3d708966547b10bbfa6d0a443761a1008d6bbb31ddc457ad5f2f7d8d49a74817

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260809-agsp7swhme
SHA256 3d708966547b10bbfa6d0a443761a1008d6bbb31ddc457ad5f2f7d8d49a74817
MD5 92b21e1a9d8ade4a34861896491bb0ca
SHA1 82e078ad511272355e4e26da80a72611a1faeeb6
SHA512 aca98b7171115668ff097a5a46dd9bb17fb2583a651898ce8a9c7407613fe99eadedbc99e7108c464756cd611a8661526973ae2c652689c88a27143e46ce9df4
SSDEEP 24576:IYJ9b4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IYJt4LNiXicJFFRGNzj3
TLSH
T13465026171C084B2EAB7043509B89670AA7CFD354F2549EBA3943B6E9A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4124	elevation_service.exe
4536	elevation_service.exe
1016	maintenanceservice.exe
4768	OSE.EXE
5432	PerceptionSimulationService.exe
2360	perfhost.exe
4472	ReFsDedupSvc.exe
124	SensorDataService.exe
1376	ssh-agent.exe
1648	AgentService.exe
5924	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1a3dde4b8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fe777a89327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0d3d4a89327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001713fae99327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2af15a99327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6ac0fab9327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7f27ca89327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1648	AgentService.exe
Token: 33	5924	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5924	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5924	SearchIndexer.exe
Token: SeDebugPrivilege	4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4196	2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4124	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 5696	5924	SearchIndexer.exe	100
PID 5924 wrote to memory of 916	5924	SearchIndexer.exe	101
PID 5924 wrote to memory of 4892	5924	SearchIndexer.exe	102
PID 5924 wrote to memory of 4504	5924	SearchIndexer.exe	103
PID 5924 wrote to memory of 2692	5924	SearchIndexer.exe	105
PID 5924 wrote to memory of 5900	5924	SearchIndexer.exe	106
PID 5924 wrote to memory of 1432	5924	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_92b21e1a9d8ade4a34861896491bb0ca_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cb6774d5fc9f36913e22f1a95a4ca76ca833b6f856372e7275d315b242658165
MD5 490cfd80606ec242dfcc2ec50d38d649
SHA1 651a4a6ecc5cd8b3d5f48660e311fd6df1256eaf
SHA512 9298027318b2037ba3a8e7f41b39ca7ee331ade2e739e2369a019af9f5bbee0cd2e1a4a4936f86daf0dfb15bdf0bacdbd39b5bc1dafb3ab2cad22651bef3b4ad
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrLNiXicJFFRGNzj3:43q6mjB47wRGpj3
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7c36e95a546723c1ca27309a7b88ae4f89f3011e6a8bd12b5ea76de560f7b8f5
MD5 55c2562581f2cd9d5ec19920d040fb8e
SHA1 8ae787ca6e8c993d638f6697ccfdd9ea683c48a1
SHA512 9d35ba2902ee41058b20bfaa028b6edfe6846e3de89a472f02518e1ec8f0765624efa3a14433b840d039a0edb17fdbef1c9a2925b18af4f262e7bf16a11f9dbe
SSDEEP 24576:wXYfDtczAE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Htc9LNiXicJFFRGNzj3
TLSH
T15D75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 90826406702efa3109e42b8a1d73ceb5b4689085aa1d3cee3ed2716c032a2bfb
MD5 808061bc118b98d34248f6a82dd03bc2
SHA1 07da6b59676c8dd84a0fe5584885b33bb1ef93c6
SHA512 b6248ad0262716ae813473689744e5d3ba6a3e78eee62a5b98a0bef57bf640517a5b2975a7dbfd4659dc13f4764092aefd56f8f80c0ad982015aac4e8d3dea84
SSDEEP 24576:p0Le5ji0hmxhrMT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0Az6LNiXicJFFRGNzj3
TLSH
T1A4859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e57b6cae784dfae10c0342b833b1c971f76779652be15ba1a8b9676a765029e9
MD5 429ac875d183a1f19493ec29b3180f99
SHA1 59593b22d591a99d1bfbe395e847e493ddcaced7
SHA512 c75db94ca96560955b7fe13bf4b2b2eb9bec9546ffea1edbbf4a72606789fcf98bc17baa80261422298091bb0823b311db070ff326d48b805c51ca97511068c5
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWj6q8wyut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c/ezSC6vUzPv+HjymLNiXicJFFRGNzj3
TLSH
T1B9756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 87735dd91034972d7afb7b051d55c7f342727246156648796f523116767c191a
MD5 e4d942ae2456a09d1243db9e7559641c
SHA1 30c83318f0c7aa7a1bf09fcbc3b8943f516d2171
SHA512 47819cdeb0915b58099dfa1fa72a7ebb10de0d9b6b06b46d10aa2183f661f5037b3ec1d3f92f8662760c59ea3d3dccef6c5932c9340579bd2a2148644e84da32
SSDEEP 24576:pVbqPb88hv/l+Bo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pVO88hXl+aLNiXicJFFRGNzj3
TLSH
T1FA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 30c48a55cd8cb09587fdcec9dffd6d9a8c552ec8ce743c65f4f62be625ea88ec
MD5 7452cec01566f6907f99e84ffce24d48
SHA1 f93eb3bd2aca0fb24134a14b9a7fae6accb2876c
SHA512 6d80696e517060b405162e8ba7878de3a098970af331a07315e4779e1c3bd79645121a1611b315eeb0a3d86c64bf4198eb49a8f0d4fbdf74974f34f1a42e8d12
SSDEEP 24576:SGn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9LNiXicJFFRGNzj3
TLSH
T1BE5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8279a2f935028486cbe2192d78aa8a57cb2886b6eaa51bf9af20f799b1003c81
MD5 7b127eb1a218c49f1ccf32426f9cfc4a
SHA1 c2d41e756a728d7a86969247d659637097d725f0
SHA512 752c0807fa0aa7858668fb7c50ed44587addb3194b21ee594b47ab9824b7b1df0ab02d93362474b76cb0fc47e2959f9742debd9a979ffc0af5e1ed404c6f3e30
SSDEEP 24576:QJIUw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJIUwLNiXicJFFRGNzj3
TLSH
T14D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 119ddd740510d8989de18d87ffc8f1480264bbb1d66e9d44160b7ea3f1c0fc20
MD5 58b03e2a4d46c8f76886307a9c8dd45b
SHA1 002a48c2cecdde600e95d4ec8c765e4e57631a5c
SHA512 3b73f50a2445f5b22f421853574f0fbec557c90fa040a95fbe185b59828369c2b40878eba6f7affb74f3d4cba03b08b54af32640aac3619d5d5e0b4c7e8bfb48
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THe:7QvGAdlCEL8c/WRNw5Cd7wRGpj3
TLSH
T16A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2632fb2d0182edc728c017dfab0cf01fdddabd6c84dd1c952f2009ad15cb45ea
MD5 8ac521c94dc5939d2d630eca9c4c4f7c
SHA1 923c5693dad5f979197af4efbe2190cfc00046b6
SHA512 03eec4c8e0e3dcf4ff3fd1c0fe699dcfd5536605d1929a91126a5ba778712f94263d9372b01798a525f0a9dca17a215bd015b195ee4c158728e46c1690e7da5b
SSDEEP 24576:BfewsAjq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ljqLNiXicJFFRGNzj3
TLSH
T12F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5057a31c76012fb71fb0f6ca49f104dd23356d40af012e97d05b195e8feaac38
MD5 6cf908aee389211f4a183b81eea15a46
SHA1 0f1b2f811adbce3520155a1ee9a975c1b43f94ac
SHA512 2d60fd5f4d0c7e762cfdac97b26d83a35843e92c20413c7fe3e8fb1ad4be00a42b972fc92268a6392e0d0f1bac4e77b523e24243bdd66456a8ca82e5a78ad362
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHmF9:TUEtQevvqc2W1cpV20I32K9
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e7c317d5c132fb5b91ea4efa56d676e1badae98a9ee5f9c6ca816a1288ca4ca0
MD5 a83bb2e415abf31aa9a4104396ae6f66
SHA1 2dbc8bd55d422d78cd8ecfc31904dd6b06316a9f
SHA512 df857b1b4630a7d95e2afab232939c5ae5c5018ef4194c9665a70252116b47984dafb45a3d9e80937428a334e328015e993bff1e92d4a97f1d2e747571fd62f5
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zKLNiXicJFFRGNzj3:goq2VjnmZ7wRGpj3
TLSH
T194D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e69d88ef126d09e69e253ab9da1681746c1aa29b434c3b7c18d0d7feb0e1bde
MD5 5ea776d53add5a6b048ee11a47e162ab
SHA1 fd578e49bca69e9e305ed19cdda5c67735c305db
SHA512 0873dcbae7d73afde9f241b011e36d7f348d305c3ab301c9762aec91a335ad46e28eab655ce51185c44e4a8b67b7e48310d8c012b3076d61ba0553787137b07e
SSDEEP 24576:wAhGL6IFoiwtA5l7S535/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wAM5Foiq5JLNiXicJFFRGNzj3
TLSH
T18E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6a9f0b1f3b49415d2fe22b96ccefce350bbb6a5217e495abc78eca6f4a67c9d7
MD5 f706031b95a7fd1d3b102cad17b3824f
SHA1 b8beaa4d38a9d2062cc61858c8bae2ddc3b5e7fc
SHA512 2aa57e839b49b19e7c02a987508df544a4e8257140c24f173e54ee46eab7fe169a26fff90e4c13e611a0da9eefd5437937c0e9ebf8f26c18df04ba7bbd971182
SSDEEP 24576:2wuROWG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2wSOVLNiXicJFFRGNzj3
TLSH
T19B65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3ccf4799d57c144be9e43b9a99cf744c3d4043cd165d6b505ccd315be2e5e20b
MD5 d1c28b8342f68514317e5c9ab3fe2aab
SHA1 ce555d2b9e42374815c8c23c6738b07c79f5e38b
SHA512 75f450b77f4ebe35f7d5dd97f3d9dcf138b2b7be7c02a7cffaabc26b6604f8ea08d48d9477c16b7655f80e7dacecf7e0ccc87a0e7d0a6f86def1d8389eca6e90
SSDEEP 24576:WZub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T15E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3991ca6d61cc4fb491997b67d712e08584a262346aa1377b8e708a005a6b04eb
MD5 d12102e92848310965032512cee8e00b
SHA1 3aa5f84c92582e1cb15c2f6b44f75e1dcb9c6aec
SHA512 84986d2d7f296ac4a4196e5454e874d20611a59de447725d80c18ac789bcb5c98a3853b59d8cef18eba7ade70c65a2e379cde193fd82683775352eb16b24e6c2
SSDEEP 98304:5QRQyi36YOcPDLvw2gAf+PN3M7wRGpj3:wQyiKanX+PN4F9
TLSH
T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bebde8ba04117a2d1f4d46d6ab9210ba08bce4f0d0975f131bc5ef74fb8f82fd
MD5 b75fea2c90dc653ddba245a3ff01b35a
SHA1 013e1f44abd577f89d953883414676157548703a
SHA512 6f9c5609c8b4675721f085eed097dfb6d6c3e44ba860731c6ffc3ceb9d849f51ea9498f64560e9aa01eed20c66b4c1e506ec872df7a5bf43e9e4605f991a9c3e
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3M7wRGpj3:OQyiKanX+PN4F9
TLSH
T172667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5c9787b08e93f41ed708583e1d16e9b8acd5e024d5049555f86c58a747d0401d
MD5 b75362c1dd9ab163e1971988700d8f94
SHA1 fed3390f2a7b69df2f9075402577e07f030567e2
SHA512 8fe0b5bbd9e59bf8a03980746da61cef320e8c3de33e9bed9ebb67799bfda89f17e3ecb398c010b610d2ce2d05122809ff2712f6630efad818784c143050fdc4
SSDEEP 49152:I68Qg55nhkeWu7PNU3/6LNiXicJFFRGNzj3:SthTRc/67wRGpj3
TLSH
T176B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b04e1cc68ebe155fe44a9c196e8738df87daacc03575aa44231af2949c6e344
MD5 ec8f3ddbfb16d564fc8503c7b8675c91
SHA1 23cc22070ecc2507ad927eeb8210f31f4475d2bc
SHA512 c804988a61f2dea6c4940c93d78efd40975ee4aa568df4258c84847098ac3b1819d8d30e5126693c060ce0b6f0da1c1c261d850945bbbc0b0166dbfe823db315
SSDEEP 98304:Ty5112gYy5azzVvU69nLKnhZn7wRGpj3:uLIHRWh1F9
TLSH
T18F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3de17fede9877208a6cea68664eae08518bde90f233abd00ec5a5e846fc5f7f3
MD5 087aa64aec5a8bd8d57daf7665aeca7d
SHA1 0d8def189c1f3fdc3a21d258be7af88e2a0bef4f
SHA512 ff5d653420f3f95f4ca3e66ea7a816e3799a81b1d3d9d3997bc751f48618b41e60b73227640e68889a2371953d7e536fd3d99f62e7d3f67f14610b6b9a917f34
SSDEEP 49152:wB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glULNiXicJFFRGNzj3:qu6JmIxd2dU7wRGpj3
TLSH
T1CFD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 21c0fdc550539df0418dbc7dc96028a9091b8e8b00065e927ca550083a783023
MD5 fe3ba74ed443b91f0ef81f9aaf825f03
SHA1 c5311ff7d47c82b341727e2215e364945a79845b
SHA512 711d632d11c2ac95237ecd6a5ef77cfcd931a7d5e916b65baddaf276103fc847b71c470f2b0cd400e27c58505154ca49c5e9aed6e261f1d3707ea21014570977
SSDEEP 49152:X1hpsNoJpF1A67U44CwH7R4xQLNiXicJFFRGNzj3:XmifPqRZ7wRGpj3
TLSH
T18CB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4559660296f865a088b3cebe5ba6cefca89b25ad0afd4f3d5d74c2597345cb63
MD5 0d187945a5648add8fc6e2d201adb215
SHA1 7da165449070e7ddb12a70bb6c7107603928f814
SHA512 7d0fe17f974865c1a11ca20cad98698f5cc56e65e40ec7d85dda604e87870f6016f131a377632a5b84130183a87978859850ee7eb4737291a9c32db55947bfdb
SSDEEP 49152:cSuZQIY0Be2KkRVtOnks6NMHqbLNiXicJFFRGNzj3:e5dKqi61b7wRGpj3
TLSH
T16AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eb5474ce2b2fee282a5cd4d7b2177b0f076cbdca6f238168fb995b1ba2221c22
MD5 d31e1e4889f9b2e4315ec88a7e2d6297
SHA1 046ec5243e2ef8b213fbe296dcf263286c5ed63c
SHA512 e7e8275ed328e04dcb1d2d6b6f248635ab792ce20e72a5dba4b1650ea4360370d6699dbabc840f9c1fee5b980bfcaabd5ae2e26de47566642f96e931c61a7ff6
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5wELNiXicJFFRGNzj3:7X2iWph17wRGpj3
TLSH
T14295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 62b759db2cce8b23e4ef52e7230a347d4377d7715bb8973bb737a5d52ed166ce
MD5 d76b1416f12aa9def550d1d55e089f18
SHA1 e1b981042e62127f44d5333b06654ff313761506
SHA512 84d689c87097c29cfcd25934c4f68975972f79156354cc0007de1a546839b6bcbd2fdefb979eef0f8def48f62558153076f6180df3e4b9bdcd207267a9db6c1c
SSDEEP 12288:q7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ddc7afc224fc6f88b6504be82a54561094033ceed6a3b839b16b659476957702
MD5 944cc17413ea5d2a0fbcba3b0e5f35e1
SHA1 8ae5b99baca91482197c7392b052da7e6b56df92
SHA512 ddaea95ec7eac459d175a256d64118f57ee92549bfc902f1a0dafeb25a57d262fb1717633de0170f5f861d10f0d13d298be1d911f1f5b4e2a2a57b040202fba4
SSDEEP 12288:cUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4049003e41c66de33a0f799ae1fca7b4343cf5a885e714fc6902a46957173c66
MD5 dbe2284653f46a5c7c3588adb15eeac2
SHA1 937333972287b13f3418f7a4a3b4ae67a2322131
SHA512 d47377b2843be52fe18d3914d186596ea5bd1d3371e630ed679d278adc6464f38f72e7b8b39702bc7ea89cf68f495165dd5e3ddde60ba1dff961d1aba5685bae
SSDEEP 12288:MOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6862d6dc5744ec478f259d6bb52ace87fa5cd7df0c914c41bd5a992945783161
MD5 2b3e321ec917cdafae6dc24d6211499f
SHA1 3414f7486703d33ec2f9ef46c73fdb17d4214183
SHA512 882f3a9ff69b45020532e5e8e3424145993c9c9d65b4c8d1babe21c16987b1f1124abd7dd09a9d53488cd591ed424ba9af94fd4bad4435f69d9fd1e040e477fe
SSDEEP 12288:qV1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E7552393168901F1E9BD8039CA764424F2947D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 488cf0711ac45684723b813f0ad66418562f30269c2ceaed348fd1cb51d05cfe
MD5 75933f49496ca092d773a21dd38d38f4
SHA1 bf820de130af4a232dac97dca616f17dc399624a
SHA512 96ec859b6f360fd2624c07b7fdb6fc0e5106043b6a18e6ca0d2e50778b016e762186ffcba6647043f6b4cf5302f0049b4071eabcdba9c9eb4f8c399a4eba25a3
SSDEEP 12288:ptiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:px/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3d4ff18a8a2c15a84d3564844f5b36597aaaa141c9f83b71eb348c86eedb6ee6
MD5 5714e356e05b66bc56c3a5a615703f88
SHA1 96508b41836303e00f4b7af13a3dfe4787ffa06a
SHA512 804b9e531d37d232e4fb1a98b179f490a9f95c3a1ac024dbc586ffaaedd866e676458d5041589fc2796d5d3bf2f1abc97c61cf263020c85b7f424ca959d131d7
SSDEEP 12288:LgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ly/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3558955B2FABC0039C6754428F5882E2DEB5619E3E3043D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1fe483e875caaf8a707c9eb35807a2d169d515e444819d4f90d3f4d790ec75c2
MD5 b7d7c5fe9a7533cc572714f296678dac
SHA1 fea6ffbb339713358b06ddf7a981cdcc548d6018
SHA512 81e0098589ac2c08b41be8a30e0c4275eae1414286e93b5696b083b045016e1c57e7d70cbb83086357a123d8b19f89c5e40b285370419c96e1aa06e64e1c6121
SSDEEP 12288:JsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 079f10a69b61590eed2997190aac71ea5fa8fa7c2962685e5fe25ed9ff5c0fc2
MD5 2efc234cbcd04adbb32b84b12c200641
SHA1 f38f516eeb9183223767d502c98f7df0a82d2fc2
SHA512 77c83e130672f9f0af8a4a265ddbe1d4925a7d64436a7615a5542893b351a4cd174489949d9e8ce87e644ff341edc97a8770c4003bd01b9216c49ca9a4d8424d
SSDEEP 24576:oZM3zFVSOe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oZM3zfiLNiXicJFFRGNzj3
TLSH
T1C6750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d98b790678d44651179163e0c179ffee355420c6869f9f07d3890ad5379a6957
MD5 39bfaa599f1173b1ddc5aeac9c2190cc
SHA1 69a009ee577ce9b15c8e9c6bf8cc81e0611ba425
SHA512 8cc1807a87e512cd589d663852d5bdcf8e2d956a96ea3f5f6484e9d7ae9653d5f65225107d03ef9af376909de0c2f8ce786fec24da1219a621717aad25cfa88d
SSDEEP 12288:A/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3558955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cf98278cc580722fb5150082fa4fe23475ace2c08fa250e54ed249463e691202
MD5 cf7200d63709dc1dc7059e6e6cd00959
SHA1 a9e70d01afa550fae66a8569f3307f8c73b7680c
SHA512 a9e725c1a4add94e6c0b61d3a7e588861984dec6362cd6b9332fd3652e73194f417cc666f365150ab3891604138a209092a3ac3f3c2771ff77f4cff28e2347da
SSDEEP 12288:UjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 996cf2000f11741c89171d710f6e9213ab373f6ebdbc484b1717d21e813d4939
MD5 e3019ac96eff2de9a024e84ebbbbb2b5
SHA1 30c7291f9cdac39d298fbf7eb5d1886f2adeceb0
SHA512 a98a72ee1426e75f2def62653f036261c7ae1695dba0d1fa209965420439ac90cfb21ba4c57f3c84e428965b472e9855cace476feb430f406ce48fbb9abdcf4f
SSDEEP 24576:Nzya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N1LNiXicJFFRGNzj3
TLSH
T1C4650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 07fcccd53b69b253c70c36bca1b30000badc5ae1f22572dde26088af9ab16487
MD5 4e6d0178687516a5508a9bd02f4f4a37
SHA1 fdfe7a0cc4bb1713fe4a7cfbc9ccf7687df887e9
SHA512 ddd426a8b8a00e6e357f8b8ef8892dd31ad07977b00ef63273e21e6376852a0b8dd7420ee8b4b42ea877449a2f5c4b99224364ca2160c5102bfe210dd162564b
SSDEEP 12288:G/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D3558955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 49452dcbd39b15532f2206a1c85f0d698a83905832f8ff51d55d6bcd8237e90f
MD5 17417e2ab3052667bb914a6c6b6bb050
SHA1 28282973768b796241f12d9fdf71fb4e5d636123
SHA512 121bceacdae233bc0cdcda0b5bccf665e7f553baaba6a3c1029b4bea3881c3a5f0951ef6580746076cd41352709bc4429a8bcd3f06e7678252ce5593b82e80ac
SSDEEP 12288:q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F5523D3558955B1FAFC003986354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 43060cc5e56781e5f0f576fbca6375e9c63a19be4c7acd19c1e14b926d36ec26
MD5 ba376745ac99c9a972945fd476813a54
SHA1 2dc970fc5d83de0000472931d13481508b6a8a63
SHA512 150c174a9b31c8f9fcf5c3a731f524a947f64d237dcd04c2023da77461eda11abf6a0c6dd2b7bfce83474bb71ae0a5c2a161dc2f74474e5fe5c25514a03b5715
SSDEEP 24576:/zya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/1LNiXicJFFRGNzj3
TLSH
T102650247629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6f1f00fe24c4e152a7b8fe7ffea25d7e9fd9845a261db49bfd6a8d37a48a999c
MD5 aec08b8401d92d99ae923d25b6cc68e6
SHA1 56e58069ec04badb35c12e999926cf965074da0a
SHA512 1acc355ff2f8771c3db307627a59c1a65c7031a0607373526b068738c88cb80ce47b33ca1b4f8bbf54a709d7c810bc4d654aa6a9c3d31627cbe418ea8ea9a495
SSDEEP 24576:nT8aLl3z0zDI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nT7LljtLNiXicJFFRGNzj3
TLSH
T1BF7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 45395d3b7b4b1dc729c94462e2478ec6f0c354a5d010d4c358d20da60310e8c1
MD5 31a9b861e076778f03e57f64ea50a0b7
SHA1 1d8dbbb87dc6bb2aa5547fa30090be8c8920fd77
SHA512 d250464dbf555c92ab79d7c03bee0c3613883f77ad2073d33bfa60ab7be81b03b6672b92c2d5bd58b7b31591db858d0a982604ec951affea62488d146aa0b1d9
SSDEEP 24576:53rd9CHKy7GZs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jrd9CHKyaiLNiXicJFFRGNzj3
TLSH
T1C385CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ad16aa0f06bd5f0b8dad83ceede95813d301a0d9d51a20fb4a37ddfbfcdc1763
MD5 3921e54eea4207d859ab1f76b4665fdf
SHA1 b027d7a9732915c7b891490fb40000298e2cd7c1
SHA512 6c2c4b6f57d2615b8567e68f56c98dfe0d71b7c0c945e281671216537d3e6d923ecfc5023c5b091d0bfcaab72927c082e7a776a803bc6352f3e980cc4d0f1fd3
SSDEEP 12288:CuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E3483D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6366b19da0cc138a83deab11f00b25ba19021348db28d4d06a199919c249084d
MD5 265bfee7e0f3eb8daa4c2c7d8c56bb35
SHA1 10f29ede649217f034e7964aab2b4e2f245da41d
SHA512 76ee02da492e822150e681be77ec2a62d4e1de79e4386e468c74bf58867a45706cba186bc0e21f907f152a84779b69f32020d75b94413240e0922c7fc58e29d7
SSDEEP 12288:9IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:96/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1405523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c88f98db22b8eb0a05e1fc561ddb40acc3f711a6423a52e32dc18ddb058a90b7
MD5 673ae89acd359f132b3a3791e1c24d91
SHA1 34807fdc86f51196e486fef7bc29dcd4fdae01d6
SHA512 ea4ff84d75959a4e024431f5a88e230907227a7347648fd0e7266769e67066fbeaea4c01abf77bc40143a65f441cb73bd83564435e92ca65c2d4b6adf36c7bf8
SSDEEP 12288:+5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1FAFC0039C6354428F5882E2DEB5619E3E3483D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 58679067caad04b3f2d165b42c9922c897f606fa2b7abbc0ee63ac1d6e586026
MD5 acf9245fe26a0d5fd987091b674fc94f
SHA1 de2907e0892890697c9aa32a781af80faad3608b
SHA512 d80dcc1b1558f6eb859d4756d8b13b061cf1cf34f08e12d7683c4152d34e4caf279b69d8df265a800f49f37f125e197a9fbdded9477d2d2c80eb6a43d36a9196
SSDEEP 12288:q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 25acb5b5204bee23845e89bf9c68dbec158a4e75bd515bc971d70291c51bb13a
MD5 25c81d260f5276a395ce03cd3f533f4d
SHA1 405a0507c7052a6f1d0fbed764207c13f64f23c8
SHA512 1f5d256678a6725c6d52b664ace69ee62948da7fd4b58f0ea3c5c266b54f6982c525829dcc518afa70294a666cc7c742379627578be19550dd88b35197a033e0
SSDEEP 12288:fuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2dca9ede07b66babb27edf67331c1b1d18c8be2167987ecd1a9d97ce523affac
MD5 3894ece6ee2a8cd923ebf0c2799c6678
SHA1 f8569e9666402d290580fcb80a4e1b4b58f34782
SHA512 34b79847f989054694b6312e9a7c379280caefbf3374d6bd27cf3c8876dbcee55abe2e744b643801747faddcf2639b6c588faffd716b165c67790e7fd2691e9b
SSDEEP 12288:bXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3558955B1FABC0039C6764428F5882E2DEB5619E3E3043D1EA278FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b0d637ef148c42c63e6fcfcbf944206e12baea10e8f0caa902541697b3ace061
MD5 f523f007167c76b4e5b2282fd5c2e829
SHA1 6255b4087a6bbe185ff51c61ed11cfcc73d8bf27
SHA512 e147533f615ad8b4f6aa3ad273253a143c9cda23f9456b165f53ee09935415084bc07ef6a078700a5dcc3279b48eea89d94f5cc29ffd03c7538b32d2ceb064c8
SSDEEP 12288:YtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 824592f30852d57cc44025dd4c27629081296d2e1acae32e2a7eccae526dee0c
MD5 b0d0def4e046c1ae1c45049f6b7e66b7
SHA1 651734388a9d468b23ec801e0bccaca4bf9d5180
SHA512 05560ce52cac981fa93aaa176c52f27783c80ec76e5813ec2a3d9677fb1cd89891336173d643fa5b216ca9034ea89b75a598e21eb81c33f860cbe66126e0fa0a
SSDEEP 24576:Ufwvzk9RX6wkyAIH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/MnYIHLNiXicJFFRGNzj3
TLSH
T16A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 58942e37c9d7ee42b6e8133aca7f4f32a36a0d192a8ef810dcdbcd1b6dfaf44f
MD5 2bfc461e33a587ac00231ad189c5a2f8
SHA1 ffaa3c69e738f1c8461a7a76a85f4cd411e811cf
SHA512 f30f200c139c4bbc5bcc2115a064e23ac1173925e8d03ac95e4fe9e6cd5e40fd53c31f9062e2f7699935b8c810686ffcf87574723f4b746ab3b75632a621efd0
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kLNiXicJFFRGN:zySzPs7wRGpj3
TLSH
T11E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8523cb6b202898e3c784c4268351bc9085e1cdbb61869188270fd330520cc473
MD5 a71572a4426bcf1d4927b92adfb77882
SHA1 c1f8c8fe43d22de27d2745855430b75d40c5c86b
SHA512 31affb44dd43fffe4587938ea17a10e12cd523fc67b0ec355afe50da37ac470d6d6dc7a200cb73f131701d03424ceebf897cdcb23482ef22da25bbb218137fd5
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n47JUQjqirIhCnDHUPfF/ULNiXicJFFS
TLSH
T14965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9cc9473499943361d5ecab3c20085902e2ebbf0312fea380faec036e6ad80e38
MD5 35e70d8eaa87d09629b3e58812dd749c
SHA1 1122594606926890a2017a91e669370977d13d7b
SHA512 17d948e18a7014cac2e79d599fe64b62e2a6c0f59a9a42743150b3f252390834e8b1265cccddd18a8bf20c3a1345508d178954505192240d900f5b2c19a5145f
SSDEEP 12288:IpsfviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19665F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 900KB
SHA256 fd8dd4a9b4871bb1a3574e2f719024a521388931c12b36e1ad6795ab69c6985e
MD5 e3726579628af63777c175551038242c
SHA1 46d1fb79313e51814ed391baf215f236506533a2
SHA512 e708664af5b3dbefa65cdab1f2231c4aa14ad48d89023e5d372e6624e62049dc8599737510b34aba9901120349c2a8e955c3cb4143de93d7f46a0c0c325c9714
SSDEEP 6144:WsBC2na6gRvnzW3L/SmotMx5Q2OU3fcka3RIX1KbBGGK85vVD9M+f8k1FLGfWU7R:TI0MU3fiuhGjfzLG+U1WdhfsmoHsEG
TLSH
T1621517117666D74FC6AD40325E33C1CCABB07D01EE45AB0372C9872FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 453bc741075ca45d36bf9a1750893127a346e4c1de1bd8c30808329d5857c838
MD5 73b55af9c849662eb690d77ee60dd676
SHA1 a240f7755e05ebdfd7128078784fa55dc584647d
SHA512 4af87fd25c930e313b83dc6cc191ded63a624d14776e4e50b82946524970da649c22dcdb6426a517ed6f142d6cb3963a540324ed10c5bf4acc05a24dbb27504c
SSDEEP 6144:32opvRYJpTSajWt3nlHG3IhIr3VD91u5DV55VVD9MqwQoJaQSqtMxzSqtMxvnE7j:32osTSajM1GF5IeEEp085x71wvIpzOW2
TLSH
T1CB65D7409537A3CFD1BA6032472A9B4CBB64EC0677496F277388053AD86AB15B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3ab4ed71351f3ebe644021e12d6039ab35ee6f0b9d5bd0d98afcd38fdc249693
MD5 63eef3e864fcd0ded3a7ffe2accd8315
SHA1 b4b70206cc9df0c27e10c8b30940c275ae336f62
SHA512 ae0e65342d9d2eda7587016884923ded2c6a28f3af7a5199361faa0a6b23ac4c1f93e3521de415768c3ad91d7a29f9153eb5bd00140c40088302d1556d8c937d
SSDEEP 12288:nF7HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523A3468C59B1FAFD1039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8e886b5888a1f05c2faae48b9b8565f2012ba3bc5ce3a7dde892b56a8f4aa5c
MD5 4ecb62a36ef9186b97dea3d07923ceb4
SHA1 23dcf03731945e3717f0117cf79b1895f8731f87
SHA512 1801acb32e5186b19305b5ed066dc6df17322cdf16387e5af8e5536bc4c096037ddbd54ec80cbe1f09f24a037a00d12b4b079ccd12b7f34e39b89eb1d1fed4d0
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fgb4mBIBhGFOLNiXicJFFRGNzj3
TLSH
T10865AE1E22EC02F5E1F9D2B8CDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4d411a38ed5e83312d0e4e6e2a7ed589473a0a1ce72518ff582f8891fa52a45f
MD5 fd7c8fea91ed177bfbb1b562d40e5292
SHA1 5fcc872ebd3c8a5b4741023f11db7e4e365bc158
SHA512 b8812a49fbd77891188b176f01bd7f30255cd09628552826ca34564f3b6669b3c774531d129469167a32fc5668ef2ef9f0c7022126dd2cdb112a0ab3818f55e4
SSDEEP 24576:sG88u8FpJqH1vzria7/me/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P7ZFPqVya7/FLNiXicJFFRGNzj3
TLSH
T10885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9f63011fa3de88cfc6b1e40bb7cc53b70a118b50d6d180257c7267368c48075e
MD5 53ecc67788e4ecbe8bdfbfa319e67ead
SHA1 d10ce594bd657f9730ba8cc3f8eb389d53d33fc9
SHA512 0da9e5672f5366c6c6c7a13d6171dfdf0648967cf0496c9687eddd7372fb40241e9315a1a5de67e5fa1c5bfcdae8ed6dd05e0e946f992cb434d1018ea551d909
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyLNiXicJFFRGNzj3:nG05lO43bf7wRGpj3
TLSH
T168D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0053d18c2f784ee2db63edd92fe2f9f4b55d18f97dbc34a527d2f47a584f3227
MD5 d660593e42c01e29fad062149de6f1bd
SHA1 886948a2711421f27a2368f973df14aa15b38536
SHA512 f5318382f8d8682a2cc4882515f13206a4fc9688467eb3f210db5c9ea15adb0d4b8d020a6b7bb9176f9e89ad4cf89cb83b84697ed23b7c9c14b6e36a706fc649
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnk/TwSfVcYG3K/cJHlnFR+IGNe8jg:ha5POZ3lJt2pasx2+m6LNiXicJFFRGNf
TLSH
T1AB65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3feb7b6b2879896045f778adc10d9ebea8d03123d733825f4b6c0e4895b4d834
MD5 ab72b6fb0c2cfd523000294fcd70e73c
SHA1 433146ddce33ac8edc94624b00891ae2320d57b7
SHA512 95ec658a2f240ebf0a5a018768bb19d514a1041ed8535e20cc37f482fd2994f69d5503343ac191f0f81d774bbcf609be726ffd9963ed954b2e6bcfbbce1dcd36
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fkm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Nc/zEOVHFlLNiXicJFFRGNzj3
TLSH
T14E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3cc5cb36c3e2062c8fdbfd8c017b109dcad93b6a6291d4a3b52e2993b850dd36
MD5 27dec961f0c0e3aba978819161c000b2
SHA1 45e6583de2faeed6f7d8c6769fdbc12c39d24a5f
SHA512 d5822b614cc32074df813e5230e5e069088f0e807941374862f851e6da16b21033f3b93450ef453672f353ae29849c8c0932085acafc8c677b5ff5a958123094
SSDEEP 24576:tzkNvNnaFeYhJNtmZBmg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tzMwBtOmgLNiXicJFFRGNzj3
TLSH
T1DC55AF6EA6E806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3eb4815d75217f0ef42fde43a823c306028ddd1650772dab6ebe3e658eb2ef2f
MD5 d653c20b5da0f1109885edf3db34ea82
SHA1 fc65e34a172c794510107bd5f7ac7ce181620c71
SHA512 8bd04eb5890a25967d8716ec367e58bac2ebee69858f4cd88949606faf6f40e9b5b928e41278fb688cae6037a5cd3a22861ab6de34751ac734991c518ced2973
SSDEEP 24576:jPUr+NQi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJQiLNiXicJFFRGNzj3
TLSH
T1CD65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 429880118b8256d6a8afefeb9a171e944ad7fc05a10ccc61a1b01b04e1b3ab1e
MD5 f9148fbc598f5fc919a5ada0bdc26a07
SHA1 4e6b4d887b9ed799f53a31f5c4a27c05d18ba091
SHA512 aa67dc17c3e7cd212d92bc4365505b13f46c3d12807d020b6af6efae84677af3ecb49f65e1af5a405e236af70e137ddfe0d6d5ad3770c5966aacbfa4b0b7de93
SSDEEP 24576:dD3FHshBIYQgAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dDVHeBIAAPLNiXicJFFRGNzj3
TLSH
T11175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-311-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/124-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/124-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1016-38-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/1016-44-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/1016-59-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1016-46-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1016-51-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/1376-120-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1376-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1376-310-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1648-134-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1648-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1648-126-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1648-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1648-132-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2360-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2360-78-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/2360-83-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/2360-293-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4124-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4124-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4124-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4124-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4124-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4196-7-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/4196-1-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/4196-6-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/4196-76-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4196-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4472-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4472-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4472-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-326-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4504-325-0x00000271AB190000-0x00000271AB20C000-memory.dmp

Download

memory/4536-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4536-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-100-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4536-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4768-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4768-53-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4768-50-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4768-216-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5432-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5432-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5432-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5432-277-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5924-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5924-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5924-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5924-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download