8ae2c9690d799501d330a632309bb611f57b594a4bb65e57018e6fb08633be3b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 2.3MB
Sample260707-lzdjsact5k
SHA256 8ae2c9690d799501d330a632309bb611f57b594a4bb65e57018e6fb08633be3b
MD5 c40080658b1f2bd72a96629bfa2ae48a
SHA1 3b6b2109cceaec8ec9af3456076463ca6bc9a88b
SHA512 c5c935e71c4941fa39310ce240f020453b0d8d1d8cbf983c0ac47e1d5fb9d2103b58bd9e55a45b7fe00af536d144b3612340c0a578e3f6ac1e8d16ff1251955b
SSDEEP 49152:Ha1TQPTB76HjtvWQYjKnzheD9nDFpoRG0BMLYKtgLNiXicJFFRGNzj3:6BA1ijtvvsRDFpoRJIi7wRGpj3
TLSH
T10EB5235279C1C4B2F5F618345AF489B287BDBDB44B20869B13402D2D5F39BC1EA38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
748	elevation_service.exe
4540	elevation_service.exe
1956	maintenanceservice.exe
3912	OSE.EXE
1148	PerceptionSimulationService.exe
2768	perfhost.exe
1916	ReFsDedupSvc.exe
5964	SensorDataService.exe
2796	ssh-agent.exe
4124	AgentService.exe
568	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84bbd5ebce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\ASUS\Temp\GUM4721.tmp\asupdateres_sk.dll	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\ASUS\Temp\GUM4721.tmp\asupdateres_pl.dll	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\ASUS\Temp\GUM4721.tmp\asupdateres_ta.dll	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaws.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File created	C:\Program Files (x86)\ASUS\Temp\GUM4721.tmp\asupdateres_pt-BR.dll	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\ASUS\Temp\GUM4721.tmp\AsusUpdateHelper.msi	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a882ea1ff70ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074647221f70ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a03c4f6cf70ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d19f8620f70ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000801eb728f70ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3711f6cf70ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad29ff20f70ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{8489005D-4029-4E78-B23D-17651DB0135D}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{8C97EF58-C778-4CAC-B05C-D2B4A0084402}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5844	explorer.exe
5844	explorer.exe
748	elevation_service.exe
748	elevation_service.exe
748	elevation_service.exe
748	elevation_service.exe
748	elevation_service.exe
748	elevation_service.exe
748	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe
4540	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	612	2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	1916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1916	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4124	AgentService.exe
Token: 33	568	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	568	SearchIndexer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeDebugPrivilege	748	elevation_service.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeShutdownPrivilege	5844	explorer.exe
Token: SeCreatePagefilePrivilege	5844	explorer.exe
Token: SeDebugPrivilege	4540	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5276	sihost.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe
5844	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4948	StartMenuExperienceHost.exe
5468	SearchHost.exe
5844	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2456	568	SearchIndexer.exe	98
PID 568 wrote to memory of 1244	568	SearchIndexer.exe	99
PID 568 wrote to memory of 2040	568	SearchIndexer.exe	100
PID 568 wrote to memory of 5308	568	SearchIndexer.exe	101
PID 5276 wrote to memory of 5844	5276	sihost.exe	106
PID 568 wrote to memory of 3020	568	SearchIndexer.exe	113
PID 568 wrote to memory of 2804	568	SearchIndexer.exe	114
PID 568 wrote to memory of 2628	568	SearchIndexer.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_c40080658b1f2bd72a96629bfa2ae48a_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2628

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5844

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5468

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cac352b60cae53fae404a481d4826c566a00de11fb6a366ebcd31660130a5317
MD5 40ea054bd688d9072a8ff926fa0943ce
SHA1 95b9b522c4af8e783d41c3400c0a57c0baacb08d
SHA512 3462eec248fa3ccf25a5824f14c6b46ec762cd07d9bbfbe6737a978d936d432b084dfbe5b322e35eb9c4360ae0ceea743776f6d217bfe8b1015be96e2566c11f
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSLNiXicJFFRGNzj3:Q3q6mjB97wRGpj3
TLSH
T127D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 957fe3f778c59fdda6fb0cef5ea9daa8b085f4e861ed580348578856b317d827
MD5 0c42d9dd2aa6a812712b06ecdd423f45
SHA1 e0d349bfad9f5e634303082b5466366a2d9cc7e7
SHA512 87b1b7ae7e9ad0b1a565d65ad592fdad7398ce0c34c17d94cb9e146b66fd35d5d61644e5a00b398be97b39426d0deb2ac8c2e4bdbbd50cf00790924f3dbf26ca
SSDEEP 24576:QXYfDtczAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ntcQLNiXicJFFRGNzj3
TLSH
T11475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2bc25a6fe512801e4f0ae635dc5e748740e37a70fae2235f40e1db0ca63a49e6
MD5 5924f8d517178ecc3c2a68a2898d3d76
SHA1 400bf28dfcca139b860f277b72a6087560af5f84
SHA512 d49520710695774822240c6bc33fcb6b1f10e658b972b4f0534339c42b118a309dacf39bd40181026f9274d879d8cc9de05780bafe1f297e002371090d1ac84f
SSDEEP 24576:W0Le5ji0hmxhrMa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WPji0AzDLNiXicJFFRGNzj3
TLSH
T180859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc342c0c5b77b3951d4d18e504c0cc995f10722ae37bb890c65ecdc6b0c6ae2d
MD5 76a50a37953cc9946b3419854cefc65c
SHA1 e35773682f742a1c3c09598278bf41996348d4bf
SHA512 bed588d5a5ae2f267d5ebb6611288fa864576c891fee44b8beced91b98de52f4a3883b35dbcbf72b3296507f439440f360e3749e3c941adbb97f1b16850bc618
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T/ezSC6vUzPv+HjyvLNiXicJFFRGNzj3
TLSH
T1D5756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dbed359aec0feb6c63f616f7285d8c9b12f34155bfd923baf03a8487167a8d00
MD5 6ce651a9183582801cd65f584566fb58
SHA1 81872fd2df9d28fff098270b6e2b7ec1a6509aec
SHA512 b0260a97a4203c42d78295d801a35d4e6910cc7a71573aaa03a664fc7d8d0f849e5ab39b71c20037e45e3b3423abb0c55631714a84a41cb8f49c8941ff8f7992
SSDEEP 24576:HVbqPb88hv/l+Bt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HVO88hXl+jLNiXicJFFRGNzj3
TLSH
T1F1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d78888c880d5488ff9f97f145bcf4c30cc43a1f602ae0a89b976343145c18193
MD5 46707e2080e117e263a88ec3677328f6
SHA1 593468ae9000e94987fab4c98746a9bf006ed8cb
SHA512 896ef2693e908cb83d2d8254af572a2270bcaf2d94705d2d37f6c7a11caaf5ef296bc428f7d0292d902b7bcc7c629806137bdd705337145c85eb678c465ee13b
SSDEEP 24576:vGe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rLNiXicJFFRGNzj3
TLSH
T1605523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1c994d97c0a7744a0105865fb4029b84c6ce30ec2effbe997e84c5905c5ed742
MD5 139521d7c5ebbaf1c9b48be99daa3edf
SHA1 18e77f2001d55996edb7f5cad38f939da06b4412
SHA512 a260b283884057930477a2986c81b3143739ec15e8c1c30d55f0a1c4e538dabbed54a9415f0572845adc0af8809b90990ac89eca1de648caae54cb3d75d6aede
SSDEEP 24576:8JIU1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JIU1LNiXicJFFRGNzj3
TLSH
T15675CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bf42e819ec5c37e2c9cffbf8103f5a257ea92136b43e6bd59baafbcfd22c4df
MD5 2c1cdd65ab6e6c89420e13e3011b8a86
SHA1 00a843701aee60276e2e6891f2f5d27987b539cd
SHA512 545abcc5557668a16528fb1728218f6849ffb6ce01867450b905863af1ab859917cff4d874e20573cbe47009727fec76110b60f7cb0d64cf1632ba4e9808b38a
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH9:+QvGAdlCEL8c/WRNw5Cw7wRGpj3
TLSH
T1E4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a95109a177b3827b47b96a8da0906d4baaa69ca36f62d78b0a7cc7f69842d353
MD5 0c343608d9d9d6aa38df3ed0faa76a87
SHA1 90cd98f169bb5519b47dc26804de7288e6ddbd62
SHA512 a2151c883f141571b533901be7c31bba7e26f115273e676006e68091176d4b518b42783cc753ce3135148a47557be951bc76e1a96eea1608997a53801867f43b
SSDEEP 24576:lfewsAjz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljzLNiXicJFFRGNzj3
TLSH
T1B675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 77b9b3e8e30926257d7efe4fcde6dce3a3b73967ac7faae0b2aa66b5b44bfea2
MD5 78b8ec89948ecdc654ad402675914380
SHA1 538b63515e1f0365d5e8880d1c0e8e5c0e137ead
SHA512 d11909d4825c276efdcf18da0034b4452349ba913a6320c80c659bbf17176dbf8bebd5effe88344fdd20eee1c3da0525988d2b2bc80bfad945c7d04035e17f19
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPF9:lUEtQevvqc2W1cpV20I3299
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c6bcd1c4df27d4657f3f2abb247d62df28f547064cd1553ec262536c37d1504e
MD5 791cab12e9d699b95c65590054e54700
SHA1 6ffb70f595a280ca91941bc83bc3aae987c3922a
SHA512 bf36270c783a37aec0d723d1e6e384c2edfbfd73fa10476b10f4ea6d7591c36058c3ec6e405bcce2d843321966c825db61d9141b7fef1c533e82d9e16999a6a6
SSDEEP 49152:JCbRquA/m2yL5zLfFiV+XenmE3/zTLNiXicJFFRGNzj3:Goq2Vjnms7wRGpj3
TLSH
T13BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 45b8f4a976af37f8a745d2d7f92e92379770c986cf1afc66ffc87266d6e6b940
MD5 90a97a72db51f190a4ab4132b0e110c3
SHA1 abbf3b8624ba993eeaa55616fa02a6a4be26b534
SHA512 41f57d6607814e9ed6f84232242a6969689b19520bc1a9cec44bfb2a44ea74fd51a6d7ed551674e9cf2f8db2a5249c2dfc7e00648bc85c2b18d8a5f8b408adec
SSDEEP 24576:VAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VAM5Foiq5cLNiXicJFFRGNzj3
TLSH
T18E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 29cec597209e9169d1033cf0b9033a262b0cdd221de141006cdd77c263cd2458
MD5 7640c8b91429f14c519d65a66b4c640a
SHA1 a368398b63590bccdddf2f3c92992ba6c789792f
SHA512 e40b12f1e0304772ada26393a6529bbd1b973fac810381e8dff624da533588f299186581558716c6bf62659ba725887afae8a0d83458371c7d3d670812235239
SSDEEP 24576:xwuROWP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOILNiXicJFFRGNzj3
TLSH
T15565F18632940CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c4b07ee09a3512757e0f5332ea04ca06058fa297166de5b1e3b1047ff6933b53
MD5 d59f775b5be11bed069ea286ec892cf3
SHA1 1233b4578650356c9edfec0465552ed45b0d6d57
SHA512 a16acceea4b85f96bcb1b58d550ba1eaef284af1a5cf43dfb9c58d82e753bba25ae68abbe13916434d4e4fa42853601b9dd537239e18dcb61bce1247ecf7d30f
SSDEEP 24576:TZuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T1BE55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe9f22cc6eb3f19645b09398ad9e1ca6224ae54eadfaaf06654d032493ba7905
MD5 3c2544323f030ed89a320e631303a77d
SHA1 68deeee5465c0e6c0c20ca4a61c7d19264367347
SHA512 443c7043e21e713b60b5ae34c8f2bc55baa48802e09cfa16c66e2c94bc40758cc3a62d3781f5c6a236255ae62c13bfc45964c0de02954e58be4f83f1efb53f00
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3x7wRGpj3:dQyiKanX+PNFF9
TLSH
T1A9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a944df96901296cbec0fca49d6477b6790c9173a0a293d984f11acb44320be97
MD5 24637a552bd92c70e28396e22631f074
SHA1 d36e0f47d0183af1d24e22028ca1baab3d058661
SHA512 c01156db8ceeed38aff71f9dd52d0531e380c9001ccce0c74c871219cd17c934dd4c7278b01d24623fbde78dba6743c7bed8c7e1f68cd56604285f728054a6c2
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3x7wRGpj3:7QyiKanX+PNFF9
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fa25b0e1b7b7a83d88433eb6d1c30bbf0b2e6cc2483ce82b845157f64f5d4d03
MD5 e7d8f4f1691e007883563204b37517f8
SHA1 0f5cddb2d650bb09f43f52698b531b550fd20fd6
SHA512 014194ee943cc32b9797af36e175ac17d632d3eb96415a6d7af9561cbd0a6e533ea0b23c51d1c2281bace2829717b5b46afb77913f16501958c704139b641350
SSDEEP 49152:r68Qg55nhkeWu7PNU3/DLNiXicJFFRGNzj3:1thTRc/D7wRGpj3
TLSH
T162B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57b00d4f4dc8a31a7a99e6b84a91c48ff7f3ee71780d918839d27dc7e86507f0
MD5 a78ecf3fabf76f69557861f8fe3ce68d
SHA1 707e8c4e1a3485f053c8e76e86743800b6d7b991
SHA512 8b309f9125abea506115a0d1a09d64a90f9f63c6485ef80cad51a7514af35861c62d024362db0e726211f10068319ec6f1086a1b685a109d36e7e9ee281033ca
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZe7wRGpj3:/LIHRWhQF9
TLSH
T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2bad3960ddaab5bff7b8b0b813e05db73a59be6c7ddb4c1d98078abd84a68c84
MD5 aa636c2563bfba065b7f44efe2d7b63e
SHA1 a2ecbdb204c57df87b2d814008f8583287c2501c
SHA512 5677a1878020c6f05567ec42730c6b31aab10746e1ef115bd683dced11b6d2ad75d48883aa9c5caf04fce3bc663dc0c0de523dcd7cdf8509a826c65e2acb947f
SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5LNiXicJFFRGNzj3:1u6JmIxd2d57wRGpj3
TLSH
T1E2D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 47d574d82bc52843f2b676c86966b8ef2789e9f20b94f958ad3c73475b8cea95
MD5 b832f6fd7612f5e68d7e8d2f328d42de
SHA1 19cb512a577c4b26927aae483f6dddd42332810f
SHA512 e7eb39c37c478ad386d04d5f27e9627f0844444c657ef70283028629913eb294e21c4230a9fb1ec5373dbd0728d9d0801943ca61543843a5ec36161947871eec
SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4xVLNiXicJFFRGNzj3:3mifPqRs7wRGpj3
TLSH
T192B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08399e9dd02ec81b086650a55d588fe2557616692b93bf21b7a83ce78cec5532
MD5 143e0ad3bebe867c854744db72110c6c
SHA1 3f226ad793c30ad3df16115a01c7eab469c493bb
SHA512 462539541e1f7b8f86854e8b0f32cc53d5dd2b89d516a4c45798634e314f632253db799dc3c62b9a1145a9b17f234acbb728ff3e9e0fdd1fe5d34b90b1c561b2
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqCLNiXicJFFRGNzj3:65dKqi61C7wRGpj3
