Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe
- Size 2.1MB
- Sample260727-c7j7vsvbpf
- SHA256 8e22f81faf5cc5b72ab02277c9c2ee5381e2793e561ead6a266967234e147a52
- MD5 c48398ff157955b0bb9d60c834312493
- SHA1 5776b5081ae9d3f9338d8172c133d7812815d5a8
- SHA512 0f70c254854e640cd90dc528b7ebd91990f5a987e8713875e0582ef87f9005f7bc29f882f0fcb331991e0fc6691d7747ce4699e1ad106150923602d019f319fc
- SSDEEP 49152:kiEl3qTmtbMK7EOfW3vMKa7BzDuYtO2E8ywqev:kiDmtbMnQUMzFzDuFJ8yHe
- TLSH T111A5230079D18071F1F32A3088F49BB11ABABC711FB595DF57949E1E1A388E3D23A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5116 elevation_service.exe 5680 elevation_service.exe 5280 maintenanceservice.exe 5504 OSE.EXE 3032 PerceptionSimulationService.exe 4412 perfhost.exe 3564 ReFsDedupSvc.exe 1960 SensorDataService.exe 5512 ssh-agent.exe 5440 AgentService.exe 2148 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f903cc4fb05c2f27.bin elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_fr.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\psmachine_64.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_bg.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_hr.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_lt.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_gd.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_it.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4D6A.tmp\msedgeupdateres_sr.dll 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b58e64b1711ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b032ef1711ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b2f2fb1711ddd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3ecd1b1711ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef7a34b0711ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f89a3b0711ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000892a39f1711ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5116 elevation_service.exe 5116 elevation_service.exe 5116 elevation_service.exe 5116 elevation_service.exe 5116 elevation_service.exe 5116 elevation_service.exe 5116 elevation_service.exe 5680 elevation_service.exe 5680 elevation_service.exe 5680 elevation_service.exe 5680 elevation_service.exe 5680 elevation_service.exe 5680 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4252 2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe Token: SeAssignPrimaryTokenPrivilege 5440 AgentService.exe Token: SeBackupPrivilege 3564 ReFsDedupSvc.exe Token: SeRestorePrivilege 3564 ReFsDedupSvc.exe Token: SeBackupPrivilege 3564 ReFsDedupSvc.exe Token: SeRestorePrivilege 3564 ReFsDedupSvc.exe Token: SeBackupPrivilege 3564 ReFsDedupSvc.exe Token: SeRestorePrivilege 3564 ReFsDedupSvc.exe Token: SeBackupPrivilege 3564 ReFsDedupSvc.exe Token: SeRestorePrivilege 3564 ReFsDedupSvc.exe Token: SeBackupPrivilege 3564 ReFsDedupSvc.exe Token: SeRestorePrivilege 3564 ReFsDedupSvc.exe Token: 33 2148 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2148 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2148 SearchIndexer.exe Token: SeDebugPrivilege 5116 elevation_service.exe Token: SeDebugPrivilege 5680 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2148 wrote to memory of 440 2148 SearchIndexer.exe 101 PID 2148 wrote to memory of 5136 2148 SearchIndexer.exe 102 PID 2148 wrote to memory of 1404 2148 SearchIndexer.exe 103 PID 2148 wrote to memory of 1852 2148 SearchIndexer.exe 104 PID 2148 wrote to memory of 6040 2148 SearchIndexer.exe 106 PID 2148 wrote to memory of 120 2148 SearchIndexer.exe 107 PID 2148 wrote to memory of 2652 2148 SearchIndexer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c48398ff157955b0bb9d60c834312493_amadey_elex_hellokitty_luca-stealer_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5680
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5280
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5504
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3032
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1960
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5512
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5440
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:440
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5136
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1404
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1852
