7e4b59ebf8549b57da9478827753bfbb7a765b154b4836359b860607d92027ef

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260728-qdvcmaxdle
SHA256 7e4b59ebf8549b57da9478827753bfbb7a765b154b4836359b860607d92027ef
MD5 0f50a0e30e7367ca5626c4dae8a7fbe1
SHA1 d7d4326364105333751267476fa37701c7b95643
SHA512 9fa93be971a1cfda9acb42400c85f277a8f9080e7047e9c347fa73240378953adedcf92f79efe78ef9ca8bb13406eea04d5fdf77d220040bdde482069a75cfb8
SSDEEP 12288:SUYJ9biSGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:DYJ9bsXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T18C85023272C1C4B3EA73043105F896B1953DFC311F319AEB57A1679A9E346E0993EA72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4572	elevation_service.exe
356	elevation_service.exe
944	maintenanceservice.exe
3276	OSE.EXE
2324	PerceptionSimulationService.exe
4484	perfhost.exe
2360	ReFsDedupSvc.exe
4764	SensorDataService.exe
5980	ssh-agent.exe
2608	AgentService.exe
1820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\245cc896c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092ac7252921edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d8fce53921edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f858e053921edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c235853921edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6ad9c55921edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c674e795921edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe
4572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2608	AgentService.exe
Token: 33	1820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeDebugPrivilege	2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2400	2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2040	1820	SearchIndexer.exe	100
PID 1820 wrote to memory of 2320	1820	SearchIndexer.exe	101
PID 1820 wrote to memory of 3460	1820	SearchIndexer.exe	102
PID 1820 wrote to memory of 5856	1820	SearchIndexer.exe	103
PID 1820 wrote to memory of 1804	1820	SearchIndexer.exe	105
PID 1820 wrote to memory of 2664	1820	SearchIndexer.exe	106
PID 1820 wrote to memory of 5144	1820	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_0f50a0e30e7367ca5626c4dae8a7fbe1_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6e53c48dd4b69c54615ca96b06b12bee89175d650592a8b36ea0be96362e19c4
MD5 973ed1d8ed271d083ee7b42159096378
SHA1 7b5f14901540c6887ad4fa059718b78dc44c72ac
SHA512 0884ce9d814936a8b40f4d593787ec860ca96decf07a747a0b9dc788e7ad3d5935a836c4a624519fda175c077c618da967509e1064181ba505542be398f3ae35
SSDEEP 49152:Qb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnlsQtZyFxTA:63q6tjBMtZ+xTA
TLSH
T172D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3bd1a39e2b5cbd7f5fb0aad2243dff32a495e22fa00bec0635c886154ab6b150
MD5 a3054125fe67840dab148fdf6ec480ca
SHA1 9cd94ffcf2900e23448b2dbf94d28f4e9d68b4d8
SHA512 add938f320dbc75f5f89fe36ddc4cfd1559d99bb66d0d8b248093892e3d3f1d2e0476f68cf83b87903146863af8dc9999cfdc72d4df24e6abd1ea246bbcfb4de
SSDEEP 24576:2XYfDtczAcXGUaQaoZ1oXFTyMxV6SAIH:1tc3sQtZyFxTA
TLSH
T144850129A3E508F9ED67823CC9A28412E633BC5147A0E7DB03E495265F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 00283998babe850350b3b3b0f6dbea57bff2c722d0622a1f055c57110ebc228f
MD5 0de29c75f0c22365dc981f155616fbaf
SHA1 81f4dff5a34d10acd4d2176e9095c34d7c9954e1
SHA512 e9f6a4311ba16399166a36faccc3a6d47830f9b71e056d587758a4cf8daac918d15512461422d23382fe65601761336dc03684780dd6483cfcc50b401c7d7704
SSDEEP 24576:R0Le5ji0hmxsrMNXGUaQaoZ1oXFTyMxV6SAIH:RPji0AmCsQtZyFxTA
TLSH
T1E6A59E16F6748735D073C0B9C5D2A68AE97134821B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a52d2747b0a11e67032442e43a945af1a3da8c38a4deb5fc74a2114a7f6bf0c8
MD5 1658501423ffe8990be260fc43e4ad8d
SHA1 0cdf15d324f8ced790371a2c368f0a03f4d24ff2
SHA512 ccdd875bf529e760ecf308d218faa6aa0a9348fe875abd03eb4223ba3adcc577722e8351b42d904a9d560561efc8b4e8811789649636a4e85e7acd6e410f7e68
SSDEEP 24576:xa7/ezSC6vUyDZaqgrvWx6q8wyuHXGUaQaoZ1oXFTyMxV6SAIH:w/ezSC6vURPvMHjy+sQtZyFxTA
TLSH
T1D1755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a40be33881889c0f44529e16c99d95c19f89fef5b9fb84ffa040f39c75b4b6b2
MD5 779234b0308a4282e6466827f55dbcee
SHA1 4f7021b3c76c6545de0f05f1d1c1319e64a69289
SHA512 5510eae92c6ab20efabfe21fbdc1171129fced6e856bc3312ad962ed5b8f2c555ee3a425ab970456c752abac596dad16abe82dfea5a2cd923ff92dca0d1011e0
SSDEEP 24576:rVbqPb88hv/lV7wXGUaQaoZ1oXFTyMxV6SAIH:rVO88hXlVUsQtZyFxTA
TLSH