TLSH
T1CDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1204b359b4438aa034bf003a48ff9a63ef072fa49f1dbefaddfd4f2cb50801fe
MD5 5498dcb4e7b5ac631c778e2ca38d729b
SHA1 f70cc76a38fa8c07daf429ef1b04f95617ab249c
SHA512 abbc8e855d649004b6c5049fb6460c01a3ab43dc43f6dc67a51b29ba6f9067037a3c6db5a066c65220b333682b2216e2a30cedc27b99855f2fb2e0d890d80ef2
SSDEEP 49152:7htSn8EApI0figjgiDn0AP5wpLNiXicJFFRGNzj3:aX2iWpho7wRGpj3
TLSH
T1D495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3620e31635fa831ae921f801fff0a934af27ea8612677c03881d79d3238f0a5
MD5 8b3119de89da4b9c0eb97f9161a096e9
SHA1 8b4f0b5a3c95dc8557d663f1adcd8d0e52bf6d39
SHA512 c805d6cd3b9ede4373b7d9f62107dfcf694424c9745124a60b661e9f59517392bff8118db24434e57bc7b1c9122ce4ce8ff31be3802c454df19419f74429bdfc
SSDEEP 12288:JciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D3558955B1EBFC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 be3536fd3a37d07c4fe57d74a9bb4f6b5465f82f3a13fcfb3391ab3b4e7f5071
MD5 a81b01c09ff3d72a4d608e7feb2cfba8
SHA1 b81fa528d70287f47ba8e988871a4346f38b521e
SHA512 461fbdc8249664e6764e4a3c77cea6221c8635c027dc471d9e39032b20577cc3e715a69c32dd8cb92e6b0cd7728a0ad862a7d500bd88b020d680a8d55203f0d9
SSDEEP 12288:uTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:un/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3558955B1EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ac0c0fb0505e8627113539dd038d55fc2f3e2be03f7f872d95e5671a07880c0c
MD5 afdb3823f78a792727e48d99a2e4e37f
SHA1 96cb86e506583079a55eca8072ce560a0bcdacf9
SHA512 5591bd32abe70493761e41d31efb5de2fc830d90c0af0417fc8a64b30f6c1c72e23db1aa11c3663ade8f4470224131cccd74ccc4ce5d8a1fcefbe64606515b75
SSDEEP 12288:WxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:W9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1015523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 49875a17a4d8e649edd245076e2ed4b6104943d3684db7776ca3f480c22e9fa8
MD5 ebf26a021f9092d9776d9e0678c01549
SHA1 939dd108f97d9d5b8fa51eae0daddb4abc523801
SHA512 aef943131156d8a53e2f01364047ae213e15849053748b583e2aad4a5b19c6d01197a90785d9d111b5dc9de83b501ecd4c8366d075bce3ebe8d990355fbcad06
SSDEEP 12288:qVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E1552392168901E1EAFD8039C6764424F2E47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3cc0dc718a55a3a08847ed6f0021e977af3a4b373eea5585a03b2928c48522c5
MD5 837e38628363814c3a5de49a7300d867
SHA1 979e244aa649bb6670418259a14b1223a50cd739
SHA512 575ccf12d1fd506191cc8acf316e6d32ff0ea5bf5b4a9554b1a37d192f066a0f5f52b64ca8630a371d24dc517f3536cab6170b58362aa8ebdb82dbaa79126172
SSDEEP 12288:XiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3b484bba5f9e058fdc0d448d4bb04c561f41e1a0f4db5ec117dd7c98060065ce
MD5 d0fdec5eef2300a9fbce1332c66c8484
SHA1 33a15694d07e08031ffe9857e9ada45af3ea5c40
SHA512 5a94f9c2016b2e60d9cd9ba4269ac6df44cef65d3fd13f37994263b830b68cc38be0a08a429d03b6a6dbece24ca39233420d4ea6efec019425c3ac414344f696
SSDEEP 12288:tviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3558955B1EABC0039C6754428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4f7d2ff09107c1c58e757ec6f66b26638def3940b7de81f0ced469482cde3a95
MD5 275d367fcc869707cb2599feda7cd1a6
SHA1 75a895f2639c4dfd5395070a28d565056c96da30
SHA512 10c28d1c38bc0fb1b3aeab33da8c0ed9c7c45dbd3deff269d5892c8421cd0de4cf14746594e52bd3260a91ae375d1d515f191004bbe4b4c8ab71ff04bc138c6b
SSDEEP 12288:ELiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ef/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D2548955B1EABC0039C6754428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c7a27c5fb1f17fc283b6411376c6c8abfdf7e3ea3f26faf8e8e9e9cdcc987c22
MD5 97db507208631c8704c4617cdba0ace3
SHA1 e97e886f21074c0366a549236ba337c6a754aace
SHA512 79835f87fb5d883794530a722d842e7d8a1f8102a467b956586e2e8453b492e3fcd75440afdf02974c620272ab01253ce1f1e24af67dff132994bc3df5a18e63
SSDEEP 24576:kZM3zFVSOH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZM3zfLLNiXicJFFRGNzj3
TLSH
T171750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ef09e43c727f3e5a0545381352d3adc87eb84b3245b373bdf69b1c8b7b954a53
MD5 a5e370f94a4280da8950106c151202eb
SHA1 801bb85b87d195d100d5a0ccc9159135f5ecc421
SHA512 1c69a4b43be0b87960899f2a8fcdb53a84affc426ad4b923aa9ed2e9d1f965bca6ccad55b632c0869fe169afce6c231a4e5047d62852bfa0d76b296951ef0577
SSDEEP 12288:dgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a6f9cb8ad45d40f9b17af022f70968335c58f1fa73ce7b6efe80fe9b71cfcefb
MD5 ae90edc137bf7c6b3fe0a7ed7c49a5b2
SHA1 18add1a7295d8707b1e98ea2980062585820dcd7
SHA512 276fcf76fecad5958493d289cf85f1633051ae8867380744488a8cf25c6bcb55a5fdda11de30d871f4f85b2fc98d47f3d2dec6ba54563f17f1cd708c6ebcb4d9
SSDEEP 12288:oEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3548955B1EABC0039C6754428F5886E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fcd064c95583e798dab83f8581baa1606d9b70ba510650f3b3df0f0d1b14f507
MD5 133badce998ca4293f4d8232dbb58189
SHA1 274e958304ea5cb1d1a448d8dc4830b128586153
SHA512 1658997f733040c07942027216cb16505ede8fe726b9875180568ded12268cb10dc505e910ee8a7919cc602de5177bdc29899b1e89bf5f297f8cb03a1b3a2e56
SSDEEP 24576:Gzyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GoLNiXicJFFRGNzj3
TLSH
T184650257629530F9D17A8139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 801090411da24a732251879c8e898209b92ce9f8081d4e0d68bf33e4606cd86d
MD5 7feafc0de3757823db678c0b735c9fb4
SHA1 67c1281dcd43e319219a750c169016f9915d6d08
SHA512 9f1e0195465ed2f49e29e2424c031fd2e03bb9cc44662cda33dbceca73ae802b6b1b392fabc0822ca4056b1e58a917d70441a02bc5c0923dde86d20e440cff8d
SSDEEP 12288:TgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ty/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1725523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ac609b3031a5d82ceb330c98d7fb11aa05a79573cc37043be8bcb5955b6c5836
MD5 900aa97c546b772f5c78d7ae4dbe5e5e
SHA1 4b3dde16e831d8cf23b82cef5f4ceb9ad47b5eda
SHA512 00204cd96a166eb6adc73ba9496d0e13958829038963471a865d57d39b13d2bda9a8e3b567e9927d6028377acc8a8143f136080a002ce92424bd286b612510d6
SSDEEP 12288:ygiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D3558955B1EAFC0039C6794428F5881E2DEB5618E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6b0b38ab2261fd784af91527b3d59cbeea9bf2446bdcd832bcb50b23db7d736e
MD5 5450f6c54d1bc544e56f560d4959d8af
SHA1 3c9266ade62875f239d06e1fdf172603823a3c88
SHA512 2389256e9f9755717f4a0f9e1251431bcf228c0e9318dc7f1d9684dc7936221f2d146f32341c750d9951ab65c0e65ce0e8288f94a9a1d802c4a0cb1839fa7f04
SSDEEP 24576:Izyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IoLNiXicJFFRGNzj3
TLSH
T16A650157629530F9D17A8139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0bbfbfecc8d9532b102c573dbb0d80571618c5c1f6105e71fc6863636914578f
MD5 53dae692b80354ab84c8fdae9660cfd7
SHA1 35d2f0433c87f26d5227c24623b5d911ecc738c2
SHA512 03316208afea24c16eb603051ec1cde4d145053381fe9d4e813174629628f5551548e9e2616b06db481aea0f889483de2a46e7dfb2a7adf0b03cc7fa538bf747
SSDEEP 24576:xT8aLl3z0zDN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xT7LljALNiXicJFFRGNzj3
TLSH
T1157502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5ee833d59cc65c9543dac02a0ddaf38a182fcdf1cf3898dc6aa8172c69b981ca
MD5 73221f8b84ed3d488956d751ffcfc250
SHA1 d618e1e98fa5294fb42f037bf31ac0e89ceb9d71
SHA512 682a12fb2ecd0179e018a540b730ebfcd4256a360ce40ca788026460de322e7145bca49f240b2a9d9b7f158949833f921f727e8be7eb57e55728870136c2a712
SSDEEP 24576:J3rd9CHKy7GZR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zrd9CHKyaLLNiXicJFFRGNzj3
TLSH
T1AD85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c2fb5c41e9d7e40ef33af313c2b918d97c053e89681ae0eb16e8de23223a06ac
MD5 d7423d09a0d1c25a1ac941b3f996f186
SHA1 7142fc34133469f90d0225b5da9a97f85ec1b5f9
SHA512 b488db89f94ace49f3214aa0d86d09374215aa105ca5fd14d37495173d485a7c2b540d9b46308ace4d361199924b8e6e35e83925041f8c145c0a4a447fd12ce9
SSDEEP 12288:HRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6742e5222465b77f6594aafb66eade0c5aa0bb26ca0b2ffa17a28bcf78480746
MD5 1e9a8d5f920d30dc189140981d13faf8
SHA1 8f46220693ad823c39499d96e28cc85a61f418aa
SHA512 42d4b7de6e81e83185f4f68a9c4f6aee63d1438aa778171888e19fe1b31c8dbdfaa2668f4113572441f4fc54c8b6e54a76950597c7ebe8ca9b4a1eff484d78c0
SSDEEP 12288:93iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D2558955B1F6BC0039867A4428F5881E2DEB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a6bd27ad1bcafe9620dedb9a550584ed6c34c53a1917e60f6274b1000b260672
MD5 26623486170e0d5a12504fc5f7010fbe
SHA1 90ffed5b77ac41c2de71824b44742a9dccff4dae
SHA512 f250afe8f09cd0f4c9ee9cd48c998713b4b9e94dba144ce4c292d1a334497a8e336cb45fe1fb739ca8ac65b150151042cdfc7cd2dd82b012641810384384d65e
SSDEEP 12288:RuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 de11ecbf4525467aa09d54050a4e3694a3a12782b2ec3e72bd1513b9e152c5a6
MD5 098917e7e22ef69e5339d6cf2d679c96
SHA1 3409ede00eb3a238b91719b7a1066ec43306850a
SHA512 b39c584b95eca415e9b9a9b885b6beab4d6d89e8e93c66a80145926eb5521b4b9ba88b37e68b8c45547a0e3affb9c4070741db9636a2223ad4f1acf379afc5a2
SSDEEP 12288:GgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3548955B1EAFC003986794428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2355eca994fdce13d3af2afe81a0ccb24133d266451374cf5ab3ebcf3c70da84
MD5 ba8bba54ec7e424f4462109fe7197246
SHA1 12126519822d9658953f7348a9112e3b5eb35e22
SHA512 41821e27300c7211e0416f48dd9857d458a749b8fc13c35d48f66b654c3db930d8982c0ac1f4f0b9d09e01eb7622696f6f1b9587f37549d69605c27e5e222741
SSDEEP 12288:IRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Id/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5b081e64c960926de8cc773aacc860b79f750cc5cc72528ccd38621f1dcdb6a3
MD5 5120b0e5fffd5c9fb6ccd48bce2b9fbc
SHA1 3a8ecdd5d9f3ce4c6597e7aad25f939db3358d20
SHA512 b4bc1905b68d10c5433a17dc0994d735c33ce1c179895c9e1743522943760e018460fb601aeb489186181e9d00501512064486a55975313025e44872dd9bbb4f
SSDEEP 12288:vYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D2548955B1EABC0039C6754428F5881E2DEB5659E3E2083E1EA23CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d925a8148f4420a400f13ed4377a35ecd48d5a7441c7fa232a119d17c1c93183
MD5 aae3ab1ed5b5324c810649918275c4ed
SHA1 af0b52ba7be076d38481ccb5dd5096c827a03d2d
SHA512 3644ab8b2e4ae38275c6321b13bdb7eee6bd94efdd9fb07fec629853ab201bfaad83683277bbdbfebdf38b7d4415649d8a5b5816f3e43b19c52dba428d78511f
SSDEEP 12288:niiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0581d27641a54903338348c3e3abe36aa285b348b496c5babb41297674cfe26a
MD5 25679be3675f356adec535f7089688ef
SHA1 cb057eb7b7eea46726e39c3813fa6c975476f447
SHA512 d6623b36e50c58e630d625a2fa5e36fa875e1b400efd491cbacce92c4d5a1d8014d7c3a7b2683fb58672c9425ec76ae11b1089c1ceb4d3c2775b346ca817d579
SSDEEP 12288:K5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D2558955B1EBBC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7fd4b0e117371315b9020ade1f685ccf4ba1cc11b5c377670b4080367bb7b5b0
MD5 08ae8bdedf53871c87bd3a61c643764a
SHA1 20048ccce163ad3b5757a51897eb5ac9400f7ca5
SHA512 1da64a341984d0213d756ebc526c69d1f3187fee1bddc7fc9b5d45460cb9be7350b9f6a4963977962745cd4e9f53199741992c88367fe712bdd84b1246021bcb
SSDEEP 24576:Dfwvzk9RX6wkyAI+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WMnYI+LNiXicJFFRGNzj3
TLSH
T1C785DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 851841a462f32171d856ca842854a080635207979f6060b664a779bb50d27085
MD5 cbecd817d0bc34fb874724d1e703990a
SHA1 3747eff26f2e4f19e797358060fdfe1494d35467
SHA512 7abc44e147283fa016b0f29e34b5bb9d240731b1f62406c52b415de2272506a168765991ad52b8d0cce79d8c946382b1318ea2d05445ece47fa93583ef62b09e
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JLNiXicJFFRGN:KySzPR7wRGpj3
TLSH
T148066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e1eace0740544706b066659e7c87f8caabec00498568a69321d83da071c18757
MD5 74a31be664a750b03252d594623877bb
SHA1 91dca3db4e88ecd43b07c8c5b8452e0a8c5cea72
SHA512 4e4e6ebfff0f3463ca3e69f160c968d846084ba6d28ef05d0bf6ba87412577bd91722a373707113efcfa2522b5f3ed6dd375b0abe4f14227734fcce8c3187780
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n47JUQjqirIhCnDHUPfF/5LNiXicJFFS
TLSH
T1F565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b88acdf31054a5b14ba1ddce1e6d918e1e3f9b92ccc36e58849a6782f675de06
MD5 29affca14b337f908d8ef29bcea4dd18
SHA1 c5b4e3fe0daa5473ced71051406ff8b77104e730
SHA512 6061f9cd7479fab0e68d44604bfea6d338e38005afdf456c961ad609dcf61ebd600cddec180bd1880aff338101b8a05aaec4fca6253133f80c2696e7df8f4ece
SSDEEP 12288:ypsfQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12465F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 dd88e7476796a464ac0a285568d595130e8aff5bd7104923d6ea932c682beebe
MD5 3a9fc340420772f62dbd10ed859bf9fc
SHA1 258ca648f095931fb97e667289c2284b1b852774
SHA512 8e5708ff4b53ea92327bf5fcbe113489c8b6d94cf2069c41e842f359164aee535cb131c0c04dec3887936e6b530214aa9770232453d37661ce907077ddae2905
SSDEEP 24576:r6hMbIMbjfzF9kMZgN/T2yrUNlFBjMGNUm:uMbIMb7zF9kh/T2SUNTBjMgUm
TLSH
T1506527007626C68FC6A940725E36D6CCAB707D42EE056F0773CC8B3F9576658BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 09a193e4dc0bba421b6edbc62b78c68772555fa33b65ead29364ddcdb5b94fca
MD5 39a6facb85afd2a4e616908d591d3fca
SHA1 424224bf19a2739f1cc359ae641fc2724ae88f7b
SHA512 8f34bc54050f0b093950e1780a71318d439e5d640adfa5e2e79824ef26fc4c16a71348cfbf6472200f463f82f0c51c4ba53067aad035b7f693716b3ca38d6e5e
SSDEEP 12:K+WEEEEEEEtt2EzBRMtrC0EEEC3UBEn8tUfs5RvLvsMlE3Uvnuj/:K1yiCqW8snRLs0sknuj/
TLSH
T11E022BBAEBA04E10DBF65D32C4877F521FB3D42865CA83C311802268AEA53E45C3CA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 f4626514b8a64d8a6c9326cf83d1e78f5bb2218aed6dcf5d3e48996560db70ad
MD5 e413ba87dc87faf2a6b602c9557d5471
SHA1 43dd993dc22267ac8d76fcb6adea1e2f3755df34
SHA512 44e912ddd4d0fe3663559a24b38837615db884efed6698c0db3c8890f08962a0ff982530c1e07effa21657c6cbd041a367dc72c78461ccbe0bffe2f8387c7367
SSDEEP 24576:4uMbnMbzMboMbUMbDMbKMbMfzoDPzMbmMbZoMbHO:4uMbnMbzMboMbUMbDMbKMbgz+MbmMbZ6
TLSH
T118353A41B177A70FC5BA40B34332C68EBB74EC47BB462A06738C0C39D866A59B5F56D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 21d6044e671a74ec94db73b9e6d76efc67525d1eb97bbaeacfd75554a4a5b77a
MD5 2f34ffe8e9d507a66abbcbe2d304e101
SHA1 c1835d98f3aac913362b4a1f0ffe7fe25de4c05e
SHA512 60945ca645c9baa35610d88d7ae3081db0bfee0c1973f77593dbc7d4178f045a25b8a60efdf701cd0a4b4d94872eef71c77aa38a3422e7e67c383c1b38fbb1a0
SSDEEP 12288:wF7IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523A3568C59A1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5e4546838b048b7114e983d70d28a51942d4acdcd0bc8d1b84ca6a218f412671
MD5 ba8ece4ba4ee1595aa600e6d5c6c2843
SHA1 83659471798c1912b7dbadfa2f743eaaadd1a8bc
SHA512 619ca5754a38cd069373e4fb06f7183e1c544cf3feebe5d7250d82961cf6395f5dca660f24902e421322b18f0a38a8b6a93a517181f5835fd955824957344db7
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ogb4mBIBhGF3LNiXicJFFRGNzj3
TLSH
T12F65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 60aa1902a5445bb33a5c542bccb87eaa56837902bd031c4a75648ebaa4d40a5c
MD5 fd5eaf87110e0fa3b5370e996e1cf319
SHA1 f3dc0293b0893b0d5e59735e286cc404897a6b66
SHA512 0987bb9df03b36f3670d742342b4edcf895db9e9b3177f5bcf8e6b4bb284af5f0d26582de33c634eb92de698d61e8ca552f099f31e62f946260570f792f23643
SSDEEP 24576:aG88u8FpJqH1vzria7/mH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h7ZFPqVya7/4LNiXicJFFRGNzj3
TLSH
T1E285F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c101314a8a63812fc2b2a0bca2ce644f37ab53ef036bb2f937574a99b63d2cb1
MD5 10159f0504b69556f39a2c8e41646332
SHA1 9b2188dec96ae69a55490143c9a414a21babc08c
SHA512 f3dc0ba4bd9f44bcb69903d12fb03855760d5128200471a3e289618f5219aee22e27e5ebf85ce386f944f9d944c2fd3a27e273b6549e6bc60958ce8699c959dc
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbLNiXicJFFRGNzj3:WG05lO43bW7wRGpj3
TLSH
T174D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9d01408cdea867fb564693adcec5175fbf1e20c79650a8b64db02f5e22b00b1
MD5 5e243129f724526943946730a9804f72
SHA1 70d0e43f2ff37b1b910a11675212a3a84ed85950
SHA512 6fdca91bec65fcb94f8c9995055c83d2625920d0d3aec0625d2802a32339f80ab5024fb16faede992b4b3c6da67bc3b9f51f3cfc87bf6521f0fef166974fedfe
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJ/TwSfVcYG3K/cJHlnFR+IGNe8jg:ha5POZ3lJt2pasx2+mDLNiXicJFFRGNf
TLSH
T16665BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f9da114a425ef5b0d030a4f17c4794189c8c21facedadd5dbb1a579abe4c90c
MD5 dda226766b4999997e4cca13b7026b9a
SHA1 3a417ee612a7c17a0a8d6b128c9afc42bdc83bdd
SHA512 0d41134463c3a7285f7c4812e829c23f0d4f727c664b960da7c7f79d7a52982bc211292c11ecc11a6c9e06d9016f8431e373461325e7c64ea7617186dbc2bc09
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fkv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Nc/zEOVHFYLNiXicJFFRGNzj3
TLSH
T195858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 44888b7de177033cb22213a6ea500d7bcb0b0fe4191913b2e5298e34f12cd887
MD5 a90ad39a0a26512f237e4600588aa388
SHA1 82022bb3d16227083026ffc13b25c9a2838d8f52
SHA512 808b963d932de4718275763636b3b8be7ec5913ccebaa5711e34d7aafea0c91ef2b59748e4b0300ba6f1e38a7c21b67ac4ac0c19eb70215d6c54f33cbdb34e8c
SSDEEP 24576:3zkNvNnaFeYhJNtmZBml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3zMwBtOmlLNiXicJFFRGNzj3
TLSH
T14455AF6EA6E806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 94c2a3b44b3df95a9a212c4771c6b22ca72eac70c5d2eb3c9ca673eb6066dd78
MD5 b51cd79eb9fc3652dfa2a64a36f4b419
SHA1 ec0e80a9cdcb27ed0b4074bd184ac78d502aa7c5
SHA512 fb6c2e52b8e06e373b80b7d60cc27babc7994896ca04dd40aacb97c8aada61c3d395c82a92150ba0211466dd0a7dc8cd81834dce740f468ce213de7ab3d4ff2f
SSDEEP 24576:NPUr+NQL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJQLLNiXicJFFRGNzj3
TLSH
T1AD65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 024bda637d756fd05912d8b7535541617d294a4b2aed99b3cb95881266044bfe
MD5 4da85ce1d70aed300917d5bba5833f9e
SHA1 e3c20619c83d2a1b1528f6980a31cba9cf2625a9
SHA512 74a32b4ba2abd9ba35960f3f141946bb10f648106b8bee471f5ee523dbd2a3e72d05d9b08f2505988cf9c0ba160589ecae49837f221637f2124e615b501b251a
SSDEEP 24576:BD3FHshBIYQgAG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BDVHeBIAAGLNiXicJFFRGNzj3
TLSH
T1BC75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-215-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/568-398-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/568-214-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/568-221-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/612-0-0x0000000000400000-0x000000000065B000-memory.dmp

Download

memory/612-403-0x0000000000400000-0x000000000065B000-memory.dmp

Download

memory/612-158-0x0000000000400000-0x000000000065B000-memory.dmp

Download

memory/612-1-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/612-8-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/748-20-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/748-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/748-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/748-14-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/748-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1148-138-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1148-367-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1148-144-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1148-136-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1916-166-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1916-392-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1916-159-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1916-642-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1916-160-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1916-640-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1956-110-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1956-121-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/1956-123-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1956-111-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/1956-117-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2768-148-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2768-149-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2768-154-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2768-391-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2796-184-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2796-396-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2796-192-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2796-186-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3912-126-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3912-132-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3912-349-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3912-125-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4124-196-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4124-212-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4124-210-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4124-205-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4124-199-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4540-198-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4540-107-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4540-98-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4540-99-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-653-0x000001DBCF000000-0x000001DBCF691000-memory.dmp

Download

memory/5468-469-0x000001EE80000000-0x000001EE80100000-memory.dmp

Download

memory/5468-518-0x000001EE93F30000-0x000001EE93F50000-memory.dmp

Download

memory/5468-481-0x000001EE93BB0000-0x000001EE93CB0000-memory.dmp

Download

memory/5468-468-0x000001EE80000000-0x000001EE80100000-memory.dmp

Download

memory/5468-496-0x000001EE839B0000-0x000001EE839D0000-memory.dmp

Download

memory/5468-480-0x000001EE83760000-0x000001EE83780000-memory.dmp

Download

memory/5964-393-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5964-394-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5964-172-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5964-178-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5964-397-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5964-171-0x0000000140000000-0x00000001401BA000-memory.dmp

Download