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6040
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:120
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2652
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8ce049212bfab45888ac94b0f0020b9b4b1b1d131cff3892fdf59c149ae56ede
- MD5 e7b12c8aed8226689cedd6bf07432f47
- SHA1 401034d83601c84068bf728c2309a6f2d52ab607
- SHA512 dbea7dd05ef3655f4caac0552e5366488c1b6049801cbf131cd5b5d83d4e93875d82a05ac242102a5f800abf595814503996c08758c0fd4722cc030b69d5e05f
- SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKuYtO2E8ywqev:U3q6mjBzuFJ8yHe
- TLSH T1DAD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 6372c642fe833f232d778ec503c0809a0652d1c744deec149d32a43e8d5bcc51
- MD5 6afbbafdd38b0d188a3a0643ef73535f
- SHA1 cc3793772668cc2a0c71d2231d20e1be5ed0b338
- SHA512 bcdcbb47a228c70ee0c9550fb429faa41832cc462714b8a4a9e03abf537161511e7f26dca47055f6fb05a3769f7cfa7ecb0fb73efcb4c7e10013f351c849c294
- SSDEEP 24576:xXYfDtczAsm2kxUlYtEjedEeQ16ywqmpv:UtcMuYtO2E8ywqev
- TLSH T11D05022977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 6b4d9d819e60aa1dccfb372af5d3312b886c3d196ed2afc2e5e1f4b7344c8e06
- MD5 84b0a690a20bef7bab583420a9fe3f96
- SHA1 3b87b5cb56e35e13ae53452ce47d2380bc1bd132
- SHA512 1940741f2615b9b244a0694d828a4d951f805a56f6db8284dd4a6e3355f9f458b399483107a53b3ac85decb818d45cfb08c516f73ebbc913b797f69abda92dbd
- SSDEEP 24576:M0Le5ji0hmxhrMfm2kxUlYtEjedEeQ16ywqmpv:MPji0AzFuYtO2E8ywqev
- TLSH T19D35AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 81c51c68f62f54bd8e2063efdfd54fae3fdab0f891c3cf7fde17ee9c38774050
- MD5 c32a309161e544a91516c141fa74815c
- SHA1 4c9b53731009753fcaf90e41f184c63853d05c45
- SHA512 c028bdd5a033feb8650473c084d5858b4693a58d2e686a432b2a0742b0b90c1a7027004fe2c5293929a1ac63b8f4b713021ceb5058921876b67b712a874bdd21
- SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWj6q8wyuRm2kxUlYtEjedEeQ16ywqmpv:c/ezSC6vUzPv+HjyhuYtO2E8ywqev
- TLSH T1BF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 52279b43d8e38eb90530a2359b69fd0cc4bc9a2969fc2648d2c3f8beb10ab406
- MD5 33f1a2ca39856e04ec8d8569707174a4
- SHA1 1aed4cc1f0d0646a0bbadead2e455f42c9819bb7
- SHA512 43574036950d6210d437bac182c3f92f2e3bddd1f3226c99f24f959e8d90565b5ae69bb617693b7ce27930c50c096919e3772e39ee95b970a509f2376360b940
- SSDEEP 24576:wVbqPb88hv/l+Bgm2kxUlYtEjedEeQ16ywqmpv:wVO88hXl+luYtO2E8ywqev
- TLSH T1F2559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 1037dbd7e66657bffcaf72da144f15af1c1f3b7d55b210f24ffe52f0ac374734
- MD5 3244f6ffe99d89c19e23d4e5cb19b1ea
- SHA1 e510c36fb16634a4863fb73cf3624369b8396181
- SHA512 446ae2963eb4bfd35041e1e2d14b0072c1ee5c9163480208354b0499860f7e3b1377acd626d8fddc7eacf1d0df07933afd4eb74161e5c9a70bf2e7e7988db8eb
- SSDEEP 12288:RG3TAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:RGjm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1ACC423C3A6253188F7655E3424FAE96312564CFA35DCD5DBCBD2B75E80BC023D2EA182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 6c1623b2a5e636ac2100c988443b5b39d382879a4949ccaab9b2f9ce60af40ec
- MD5 a801618100341ceed5ac2ba45b809bc7
- SHA1 96af49ac81a2de34acf6989dd2791bacac62c6fb
- SHA512 52e0bea7e199ed644ba68e79439f64d139e558cf65b911eb2b30341f52ce169c1acd92b4e732e67cbc095fa28c5c7cbc53e72c788323cece9dbaf059b729267e
- SSDEEP 12288:3eBNUbTVO86UmTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:3JIUom2kxUlYtEjedEeQ16ywqmpv
- TLSH T18305CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 68ebed19d6045b49af7dca94cd37ca4baa35485cf8b69d6d786652d3cda53c49
- MD5 3ba022e48234fef31ab609c6776007da
- SHA1 15b6aa4e8c16a81702e891a214af0b9f02d6e936
- SHA512 1ad015cd00ccb9b4965c95aa8ae3453b6a95aa834658e1118eb7e32762e6d71989472d8159145032e7cd2ff0f3d86691e67925da65c2f28698e75cb3c2b921e3
- SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:rQvGAdlCEL8c/WRNw5CsuFJ8yHe
- TLSH T1CF267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 06b8d93a96c71d2b72b57b2cf8d1d7480819bfadb5350b0a3da9cb777b57ffde
- MD5 fe5b32217f61782d356e422b578f39a7
- SHA1 3d8b4d9b0680338e0bb561440e6ab3811477484c
- SHA512 c70740312bad03c98adc81908a38e1242fae3cc35db0adef10e4363b0f56f8def17a370f86a07accc793e0572ba5d3ba0a048a671c02131d8e380d870fea7bda
- SSDEEP 12288:2AwSfxL/2Dc3mDLLmt0LDQewsAjATAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:LfewsAjCm2kxUlYtEjedEeQ16ywqmpv
- TLSH T13215E031FE74E036D3BB0DB21B76C716142D79604BA11AC3E3E89E9E49342D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 28b40692499a889cc5c43a0c9ec39d4fbb8c8c83cc68c9d8e7e342fd008c28c1
- MD5 8d3201911dc0c3ff181ba5bff056c400
- SHA1 49c2c93257b9465ce749084385cfdbce1e71f9d0
- SHA512 560f97cc270dc3b26455bcd44fed0f5e207ffec46d073b320de14b7b4bd3b4b3586824551b21cc8a72057526d45372473e756cb6fe7877596b2913d96df3ab80
- SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHI0y:jUEtQevvqc2W1cpV20I32I7
- TLSH T175474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 11fff4827410380d27460da5c69aeab49cd10d3a3ccd7e26e3a34f4db9d49945
- MD5 9ed65a471a300135b9edda4cab4c2891
- SHA1 2d8e97c1bf5b7d58bdf0ad902d29ccf3bdb927bf
- SHA512 520a9258348e3b61d7d12f7aa72bf71f6b0f56614f54ba0b6dc54c293c2f96b2ce8299df635b594b61331ba4d6ea585aab302fd6f84750d5ca9505bc3fee63eb
- SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zVuYtO2E8ywqev:PoqtVjnmouFJ8yHe
- TLSH T1A5D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 fca62ec0d37db2a06fa8605e6ef465f4fb3e6342cde3f5c14c2edf638196ffa1
- MD5 887b6814a8f56b37518514f7ae1b4b63
- SHA1 4f38b2e05458e9659523d2f3ac06aefb5ffb5f6a
- SHA512 c023bbbf21347d1047fb98d665bec9ababcdb2192cde56017036fa6474711f687e13ea7ad5d5e6dcc0619bf38f22b2e0c4a48349a525381bc3568268780a1439
- SSDEEP 24576:bAhGL6IFoiwtA5l7S539m2kxUlYtEjedEeQ16ywqmpv:bAM5Foiq5YuYtO2E8ywqev
- TLSH T10735AD81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33A50DD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 7c39f4e4d9fa350ceaba0c4460c1c6b7885e4d4d04bbbc779df8d8e575d4bec4
- MD5 514a8d7b1d623070fe2514b119c4f33e
- SHA1 d661970198b590934af7f799664e4dc63401b082
- SHA512 af200246c392f4422743ed50e9c702dd530288c27f132b0639b2ebc4cd2dfe99174314230d0a6e002f07ec6ea2526d962182d107774d6e3b64a9c2bec1ca4301
- SSDEEP 12288:Vmw5HEjsChNEBFgl0WDm+CNTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:QwuROWem2kxUlYtEjedEeQ16ywqmpv
- TLSH T1A905F14676A51CF9E96786388597C132F3F2BC523A24D71F07A0C65B5F37221AE2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 23c4388c72dd663e7a1bfc0f737aa764e4813ba3bb53a7ec18871a3e473b185b
- MD5 0f426267c711b5b3cde0a62e6c97357f
- SHA1 94c0468750915a0b146304ea0c23587c118eea44
- SHA512 f6b2d3a0bed70168f5b7ec139a1aee5e4c26ab8bf86d800ea1ec6110a425f35476ace97e53b378b9285ca1b48f0d81750414f92a9a4ce4dd3ae4017636809daa
- SSDEEP 12288:IyZ1IywTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:dZunm2kxUlYtEjedEeQ16ywqmpv
- TLSH T17EE4128632A430F9F2A3563C98F19602D37278A73374C3CF46A5525E5E776D29E39322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 280959f97a84d017d58a7ccbbeffce14d1b5b3da204633811f6a594c5714d2ed
- MD5 3384ab0ef1744c102c96268f93d05b35
- SHA1 c696a7f50e08426819673ebd1daf2fb88be57cb7
- SHA512 b918615a5dd94632d0b47ade2de06b649a4956ff2c741f85cbdb68fe15b28838cf4cad81ff770c88f8ea7ddd75dea551f5ec704b0c7224271eb1d0de55b0fd1c
- SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3XuFJ8yHe:OQyiKanX+PNu0y
- TLSH T108667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b11387d44c99e3f252e6ec1e97671395c9fe423b620fb4bafe352e801832eecb
- MD5 0b0b4e7bfbff48142143c0d5137034f7
- SHA1 394c1595f41036234b76a8212912f68d9db664f0
- SHA512 0295454a50ae9a7a8fbdbb0c70a2d8db5d4df8943a2584f8ab4b472cd3e21638e2050c0d68f4776c21ea5433ab9e6b9298fdd511a9b1c12c833d32d358731f33
- SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3XuFJ8yHe:dQyiKanX+PNu0y
- TLSH T1A5667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f827bd276655ca2e9bae070c9eafd4ecbc34ad14fa3cd4c1a8ac1c69470e7708
- MD5 7524b114c24e48e30f245d51827d4540
- SHA1 bc07707662f2b60771d151c8334b51e93d97bffe
- SHA512 42fcfde9ace478d4aa66f5d124f7ac55c0dc946bf8e440f65031290eecbebd09fec93cfbf71cc69ae7d2e0046b62c10bfa44ce398c5695d46e284ebd6498b57a
- SSDEEP 49152:K68Qg55nhkeWu7PNU3/FuYtO2E8ywqev:4thTRc/FuFJ8yHe
- TLSH T1EDB55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 03956c31ba225a8a55c35ae44d9c0f3c041c0a28f3e0de6dd0e915dd0e47f6a7
- MD5 7317a272092edd251d095c3fc8785adb
- SHA1 6693efc667ab2a0b7269415d4bc9bf426bf2e03a
- SHA512 5b6abd47c662981c7003ef7d42345e2a94b56c50449e0eb2c957cc97b1ae1ca345d86ae7052c7d57c0d0f8adc88380d0006600d19bc668cd1f0b78d1d082b425
- SSDEEP 98304:2y5112gYy5azzVvU69nLKnhZWuFJ8yHe:nLIHRWhZ0y
- TLSH T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 0b49e61ce671827cb64a6cf3dceedc71ccd76cb1a7f35639770e391a42444779
- MD5 7aaaf12a1ad2fce80a6863acbebd5f55