T13F559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 1cd006f029b54210d4ba85e68909a200fc2729a3f88ae81f7dde48955f7fddbe
MD5 8615b7a8a06fe654d62fe600a56c3b4b
SHA1 75b22beaa95162401355b500d7d576968878a48c
SHA512 f464b4079681b043625c8a021c67c2aff12c9b96c2c1f1224b4f2e2dc3d023924ab7ab403514caaa9d9b02d183a461018602015f2085f448cf0c4e73ad54796e
SSDEEP 12288:m0oGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:m0xXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1A3752323831588EBF76B5535E2AD10D6D072AD602871EBD34DE2B14A9A3CBB1D1FF460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2c94e7c02287aba24288363c7e892ef83bc6da1d9ee982e15d976b96f8b457af
MD5 80cc7896e4c0b0988a5332ee0858f3ff
SHA1 f8e69d08b59c3befe04d5434d8a0cde38c5f92ac
SHA512 ea990e7edfd909ac87a85bd483060d948cb05899216e4a50ac4066c8546a2b02f2beb0554075e242faf0b148ba57d7a66796ae825e65a6e0e91cecebabfa6e89
SSDEEP 12288:4eBNUbTVO86UBGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:4JIUYXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T18185C03BEE28ECE2C27E8D7956918640D77278304F61A3CBD175820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b593fa120bce65e2732c7db0461376e69c950dfa45eef4049ae7789615025cf1
MD5 56cb995ee7ca57437eb61fc8f3dd1124
SHA1 dc8d1886bbd556b675a7ecb09ea6c4ee4d807278
SHA512 820195faec86fc30f91842c54cf322ffd19af458773c88190c8af78c42ae41605eff1f1993ce07d4074d1e2bfd309a8dee6a3d7d2f725e2af2481307b3d733eb
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THW:aQvGAdlCEL8c/pRNw5CttZ+xTA
TLSH
T19F267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0754bb3dafbd75403addef964a2abce3dedc6615b9e6321ff34eab810926735a
MD5 0afd9a64f8f30325a84a9632b90c3c93
SHA1 77501ed1171755d1efec7dd1ae9da9c18d9c8467
SHA512 cf970a7dc5587e04557dc44e60e3f1ffa1380b73dfa1d6cca701e4bccc22ebf1e1229999fbfd2293b2511954627b912682c607f69b9cc1bdfdf19a92ac756b5c
SSDEEP 12288:VAwSfxL/2Dc3aDLLmt0LDQewsAjTGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85k:2LewsAjSXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T10795E031FA74D436C37F0DB61B26C716547DBD204B611AC3E3E89A8E59342D2237AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 37f5180571e6f143702b4cffe3c19776d7199f47445f92b9588763d7e5d645d3
MD5 6c0e36e2d042e8a5274c9f24442344fe
SHA1 2d18c1f3fdcf96fd8a924e3ac211586f081edd5e
SHA512 c1c60b3e48fe96e558d5c2aef2bb8f6dbaacbbe6d648e9a3bc45945d0ef872b90597c26af0aced2cd7ec501986d7d31f7288735a4ad743f9f455e6f61de5ea0f
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHatZ+x:SUEtQevvqc2W1cpV29I32W
TLSH
T1E7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 63c8d2023d6b8e145303a99e781298102459df9a8fda72c4f6a88f0311752561
MD5 c1fd94f1a9451c67b2672eeab383c0dc
SHA1 0beb054192021849d673db112e069989a963f033
SHA512 e52ef9e657f336799c1f7020d8b153fccc33ac70834e8467d2d369cb3bbbeaf8a1f3de06554ed69f9dff78cc6c553b153afc5de407337506fead7a4251422603
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zysQtZyFxTA:BoquVjnmhtZ+xTA
TLSH
T191D58D1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f7c1fe822ee806bc0ac1aab05b864c3f6f60920213947d5eb48c5ace19ce574
MD5 37c043623e83f2217991c7a8b57218ee
SHA1 608ad4303a16e4488e99dcdb4d28c04d9d85a716
SHA512 1aadf9618277d9d64ecb532261909d9cc670299b9fbdcec64814ad73c4628347f67a0334a6b71a3e2231dd9c43268021a3d8efdaf223f97c1d7b8c68638e08a9
SSDEEP 24576:kAhGLmIFoiwtA5l7S53jXGUaQaoZ1oXFTyMxV6SAIH:kAM1Foiq5TsQtZyFxTA
TLSH
T1E435AD81E7F945D4F5B3AAB899B69171EA76BCA65E31C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3517dafc241b58f9fa2bf05d096d0223457f28a1a474eea5b9deade821be6874
MD5 86fce6fcec74352169b27f08a6e106c6
SHA1 d7662b7f55dd1ca40148c9cf447f17334ef127f1
SHA512 7a557c7e0b226e4616256e2098b2b721a1027169b624f841a9a663a4e33226885a2ae7ea7a9e4162c1e76e9190bb2146f07452c30df6176f2d606dc50880a94b
SSDEEP 12288:zmw5HEjsChN/BFgl0WDm+CmGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIC:SwuSOWeXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1EB85F10673A50CF9EA679539C5978036F7B2BC112A21DB1F07A0C65B5F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 23f2aef585e6910ce45ee29895beda1c8caf065157a4e0ec87a9ae74fcf7bfab
MD5 e53409fcf2d57fc5ecee4b0d036f670b
SHA1 e1fc658f647d848feee0660445104727b8d6e67c
SHA512 5a8b5bc7d14ea56ca07b3fe9ee82b5f9ca99e3597e4aa2029fcfe36eecf846c15aab92640a094c4e9ce8bb8a5fa70e4e45202f1798e68e886b9aa669066adb1b
SSDEEP 12288:RdZ1IyDGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:bZu1XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T11475121623A460FAE2A7923DC5E90145E3727C62277283CF0AA1525A5F37FE25D3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6774f69d4564fbc82ffc23969e07752c2f806c15e608b9fd7c723340f0e611ae
MD5 738a5d6bf453ee3a2b3638f099f3e3dd
SHA1 36ddf566ff124e9d311c3313ab29c15613852255
SHA512 24f86704280dd5548d44573fb8346b07d15d30603ed8d593e04bacf6625eb9fc7655b151222736aeae1427e0e68bf14c0ec9e61d5e2edc3e0d155deffe195829
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ua:mQRQyi36YOcPuLvw2gAf+PN3otZ+xTA
TLSH
T150667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 db452221f1a27c7e0e32ef5b375450aec5914dd35ace474efbd68e76efee9eba
MD5 20b5a013665a9dd644a6458418c05071
SHA1 17fdf054c13fd6a6ff93e583093bf6e6dc4d4027
SHA512 6e6366d4816f7f4b0f83371b3ef05a6a217563d69a69d3240a85ac4f6ba4e30a7fccbfa0d1bac240e493b7c790f5aeff469843df33398df132a84f7ece7f5793
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ua:bQRQyi36YOcPuLvw2gAf+PN3otZ+xTA
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 101d67f28eba7582d2c4d2e07619bd4e7e89afa41b6c0855ee5aae752236ecc2
MD5 025c48af2220f0e7b23444feb31c6da3
SHA1 892b51e13f30252b8bb0592a5977ac4a49fae154
SHA512 d20aace7f321f05551f4f771556aeda6600d87837547322b808d517eb6a1d69f6974d0615bf6ad4efcf516ffd795ad61785bd6ead9cfb0a80338f204f484dd0e
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0lXGUaQaoZ1oXFTn:I68Qg55nhxeWu7PNU3/CsQtZyFxTA
TLSH
T198B55933B2F600A9C44DE1769F4A872196D27C718FE1E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a5a30c328694c93ac13618360893bfc038773feea9a92a191e3885fb716dfbd
MD5 c11b63e9391872cdc4c0e3c63a616bbc
SHA1 32bbc27b17607002d262d408b55a221b33cebc6d
SHA512 1682f137bcc2556a963291e3420223f00d2da5513d8732a916f7f407252ce38562598da3e12358b46ec174dd1c7ff9950a9841f8d91da4b381511b6acc67160f
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:iy5112gYy5azzVvD69nLKnhZDtZ+xTA
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6a4f3eb660bbc7798b50dad179d5e0b6f6b7cf607594a7ee4859cfefebfee66e
MD5 d95cb716b4167c34285c16e47c2af53d
SHA1 834bb09639fda752207ea7e35d715035b07ec718
SHA512 14df29919d95c2bc85033bc5d12b14278b203f0b9da49d872bf2ba349a261c65405532980f2f5bd64fea92f8699f3299352c8d8c3d91baab3a6ee0726cb72f5a
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMsQtZyFxTA:nu6JmQxd2dwtZ+xTA
TLSH
T1A6D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 32f5e03fd8f74dacc362ffb269fc99e7f1c43865ec40d716881df9d1da80487a
MD5 aa283ae2238f35fe71d2578ff4a73e03
SHA1 32c7997b076ea86396a9f0f44dcd6e631be28094
SHA512 8bfc1280ebef9767dfc6291d80aeadcede5f44c9862aac95a8adc86acd619a1d5013b6a3c8b38e6f600f07eda004fce2aa5ba0322b3fb3924e8173492b908cad
SSDEEP 49152:Q1hpsNoJpF1A6yU44CwH7R4x4sQtZyFxTA:QmifPVRhtZ+xTA
TLSH
T134B5AE13F29900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d9018f8186613cf767e80e009ede45ccc506ff5c2e7c7b80db91ff47d8fecc93
MD5 c79dfb3a604b7cf02f947c2b9e62cb48
SHA1 e61a1523aeebb70d36a033fc582dad762a50be1b
SHA512 b0694efece73225c553c379122ad1894a1e30693a57ec76589cef7f5dcd8266247f167b1b6b7bb76f66242a70a68cee254f4ab8876f4c029142e238e77179296
SSDEEP 49152:QSuZQIY0Be2KIRVtOnks6NMHq1sQtZyFxTA:K5dKOi61ftZ+xTA
TLSH
T1CDC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ed864b4586f1c7bb4b200a960715e3b8684716dace91b43c50cbf17f8dbaba0a
MD5 d5d36c542d9789f9a48b5b904247b73c
SHA1 846a456245a17750661ab976ca6a917887efa217
SHA512 ed91df7c2af49be5edc0d5624d15ee075ffb357c0af5065aa83095ae6105e6fb44b12e646c5ece3d86c395539c48292eac1c0a637d61612ffe947f7e0dc9e0b5
SSDEEP 49152:3htSn8EApI0figGgiDn0AP5wcsQtZyFxTA:mX2i/phFtZ+xTA
TLSH
T1BF95BE13F2D900E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 bb490a05ff26c81e92e40faf2256e198a2e6adce10096a63c36744c3ebf0a725
MD5 3aa0bcab769f366ffadf7a1e5e208f08
SHA1 6f6d6a0e0678ee0b67291780e201ffaacc6e03d1
SHA512 f4bcf7112fe5626713f6cf852edaf3f3bee8ff3690f2e247764c550a694bff86cd8b63022f1c0d132d58da38fdc43656f6e8a7ae5d096acc92b54ce7e49dfa6a
SSDEEP 12288:QgGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:Q5XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T147752323825A88EBF3179575D29D10C9E075AD613472D7E30EA3B0069B3DBB561FF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 fcfaa998d380124f5569d076221b9cd337275bf57671f76fc0a9be4a2b3060a1
MD5 466f98ad632cbb6e9d215f20edca477a
SHA1 124835d34c62419d05f5a6ddeea652633704d098
SHA512 73be7650111c3ef6d97071e66f860c926d430db84c006a9745ce7850b984b1343b10e1d113c7522d6a1165acc87eb60f9190a1d57dd926e52dff28fd514f01cd
SSDEEP 12288:QXGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:QWXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T13C752323925A88EBF3179575D29D10C9D075AD223872D7E30EA3B0079B3CBB561BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2371a9a05c0f386a999dc9234b3bf361cc77d51e3834ab265f28ee77ff839bdf
MD5 e30df9c88890ea5b7173b03deb660fa2
SHA1 d018b99798392f8694a20259589086fdf9f73520
SHA512 fd12cf2c8c9bf3dc994da19de9ddbd19e69e8b20c37f3142455e03b6ef4535c4852c2f52e2d25d7f7af3860762a25869fc5ad9399cec01a0e4d6f45e03fc7c7f
SSDEEP 12288:E5GvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:EgXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T135752323825A88EBF3179575D29D10C9D075AD523872E7E30DE3B0069B3DBB5A1BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d243825cbc5b6c86d83e6bd340b0468dc1659f645b38df4e55b8ee2771f33089
MD5 1781b40a2ff44ad3ad7ada1cf17a08c6
SHA1 914707ca57fd37aebaf51565dc1a66d678fbeebc
SHA512 48a8945b8cf303bab0ee2d6d12f704144fb0134bb859b5f0d234e71f96c4e2796d03d7e738a2e0cc0557196979f9b6e0b7188bd077510f6dd39b10c152fc9f35
SSDEEP 12288:uVCGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:SXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T14F752323535A44EBF667D635C1AA1085E0B1BC617632D7EF4E92600B4F39BF0A1BED60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b5186bda5ae6677b2bccc6bb2787d3aa4822449b15bf3b34b4058a89f3ff5144
MD5 4be12ceebd208e3a6222e7bc9381ae66
SHA1 290ee68a90f5c0aa8040ab1fb60c2d523ea48de4
SHA512 b0336bf54d759f79f3477b066b652a9a5e9dc02d7b6b8a29dc3138323b0702f80a50d5209242d188c361f50501c21d128548d91b37c57e271832b73e89c8d173
SSDEEP 12288:yKGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:y7XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1D2752323925A88EBF3179575D29D10C9E075AD623872D7E30DE3B0069B3CBB161BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c79663a4b2edd84387530d1fee4705d8211860fdc7d98b62c310cf3e98686f8d
MD5 695715e833b259f697f5e482252f0e46
SHA1 9ff174552c7c9b0efb691df3445eb0df320d0ce4
SHA512 d764e985d0d707db0170a7256878f18109bc2fd64fa264e0e437d2d979286de531b29ed25690f29c0f4796426d7b6b8ce9f01e9dc6715c38cc0165fe9406619a
SSDEEP 12288:CLGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:C6XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T154752323925A88EBF3179575D29D10C9D075AD623872D7E30DA3B0069B3CBB561FF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 7a8242d5b9a9c180a3597f84c4dfcc65294fe3a5700d339178b8023cc03797c2
MD5 6224956659ddd75d3c9da50fc5eb5ded
SHA1 f7534fc9cfc0e3d26f5ceaab980768bc4dc20fb2
SHA512 272fe9e7f76c2fbf4b00b78e8b382f9b0b62df866f613595a2fb52372e02d725318ac4804f3856f3302308f0baab0ffb7d5939aca42fdff8085e1a38750ab617
SSDEEP 12288:T/GvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:TOXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1A3752323925688EBF3179575D29D10D9D075AD623872D7E30EA3B0079B3CBB1A1BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bf26a75c1cb7eb5b0bde03b6f260b710a13776cad711018b1cea82ae7f909aea
MD5 aedd5de7991c87a982311009f27317d0
SHA1 00959f095582efb2eeecc8092a740cfe45019eed
SHA512 921852fba447780f921defcbd09e653ae04ab44f14765b8ea855f39a618cc56e29063b276c6f3bdff08e1d2c0120f92f0d0dc39260c2ab7c4334da4e024ddd0e
SSDEEP 24576:BZMWzFVSO2XGUaQaoZ1oXFTyMxV6SAIH:BZMWzfKsQtZyFxTA
TLSH
T196850165B3900CF9ED67813EC9654846D2B2BC2A1A70C65F07F4322B5F373A1193EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 d7761d7eaf140b868db1729a45047ab5edcedcf3f9a39a100058fec41b5a3a0e
MD5 dfe6e476f9ddbc9c4398f62bf572ce30
SHA1 024670fa9b5cc02299533b23772a3d4bbc1726f8
SHA512 2d2586ce52acb3a54ad9c052a3939c2d229c1cc1ffff5f86f0a2bc1a83bbce8fef9239e7e6df3c11df33b854fd9c8ab979b8b05e21ff11b6c885d33da3086406
SSDEEP 12288:gMGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:gFXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T154752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3CBB561BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 08be360da5c18c6bafaf51ca624e17eb6192ef6aa1e88ebd0628c5c2fd0f167d
MD5 8bbf617f1534e9df5b61f8aa41570ddf
SHA1 bf0004145f759a4bc6cabd77916e8039ae79272f
SHA512 5cc5ca02e3a4d165b69bc276ba9dec04a4a2250fbf8cac9c631174ef6e346b85d5e0da607789e8f333db499d5bd141a331e70c33a8751dc977de74287960bb3b
SSDEEP 12288:lYGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:lBXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T180752323925688EBF3179575D29D10C9D075AE623872E7E30DA3B0069B3CBB561FF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c6afe1685350c816fc2bda12cc277e5a1b37954e56e8ed2864595a8990de56cb
MD5 8286ed335479b7f817f5216dcb5f237d
SHA1 f01d36fc0a3a85002f0924bfcacafb9175f51f04
SHA512 70b6cf21ec9c2c168f439676900f9bd15dd5e08a6cf65eee7b79d4ac56dceb45f4e7706d6b8f49d4f9c3fda6c5bdb6896fd74ea71a65fae89afa5e702578ef9c
SSDEEP 12288:OyPz5L8DGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:TzyiXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T14A75021363A520F9E2279239C5A61542F372BC321730DBEF07A052665F377A19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 cfa1ac1856c69fdafaeed39fc1ae310b7c4d650eb5a42a6e4ebbc6b57d6ad0d6
MD5 c969fabe381c1e0995ed86381fbdcc12
SHA1 24ceea854b16a910822c579d7e579c94a920928b
SHA512 84eebbf2ba3b1b60c2cd522b5f8ec2c2dfe5a940305b38db0e990de445de7ba05cbb05ce11ff324706b073f2f05f759bc621873a3a3a7d34267badaf21d62a2e
SSDEEP 12288:UMGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:UFXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T168752323925A88EBF3179575D29D10C9D075AD623872E7E30DA3B0069B3CBB191BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 eaf6ccc011d6a32c86fae088912913d98ac152e77bcf70b62e45af04629b5a7a
MD5 83761b4f33546c1ca67e2a6ff80d3517
SHA1 f580df248b9c5d60d0b4e28c8f6bd6256b3c8511
SHA512 00814e2d242f7206ae47b643dbf8a46f940daacca9fa340b43d987e9f5e3362d037d853899c98e42dc45b8fc38d22b744084a3f3bec2bb2dc0ffc0a184ec88c2
SSDEEP 12288:cMGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:cFXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T199752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3DBB191BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 815ad72fb13dcde3115f457fa94334d3c397bfe3b8ebc210b822e04c033717a1
MD5 2e0e31d3a23c053b695cce93422d54f9
SHA1 256ec5ad406e7c1e64263d94982fc8418b825cbb
SHA512 e3795ca4c246824a34eae62e9bd2378d426e6836294579afb73cb6dce13b3c430a68f896f5a42b4db2fc557b19a647fac7240e347f334c01208a68ed9c02f329
SSDEEP 12288:NyPz5L8DGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:kzyiXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1BA75021363A520F9E2279239C5A61542F372BC321730DBEF07A052665F376A09E7FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9821100b920f4c5a53e29fb908eae11cb0190f286b4aff7e9f5f935c814857cc
MD5 ad8c58ac688783fc1d622b530d3dde6d
SHA1 e01e7c6aa4e4f3249979f149a17c267dad93e70e
SHA512 deba3a405de25f9c05373282d334bdfb9b4896ed250d1b6259a32f68fd245a0460f4e9d637f598757da3c44d7fa1b18575c834c2c2f5bd993de633655060765c
SSDEEP 24576:0TTaLl3z0zDQXGUaQaoZ1oXFTyMxV6SAIH:0TeLljHsQtZyFxTA
TLSH
T143850165B39008F9ED67813EC9664846D2B2BC2A0B70C65F07E4365B5F373A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 35fb4357f5eb48d0ad648012dc32b281a0b76a7530067243284096491064576b
MD5 d4a0e05a2b358ea3db0eeb03a3fd9768
SHA1 ff9e5484a759277909b00f090400d8afb33a4756
SHA512 cbb1f8ef73c182cecb0c972e6b9704af697d1dc4c45872f998770cdc7d846b09c9973ef0d592ec0cf77dcb9aa5ff23bf6f7a68a1a5b04f5a08cdfd0ac9e5c947
SSDEEP 24576:K3/d9CHKy7GZkXGUaQaoZ1oXFTyMxV6SAIH:s/d9CHKyaKsQtZyFxTA
TLSH
T16F95CF90F3E414E8F1B79A35C9764511DAB67C5A1B31DA8F03A4261A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 31b4d84b27041892c2d3f484b7d78f52439f20642bf2441aecc525dd14969fa2
MD5 e020ab8c7fb1c9d2c182cb6f088cc66e
SHA1 cd462a946dd5f3d34837cd0379c7a8948cd524e2
SHA512 1d9583309b65885e749391e65e76a26e0f002abe3bf48485bee153273a8a7e92db8017350d4dd6aa55d016a038cc8f7b867a513e71cdbb437d22a2cc566533bf
SSDEEP 12288:1ZGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:1AXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1A8752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3DBB161BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 34a110e896fdc3bf05c27a59f4dfddc3954a6e5bdc676616b9333175f2c896f8
MD5 604f4f81028e0b92e520e626fa3a6d04
SHA1 070c20f63a656785b623b546a08553460bff7cd6
SHA512 2183dae7497386191b9a575d5b14a90c235f3df161494af9777f32a179c076c7dd0a14785abd366f6e7b0c2a0cdf220cf28984588aab05ee8116f5dcd708d7af
SSDEEP 12288:JjGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:JCXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T149752323925688EBF31B9575D29D10C5E075AD623872D7E30EE3B0069B3DBB191BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 4595d16cc6aec78fc0b477fa7ce7bb3015d19bb570f16b7da658c4baeb9de634
MD5 a2eafe7ccaef74d8bc3c87fa9b5aaa53
SHA1 0b4b91dfd2da04b2e1c2ae596f97d9e888b9903d
SHA512 23a76cd543acfff99e404ab8d52ad1d129b9a2b3be6df05990b1b3b75a02ede6e14ca8721b368a8e0c2186184ad9ab6834ed39b3aa13bb0067a10eb0fd191cb4
SSDEEP 12288:LuGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:LfXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T112752323925A88EBF3179575D29D10C9D075AD6234B2E7E30DE3B0069B3CBB561BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 746db29dce4e953e7c9fa60b39c421534e9274ad950dae658842215995b6f02c
MD5 02cb66856adce60222a94c735cf11f4f
SHA1 809dc88898dd2f8409d7bef71d5c72935a3421bb
SHA512 514f58d595a5c97a6691f254afd51cc866e0aaadac8e5bfa48f4bde52dcb96de246a4ac85243282af9930cc96aa9d7c670b4ff844deec95c9a130b6185ce0cd9
SSDEEP 12288:iMGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:iFXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1F2752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3CBB591BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 e60f8c0c66b89173472b671f4407b666c5c29739820c6f925aa4c67a10c37ff9
MD5 90925db12df08b928f1ef320fb5028fe
SHA1 4b5127c379ade0837a8247496874e3038b008fbd
SHA512 66a8151b439472987d539e701b27a5a4611edac712fc37f226efc49a4753b9e119ccc6f3754eb53e904a584e78b503b2c7f936253e23956ce05d1cb9be0ad37e
SSDEEP 12288:4ZGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:4AXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1FA752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3DBB161BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 4888594e56ceee749270b8340c999bbf99757c4e47de9e58ef560e8a636f0a7b
MD5 0c1ad53030d19b1a9d0a70710724f9c4
SHA1 659bbdb93fcc296915611ab074094dea0d628d01
SHA512 437572804dffb0157d6610958c598daf17630e2245c27723dc2663ca06b8b1ea116b957b1205536d3766be73d8770381ffaa0ce3c2d9e4627b53eeae4bb95438
SSDEEP 12288:Z0GvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:Z9XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1D4752323925688EBF3179575D29D10C5D075AE6234B2E7E30EA3B0079B3CBB591BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 ba496c939b2d2c68958358d98d7342920daa195c816f5930e18f063bff75a47c
MD5 a7500d23f09a4edc13a374a1ba15f16c
SHA1 9f93eedfda37a6d2758f74e7ff518a84af53d904
SHA512 073c09125dae87b4ae3b18687233b5c908919b045c542af10076c894e82bfda8cef7774f02b6d8f3f8586ef9ad2648822ed9ed54fb578ef052b040f8d9596bc9
SSDEEP 12288:6KGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:67XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T14D752323925A88EBF3179575D29D10C9D075AD623872E7E30DE3B0069B3DBB151BF860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 dc8755a6b197478b6e96572a5951d570f92a62e7c189d68f1e027e8632acefd7
MD5 3f2376723a3688d9721fe0ff53aa5b99
SHA1 aa9dd22f6f1256053a2bbe6812d3439d38d42e0b
SHA512 c2163601d61a1963a05336630984f05f8dee5166e24019f4d27726073eb60bfa3b4300d4c5dfb7ae60c9ae563152178a6fb7be6550e363888ecb6888ac829d9f
SSDEEP 24576:9fwvrk9RX6wkyAIRXGUaQaoZ1oXFTyMxV6SAIH:YMnYIRsQtZyFxTA
TLSH
T1B395CF29EBD844E5E177913C99B7460AF2B17C691B31C2CF029A536E0E37EE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 77976cca77889c72be7a4242c31cfec8772eaf534f010434a57efdc0b1f36970
MD5 7afb744ccd064bfd4992fabb9f69a41b
SHA1 f29b79bd7c997194a431f0e150f6ef1ec128ffe7
SHA512 3edaf9f1efcefe4ff7a2b942ff801f50945ed1546f3f7da55816182db3bb44cb4ed1eb28fa2d507d3c8d2906d2faa300952dd4c3cd71ecc7d86f5a0ef50dedc9
SSDEEP 49152:tYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08sQtZyFxTA:jySzPItZ+xTA
TLSH
T166067C57A16801D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 03080bf261db6c78d95d51099711103a977cea957905a40817e90e247f16568f
MD5 34f2c453e39392a5cda5313c54fd5a9d
SHA1 7dfbe3b6393c9d316cd0024c5fb198f7ef0182ff
SHA512 d0d1896e271a0b7d816d52298615b488c0b0c25eecf84d9048dbffa3d4022350c20638e6c959f464ec6e990f34eb81a207716d4d0ff70699a023fbc8cc20997a
SSDEEP 24576:d47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYGXGUaQaoZ1oXFTyMxV6SAIH:d47JUQjairIhCnDHUPfF/MsQtZyFxTA
TLSH
T17A65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a89077ac8237d2afac32a36cf7bd4aa9c90b3a39d58fe2367afb8718cf53edc1
MD5 78e40abdc9e351264026069fc908afda
SHA1 0d1f896ee3f702c7481db43ea3c7a4421f01cd38
SHA512 47e4c128079919fa14801e45abd2721d2b897d47a1690b0cac55a12d4e8840e6169f38a662a9dea952b0559b7add89e45d45770d45c141e206b09682e35831ba
SSDEEP 12288:ebsfcGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:J1XGUaQaoZ1oXFTyMxV6SAIH
TLSH
T16275F01AD29841E9D16FA279C35A0581F3337C2157E1D3CB16D0F53E1F3AAA09DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 976KB
SHA256 0b8ef3d54d7bd51288c56191b7048ccace3242dd175b17c835d0d1734d1cede0
MD5 4b84d3e5bda0aa9df66bb32c5a892725
SHA1 680ed2249ecf7954efbf3ccb5b9285c865120b86
SHA512 d18115cb4aa3c6b6078de549ba5526bb60cf71098c955102ca4bf34e7425b25fa07cedc48ae57bf3228209a2bb0b2b747a77a468d724c23ebc93bbb74f289fbf
SSDEEP 6144:0qsBC2naYvqYEFaLhRZotMx5xnvU3fpkG7TAXVQHeDtfIOT46Kqof+T/aFPr9HYC:0v9z9U3flehFyVfkaxr9qTnOy9Ly5
TLSH
T16D252810766BD75FC6A940322E73C2CDA7707D42EE059B0372C8472FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5e4678208c47437cb808d4a574bb0206be43fb52b5b3c2fe5309c11e440b567f
MD5 86d4a572990e404c776040966d1e99fe
SHA1 de57aedb2a2e7ab778894aef7f1c5ce1d239026d
SHA512 cc107f96b72889f633190506691190e5c219dbcdcb11c4186a2982da7a650161b7964afa37318c563ce02edc527dfabb8401d33253b707ccd8145aba007e18e5
SSDEEP 12288:87iULU8Xls2iXbJuL8uqXu9buspz2xY7QgRF3unluKu5uzhrJ:8mU9VhKFm83Xob1pz2xY7QQF3GlfIeht
TLSH
T1AA55C6816137A3CFD1FB3131176A5B4DA764EC07B7095F266388093AD86BB25B0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 4789c1aa788532179de8bb69f984846135f4fd50eb366e25bcdcc9d02398bcef
MD5 8b13b5ecdce0084eaa87c56698b8f14f
SHA1 01bf047b5a170e2236322165fa9bb8cc59ad0f8e
SHA512 43d92ad7ef65ac278d639f0dd9c93e4e1015385edbe38d401bd1f8b8b7f5e08406227e81ef83d6e5c5ef68b704c351f74a7edfb04d6a67acd97ac710bb9cc148
SSDEEP 12288:cO7EGvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:3tXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1F5752323C35A8CABF67B9570D19E1065E03ABD202B71D2D35D92B1469A38FF195FF820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1569d386dc3c81fd2aac2114b7d8e316d9f86e1ae4f4bcd8889c6b61f823a2d4
MD5 e34e49ad667fc29fe3425b9d9418ae4a
SHA1 24447e14174dbe342549beb975be3e048daa31ef
SHA512 4077e91a31d97ca7f519af0696b095842f15903c03793ac1590cc739a611b63b42591d80e00c6699d371206caa58d6300f3854d89a1e239b6871ae44f6382cad
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYHXGUaQaoZ1oXFTyMxV6SAIH:Pgb4mBIBhGFGsQtZyFxTA
TLSH
T1CB65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 4e1381c7929361a7a80a097bd8f551cb88ecb20c6236b36eb08e4485cb9ac39a
MD5 600e2eba900389c4a12a50a287600caf
SHA1 f492ef28b3093f76b884638473f7dd91214db02a
SHA512 8115bbc578c5cd39354132904af8a2a6b11a93de2a904a4e12c79343b590be1090762699678e56b2f5effe932dc54241c4577b8021d80a17e1a24ed8d6e2d943
SSDEEP 24576:NG88u8FpJqH1izria7/m2XGUaQaoZ1oXFTyMxV6SAIH:A7ZFPqV9a7//sQtZyFxTA
TLSH
T167A5F12567E101F1D47BD13889864663F6B2B8211370EBDF0AA88A551F33BE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4f42ecccd2e337a5f8cdae6fe13de466f29916d64e4e4f27b8f37a4a7a6a3d22
MD5 ca5d93e316e5f7f158c4a6bbce84edcb
SHA1 863b86dd849b194746108047262a71aa41b2d374
SHA512 106e543189a299fe47b2faaf23abf8d7fd0885a2a81b1f9c4f291e55142ea95d40a67b6f1c0ad908e66a66344a984ab92de86335334abd24d42b545930a9bd83
SSDEEP 12288:OHvUrBFrEjwaQ7GvvybbutaQaoeOf+q1oXgytC2tTyMxVDe85lLhaIUI54evM:OPUr+NQKXGUaQaoZ1oXFTyMxV6SAIH
TLSH
T1CE85E12F62A918E5E677E17D85864609F271BC621711D2CF02E1817E4F37EE8BD3EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cce1fd62994c343f6913b14d853fe6f65524761f006f496310ae037fa98df3a4
MD5 d0c1d5b3b80575d0309adeebc6554534
SHA1 6bbb48497bbc96b43d467e88796e7b37168f4d2e
SHA512 b479131c748ae36bd925bcb11c6b70c8bcb62cdd58dfbe30d4d3b60441dc880b99fb49287f4e65c2a73c591c27feb8e9cd29518ce4dc971b2896a489b9913a87
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6sQtZyFxTA:MG05lO43bbtZ+xTA
TLSH
T13CD5C06A62EC01F9D1BBD17CDAC6460BEBB23825033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a2570edba5f07396c6e13687aed4d823ab0664a27b8f6d317a0036e4e79c2e2f
MD5 b9f0257503817d173384c3ca4d7fc2c7
SHA1 5010ac2150641b3588c4610ddbc34203a3101b29
SHA512 73fa710e39129794e981e9f0e6f61dcfe528558260188781a5445d460bf2cdde3c3674dadc0479b015572aadea459fcb2e48055be58e2d1663c6641f2f5f833a
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn8XGUaQaoZ1oXFTyMxV6SAIH:+a5POZ3hJt2pasx2+mCsQtZyFxTA
TLSH
T1AC65AF5EA6FC00D5D57AD17DC583461AF5B1382553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a13f42c8c67c729ffbb15e41ce04a607ec55875b0f59df56d02f28ce6d2ef8c1
MD5 a902a13f622b6ad81d0f65e689f7b09b
SHA1 8331c172f7929a1cfb22204c45ceb5e2ba73eb8a
SHA512 fe52ed1344f93aa1786693e1b4463c0fba653c0a78fb5ac2a6f61ac0a8ac2a32ad0ba3602c566ad31fe4f6fd894ec4c79576e02f27b243192f0b2a4cff455ed8
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fk+XGUaQaoZ1oXFTyMxV6SAIH:ENc/zEOVHFfsQtZyFxTA
TLSH
T15B857B2623E901E4F5BBE1BE897B9546FA71786517308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72d0da2c5aef43c4ce8400d5da8b168d42039ee0935e99b00863b4fc41d18439
MD5 ed40f271a517ad7ad69439a4adb53704
SHA1 d808a9ac01bfb920a7c2fda2057225df9c56c3bc
SHA512 40048b4ae80a11b6de6cdf4e030a8b7127f9a4a7dfc97254cf3c3c77ea7c9a2b9fe2c826c49bbb1db661103e709c83a78b962ece14ca6780666838d388523176
SSDEEP 24576:C3kNvNnaFeYhJNtmZBmoXGUaQaoZ1oXFTyMxV6SAIH:C3MwBtOmosQtZyFxTA
TLSH
T11355AF2EB6B845E4E1FEC6B5CD238512E6727861173293CB4290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 0b66b447a78dcfbb60979b59e9c771a3568707df1517dd0fe36b28e77b10bb34
MD5 77a5bf78c7c4aa51bf800a51639a1cfe
SHA1 e4058bacafb07bebb2f4b2c9d3e35644d57e3af0
SHA512 ef6d7b0b7c2509e8d22793dce6bcc55f99d9f0d653ee272126fd5a59f57aee937d4fe0ab56c1135c92d8edda8279f46d5a8e46913e816364feb9bf01ad3fc2fb
SSDEEP 24576:qD3FHshBIYQgAZXGUaQaoZ1oXFTyMxV6SAIH:qDVHeBIAAZsQtZyFxTA
TLSH
T13495E03EE69C04E5E57BD1BCD6634506E2713CA9033266DB06D081BA5F2BEE4693EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/356-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/356-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/356-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/356-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/356-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/944-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/944-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/944-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/944-52-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/944-38-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1820-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1820-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1820-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1820-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2324-67-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2324-272-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2324-73-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2324-65-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2360-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2360-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-321-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2360-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2360-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2400-77-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/2400-8-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2400-6-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2400-1-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2400-0-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/2608-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2608-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2608-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2608-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2608-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3276-61-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3276-232-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/3276-54-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/3276-55-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4484-78-0x0000000000400000-0x0000000000583000-memory.dmp

Download

memory/4484-288-0x0000000000400000-0x0000000000583000-memory.dmp

Download

memory/4572-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4572-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4572-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4572-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4764-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4764-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4764-95-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4764-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4764-306-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4764-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5856-390-0x00000128708D0000-0x0000012870A53000-memory.dmp

Download

memory/5856-320-0x00000128708D0000-0x0000012870A53000-memory.dmp

Download

memory/5980-108-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/5980-305-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/5980-115-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5980-109-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download