VmifPqRqix8EVy
TLSH
T144B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4dce5523334bc4b948f9b577d37b365bc1294b4d11b39b971b22a9487acb4619
MD5 8fc4e166399fe7021a3e2959e0fc4c44
SHA1 978cd2d648d5841501f4c37818c2df2f7359a165
SHA512 713ed63bdfa30ec96caeeff64e47882f0b4cbc69ac96571e451dac97f2d315901b93d3d7968e0370a96942471b173a5804e1e8b05d3244465e5b29d8649bc41c
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqsx4x8EVep:G5dKqi61six8EVy
TLSH
T114C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ea64d1ba40b8b9b5ba1aaadfe32f4acb49631747f198a8c93fe4c8b3bc8e6a84
MD5 db7bca9b54a6ec4fb3c5bba82589b05f
SHA1 221c552fbe8f99a72d0c4a7db0ba77232e0054de
SHA512 ce0cb60b3c9645d4a539db7992bbf1703394a085b708702acbf997900dda29535d1d9c491a15f28bbcb0efe38839461493ad3013f335264a8385685d100a0b9c
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5w7x4x8EVep:kX2iWphWix8EVy
TLSH
T14595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 67c160c1cd0eae42eda6a7ebaf8c1fba9be2c75075682e60b0a43d53fb669dd9
MD5 63f91d914b5e4389d7c7c18e135d41d2
SHA1 b2b6207c7900cc45ecf8ecf2b3a253f16a653523
SHA512 917bda0d1ccd167ca57030e97b4000c7d7c132b2ba0c5566a2cf22bda533b313f3bc8726f6d37a795e9fea8be938788716fcf32e67d7409a7e0509b410dcf573
SSDEEP 12288:2l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2lyxknw4FYnshx8OfVe247
TLSH
T19765237CBBDEE5E2F50D10734A7133566609B5A5EBB1811BC76DB00EF1B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d311561fb850d42e72be6b0f5dbed1ddd5523b0ead9acc364c43fceb04fbc910
MD5 bb480369607802f33211842108a209cc
SHA1 6476b1cd226e45223abda552118d24851b984f0a
SHA512 e5cbb2f88ef22882c65b20cc301b963ec94ee644a487f89f91e66f724ce3f8b845fe94d41daf9a5eafba87f57fa7c0458b51f28b8fc91498fe4178ec6ef709f5
SSDEEP 12288:4S+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Syxknw4FYnshx8OfVe247
TLSH
T13265237CBBDEE5E2F50D10730A7172666609B5A5EBB1811BCB7DB00EF1B0C94A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4afef40c4a11345377a4db700f4304ac31632f36a0e1c204c5e150e8c8362c39
MD5 5caa7db732039f564e3e92979774f3ae
SHA1 47cae715ca13efbae1c3ffd7201fc28b3bfac596
SHA512 9a6e574c941f39d5e989fe88feda2c94c49d0ee9d93cc17d59e09a5e7e4f4a0c44b4fd5624ef3a9af473b6986d61eb4133f0f79600f72827c06c9b6bb6882be0
SSDEEP 12288:K0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K0yxknw4FYnshx8OfVe247
TLSH
T16E65237CBBDFE5E2F50D10734A7133666605B5A5EAB1811BCB6DB00EF4B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 56219f321a1e33ced87f3b26b42aae32719b626bab08439ce18144e073e0ce54
MD5 6f18aa190ce06b3a1e0b43a092025019
SHA1 37d05d5d09d881eaf842d4bab890ef7626b69a09
SHA512 df04c58a0874d9420be16ee03d60f267fbd100a204110f51b8639b976f957d4605a934e029afa9818167d80a56be9861408406a93e5c335c46adf741a9b4f9e5
SSDEEP 12288:6V/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
TLSH
T1B865237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 bb755eed52134afc295ac40ed426215a63e9f95a01fbff200d8f3a7c260195da
MD5 8f7e5b7a939405593a430331c8b36bbb
SHA1 61490a1f4a428f20cc6fca3d1eda55dfbb8e325b
SHA512 72bb143a96ee950e695ffa8a75328e9a074605ea81b0e8d1b2f54466693747404c79a2ad79379306c9c9849ed07d1e3fac79706755d5304acebdd4d41409fa2e
SSDEEP 12288:wn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wnyxknw4FYnshx8OfVe247
TLSH
T11665237CBBDFE5E2F50D10734A7133666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 77b553a89edefa70b250e650f354a48e30dc815a0aa8c2ef322a5d5bdccb6bb1
MD5 19c9a87dc673886d23f0bf38d79bf3b5
SHA1 0d22bcf631d92fe6f814230bfeeaa32ce8654974
SHA512 240587f1ebaf7185028d0218f4a8185931553495e547f1b72a72e0206efc4b113d4fb31ccad8e08e13e9217d8e21d9c0e9f71c1ed426f12326087b0dd9f0dd7c
SSDEEP 12288:ne+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:neyxknw4FYnshx8OfVe247
TLSH
T16E65237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0634cbcaf9ef7b36f7c662cf9a854b474da9c963855513fceaa6c21b31de9990
MD5 4b86d76df8062803962a0abba9108876
SHA1 99c3f00b18a1c962d692fbff1778030669d7f6b2
SHA512 581fe7d36e032f9c15b1c2e9e007df538a931d30c873c439137cd1e847f9b87da94fd63debd6555566a5bbce717cce5933435c8dff86390487ba356646ec55b8
SSDEEP 12288:Za+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zayxknw4FYnshx8OfVe247
TLSH
T11065237CBBDBE5E2F50D10730B7172666609B5A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5a8a8622f5615f82b65cf31591b292d4979805f80fdf57784477f27d79ca1d09
MD5 e768a2d0cb80d187383c73cb2f70252d
SHA1 0e30620d9b178acc6241b1f44aecf47eafe5b877
SHA512 0f417e5b145433cc8b9dd6e3051246104217fab010bc11f38da776b64a69c52fbc1f152a26f83dc4d3304fa4517f625d69a331e707204c1f3bc861809f43d3be
SSDEEP 12288:UiZwbyzzFEoS2cPvyy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3ZMqzFVSOyyxknw4FYnshx8OfVe247
TLSH
T1B27501A8B39018F4EC67413ECD659916D6B27C694B70C21F43B8362B5F736A01C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 cbbe9d3852e510f02e77ecdedf4f5fdd35d2bc0a1e7a1cdf358b0ec479ece086
MD5 9c1d702ed3703ccf4d14bf31d73bbfb3
SHA1 44a8803fb2ddbb0b6640e4f40c336613a96384d4
SHA512 37c23a0d4d83937a9b065cb482af3409b974dd10e6e3569c95ac37b8f8052bc290e3246eca7e09558eda85cece80ffeffc987d40a70acf87bb7c4d6acd0dfafc
SSDEEP 12288:qZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qZyxknw4FYnshx8OfVe247
TLSH
T1A065237CBBDEE4E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1c13b503ddce58c617286d0211dab9b3814191350cb09624b766e4ef49af4551
MD5 7ac03b1ea306c5f297cbd1bbac8710fd
SHA1 0559a27aa4a668129af7301bb79f04119ed7612f
SHA512 3071a30b0e0b451da11b1daac74182c0abb75cfbfdfb4c1561c220686c881919347cc730831b848e84a0cac70ec61f264ca40e837aa1c03dd802114b1399be26
SSDEEP 12288:D9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:D9yxknw4FYnshx8OfVe247
TLSH
T13665237CBBDEE5E2F50D10730B7172666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d818ecae0a36214b9eca408d43ea9bef06141021956b4818408045e501e0df4c
MD5 1818153c30dec89bd29e70167ffe3c94
SHA1 c734d01ed0b0319dbb3ed5d78f966e2b1d54978a
SHA512 94c21a8286e10b7c407da8cc8236462e48b3f6724cffe8d7f91bd53921cf225b02b6e5d1b820fbbd3c431486bbfd57f9c147fed04bb249991afc5a1a32b7225a
SSDEEP 12288:myPz5L8W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bzyWyxknw4FYnshx8OfVe247
TLSH
T19A75125B73E530F5E13A523689621602F772B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9aef02abcd593950d2043876c79d487d132a3efafe57489173630284af1a5663
MD5 80e1e727a6094ce8ac5166158a1a63a7
SHA1 52614f0164cf1304acc837dfb4a119f24f7b317e
SHA512 4678af736f9ddc7043c4e2c36671fceae9e3516f55205f93f35d7fc2593e3927beb4d52c8ef3af696445a9a6023c93e6d0001986e249c4bb5f42a80182d5eefa
SSDEEP 12288:tZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tZyxknw4FYnshx8OfVe247
TLSH
T1F965237CBBDEE4E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 44033d2e34ad29fb9adc0046c3ee34d21cf340e8130057956340b2c8ba55651f
MD5 0ed5c01f20a13b894be0692532c5e16b
SHA1 52bbbd1ae3ae62d938fc44219f72f0882dff7718
SHA512 f553fc13b85880fb87cf2a0d3c9712bce897a6aea31fbcaee74417835452103f0897186d56d5d1f8ee46e2fbe19df3df4942ce6e6e4b22bbbcd5dd47c66096e2
SSDEEP 12288:fZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fZyxknw4FYnshx8OfVe247
TLSH
T1D765237CBBDEE4E2F50D10730A7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 60ba45a9f5fe147f7be887bd39a089c082bacba0f4909db848a5550b591afd6f
MD5 efc09c527ac54d53e66d1e98042ae981
SHA1 95a18e44052e62c395f9b26b08e07a5d44052691
SHA512 4419573ec2a7e710ea5da058476e607c2a00d7212dcd1ff77066a13d9fb31be461a76e4c8459cf3ab0d709567107b5483fc51ee25b8e70665afc30fcdff7651c
SSDEEP 12288:VyPz5L8W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8zyWyxknw4FYnshx8OfVe247
TLSH
T1D575125B73E630F5E13A523689621602F772B872473086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b13e012826d8b177637bee67e778c690e62dadd1cbe36050b0360e0c077dc675
MD5 c6f67a8b763564702a4dff2a8861fb35
SHA1 f74398b3bac82614461692bbb6e5c9d0705b621a
SHA512 621198ffae38030b88f5f64efdb75a4ff3bb5e4065e12399ec5f2044b90bcc2806ff7a70d8b24bd9240f7e8ae52dacd66ec2a12ead95ef36a298873fa441af3a
SSDEEP 24576:xTPaLl3z0zDEyxknw4FYnshx8OfVe247:xTSLlj+x4x8EVep
TLSH
T1147501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 512bddf7280f6b1500f56f5d588d181cac2589e8fc4cf3e0249e85a9a362ec70
MD5 02ef1ea8821f81f1c029041ada40ab60
SHA1 4129512107dd91a54c18739c2399b28818b53b34
SHA512 4a3acfca9c44ec1a41d208f3551534caa29a2914a282ae2bbf68b0679939e834f2bbab98578fa983d04fb19afdbdc423c621dc48b9ee6eaf5ca8d31a3f6422d0
SSDEEP 24576:C30d9CHKy7GZwyxknw4FYnshx8OfVe247:k0d9CHKyaBx4x8EVep
TLSH
T15695DF90F3E810E4F0B79A35CD765512DA767C995B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 d7100e882a03e7185644719e39036212828a13ff2bd164dc6df2523b8bf2e7d0
MD5 e931a77b548f3b37ad942ddd7eab0667
SHA1 c92e305b7ef306e4daacea54c0ce4300e3926098
SHA512 0ab19894dc6a97035e38dc0a18bdd88899d66da90570084f1c56d28169db0efabaca51e92e8efd3a7badcc61c355ddd4f499f99149e2790bccb392e138cc9c4d
SSDEEP 12288:EU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EUyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDFE4E2F50D10734A7133666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 0eedbe8b548feb331d770e25e56274d03165bf1bea3d0e679c8905e5dff2e23a
MD5 1b402f14ce332b689949c5826dd5d7ab
SHA1 8269ed0044be472673dc231acb08f5fa9f9ce96d
SHA512 f322fbd43be3ce853ee8c3391af7620fe906b56f3b2a44fd2c55e36d3c1b6c8858fd81f9bf2f0d8a24e39785c55df6f296ec81531dc72f2be3514dfe859b9416
SSDEEP 12288:32+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:32yxknw4FYnshx8OfVe247
TLSH
T1AF6523BCBBDEE5E2F50D10730A7163627609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 868f00dace82a9a889f536e55d7f82c54c75f3765e064d4a9cd47d7b18be9275
MD5 a824e308e934d431739193dfcf677925
SHA1 15a7923620b7aaa30d5968d371e7ba1d5d1e95c5
SHA512 3bb12359e7ff70d14422abab5918ce87fdd2e8c02b6ea0081dc4fcc04156ddf1127789b1ea0fe2cf87d675560a15935a3ed01098e5b08bf32fe73de08383a420
SSDEEP 12288:sD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sDyxknw4FYnshx8OfVe247
TLSH
T15565237CBBDEE5E2E50D10734A7133666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7014e26c331f59d0aaef25f758647558f272c716f8439e9ee2cbf9a78a8758bf
MD5 56d27e5048afb274a18f385985bc659f
SHA1 b39a520449dcf4e18f75e5821f1b5f388f177708
SHA512 52de85964f28915d3ff39ea24e802d7b00adab2a086a09d14365b61e6f399e92a5b5dd9e8787e889e205214a9d251161995fec448bc83511a312ed1c43de03c9
SSDEEP 12288:aZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aZyxknw4FYnshx8OfVe247
TLSH
T1E765237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 1856b9b4d2adeb96eeb8562727bb945cd33430e09cf6673ebc7e889bf1cb70e1
MD5 26ee30c1bc1870dfce7e9708a1b6f8f6
SHA1 8f31d67d3a13989f9c2037a95caa57cff8c55246
SHA512 57d92a6f32efa2ebff6a53c26a221950007f086d844a099f6f945d80f61f661fb05c288e00ff7c7f94f7cafba5ac723933dec1e0182f17607a127c00a85b81cc
SSDEEP 12288:+U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Uyxknw4FYnshx8OfVe247
TLSH
T1FB65237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ab0d4386e9ce4aa0eb1daa09a244e3b542d43694feec5a6c4180c5e8266233a8
MD5 3d3d98738561b6cb4e4b2bec35064f52
SHA1 c0e6e8600ee6ec3c596162bdcc843dfd40dde0cf
SHA512 660b4756d6da565885dcd60472d5450526e52f70862de20878fd3e690deac3a900880a2b099fab52ba6ad7f25d393794ed0b97930447fe4db02cc9505be38178
SSDEEP 12288:Gh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7y:Ghyxknw4FYnshx8OfVe247y
TLSH
T17865237CBBDBE5E2E50D10734B7133626609B5A5EAB2811BCB7DB10EF5B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ead98384a7308b8359d1153a75d4313787bc2b1e2d680620ff0a62b1dfd7af06
MD5 77272a5e943b96a32d2dfe620d38d0a8
SHA1 a83a46d8bb79723d58d7c43d9b6a75d62688083e
SHA512 a77a64c013a1649efec68bf7a4a20dd5d66c35eedb28d1e4b56457c4c853abe79e030e6205b8d52fd55ab308fead75c3e49740356eecc7dd224f9bab9974b82d
SSDEEP 12288:Fn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7y:Fnyxknw4FYnshx8OfVe247y
TLSH
T19C65237CBBDFE5E2F50D10734A7133666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 5a1bb4393ce6f871c435addc81962ab2c693d0f2ae47ba49fc2f9a70aeb52356
MD5 a112b9ca5320798e23a6e2f7df5c3790
SHA1 1448ca4800e0a0f52c21839a8c3828ad7d5e9aae
SHA512 ea6bdbbbde66e49afa4de78fc6d7cf6cf7e5004315f67bc9183f008dcf6c879d67e3e02aa37c9d75b94df21bf6745a7799c2fd4cc470dfc9045a23dbe8f7d82a
SSDEEP 24576:wfwvgk9RX6wkyAItyxknw4FYnshx8OfVe247:wMnYIYx4x8EVep
TLSH
T18795CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 37e7d935f129105ac5205187833fe28ddafda97d5972a403d5ec7f726469d04e
MD5 eb233e1a6ce20ea64b7df136dbc0cdf9
SHA1 524d1de5775f4ae7f64b3911e79433c91b2f888e
SHA512 625f438bfd05abdae3043d727659db2a4e0f218029fb9705b901612caf831b378a64102874409656a38f2f43da8a33d3362afe9ff2fa84831fd3096192b2902d
SSDEEP 49152:yYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bx4x8EVep:dySzPzix8EVy
TLSH
T110066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cc8a6b2d6aa23eb1b38a584cf7f460640fc8e3643fc563f30c6721df926551c0
MD5 c8657e5855bbb5d2d623aaf96d76bfba
SHA1 f35992a96b1a581109007890a60144fa45f59adc
SHA512 bf43d0c34166f93b0639f3595f2311a280e25a318eb74adc976d81c77a45404cf3aca0f003feda2f095c8632dd4f29ccdcb2a8235d4dfcf9a140c5abae69b350
SSDEEP 24576:B47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYiyxknw4FYnshx8OfVe247:B47JUQjqirIhCnDHUPfF/Lx4x8EVep
TLSH
T1FD65AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b11f084f2fb5c971ea8c8575ee5ead773829fca007e829e6a103ec89d4252200
MD5 d2db28ab726ec42d630b231bc897bc7a
SHA1 e0bcd0fb3fb89efecfbc6809a9fea53478546fac
SHA512 cdf35e127c01d35e741d6abd697532139e006c261fa2f298fa01174af9136d9b7d9f92f088ecdeeeed738d4be9a961efd0e69cdf4ee87a0abec5a3878371531e
SSDEEP 12288:o0sfp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Opyxknw4FYnshx8OfVe247
TLSH
T131750028E29852E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 9cf3549c65f2acbc4a87fc04dc9cee611bb4c33d0ff3881d2e4e362e0bc1963f
MD5 cb92f57964e52401b0d0da3c53d51abe
SHA1 d7de3a21c656a67b2bb7826fdb6e7f40aa40e870
SHA512 7e17038f83d22a9f1a11e6eeb968be2b7c9dbfc171c351fe1c6059be7682737b2717aaa9684c72506860b9946bb22a964be5e3f1bcdf49d3efbaf6a059b7882a
SSDEEP 12288:uw6vdoU3fTUtlcozdasEFma4+OeMffyD6as6lKtwhFV:urvqUPwtWqm4+bMfKGasLtwR
TLSH
T125452701762BC78BC6A950325E36D6CCA7707D01FE05AF0773C9873F9476668B6B6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5bffbaf1ab381b93e59cb76b407d09f0716051780f0c25e91eebdf213614c1d4
MD5 b8e208505744d5cec9cee7eda7f7be61
SHA1 73ecb8576d0976cd09b2f93356ea508628aa83f6
SHA512 c2391e599f9492e2efb846f4b877b85699b4eb8a8a205f3e6c7933c446745a113b1e8b26bd06e000aec71231da058b893b6e6451e36c6e91b6ba327a3e220067
SSDEEP 12288:UgbubPEdO2uBVhx+YegVq9iXs3h4fTunglgP3jMD8ngB+FcFOEYiUsN70w:Ugbumg34doxg7i8ngB+FoZY3sN70w
TLSH
T1D1653A0165BBE35FC9FD50374632C68DAB746C02BB453B0173848A6C987767EB6E26C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 55c4ddf32a937ec3ba1a2d7aa70895e517958e9e52062f2ede6fbf074785635b
MD5 09222079686539dc6269e419ca42d1b9
SHA1 1ce22a8f833b03ba1088078f363fd5783f24901d
SHA512 c72efda73ec556d03c252cb9792ddc938b5262e2e70b6876a36524680ff4187f7b4e5947a3d943c7c96cbcfab71dcc8d258a1610d8f0e417246b85790672380b
SSDEEP 12288:XR7x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5xyxknw4FYnshx8OfVe247
TLSH
T12765237CA7DEE8D2F46D11730676A221360AB5B49F70C09BDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34b8174c98ffd58b00351368b49bbf891067f09eaf0e7ba935842aa500c4575a
MD5 deb0ef27902db5349b1bded1334593f4
SHA1 fddf4ecb6e981b452ab3510688ed1919f1916612
SHA512 ba46e87755f27ff5bbcda731327dbb87b43fcd0ecf109c48028a2dd4d855c76185c68d6c3adc5e4a9b953a68aa274d62b7ae9969b6bdcd3ae1487501bf69a8c8
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYbyxknw4FYnshx8OfVe247:Kgb4mBIBhGFdx4x8EVep
TLSH
T11D65AE1E22EC02F5E0F9E2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 1a41dc089d6de6c4d2c2fdc805a26d7c585449a3beae030d22d207fcf6b93de7
MD5 b198fe3d420bc5fa3778a097885c6e95
SHA1 63a7e40ec9495f710ffaa353f2a76789d978a936
SHA512 479e2a1cad9bd169d0c91f57e3bf4477bb1a8d64ab7c4eb09e968abf6ae2304f2d0b5cd9ba6d4a2910110c1da595b59c20be5082b41dce410ccec652aaae592f
SSDEEP 24576:nG88u8FpJqH1Izria7/myyxknw4FYnshx8OfVe247:G7ZFPqV3a7/mx4x8EVep
TLSH
T13D95F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8f5d4b27ad58db85147a3f7439103678b2acbfcd0deb6d6379254272cf60b908
MD5 79360234d4378c91f8afdf55f1c72a92
SHA1 a36c5e9e411e089c2bf9c5118d8445aa1141b862
SHA512 0ac91df4b60d66a36b24586b33542fc1c77a36a4af51496e565857f7747e8a2f271c2c82696c5e938b04d3cbc7f4e172af6ca4decef176cea0c70dcca6ccf9a0
SSDEEP 12288:iHvUrBFrEjwaQO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iPUr+NQOyxknw4FYnshx8OfVe247
TLSH
T16D75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f0a8d032535efe8f7d7e1daf127278ec33eb08b8040132967124140b83f318d4
MD5 097be8249429f70e7ed086f4eb624ab7
SHA1 a4ab5b9a823e4bcef9b7ed7789258eb8f7cc788a
SHA512 2a7f33178c688952730beb7637830dff2cf350b8d7d10dbc65a25667489d53566ebb633522773dd6aad16c540a0557f45f023299d3e6d4440c43dc1e5df1596f
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRx4x8EVep:lG05lO43bgix8EVy
TLSH
T15BD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9343b3ad441072b95a3d08fb18f1e589b7d98372a0d5f5fc1968b22fb02e0e95
MD5 566de395536d87b78ab7fe64715b76fa
SHA1 f9d14cf3aaa0881b405cb00948f443357141b993
SHA512 b2df2ef114cadb1b68f9f1642ceb235546ff722393dd2c8cc25df1c1b4bfd8efd09601bfb0af0da9938b1208af95f93ca5f22b4c3f2a51521b67113fbe70cfa3
SSDEEP 24576:Tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4yxknw4FYnshx8OfVe247:ra5POZ3lJt2pasx2+mpx4x8EVep
TLSH
T15365AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7d7d83c54e48f767e4302f9e4ba8b4b271a7a6fe3a44c53f948d0d939cb60db4
MD5 36fcd1c36aa33c7f506ed2299de76ce9
SHA1 00ee8be44a8845f08123130fedfcc87c1dd077e2
SHA512 e4afef8579840e200f91e52c05857258bdce172bd7a7423efbc451ee02e677a3dbae596398e44574f61535dbb891dd372e1665483e5edbd7879d6eb666e26e23
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7Fkqyxknw4FYnshx8OfVe247:aNc/zEOVHFGx4x8EVep
TLSH
T183857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d181faf4323b597e3ae05b72f35c4cd0a60393f2cbe84d25812e7bedc32445e1
MD5 9ded7e54ff3524581ee70906757ba4e5
SHA1 f642044fabe772e059cbbd6ff36c7bef5f171e7e
SHA512 d695a14d04e7327351893fff1a4679df121489649f455c43057879eb83328998952b8a84de3662e620e0b8122ac9a405557013a9ecdcd6ae5ac57b51a181bb08
SSDEEP 24576:1zkNvNnaFeYhJNtmZBmsyxknw4FYnshx8OfVe247:1zMwBtOmHx4x8EVep
TLSH
T11D55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9a055de2d6e5520c81d9f6505412f36a68a1b5752540d919e79ea2ccd932fdbe
MD5 15889184de066b926315d3e34470d3dc
SHA1 0459bbe717f3340cf7ada8e871b7e5659115c893
SHA512 45a2284cbcad7910d6b33fb9a17b9e20436bc5b92aa6912fa3a05f41913778cb4ab2f07ecde35978ad26bcc044988585e6a943cc343006ff3a10359a94b4ade9
SSDEEP 24576:fD3FHshBIYQgAFyxknw4FYnshx8OfVe247:fDVHeBIAAQx4x8EVep
TLSH
T11585E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1196-316-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1196-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1196-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1648-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1648-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1648-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1648-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1908-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1908-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1908-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1908-44-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1908-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1908-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2160-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2160-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2160-139-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2160-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2160-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2464-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2464-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2464-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2504-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2504-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2504-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2504-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2504-329-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3188-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3188-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3188-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3188-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3188-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-278-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3396-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3396-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4832-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4832-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4832-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4832-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4832-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4996-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4996-279-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4996-72-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4996-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5488-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5488-79-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5488-84-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5488-310-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5596-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5596-335-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5596-77-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5596-7-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/5596-6-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/5596-1-0x00000000024E0000-0x0000000002546000-memory.dmp

Download