- SHA1 35e6e7c05aac5b119d6eaef302498bf602342b4f
- SHA512 af9772bda5c1fb6f29b5b477abe0bb5a5347a8e6b39857df68d512a8d98b866a55355bf3373497153e0a32adde802c61a7ecd4c12a6dfa6e319890f406e7cd75
- SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glfuYtO2E8ywqev:Nu6JmIxd2dfuFJ8yHe
- TLSH T10FD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 dee102165a5ddbf2e52361e9bc83e25934d0155037488a2a5ee2545cd04f2c45
- MD5 bdbe51b60c23c7bb7cc820dddb677a8b
- SHA1 ce6cb2de699b9dbcaa3b0a00f0b00fa4f08f7d0d
- SHA512 99b26911803f994e18ad74952ab51ba4eb82382cb05fa7de80916a4f93fa284368c5c88166ce36f26a10ec14c2ec3ebcc0830c2b7fb15a1d7e4c89e8bcf77d67
- SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xLuYtO2E8ywqev:ZmifPqRouFJ8yHe
- TLSH T162B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 a9e71f2baa2e3fc35a7017c5e738531d3ba8aa2eeed059a8fc411871e7445a77
- MD5 32e72a234d35c68f069d1aa656544110
- SHA1 65a39c79ee1da119c73e5ec80707485dad3a4da1
- SHA512 3deba82871fcac7bf62ec50aac47ebbc05d363fe627096e2d18e30ab9cb2a062952eecceea777f2b38863193054effc1179d761eed1a3eeff9eea0a5eb8bcd15
- SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHq6uYtO2E8ywqev:/5dKqi616uFJ8yHe
- TLSH T1FEC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 a12254535bc4c10d2be1ff9598f06d3999c60174c523d1512ab488c0e3d651e2
- MD5 690ff0b00d5b56a15ee6089c1148a004
- SHA1 5d31f75626a88d164c58ceddfea8e006faea0f41
- SHA512 2a83cd42dadb13a2a065a974ecc4c2efc1568afc15ad98308e9bf108513a5f7d3c2bd549e918fc60b6451dcb399b7a60c5892704335583c1b73df30c327aacf5
- SSDEEP 49152:/htSn8EApI0figjgiDn0AP5wPuYtO2E8ywqev:uX2iWphkuFJ8yHe
- TLSH T10895BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 9bfc754b2d48190d2b32f7e9daddec5f0fcc54ea8ed314b8aa738037dcef008b
- MD5 79ae378d157547c9b0a7f6be055ed985
- SHA1 2656e36864a762c3c159707aadf8b504570c5c98
- SHA512 f99df798728d0d892f7988ce083a57440e1c91bc5e65dbaa457447ef76fe446015b2c3f03b5912b2147d48df1628e16c371bf18b979af1ea5fb9792f90a1c972
- SSDEEP 12288:BPTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Brm2kxUlYtEjedEeQ16ywqmpv
- TLSH T11EC423C2A827358DF7119A3450F6E663125A1DFF76D8C1DBDBCAB21E80BD027D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 4b31d4c2b98b3fe8148e64fbd66562871f07d7344171d1cfc1a025fe4f828f6c
- MD5 b821201793e56141139de2ecba886184
- SHA1 b5f940a2a7664d3290f0a2cdb8e5705be4a07ed5
- SHA512 b726ba5234a600d424fc809521216fbb38656726e784f728fe21e46d82001cb2cc16a65ab899abcb28e1301faa8ce4980dcbae4be5ac208af0b1f14d52d59786
- SSDEEP 12288:6kTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:6Wm2kxUlYtEjedEeQ16ywqmpv
- TLSH T100C423C2A8273589F7159A3460F6E663125A1DFF76D8C1DBDBCAB10E80BC027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 11eef2941c5f46138669ba8fbbc0ab9e03c23e9f38c7b86a2e18221571a1bda4
- MD5 ea36c659497b5ab1a6ba49d00a74e335
- SHA1 b9172240b863cc84d08cb71a8330e4430625430c
- SHA512 dc2fe37d38de15dbba49322dd95e717856a7601c3e2d54cba42000872a8f593ac94bd446b81f9aa7ef343169d1c7f9bdffb0c3785253b703207b928799fa2a2e
- SSDEEP 12288:X+TAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Xwm2kxUlYtEjedEeQ16ywqmpv
- TLSH T137C423C2A827358DF6149A3460E6E663125A0DFF76C8D1DBDBCBB11E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 78b3a5804295399793da84bf6302924cd00d3d7fa0a5ee4874acf1b6059653ac
- MD5 86b55a98dcc2675c637d6b4defd83841
- SHA1 9fac3cd8247c19cdfebeafcb24b5258b82da86b2
- SHA512 5d7fb970ff35921fa6c4a40b5f484b64b7d444770a9843dd3b050eccc9a7be7ceb853bef46d9e3069f9de59bcfefa7f89752fb821c35ce6f8be75f021840f064
- SSDEEP 12288:WVJTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:am2kxUlYtEjedEeQ16ywqmpv
- TLSH T1BBD42382766630C9F521D63484F2D52393B67CFB77B4D2DFCB81650E0CB9252DAB9281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 2259ca80b888ba834d7c998cde8421465b33082531b5f67bdf9ae8c4676e7b77
- MD5 968fb3cbfd5085ba118f2804ee7452de
- SHA1 5b1d9ed9cfd70eef1c07f2d383fae5578db3c393
- SHA512 01ce8c05b61bc1773095e809fb9945d9ecac7467b9025768a70a5075db21ec3f85ba4f32f7f570715f457f815e4cc6411602ad9c9b2b0f35f826703d5280f41b
- SSDEEP 12288:4xTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:41m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1A6C423C2A827358DF6149A3460E6D6A2125A0DFF75C8D1DBDBCBB11E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 744169fba920536a62e977c5eedad50b23d1811b6b632018d04d0913a6109ae0
- MD5 be471c7648af072bf754a23f3ed0bb3c
- SHA1 cbc9a0b9baf82e222b707eb7c98fae65d4139b01
- SHA512 ab2daaf92610da3e2f50605abfee9881d2ca101eb931e0782c3f564e33fc4929e8cd1caa0b9697f0fe64ed62053a860f769493554a350676409e05d73ca0cb60
- SSDEEP 12288:94TAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:9Km2kxUlYtEjedEeQ16ywqmpv
- TLSH T1ECC423C2A827358DF7159A3464F6D662121A1DFF76D8C1DBDBCAB21E80BC027D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 ae66d4bd9030827ad13e0fab43094c1b7ab7731b4cf21036a572a7aacbdf0f36
- MD5 ae56c67c835b21f26325ec187c1384eb
- SHA1 23fd5671c31d6b75445282da748909c8b34e7219
- SHA512 fc50f19e1f3e902b28686098b6e67e0d09c7d626b57e159381fcb7f3fea977389e6299e60b3aadb5ad79e1bb29e1c6882c96be66ae64eb09650c4c9ecb132018
- SSDEEP 12288:AMTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Aum2kxUlYtEjedEeQ16ywqmpv
- TLSH T1CEC423C2A827358DF7159A3460E6E662025A1DFF75D8C1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 f46c5a612ea3989eefdc30f875ead454e1bfb3c5dc4487598c0436edf3b58225
- MD5 b1ed8efd4b9f2ab094b7c2b6a26a687a
- SHA1 d29e7145b8d9a59602eba4874d3db1004b3029af
- SHA512 fe38c732692559c9439079949f4630fa407767b8dcec2a0747b8cf68e1ebbbb6cec2d472e357caec8472f76250a8671c98c4463f0709d8d784a698244af82869
- SSDEEP 24576:wZM3zFVSO2m2kxUlYtEjedEeQ16ywqmpv:wZM3zfNuYtO2E8ywqev
- TLSH T12F050295B35018F8EC63823EC8658916D2B27C6A17B0C65F03E4362B5F373A15D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 ff36759e0ac8fb721df72b7ddbf42c3abf82d463e1075c88cb4a1db64f81b7a0
- MD5 3de01f46cdd0c47fad208da88832b58f
- SHA1 0d4714041132bd7de5767314117f1b0240779ecd
- SHA512 2d7ce806e1f9f564580f652102d06ac999a1650e2fbd06888b16020c5247c0df1dca6e0420090631f0013a7b32a741c7efb33ab25c66dedc9bb5a27511bf0e59
- SSDEEP 12288:vbTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:vXm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1DDC423C2A827358DF7155A3460E6E662025A1DFF76C8D1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 1926bb07fa3eac74f2587cd3bbe72b23059029c89d4fc090bfbae00a1f7f5c66
- MD5 d225d913874465a7436a58553d91854f
- SHA1 2e977e932194c7c663270973c7b7a36da914f2f9
- SHA512 5538795f5705d8a3f9ead559c5e755e36346c4f359a8478bc3b24f4c77bb2fe7de660698a77d8057ba2524ca1e01ebd10033190a9e403bd99de5415908f21c15
- SSDEEP 12288:MnTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:MTm2kxUlYtEjedEeQ16ywqmpv
- TLSH T176C423C2A827358DF7159A3460E6E662025A5DFF75C8D1DBDBCBB21E80BC027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 cb8e327941eab15bc1f6c8387d00f91d9a9e634df9ab05118cd69817cb4e9eb4
- MD5 079764ac04ab5d809ad1121e5b125cfc
- SHA1 381a5d00ff503c10169ec37dd50f3fc8e101834f
- SHA512 bc26de4a98cd51bfee57d71eeb5be124289ad4e8c9e5544868dab9b3bbaec1765de08aa7da0a6a6912cbc99ba9c9ebb0b3ec6d0b71cb99a6a4d4de5c88dbc0a7
- SSDEEP 12288:hyPz5L8wTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:wzyym2kxUlYtEjedEeQ16ywqmpv
- TLSH T1C2F4124773A130FCE136823888A25A12F37278761764CAEF57A4477A1E37291DE7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 7b407dae456bbcb294cbb7c967246b68140bcc2e8cfa825254554e25b8651958
- MD5 78f51e09504f619a7a906e653fda303d
- SHA1 bafb44cf932febd386bdf301821a90c6539b9e1f
- SHA512 b441552861a9e6ba79aaa7ad1a4032dcd3b5e9ef469a6e4be5be76875a9b7030aef2c083f619b317a3cda7fe66fe0af41e3f4e82e9bb5e16ab2d6f59efc5b151
- SSDEEP 12288:/bTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/Xm2kxUlYtEjedEeQ16ywqmpv
- TLSH T152C423C2A827358DF7155A3460E6E662025A1DFF76C8D1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 67567f3925d028fec27f85235b23e6b2d22ec78f1bef84910c7c308c9000c4ca
- MD5 8b9a95337f7bb45fdd2a5b3013055bdf
- SHA1 f5ea56ce9f7bf31ee1282056f2b075d13d0eed38
- SHA512 430ae0c5a3d754039be715dad7d13f35a8bf29fd982b32cbd0a4f953bc5c6d0c05f7b5b063d4a110ffbe199b45c5f26b4d1cebf1e100f65c07bdae4655cda01f
- SSDEEP 12288:/bTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/Xm2kxUlYtEjedEeQ16ywqmpv
- TLSH T11FC423C2A827358DF7155A3460E6E662025A1DFF76C8D1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 4ef9fd1133be9cf1353dfcc62fc70fc89d2cf23a71bf7052b3cb6d3845be10f6
- MD5 9764e6a5538250dcb65a4414afef0a51
- SHA1 8814fdacae0da16fd4045b3fbbd39b8602c184bd
- SHA512 fd545968067167bb81e7d8bad4078d4d23fd38be49469f1787c20fa82f850178df008d9f88ced06ae46d1cafa84cdd6baada9b1b623ce3fe5162a5b09577d65d
- SSDEEP 12288:gyPz5L8wTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv8:Rzyym2kxUlYtEjedEeQ16ywqmpv8
- TLSH T1D1F4124773A130FCE136823888A25A12F37278761764CAEF57A4477A1E37291DE7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 ca93d9f4f4ad713de649da38d914247d09efd9522a6af957b325c4b13a671cdd
- MD5 d1a3516ef8d7a1dbb7677b7a989870a8
- SHA1 336a29b906c2b97ce5d7a95a50cc1799112d3d4d
- SHA512 dec3570665a5337f83167d9f0177c56f4677ff29ee96b9c7961dda0c1588272fdd149ed9149f547421fd5ed542a7388448d7fe0394d4d1234d675d9e9cbd7642
- SSDEEP 24576:oT8aLl3z0zDAm2kxUlYtEjedEeQ16ywqmpv8:oT7Llj8uYtO2E8ywqev
- TLSH T1DB050295B35018F8EC67823EC8658912D2B27C6A07B0C65F03E4366B4F373A15D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 6df806798830e2019b3dc45238b0cd9ba9ef91f437fe0fe557c8e1cc686f236c
- MD5 08674e0d6248ae26a8db6eccdeebd51c
- SHA1 79432ac61a840b2987fcd8453439b7ac18d4fe23
- SHA512 c22f68a2dc5c6fe83d5fc42126009b91b17b43aba36603e0ad451b8fe6b4d3524cf312c3a830d409947072c7bf9c258372777abd64aacd08446f06bb746eba6e
- SSDEEP 24576:83rd9CHKy7GZUm2kxUlYtEjedEeQ16ywqmpv:mrd9CHKyaNuYtO2E8ywqev
- TLSH T11725CF90F3E410E8F1B7DA3588769512DA767C9A1B70DE8F03A4661A1F336D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 30212ba9209b3253dcbfab9f0da631cd71a5194e62006c6a0d89a5db69bdb13a
- MD5 b1e614c1ccd112f6b00eea205910631a
- SHA1 370aa06ffa6db5516028286564cb603d6e2cb3fb
- SHA512 c4dce8e96769508163d16e2decdebe01841fdd51516799e60ecdcfe6e4fd18f6b7d2826d4244498e4d12468d77f0d3cb706f74b0cae40893048a3499344a4af0
- SSDEEP 12288:xeTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:xQm2kxUlYtEjedEeQ16ywqmpv
- TLSH T16DC423C2A827358DF7149A3460E6E662125A1CFF76D8D1DBDBCBB11E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 9beaa2947138fecfb752b709ed669b226939a1a92459be6a8ae5bc08ab4fec20
- MD5 98bfc5c5f5edca9aa144655128381abe
- SHA1 875930070e86be576e24bc968c2f0683d2114090
- SHA512 8893917ed0908f18978856f97249e1248679d48455ac50b0691e0abb0cb6d2ae9cb8d88fc78084c0767d45a3a4f3c21ce3d8e0c6de85e0e2207c309fbc3f914a
- SSDEEP 12288:nQTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:nSm2kxUlYtEjedEeQ16ywqmpv
- TLSH T15FC423C2A826359DF7159A3420F6DA63125A1DFF75D8C1DBDBCBB11E80BD023D2EA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 40fc1cde3b44f2fd94f5d4c91cb374be2e6c813e720b77e32ec7cfb3f7dc3692
- MD5 39e5f1ffeb201e6030539b956a1ec016
- SHA1 376d40640bdcac2e9697e9c723b99dbc14894a1e
- SHA512 3db582f844baa681e1776b285788fb38aba02ca97b9261fe9242b1737c52938df1c0723811b561d0a5cf18dc8186b4a483335c3ae9516836d69f0161ca675d0a
- SSDEEP 12288:/1TAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/Jm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1F3C423C2A827358DF7159A3460E6D662025A1DFF75C8D1DBDBCBB20E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 e7bc98d5493289ef1c16e8872318cdc401939e0bcb949f269f867529701d0b55
- MD5 97b702e2f5fec4022bef3f9ebf3cfef2
- SHA1 0876f74f88450861ec81569dcb6a0e37ff83663a
- SHA512 d9e222cda306eedfc0b89f5a460166c399517484d653e8c53db6c4b1f33c9fc8822776abda56b9b737468adfb4e75b66190144b0d4053c39487d617d34e706d3
- SSDEEP 12288:zbTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:zXm2kxUlYtEjedEeQ16ywqmpv
- TLSH T108C423C2A827358DF7149A3460E6E662025A1DFF75D8D1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 1cba8e9b28dc58382a20a368c862866c57f883dc1e6173793d7ac136a8bc16dd
- MD5 9c72a721a15b2c0c4b6f6727d3799b8e
- SHA1 e62fbfe6124d43d40509ce7c247a5d2d620895ca
- SHA512 8421859de334de02d817a59705879c292285f1de31ff549418bab118feb63d9ac358216679698edd6056d84c8750c9a55e95614ef53933a9c6398cd6b1e38893
- SSDEEP 12288:QeTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:QQm2kxUlYtEjedEeQ16ywqmpv
- TLSH T195C423C2A827358DF6149A3460E6D6A3125A1CFF76D8C1DBDBCBB11E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 983c4a596348780d5a18338fdb686e9c1f3bfa1ec1d87e0e58d6bfd110824693
- MD5 3b63308880fda1fcda2b358774cbd066
- SHA1 9bd8c8a4aa520853d8e162987a63b44456d0a3b2
- SHA512 8a0b2be59bee99aaeb064662ea72a60c042b4f35374a0a19aa1302baa9754304913b2ebec912b25f5977d9fd8ec67bb7e7c4634e3a7f51792928502e2246bb68
- SSDEEP 12288:9jTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:9vm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1BBC423C2A827358DF7159A3464E6E663025A1DFF75C8D1DBDBCBB20E80BD027D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 2d7b6a3de270faf24895f13ba4f352a7f6b632c20c21689d29e5a731cc6e8e9b
- MD5 df3fb38662df07a77e1780fdd646a068
- SHA1 2e50172388e601dc7b024eeb99605a9a86ba2d8d
- SHA512 20e03749b6d1c83c5443fc20b9709b06838d10d284636ddb4217d43a255862437126009cbdeb8dfbaa8e423eb9b07afeaced05f313a233c0fa58af42f5bd2b63
- SSDEEP 12288:oxTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:o1m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1D4C423C2A827354DF6149A3460E6D6A3125A1DFF76C8D1DBDBCBB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 581KB
- SHA256 e0d2396fa5cb93ad999e5ad528162790429e64fbf9f4fe912d4095ab26ee103d
- MD5 6b073138fd087aafd208991cd37fd974
- SHA1 4e102e520b84f05ca4f1a26056f57506c73bb33d
- SHA512 9f602466eb221f19377d551139d75ab411208798cba2ca48ecdcc558aada7002e27a2c88ecbcf0e52d7f779379ac2b0b52b8be2df9a1111ac1c9ff510392d8a9
- SSDEEP 12288:XWTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:XYm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1B6C423C2A827358DF7159A3464E6DA63025A1DFF75C8D1DBDBCBB20E80BD027D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 581KB
- SHA256 a95030dc8938f3514870974bbc0d19c491912cc6623c0ec9dba66c7889800d52
- MD5 fde7c834210172672bee00a2ce415979
- SHA1 3116e543510f4f1401e91dd67ccf6b204bd0969e
- SHA512 45ab77272130ababe767821ee00c9d6617840baf0b787cf106fa065efcb2477931cde9a0e932c42b08f7c938a5a1a4a653960170ae8b6edf7300dfa42b02a163
- SSDEEP 12288:zxTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:z1m2kxUlYtEjedEeQ16ywqmpv
- TLSH T186C423C2A827354DF6149A3460E6D663125A1DFF75C8D1DBDBCBB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 bf0124eed4f73c4846c91f23a21397b6beb19bada24e2a9f25218dc4872d94ca
- MD5 f996cb8c50aff1b69d0c4dd48cb36739
- SHA1 0f99234dba50fc71eaaa8758837cb28ed700248b
- SHA512 6d77040a69b044a06fd32fed265a7bf848be526a7c9313e8d09a42fbfaa986174dff46503bc865605e8f8672e0e56dfb0257fc1bfcbd7aba09067ce33d08f7aa
- SSDEEP 24576:ifwvzk9RX6wkyAIDm2kxUlYtEjedEeQ16ywqmpv:JMnYI2uYtO2E8ywqev
- TLSH T13C35C029EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 52f60177f2497da84a33a874e918844dc0b2bf80253077ef68cb73cc1013b398
- MD5 af58dfff10b4c55cf709a17a8416ad90
- SHA1 181235c755400f2d0700a2b05291015e52e546af
- SHA512 3d4a8b8760285b9a2f9d7adb1146cbee2ea8a19c0084b9de19865795f926a4e806f930f511728f33ecc593614e9d97399a027f0131cf818d5c5e70ef5d29e53f
- SSDEEP 49152:pYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vuYtO2E8ywqev:gySzP3uFJ8yHe
- TLSH T195067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 0a6021d87a7c3f58fa04401ce9d9c5726801aeffb65f6e32395c7bac00001755
- MD5 72e73c63328a3da88a5e29ff730f36e8
- SHA1 ffec448a9d7d3afb7b590be2b3d8eb8a3e698a27
- SHA512 bff6136c25bc43d74720c4f80223ce30ae31fb526f6df090c807efafc0aff3753c1763e370557b081fa322970701d66d5a817decaafb64b3c74d39c72451e1c6
- SSDEEP 24576:G47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYmm2kxUlYtEjedEeQ16ywqmpv:G47JUQjqirIhCnDHUPfF/fuYtO2E8ywf
- TLSH T1D765AE1EA3EC01D5E1BA927885558A1AEA71742E1F31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 d02c6a047af763e248abef2738d99f63d9771a77aed385747acc8e71858fae4c
- MD5 c17876ca664b9111119daba51e50907f
- SHA1 4fadbd699e34f90342f6c098e775a9be17b54e8f
- SHA512 0573c8905702dd6e3a54665e4b893f05d40d82d0d51c003a94144eeaece46f898ca25d7ed536be073feec29f781b4a4144d1a14bd87f1ca7ccf97586e618d9cd
- SSDEEP 12288:ypsfrTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:7nm2kxUlYtEjedEeQ16ywqmpv
- TLSH T12FE4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 278ff9ed2b9deedb4c629c22d5a9e23e679e7214d6dc739fe8e89da7bf1db7c6
- MD5 837217040a1f63d82abc060daf276c4c
- SHA1 9438398d86b7b66dc961b5986a2d56f01d35040d
- SHA512 14a8fc9547a6ed67d50bc8bf9d35edd87a6ea52413601f3da03e74bf71fb941efef2c9eadc6078b13838cc837ac43c6f46a6ea869c3c6086659b314336f93691
- SSDEEP 12288:YyxD9ZKQU3fzY+rVRN+rJcmOlw5VKgntEzPHfuJy7F0Er4:YyJ9ZXUPzY+5RN+vOlwmUtkPHGo769
- TLSH T1F5352840762BDB5FC6A940321E72D1CCA7707D11EE05AB0372C8873FD576669BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 38b3113f4d030a1909fb9efb7d6af79a6b034a038199d458c91cd07bf9bda941
- MD5 2fbe877455bf1501ed9833ded7080a7f
- SHA1 a26a0ca4dea2b7a3d62443fba1d33211d86fbf5c
- SHA512 e87715277e7c794d31cd5172f1c8330c478815ca6026ce74a8eaf2ca1b2a01b4a9f0c4577a2b96c46fb0db5ec424aa4ec067b3dc405524ce6f8209d3603ac1a5
- SSDEEP 12288:NlUdXheIQleb0klA1Th/Abz7FxCda2nhvkA+FLxNldTBb:NlUdvT/
- TLSH T15A65E7809137A39FD1F76031076A5B4CAB64EC07B7056F26B3D8443ED82AB65A4BD3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 f6b8a617360da69ca879b1f538b984b304076dd20f245a2b4897f05b67c8867b
- MD5 36a3a4a1a35db3f0caf70f5fd186f832
- SHA1 d09c7c3cbbd7bab1fcb78c502bfb513328eecbe2
- SHA512 dc67364d4005ed0a6c01c74eb64daad74454be0a015f54f30f0c6209081c28ba9977db2dbea3bf2fe3b4d9dd74380fbecfcee354e522cd5548c9ab0665cf78a6
- SSDEEP 12288:XM7zTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:s/m2kxUlYtEjedEeQ16ywqmpv
- TLSH T11ED42383A65A3949F6755A3410FAD532121E7DFE3B88C0CBE686B25E807C0D3DEF9146
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 1fb28d06475015b56db7d468cbd08e83e9c5b5aba1adaf7d8afec61addd9ac50
- MD5 06b36c2fe3cd8cabed8b3076f2a831ca
- SHA1 2a609be6a495340e956d06fa50d1a28462b0e75f
- SHA512 c4ac5e8de024d3c5b270c47e1286d36dc6d00a4c61a5b0c3d8c873db1edf1470ee5e9d99e5a69a96759a5b1d750dc1ed8af169ad31e46d59362043a90600a340
- SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYRm2kxUlYtEjedEeQ16ywqmpv:0gb4mBIBhGFpuYtO2E8ywqev
- TLSH T19365AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 1af2e438ba4390b61265f189f54ae799d34f0dc701c41c000cc697880d0ef0a6
- MD5 3e5ed45efe070837670bfef734dab603
- SHA1 93fa7c10ecda9e81b9009d0c148dff61b835299e
- SHA512 0a97c4aaa123d8876ac93b209962071b673daaf865a2d8ac74145b35fa6678e080183ac746b2fd31b7a0a46dbdc11640afae2a0f543f483d8412b5abe03eb8c9
- SSDEEP 24576:gG88u8FpJqH1vzria7/m2m2kxUlYtEjedEeQ16ywqmpv:z7ZFPqVya7/0uYtO2E8ywqev
- TLSH T17F35016576E101F0E47BD13889824663F2B2B8251364EBDF07A88B551F33AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 ea2d98838bcc0f59782807ed1e898c41a0d7704a0927dfdf08c7bf469b03702c
- MD5 405082bec6246d1d077f6663a3a1708f
- SHA1 3f58bd7ee96bf7ce46191acf99614886aea43c15
- SHA512 744d97a239305a01d28bcc018d2d2bc6d7e8eb838a544e40f5c7706474a1a34df4aa7646c555b4c6966c9da42163f3bc1cc1240247134ab11e55fab9c4f1bb9c
- SSDEEP 12288:nHvUrBFrEjwaQoTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:nPUr+NQ6m2kxUlYtEjedEeQ16ywqmpv
- TLSH T13D05E15F22AD18E5F676E17C85828719E372B8621351D2CF02E1817E4E779E8BD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 45b6f01fde35ddedab6d74f4071c77fb4b17b9d7327143c122891cf9552e31f2
- MD5 18af5a59116ec0b44465ff7865990805
- SHA1 61ce2a83c55f5ac8722fe39a742e58a5572b5f0e
- SHA512 068b868c3a7e5fd393d4ee62cbb744541d7b479f2990d4ace2d53e0ac60ee0cbf3ee587f6f16c85c3490d2b4a4dfa7cf9145bd0301408c1893c9ec34d9abb061
- SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjduYtO2E8ywqev:mG05lO43buuFJ8yHe
- TLSH T17CD5C06A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 723862b05966609563615c77df3823a4ffdc2d46e22383edce0460f898a1e538
- MD5 9ca107674f7dacf60a3c1417a4eee987
- SHA1 d4f4151b85794026b4221bd0d08b748b0062e764
- SHA512 acd92d04de5440184af109202bf3ee621fef3f24629862449a9a6cadccf4147a1f34dcf464c78520c52760f10ec9b23ea50840c49df1b054e47817c3362a3586
- SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnMm2kxUlYtEjedEeQ16ywqmpv:Ha5POZ3lJt2pasx2+mFuYtO2E8ywqev
- TLSH T1FB65BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 2d0fc3a4c1d85eb2bb2791aa4787deba755d2f6abb178ad459e56c4476e8058e
- MD5 e0dd9711ba2430449803d97651eb7d18
- SHA1 eb238425f420eef1a99007201568e238c75e16c9
- SHA512 e7afe37c741705a7f9491148637aba99f0f23f20c2a3411a733efc47695bd76a42d2d4ee8bb90512e1cc1c6fa2f2485c5d0ffef56e06438687796216bdb37529
- SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fk+m2kxUlYtEjedEeQ16ywqmpv:7Nc/zEOVHFUuYtO2E8ywqev
- TLSH T14A857B5622E901E4F1BBE1BE89779546FA71786913348ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 720e1832ed23a287068c6a43df0cfcb66656d9b3e19d7f16226a770941aa09b0
- MD5 338872c1129d9eee8307e558d9c58375
- SHA1 5cca8f6b649bd4a64a5e187347d9ed1b9624f5e4
- SHA512 4d79c6356751df68e24c539872ca48f9f3c68c62ad93ead7a569be408ed9aa21b547afe93958f3b96b13b13a7cf3dbfb0ab7af986320edb53d3aaea671fc8b5c
- SSDEEP 24576:AzkNvNnaFeYhJNtmZBmYm2kxUlYtEjedEeQ16ywqmpv:AzMwBtOmbuYtO2E8ywqev
- TLSH T18655AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 210882f700d95521eae6f3fe555f343a71d82ba5e9316ee29f89618f72540992
- MD5 073f732552f06be314470bf622fd9eb6
- SHA1 21a034af38f554f4f980faebe02dbe6f548a433a
- SHA512 e33d6e1eb4d6d97810daa6279f681cbb205e9cb8351625c72570b3fdaa9bc3bb8017a03188ae5383a3fda76aee92900891b1b32b0389d741e39a4e708859631c
- SSDEEP 24576:7D3FHshBIYQgALm2kxUlYtEjedEeQ16ywqmpv:7DVHeBIAAeuYtO2E8ywqev
- TLSH T1F825E17EE65C04E4E57AD1BCD6A38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH