Analysis
- max time kernel
123s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
- Size 1.4MB
- Sample260701-czpsdacy5j
- SHA256 9ab5f3fe6f09edb6e33821844c91811ddc521da217be23da420faef641c1a71e
- MD5 d9ef23e68ed9856c27befb97f1c21a48
- SHA1 59da773d0c0431817d57803ccef189be9b0ce3c8
- SHA512 288b41bee30030ecfb17752e31005c2d698c7a4a3763c6d4562c9138c13dc478ac3f0cab1f2974f200d3da874ea5b889222764eb6e53c364df4f50913c43fd60
- SSDEEP 12288:gUYJ9bibGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:dYJ9b6nQ/tbw/2Mkjy6Fr7g0oF
- TLSH T1F865013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 4516 elevation_service.exe 4184 elevation_service.exe 2740 maintenanceservice.exe 4824 OSE.EXE 2604 PerceptionSimulationService.exe 1372 perfhost.exe 2728 ReFsDedupSvc.exe 2060 SensorDataService.exe 1724 ssh-agent.exe 1204 AgentService.exe 2000 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\locator.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\141b541059cd5fa8.bin elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\System32\vds.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e693eb50109dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3d67fb30109dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000320003b40109dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000012cf9b30109dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{CB2E5AE0-CB07-4A77-8761-8E40123A936F} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{827D9F7E-F471-4A8C-BC76-F08A09C1E5EA} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe 1576 explorer.exe 1576 explorer.exe 4516 elevation_service.exe 4516 elevation_service.exe 4516 elevation_service.exe 4516 elevation_service.exe 4516 elevation_service.exe 4516 elevation_service.exe 4516 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Token: SeAssignPrimaryTokenPrivilege 1204 AgentService.exe Token: SeBackupPrivilege 2728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2728 ReFsDedupSvc.exe Token: SeBackupPrivilege 2728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2728 ReFsDedupSvc.exe Token: SeBackupPrivilege 2728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2728 ReFsDedupSvc.exe Token: SeBackupPrivilege 2728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2728 ReFsDedupSvc.exe Token: SeBackupPrivilege 2728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2728 ReFsDedupSvc.exe Token: 33 2000 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2000 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2000 SearchIndexer.exe Token: SeDebugPrivilege 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Token: SeDebugPrivilege 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Token: SeDebugPrivilege 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Token: SeDebugPrivilege 5376 2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeDebugPrivilege 4516 elevation_service.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 5640 sihost.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1180 StartMenuExperienceHost.exe 2504 SearchHost.exe 1576 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3552 2000 SearchIndexer.exe 99 PID 2000 wrote to memory of 4400 2000 SearchIndexer.exe 100 PID 2000 wrote to memory of 4896 2000 SearchIndexer.exe 101 PID 2000 wrote to memory of 2040 2000 SearchIndexer.exe 102 PID 5640 wrote to memory of 1576 5640 sihost.exe 110 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_d9ef23e68ed9856c27befb97f1c21a48_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4184
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2740
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4824
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2604
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1372
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2060
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1724
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3552
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4400
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4896
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2040
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2988
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5984
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1864
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2504
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1180
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 5d39ff24b05be3d6c445a34210aaa4f32588039f271174373abd899986758e21
- MD5 54d0564cc8927531b25d36ad9ec71654
- SHA1 b4c86a04dbf9151b6b82fe9d13c8d358ebffd4db
- SHA512 19d193f6d6afbba70ce1a6cb1b8e0bd6af40a898855cfa6158fbcf2a240177837c835d99db8c2b3a12f4c283f052107c9de64a2e93f385eea0f93a18a056e276
- SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1Q/lFTjN4:43q6HjBJLm
- TLSH T155D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 40ec1f0f0dec58a448e4a49be0ea8d3ae0dc61283f2f311c24a9ab5c10b0b364
- MD5 cf41b0a73761e32a0f2824d2ea38e45b
- SHA1 3a588520327fb976ff443e611d6ed8d221986eb1
- SHA512 6af4904db899fdf64214995bd33cc7baa349cd926c3cbcf02bee259c3edf737f946ec2b2518931364bb7c0b558b2ed42986fc874573393d426c2820d10e13a05
- SSDEEP 12288:d1XLsswWkxy2lRq2czAiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:TXYfDtczAinQ/tbw/2Mkjy6Fr7g0os
- TLSH T17065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 fc8a32f72ad49c4cb455bde619e0b89411ed8de22252ddadb11b080dc68d8c2f
- MD5 8378ba05ed6579de10a978a57305fbd5
- SHA1 e6ab6b97f9310d1232015b579cc4be6f879e40b2
- SHA512 b413da3dfdd430c29c1ed48747c7cbd8978838cced22a1f0c8182edbe500cb7ea92cda2eb9b064ca374e4a985a2f97fae3364aa3fbb8cb4c8fb9514433ddd1c5
- SSDEEP 24576:O0Le5ji0hmxLrM9nQ/tbw/2Mkjy6Fr7g0oZ:OPji0AlAQ/lFTjN4
- TLSH T16D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 02f7aac215370ad984a6b42eca2806c351f999bd1adec648d443102800da5a55
- MD5 1aaac2eca7db78e321dfb0e5e5144c6a
- SHA1 f28284c64b1209dbfddbb7fe7a92037c7db1415c
- SHA512 19e662fb74cfce4c9ef889404f3877bd0592d2b4c80acb83c9748ee9dd1d49356b8d64866eb4b6a462d48eccce7ba0aa378cebe3137c961bc06b101076c264d2
- SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyuXnQ/tbw/2Mkjy6Fr7g0oA:r/ezSC6vUzPvxHjyUQ/lFTjN4
- TLSH T1D0755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 dafca0f8444e9cf46ec4dee0ea24d979a02bdf53ecefb2e499ecbc81d40915a3
- MD5 137f24e18ff4fdfae3a9eb9451d15d2d
- SHA1 45a18d304015aba13f02e4f9599e5be5030571c9
- SHA512 c707989a4209dc0f9ca6909b36c8e8f2fc6542dc4ea9be02b421731b31191c8d5590b2432a97c2eaa859e813d92eb29ebd2730b80f965cf7f3edca9a5d56c8f7
- SSDEEP 24576:ZVbqPb88hv/l+6+nQ/tbw/2Mkjy6Fr7g0oM:ZVO88hXl+xQ/lFTjN4
- TLSH T1A7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 b9449a8403f3e71648cdfd86c8a937f2c53300f1e6b1db25de7e718445cf7063
- MD5 e7b182754da07c32a07a2d0c94f23f78
- SHA1 aca74d7da00d6c9a6a8b6d3d3cde13badab6b189
- SHA512 e927d8abd028c34fe1516c59dd17db2ef4a40915fbf1c93f98228da9379dd4473056da899fda851fe4bf76431fb920878451a1856495cc2b72a64758f265e8ea
- SSDEEP 12288:Fz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:FzJnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1775523696A24F887FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 cfc00fbf527a05778f832ddfd2a465e3a4b1a561ee2b4202744e173aa08f1725
- MD5 c57128529d8819b5ad7c1dfccc8ec1fe
- SHA1 88c07ec7e54159b003525178eb6bf0a06d23b834
- SHA512 db09355d436022dfc97b7fcbab97b95ed7ad293cb72c2a4cfa63116438fadf1f88cd04a3b5de4e16bea55a5d27bf7f92eb707e829727a603fd8b06e7ae6f0ebc
- SSDEEP 12288:neBNUbTVO86UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:nJIUGnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T18E75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8e281eb035359cf3eae0302d7293e3ec10e966d1f10c385ed2fc88ebdd76ea95
- MD5 67aef33e305c14fa1f2df163941937c1
- SHA1 61744589303e2744f6522d63c0226255976b417c
- SHA512 35643a9480c93b14d287bbeb69109ef1d3079f580f387f848b8d730b044a8bd66ecf1f71f2c3be71e32f07e1ac3eea784a54f29ebd13593124e7312cd0ffed97
- SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:iQvGAdlCEL8c/yRNw5CMLm
- TLSH T17D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 473a01232167eded9fb6139154e1cf915bb20a60c571ee35dad52a02c2e5670b
- MD5 4870eccdb6a39d431ab1b91810b9b8a5
- SHA1 c938074b1046d6d3c4e73f2502923c0e45bf5275
- SHA512 7459c5a09eadb092f5e2b0653797c74ec24a9f356fdf3543b766cccb678a83791af3979ff4b40f471b1f5999bb9c0b21cb19d887be11835c2dedc5610f908306
- SSDEEP 12288:KAwSfxL/2Dc39DLLmt0LDQewsAjwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsga:fQewsAjQnQ/tbw/2Mkjy6Fr7g0o0
- TLSH T17D75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ad47590ada882b9b2f9a461c8eb11b77591a64ea6a399f5915a5ce5b55f6c087
- MD5 cc0776051825817bd9afa1c89815a293
- SHA1 91d30b77585217ffd0e70af2a4c20c852113577b
- SHA512 e9ef5e19110b50cd5fb868e0e48e25ea50e9556d2288dbb6b9e3765257031af6543f3d48ff256e3a25b112d1a970856435e1ae9b55b707a99b121de1ab60e1dc
- SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLL:iUEtQevvqc2W1cpV2EI32
- TLSH T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8c3c7b5924e7a6bbcffa810622eedb91b5a7a7d47ac34efd49e166ae3aaa8c28
- MD5 07f0c1f1f1846fe277a6c6101edfb919
- SHA1 329bfb65401ebaa5085843b425f0fb004e3560bf
- SHA512 7a775e68b59d5b279395ac1e59237c1643c2626f06cd5260a96f76d72fd1143eb08b1d630d385e199d325a300cecd4fd4f32af9d258b3d6b3a6b694a9f2057cd
- SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zwQ/lFTjN4:5oqtVjnmQLm
- TLSH T1B7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 497961e49038ccc487f337b706093eea576260309260753326402328f6a12b85
- MD5 c4e3ad140ed66a6575e1f3142a281b66
- SHA1 9aa56a4ae83869bd1b48294950c9e98e1577943f
- SHA512 4a62dbc7a7179d8110faf9e051755b1da28cdf249dfde2f613eeaf2f4b3e4f1c83fb17e586679cea3b870b8cdd3d15102f7b61c9795393d53507a1c6212e8719
- SSDEEP 24576:tAhGLJIFoiwtA5l7S537nQ/tbw/2Mkjy6Fr7g0oc:tAMyFoiq5rQ/lFTjN4
- TLSH T1B935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 4eacce4e504e6d7a49e329d2471f95803367321e9c6577b9a6e0771c209b072f
- MD5 ef88b0f279679c65d8dbf10223dbc2ad
- SHA1 edc3e42599bb44cbae1cce0fc44e258282704cf0
- SHA512 d3f24788b058ec6e3883659e7e8d36d64e16a1d411fdd314dc88d2dc3ccff328a30a163fd94b02dc8d6bb2ad8f8a0a427bd82e1c4f026bb06d89738ac71b735d
- SSDEEP 12288:Zmw5HEjsChN2BFgl0WDm+CXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM5:0wuHOW0nQ/tbw/2Mkjy6Fr7g0oo
- TLSH T16965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 ba9d454eb97245404b6b28fa165ef8bee334e890897415479d78cf07a27fdb8c
- MD5 0ae47d5f07491b6095825ff62449238f
- SHA1 0b9425ae000c593f829bce24eb3834cf3b6cee18
- SHA512 018d5248a43cbbc2d3bd3323a6c65dd6c576e8e572d0c5feb11995efd690bf0b741d180a4f3f5f3836c378b4b184aabd1b7f281d45a29e5af199895fbc94b0ca
- SSDEEP 12288:+XZ1IyAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:OZuFnQ/tbw/2Mkjy6Fr7g0oP
- TLSH T10B55126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 2444317261be2289bcdc4385efe3034e0db05e002a97368e8ffeab23883355a8
- MD5 682cccc847745ace30415de93c4c4bba
- SHA1 7c67deda9491776e3118b12c9b55be28d0bfb151
- SHA512 ac95e081cdfdae89010a9bf949612f719e2d72557d4473aa127c16be8aca0d9349205255e3452970612b435e86177d410afa1990902172ab981ee439040111bd
- SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:VQRQyi36YOcPQLvw2gAf+PN3lLm
- TLSH T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e86b6e0aff5abcaf8f146428638b9a4a9a6a4da60f0635a4fdd1c7f8b80ef9a6
- MD5 0edfec1b7efc58c607389a195fd09268
- SHA1 6e32d9aff84cffaa2aa20da9f64245453b891c61
- SHA512 6623e201e31405a68433d997edaf6362ffa4854c825fc9ab753ee3f001530ffcc00c416f04aa64456096ac90117e054c854af015937202f7813a8cdacbf583ec
- SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:PQRQyi36YOcPQLvw2gAf+PN3lLm
- TLSH T18C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 629837767d76424ddf2568b8caa65aa3b4a818c8da6f4e5b9fc42ef7718ce427
- MD5 2204cfdac61df234abefebd94c978722
- SHA1 92eb8cbebdd5c47f5fc3a8fa01bff370c325d67d
- SHA512 7f16aaa38ec7661ec16f794e772d015ebadbcb57bbde8fbbf244ab7a116c6e88e66c9d6dc2094b90156ccc4017a40e17df8c55b404ea8b014639b2b4b32c2668
- SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01nQ/tbw/2Mkjy6x:N68Qg55nhheWu7PNU3/AQ/lFTjN4
- TLSH T1D9B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 c2401b27b4bf00d565eca64aaa74805318cbf3f17fe165486f913cb77c0fb448
- MD5 5a44e0820445a3be36772817a6d847f6
- SHA1 794235af561c795dc5bd8f7dfa999d7018e14a99
- SHA512 5014207dc2396cc922ec76dc36c7f0911ebd3de8797f2bf8db7857c54fc5e1cdbd486626ec89689abfd40953116969a5953349ddd76037a9ccef48236f96c513
- SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Wy5112gYy5azzVvL69nLKnhZ+Lm
- TLSH T193167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9738975cf0e0db83b9f9f640125ab44674fc9a45380a5afa639746fbb5449dd4
- MD5 3f5f8ae2bd41786deb57f1a776771a81
- SHA1 0b9b819661dc21ffdc6c15bc345d009c83a3000d
- SHA512 6a1edbdc7a246ac7890fbd849b5a1256bf10d43f1158952ab0c9e44f353af282175504119270d45d99d16a07fa2f151b53010bfd6d5a8a61e65a40605b7bc4a0
- SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glSQ/lFTjN4:Tu6JmVxd2ddLm
- TLSH T1A9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 457e6e3ca83ceac7b84ae6da05fcfae53ff4d97d3fdfb153c3b5cb7b9a1013e7
- MD5 5bba951f4070e504010ace304702ec31
- SHA1 d39fa86b06ac77678eff8ce21e3204c611288e71
- SHA512 e0054551e086c004b6ff265a4f21e9a47f4521d1be0a149955d0c394b8c98de03619559a690746ef5473cdb4e3f497f26c133d972e729e8b131aba557f82587a
- SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xmQ/lFTjN4:MmifPbRQLm
- TLSH T14BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f0139249899fc5eb32c4c74a191942803e9560d389631927c78228a1408acd97
- MD5 4d88381a0b39546a7865569b47eb998e
- SHA1 6dcc1d40bfcb9e358af44af5a7a52ed66fafeffb
- SHA512 8ee8b8935c88818bd272e8e2b8119cc88799326db9a529c3f24531dfa58bcd20f2a1688cdef62a58e0c83389c6dd79a14e9bd9962d603ed4d776ab1dbdb5313e
- SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqFQ/lFTjN4:N5dKTi61qLm
- TLSH T15DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 5ab070f5a1947968621a24cee2e872af21ae4cd8bdf9862672aa91700caa467d
- MD5 d31d890278e9200d9e8abc1142d2a852
- SHA1 f63c8dd0a84cc8e1c426f91078b7773a2c6fe094
- SHA512 01fa252cb2f3c6228a6827acaf8df702f8ebf5e8e7c6ad6f3a41b83c2314458f6d0fb570adeebb632f92f833f3adbca6226cfee4e3c2905c6817853c37c13c69
- SSDEEP 49152:5htSn8EApI0figngiDn0AP5wiQ/lFTjN4:IX2iyphULm
- TLSH T13A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 8a996a7c7bb8d35cfc538b2061955512cf05f4036c6410b4c745362a226a14ef
- MD5 2323592527e6b991f77015ff6b4d808e
- SHA1 eae6c2f3211c788ca456641ee203ac66576fe912
- SHA512 b8de5862e74a31bdbe1e7460d5a9adfa7cd50bb7bc9ce8657c76d21828a920509ab3035110249bf40d9fd1572b2459edf38a536cf01b22e043b72bd14b2a5cf1
- SSDEEP 12288:NhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:NxnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1D15523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 303ae13cc74106a9cb2ca63eff27b4bfe4445ef89bfc41b2804c3e161a5879c7
- MD5 6764488b5fde4497f3efb59edf47bf18
- SHA1 2e982f82290a6401b42641d2f407c1a63aa8b3f6
- SHA512 65db723097b7279f6aa4a72e6dd83ff5ce6a0b73799a4ff01b348e099ed8fb1d507bead0b1051b4f3fd664b9b77b34fa4b6d7ae3dc8d812f6308c0eadfc3eca0
- SSDEEP 12288:VMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:VMnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1415523697965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 c31126f81523dde30f8740a62a9e716972ff0b1f76e0143ecd1370437a354b6a
- MD5 c86c56bf8d5639f9efce1666233b570d
- SHA1 f7ff3254d63982dc25f818ebafcea358296cb314
- SHA512 c6bfe1b95ec1e61fd40130cab04e3a1d165def127dcb04f563345ce8c8b6b28f63afae1ad42c13f2c53cbf8edc4e6da18803388f782df497cad5c6cf1a77b128
- SSDEEP 12288:9uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:9unQ/tbw/2Mkjy6Fr7g0oD
- TLSH T1385523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 7e9508f7d67fb9ed36ce6ba47888d2ca5944e2a8ba7cd5a421526bb1ae8e4639
- MD5 2710e23f75435d4cf995cf0b8093ec91
- SHA1 3ed34a6997237f954129735a486e4be354628fde
- SHA512 a5568870488fd878e7428b1ebf36149109ef3a80cae7ba8d3e6c304d239284de39b7aa3d0aa5b855355709b3c6a1a98d67778721c57b960e46ff76572c29a2af
- SSDEEP 12288:VVrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:rnQ/tbw/2Mkjy6Fr7g0oz
- TLSH T1B55523693669F4C7FD2742B4CC928142E77B3DC6BBA1A3CF6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 8ca5c19ad56d53da64effc519df07acaa0e7e4b54989d179b7abf088762855bf
- MD5 ec528301e488c998bfc155d68ff60951
- SHA1 66e1a0a3ba8648858d7f0abe4b54cb3b4dae9247
- SHA512 483a1f47e4051f083d608645851ed8aa234b1a036e8ca559036feac24decfecf5d716962e9a3410ce52612f38b5d2bff27b198e7d8272a2e6f0ca033ef2a2b8e
- SSDEEP 12288:UjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:UTnQ/tbw/2Mkjy6Fr7g0on
- TLSH T1D65523697965F98BFA1706F14C828182AB3B0EC6BFD1938F77482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 8f435100f1cfec74317a2e9ca1325f2254af6784c8c5f21c8ba43d955b2300b4
- MD5 0e9730608cedf158a15c729c83e620bc
- SHA1 1f98f542ebc2d74233b270f296857d8f3a8dc9dc
- SHA512 82cdb2c849aa3b2c9c5cc22410430d1f9713669e1bcfc15b49781a25e234b3c4f3d04df768b5ead96504d09aa63f9f41f58c40745222c21d1fc94df7073f3e0d
- SSDEEP 12288:A4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:A4nQ/tbw/2Mkjy6Fr7g0oz
- TLSH T12B5523697965F98BFA2B06F14C828182973F0EC7BFD1938F77482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 00f4339f878b818982b9ecca62475bad0ccab11f1f8fb3af1fed4afc98b5dd0c
- MD5 935b678f8584e574513029a622958d4b
- SHA1 23578d1a746efb8ead61b67be836a20a1582c045
- SHA512 bd7eddb54034d1bb33735754392ce9bdb102760b4923e52fbf6ab4f6f9b1cd8396dfad4ea78f1f823e8eba3a2f9d48e9222b88763fcde6ffc2abeb14354fb416
- SSDEEP 12288:OEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:OknQ/tbw/2Mkjy6Fr7g0ov
- TLSH T1845523697964F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 d90d207a469e4c1f51d8230049d227c242df1c83a2fd537c18d7facc15a65e97
- MD5 c00f99e8980d1c8cba4d2d4382ce37f3
- SHA1 c021de90f98cee26a660ee5a10a7dfa277f6d34d
- SHA512 789c3f5ebe04df4121dd95e04ee16703da05fd21077d2f129a37225ace42bd411c0bfbfef2a404b0795c70aeaa6323fe9f378dfc6d651de93ed585948b46a6bd
- SSDEEP 12288:fiZwbDzzFEoS2cPvysGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:6ZM3zFVSOsnQ/tbw/2Mkjy6Fr7g0o5
- TLSH T16E7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 db83fa2d8b3c154d7099cba543732b20f67dfb8259273ef1034f7b52a3358ad0
- MD5 816d90c1932f5f54715f9178a3c8da68
- SHA1 7f5ba0e8f3f2bab36d09c248133139a3b820e2a9
- SHA512 4f9c27f3e60855ae4faec8c7b9f2645ca7e271e2a63ea377b7e309bc608a822a80a8797d783db5c455191ce9d1c43bbe3e6c3ef94d50633ab240a32855bcfcb5
- SSDEEP 12288:Y1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:YVnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1B25523697965F98BFA1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 91d6e15eefe98ac0841846af9c68e8fe4a84cb05ab5102fe6dbd774fd0cccdff
- MD5 a61d4750781d41e2dd02ff351f66dbc3
- SHA1 37302238cada1bbcd83be87bf219d7b0b3cd4849
- SHA512 71b8659f04610fa618f2544429fc4d7384072819a8450ed27064369b4fa91660c03a8eb4b48fd7a21f4948ca0ccdfde47bbddf44ac2bb449b0cd5ada5d2566a4
- SSDEEP 12288:/JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:/ZnQ/tbw/2Mkjy6Fr7g0oF
- TLSH T1BB5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 4a5e1e385007e95e06d68c184c1b0a2290d38dfa38e4a1b4864b79ff1250e779
- MD5 9fc638c217ad1cdf65addc606a7889ac
- SHA1 c0473149b059ea269d3c5b3ebbb0cd5fd1163c7e
- SHA512 755c373ffff220d3494768ffc29280bb71ae7c48f68279225449de9c9cf3e88a85c5b0f568e54a322b975ac86142d2dc05993ee191972f38651b7b80951b5fc4
- SSDEEP 12288:GyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:7zygnQ/tbw/2Mkjy6Fr7g0oS
- TLSH T1CF65021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 e446a9a4da80a2c3eb89a52c389e946a6c957f74e8ce25152d5b605193393c0a
- MD5 129e359c7aa896d35e0b66ec2cb90675
- SHA1 1c9d649a12ea920b0e37aa2786257526c6ac9676
- SHA512 f25b2a83e462dba2383a8487ade475452ad3bc493bb63f908ff8d574448f81a374bf104c206a4710dcbe5f2fc119353b69c4b7b838ec966cde333822ffd45707
- SSDEEP 12288:U1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:UVnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1255523697964F98BFA1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 b202e93068e67a1c0c68841c90ee917167d51f5c6fc99b399d32ecd454732548
- MD5 38b6636e6a0ee87c74ccf606e8f12256
- SHA1 cadd42f4828ec52cb87e28b2a8a7451999621110
- SHA512 f6ad4bf98b1b213cb2f9cb9e9ff49ff117baadaa160a3c5520f360863cbc782231256ce1ad0b12dcb2039a0acaaf70e81780d9d87d67bb456c7d6fad04ee1e54
- SSDEEP 12288:M1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:MVnQ/tbw/2Mkjy6Fr7g0ok
- TLSH T11D5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 bcb96eb523283d014137bc4759b083e57c4c608239a29a392b7278481b00082b
- MD5 68a8ab10d6b5ffef091c7b738caff702
- SHA1 3b73795622c892008c47ba2e007502b147dcd0df
- SHA512 f4d1bfa8eb1db418ef7c5ab9e888f40f2f380ec41fb3ac7bafc5583337ee55999987412ab173389c1277ae90a45aa332de73172e84bf91325521cfa391d7efc3
- SSDEEP 12288:wyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:BzygnQ/tbw/2Mkjy6Fr7g0oq
- TLSH T15F65021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 32909d2ec7f6e86919f0d80bf14d946432718ddacd025f193a88ad7127e42225
- MD5 57186d03ace987b69849f61a9e33b95e
- SHA1 108aac6ef49f6a34cc2b3842cfb8c1cd064be4c3
- SHA512 23537acddebb7cd26674cf6233c0f37ddd08a6302a2e808ec703b6e249fdf67dcd0a31b8bef0a61a64e754d811372a1d33c46c09d4eb3b5d6f66b5a28a7f120d
- SSDEEP 24576:3T0aLl3z0zDenQ/tbw/2Mkjy6Fr7g0oc:3TDLljXQ/lFTjN4
- TLSH T1AB7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 007acee1ab691b684c870a739d58eae970bdc7a4e31c11b404851e9737b50fbf
- MD5 d9d0a6a0411a138a7df8de27831db557
- SHA1 3e88a7bb27b7c54b947e96363be75c8869cec40c
- SHA512 8670784abe682cf6043a0073686be80e6af4febcf74f96a9cf65a9f06b8e30ccc30cb2c7fd7dd64c471a8aceb939b1b6784cdddf5c2cad50cdb41b1def8ba2ee
- SSDEEP 24576:e31d9CHKy7GZKnQ/tbw/2Mkjy6Fr7g0ov:g1d9CHKyaIQ/lFTjN4
- TLSH T1BE85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 0440bf50d4faee9158275c8ff1363c2f5d252a813a178309345b0a06468f377d
- MD5 c4041267e23a6bd8d5530aa7882cf92b
- SHA1 ae7f2e0889a4b0a8eac9dc9e302bc8c2e4a9fe2f
- SHA512 da9293915a3d8d59595f4814aa51cef94d75352e2eb3074c7010fa1b8ba46f9f4e5267c56a34ee082724171f8e339ac577607704e5fc572255e2854f20e4a315
- SSDEEP 12288:rOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:rOnQ/tbw/2Mkjy6Fr7g0oY
- TLSH T1765523697929F98BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 570ebe85c1e8a617f418cdf395c0db02bd8b8298ef223d4b17d7aeefe45a4387
- MD5 0b1b9d40147a02708da5756f0bed886b
- SHA1 e3d55b88a661c402ee4f347b8ab7690cee6e949b
- SHA512 1dd7fc6b21ab45d55bcb12bb187ec32ee53e53ca6595340de1e0d190bb63e5824d3ca953768864f08af02b138f6e27d4943ecd36990f2e0e27618ecd847201c9
- SSDEEP 12288:CgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:CAnQ/tbw/2Mkjy6Fr7g0o5
- TLSH T1615523797964F99BFA2B06F14C8381829B3B0EC6BFD1938F77481129967D39406C63C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 57928fab1283a7424af6cd116243f124b16d0b3c5788926dc244fda67f3eb9b1
- MD5 aedb2b9f5c11fae66bcd792834e407d4
- SHA1 560999716e65bb7499b8cf39566b4f402d2e566d
- SHA512 c382f0d9fe4e7fc33fccb2f31ec1dd3c9777c8964344ab66017f1d50d0ea32f1f5f141821b15654a96330d5e8bc2140590a973d26b01a144a23b6e9857f883e8
- SSDEEP 12288:tPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:tvnQ/tbw/2Mkjy6Fr7g0oT
- TLSH T1115523697965F98BFA1706F14C8281829B7F0EC7BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 efb395468421a4c1f25f36f9742ff6503f55d963e6aa9398b99fb97b3605f746
- MD5 f2629deeaa7dc000ff1dc6fba0455ae4
- SHA1 6789876ee476ad56166ac536a54aa074babbdf8b
- SHA512 9ceee3a7fdfddcf93b544c0bea798554dc8e9655f25423a1f3b2b33c262879b66f9aa545336785395725bc777ea60c88a07a531798a1e48885a84c4f10e2180b
- SSDEEP 12288:L1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:LVnQ/tbw/2Mkjy6Fr7g0ov
- TLSH T1685523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 89885404a6b8783f225d8cc23ac2cf3bf4e09f4cce32228da8e2e5cddf3a9c62
- MD5 4d18cbb0b451708907b3f36b32c9f96f
- SHA1 e8e21ac63445002af13f39ec2561d09a54cc0fe6
- SHA512 d73b62d4b6246e6979af2d3bc9fa69da698533824ddedcd9067c90065b7b062bc37cfba313b4593deedf5a9e97b7a1ceddacc135d5fd80ec5c3ee8d88f277616
- SSDEEP 12288:mOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:mOnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1D15523697925F98BFA1706F14C8281829B7B0EC7BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 a04ea7359a915affc89d717feea0d8887c34f840b141e0abe5bc3c9410e1b049
- MD5 6cecf1a33865f8b915278d29101f48fe
- SHA1 e42d153d26fc48e55e2acab27d18cfbde5da8098
- SHA512 a964c595a2ca27a4346ab72e9b8f6260270bb4dd27396e645d82c1b09f328dd50461477851c6dfe9e0c494493371c24f8c8c276b329b89641deaeef73e77492e
- SSDEEP 12288:NNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:NtnQ/tbw/2Mkjy6Fr7g0oi
- TLSH T1C85523697964F98BFB1706F14C8281829B7F0EC6BFD1938F7B481129967D39406CB784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 37b667d778eec87912e443d1995a5739696d0aa9bbbc9390e16efc5fdf1b0848
- MD5 aedf71fb58ae493bbdc44809230f6493
- SHA1 e57139713022b630d87965056d94080b7b18eb1e
- SHA512 2019ed1ed28556734e7ff65b1fbc30d86d877fcbf8c792ea69e7ef99d2e37abcd40906e328f01e46e8fccf6c64623bfb8a2d882e60e131413f66d9e384c156ab
- SSDEEP 12288:1jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:1TnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T1BC5523697965F98BFA1706F1488381829B3F0EC7BFD1938F77481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 ab23e0da980355d794a817c8ee377c4953ef5336434b215f96e0d75cac3941ab
- MD5 7867142e9a7fb2fe82c3c9213600b37c
- SHA1 aecde5120be56c11286b923b6109026c4bfe787e
- SHA512 a71f894eee823a4e77d7b710954ee02a00950c812ef1d68a3bf1388ce868be5f3c1aeee5cbfa3fc1b1e646c77d6bd521bf16139902bc81931c6c1e3d3629f965
- SSDEEP 24576:Bfwv/k9RX6wkyAIpnQ/tbw/2Mkjy6Fr7g0oj:wMnYIpQ/lFTjN4
- TLSH T15685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 095c93fb650c1edd46823fa4680a3bfb8198cb8f56fcc316a2615ee7ba23afa2
- MD5 680e57c93b86826a4702e21d0d852e66
- SHA1 bd89c1f09b36e3066a920f37225708697d196fe2
- SHA512 b20ea1d53266c8d7d08f780c3596a1c564199416a00b3166c7c6f0c3bc09522eb025b2622919aae04ca1169665c611a90a9c813d611929db9309407586316cae
- SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CQ/lFTjN4:fySzPFLm
- TLSH T182066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 1275a59bcd75e56331e01152065e68070811b0ed707633d756a8669c8cf26b4d
- MD5 f51c65fdbb5e1dd44dd9e0601196b8a7
- SHA1 c56b5310ecd81419430e4f4a287c9fe061928bf7
- SHA512 1e38377ef84c7b6f480970ca2fbdbfbba2ed0ac12255ba7e404fad53f3c89f56533ff05f23f75a3af2cbe8d122362edd8479dca3df1b903c2268592ffa7333af
- SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8nQ/tbw/2Mkjy6Fr7g0oX:r47JUQj1irIhCnDHUPfF/SQ/lFTjN4
- TLSH T12E65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 c65ca81a2cf3e342b14f79e386507367a357481c58ab1100cfb08378574ff0ce
- MD5 ad53ed5352d4fb64d9f976f304f3b311
- SHA1 1c9d52cac0004b2ad50874806e682217488d319a
- SHA512 301e81aa89f313fb75b90ec7654d04121f536ee130ac2737eb91b65c8a68037b3f893a4dc307b880a720b3fb6629ea36b71e27679f41f47406972e6991f0d0fa
- SSDEEP 12288:EssflGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:qFnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T12D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 5c91848b1cde0133e3a38f68c1a09afa260f449d8eddb805eeb826efd1d13dee
- MD5 b8cf30f4c2a4212b945cab4aedaa2245
- SHA1 81e26bee59a68d752b73c11cf562f4429ee0d2bb
- SHA512 012a51a863e16b21b2ff595b6140c1d7689287436c5b21da68db11731f9c6293bee5b0e886864a22bc8127107a2758584a25f3d898286956eebd93fc97324e49
- SSDEEP 12288:lBTBS62LoU3fvYW5ml9FZcrp4LG9o7VoNu3OSGTE524GB:l9g62cUPYTdLG67Vog37Gg524i
- TLSH T1FC451701B626D78BC66940325E76D6CCAB707D51FE05AF0373C88B3FC476658BAB5282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.0MB
- SHA256 8815905fa6283d71270bb69739a834190c680b30705258a457633e640df59178
- MD5 e47f54fb027380502cc2e4caaf09a3bb
- SHA1 efe5c729231580b6cf10895cdd59346e5a62b9ec
- SHA512 0296e8b168fab5ddc7573e99f2e6afa6dc8c5dec7ecce34d9a6d921b856bb2b28471a8203863dc8e540e3749059332129cfc18fcf0a29270f9703bb470ba4692
- SSDEEP 12288:HkfaSXqfpj5EjKYf5Z6Rf5YBK6BaMHL7fQWPGp+Kb1cZTvCAG2+GCcg:HkfkKOAD8xYBK6BESCcg
- TLSH T139352A01B177A74FCABA40331230C6CEAB749C16BB453F05B3884D39D86AB59B5E67D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 7c869a01749486ec617effdb7b6f208194dc6e761a182b57e67ddb6089d76e29
- MD5 afab99f945f4e5f93069361f9a4f031f
- SHA1 70d0a593330eb25085d0485dd608f837a48374cf
- SHA512 f3ce85e232fdf74a636ec179a17f9ac74014f17a54801ce83c16f1920350bb0e11d30c841cee2ca70451d728f339e8cac464dbe60e36f5471cf60121c35128b8
- SSDEEP 12288:5679GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:wdnQ/tbw/2Mkjy6Fr7g0o5
- TLSH T1735523696668F94BFA3B06F058828111673F0EC5AF90D3CFB7082269957D3D40EF6785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 cc5e28d0720c53b22c2477c34d45a7aa4e27ca6a7e12c32130bbd14035da2856
- MD5 30d8b8e42d1948ed72396e1b58e4c397
- SHA1 fe2c55eb83c3931e6acf951bbb16f9e62350ee4a
- SHA512 b2d45874e6dc07627895f74f9f526921824eae0d27fb6a0bf9f97739a91266b6c8bcdf1a675d87d0ffedf933f522a7a4677db2a495a99176a783f5e066a01447
- SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYXnQ/tbw/2Mkjy6Fr7g0oA:Rgb4mBIBhGF8Q/lFTjN4
- TLSH T14165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 2ec95f18e500b5659d2e9406d8d6e89188b18b4edd27f80e0a2cd4e1d918dda9
- MD5 7d9f1ddd8a765b005e5942f59bc8914e
- SHA1 39a04cf199ea1668981c0952ef16253fb1d4a6bc
- SHA512 1f1db341d5bbf9e37dfb3bbf81f4e61a9ccafe465de359846c3c703fc4a0d6b0b5b64de9373d8165b4dd4f06bf802e092d99731a71d42d1168eaf02c2c80dbc6
- SSDEEP 24576:AG88u8FpJqH1Qzria7/msnQ/tbw/2Mkjy6Fr7g0oZ:T7ZFPqVva7/PQ/lFTjN4
- TLSH T1BC85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 ef12b83cffa5532455f470b28bd55930e7a6e9742f1e1aa845c0e9c64e63f12c
- MD5 fe863dbe095336866b5a40d77643d5a5
- SHA1 0578d840ec593bd0b5e784ea77e71976359848b0
- SHA512 aee9a5c2a169f9e52e6aa437ecfda578ffcc63a993aa1be8228985eaf9a2cf7c6c3157b2b045eaf955ba5855b3da48aece873ba07b9f21513732988798ab3722
- SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Q/lFTjN4:XG05lO43bmLm
- TLSH T1A9D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 27b7024005c8693e7104305ee736ece0c18014b782a2b21d5354d836d58a14d0
- MD5 9bfded3d2c297c9758e57b3b2e3e2f7e
- SHA1 ab216ed357d93efea668e91bf7a45f8af040ce8e
- SHA512 3429e5f099837b6db35c50adab9ad2a5dbca3e504ea17f638494c04b17829130dc375297c9d48383f0d4ef2c97671026b4f1410a4ac6e6dacdeebe10ebbb7d45
- SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnCnQ/tbw/2Mkjy6Fr7g0oj:ra5POZ3+Jt2pasx2+mAQ/lFTjN4
- TLSH T16465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 493acf04fc13389f678b50e1f008c7e335813c05600e7e701fc46f1922d84761
- MD5 de303981ffc623761fb259140e3201bb
- SHA1 5eee6b4a9333d4566857d15126bfcb47aefb5d9b
- SHA512 a7d36030b31f9af289dc94d7ac408127f0720fc569b906083d30c5962b6b7e3d4a3af2dbd886f348aed4f6a1177a980245f672ba454cd9bcefec24031c78679a
- SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0o4:rNc/zEOVHFvQ/lFTjN4
- TLSH T18C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7b3efa9d2652f607912e144ce3e905d7509c7e7387949864a8dee4b94293d909
- MD5 6f24555082059f89e9072ece2e695202
- SHA1 5947446573ed2e07c6b923a32e6cb1644da2982b
- SHA512 9ef3ebf4d2299725225430910c2586b8e64f9ffb836210b814f01f5827fe4b209583704f794058ccc11216a50bda42de83ab05a7b0e16b61841f543d8fc9f809
- SSDEEP 24576:R8kNvNnaFeYhJNtmZBmWnQ/tbw/2Mkjy6Fr7g0oC:R8MwBtOmWQ/lFTjN4
- TLSH T1AA55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 1b99b68a04baa90ad2fa88f15b93c36e037ac44c15fd53b30be254b4eb06787e
- MD5 84e432b19c6f0ef80f823e67ec93d612
- SHA1 1cb39443fc30fb291df894d2d8ac4bff18c79120
- SHA512 f7a2a5dd43ad2e9e2bb8f068bf9bfe22dbb6fab0d43c44b34ec278b7d130e22589df1ef663e8913de432e87b02230ebee6b5ae2f01d3767eba5ce8d4e0fff9d3
- SSDEEP 12288:9HvUrBFrEjwaQIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:9PUr+NQInQ/tbw/2Mkjy6Fr7g0oB
- TLSH T1FE65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 e98a3100674ada2f29958007e34750e90884fe3e408bf7dd92e8f1157d66a307
- MD5 0ae2a695bced9154461aac8f357ae288
- SHA1 77190280416a065a6bb3e3e60b197cc260453130
- SHA512 9d99a65338b3cf72e1048c02808b05aac9bb79c90603cb2f1f6f5013aab9b8fa435cd70b20f36730e32ace2518ee0a2bf28e997d045672eacb1ca956363a6a7a
- SSDEEP 24576:KD3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0o1:KDVHeBIAARQ/lFTjN4
- TLSH T10C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH