b2f9c5525deb6b5af71ad77479b5424d04055d42068b2c310f9f5d363b4df4e2

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260809-q2fjda11fw
SHA256 b2f9c5525deb6b5af71ad77479b5424d04055d42068b2c310f9f5d363b4df4e2
MD5 bcee3b2406c4bac373e5b1f5f4a2f0df
SHA1 8a2fec7f564cc7088da3a3b9fd15c9952e9a4fad
SHA512 25f616c849895e13b1216995fa968467ab539b77d51b771a574db06e8868e7b4e01fb496826e4c586baaedae1811a0664fca1daa0ca51f621266c221ce23f94c
SSDEEP 12288:qUYJ9bi6dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:rYJ9b7y4b4qo+QdJacNX9gHliOVeVE
TLSH
T1C765012473C284B2EA77093205B5EA71993CFD710F655AEF73913BAA9E301D08939763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4984	elevation_service.exe
2044	elevation_service.exe
5076	maintenanceservice.exe
1456	OSE.EXE
2672	PerceptionSimulationService.exe
3772	perfhost.exe
5320	ReFsDedupSvc.exe
2108	SensorDataService.exe
3508	ssh-agent.exe
4716	AgentService.exe
2480	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\632e65e25387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a67c1e5b0528dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b2cb35c0528dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000299b025b0528dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b2fa55b0528dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5320	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4716	AgentService.exe
Token: 33	2480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2480	SearchIndexer.exe
Token: SeDebugPrivilege	4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4528	2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3268	2480	SearchIndexer.exe	100
PID 2480 wrote to memory of 3732	2480	SearchIndexer.exe	101
PID 2480 wrote to memory of 4184	2480	SearchIndexer.exe	102
PID 2480 wrote to memory of 5032	2480	SearchIndexer.exe	103
PID 2480 wrote to memory of 5008	2480	SearchIndexer.exe	105
PID 2480 wrote to memory of 3124	2480	SearchIndexer.exe	106
PID 2480 wrote to memory of 5512	2480	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bcee3b2406c4bac373e5b1f5f4a2f0df_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2044

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3772

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 da60bcfde5ffed242daf567feaaea8c4fad440ae158c6dc844d01f1888eb4ee1
MD5 aaa76f047036ce6fb3fca6379725c520
SHA1 8947a47b18f52ed03dd1016d926e7521de797bf5
SHA512 68b8433a3525fd343d308247104b12896eace656179732a4e63979504e9c7bf097d95201f33e845196054ac517bd9ace83c3e975bd278c50b9169492195a7d99
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjy4No+gaC6tES:H3q6HjBgNgaC6N
TLSH
T145D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b3262be6cf0a564bcc5806483f83c7539b387438b38bbe14b51c20d070d0c8e1
MD5 c9004b87d9b21ddf63c074a6ea5611a1
SHA1 05badbbbf49a4131df6625f07207c1583a596cd3
SHA512 4a1ff9db1e5204b5908f2274207de26a4c0d99877acd419e37b97d936a78cf464777e0d3b02a2a780c6a3f64170347402ab454fe83f9a16a76349c5a63b76377
SSDEEP 24576:HXYfDtczA8y4b4qo+QdJacNX9gHliOVeVE:Stcpy4No+gaC6tES
TLSH
T1AB75022863E508F9EC6B8239C8B2C511E6327C5547A0F7DB03E4AA655F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3dd159d8a55c5095319415be000608afe484b9ad8cbfd912dcd4c53077b890c1
MD5 3d63e87751853fdcadb00deda922f601
SHA1 a6b9bee492a720b0dd2d18a6fb3e730e89f8dc2b
SHA512 ac1f7abcf94f0ff870359a6946cc2a5c329d78b679f8e2740a59a219ab9fb7dcfb53f5c6b69bba7e085d72650c141c392b74df643b81e0365f149b6a636cb43d
SSDEEP 24576:l0Le5ji0hmx2rMLy4b4qo+QdJacNX9gHliOVeVE:lPji0AYWy4No+gaC6tES
TLSH
T1FE95AE16F6748331D073C0B9C5D2A69AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e1235ba6e2ce691a30de35fdb1d868e504620166d03c10d53c6a9b6c5e1aecd
MD5 5abb470def799f6b25c1891ff6ae8994
SHA1 6ba6dd5cc022d9cc33bb5a3b1e265f9a6da03a17
SHA512 5e915ca1a661877082010108214d48d945dcad45c4ba6817bab16584d7cf04f6ed63f2a900c20b33fbed87e807e7a8a76ac06eb4c12b61b6fed71b33e82771ee
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyu5y4b4qo+QdJacNX9gHliOVeVE:0/ezSC6vUzPvxHjySy4No+gaC6tES
TLSH
T150755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 98816135a8677b878a4ac4db198e7159f74a003924e8c39fd9977eb4e7bbf6f1
MD5 1e24c92b58eeed17ee8afcd63024d56c
SHA1 e9349ec90e86cae5d7041bf7d6c14cbedf05419e
SHA512 6e3b2ff573fd7ec07100f80ea7701fa5b3de108f2ef2d7f09d2a2fa83a3e6a67ed72de88cb6b49a9d5b7c7b607c19e906d9c21915eb9df5765c3a8dc944d129b
SSDEEP 24576:rVbqPb88hv/l+6wy4b4qo+QdJacNX9gHliOVeVE:rVO88hXl+Hy4No+gaC6tES
TLSH
T175559E66F6748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 a24198abef1913dd9f8e4aa0296dd6a05a9c246038b9cfcb0445fb8a8120be28
MD5 cd880c9239c0f41a04e941feb41daa77
SHA1 f5be411db323046337ff570f4a1ecb1443ff027b
SHA512 0babe55f23d642c445bc85c46e2b846d19359051b59977b85e5e817484fbc7b09e03ef015e39133fc110e7a3e5af5cd81854f5bd4c9be217963ae67416a8ae16
SSDEEP 12288:QAldyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:QAfy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1DF55231D83AE4861EE5D4B33E033A961A83C4E9459CABF9CB761BB82ADB0431D857147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c9438a7bd58c1c1537a6373d8ae4abf410a918a15ab7e6ed448573957f9429fc
MD5 fe6feefca46a96428efdad60b274f460
SHA1 d13df5ee9bbad81f0592af0002c9e9e3a45ae362
SHA512 aa38b228dd4cee87d05a6069ff40030a1412b9da9cceb9563168b81d10a8b87fa80726b8dc10c022fdf70ccb242df370c5e04d2a1e96e42d218f388f9138c1c9
SSDEEP 12288:XeBNUbTVO86UgdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:XJIU4y4b4qo+QdJacNX9gHliOVeVE
TLSH
T16375CF3BEE28ECD2C67E8D7956518600E77278304F52A3CBE165830EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 37506fa06c96b7dd7d82ffd78dbb71d21a5443ff2818a9b183afc32ee4a4e1cc
MD5 36a14f2d09389df7248e2ae4befc282d
SHA1 66aff393db54e9868123189ac2401ce73bcc72a3
SHA512 f0cb83ccdc22a79a5f9517b106b520b5abb5127793ab522623414ea8d18049ab903b187c328f254090a034a2d433e0ec331016f701bec3577c34491d804e1179
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:pQvGAdlCEL8c/yRNw5CJNgaC6N
TLSH
T1E8267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e5248da5721fea9b9faebd24beaf420cd4028e4eba18d070a31743f6b4c96a24
MD5 9b0ac594b51bdc14a01a5542a3d534d4
SHA1 483563e5c7a68a83b18dff3c810123f3f76ea279
SHA512 a76dd3ba51e30a381a53220c7241bf842bcc0c368524fb469bb11e0f3bb40e5fb378052b8e35100e5dacd6fd1a8c97e9307e4f6989b11e200e8895a825cc9539
SSDEEP 24576:m5ewsAjmy4b4qo+QdJacNX9gHliOVeVE:6ljmy4No+gaC6tES
TLSH
T1D275E031FB75E036C67F0DB21B36D716543C6A204B922AC3F3A89E8E59701D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d1dc6de5bb0a32abc685fc2c85470e92cb3cbbb588faa98bbd5c9b9c1aef796b
MD5 df73523f3d61295e8cfc463300658fce
SHA1 5e090debc5286cb66c9c9d82096facf8cc2e37fe
SHA512 7de040c305fa26a1ea354ce562d365d43861c91aa7404fd70d4f64f430039f4cb35eec16a183e3f671fab2c768f1b71433e674142bd230da940ceacf8c5f62af
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH+Sm:TUEtQevvqc2W1cpV2EI32Z
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ea2b5d27430dd82dfbb118c57e3a7febc0459ff35d6677b902a8d47691a652c1
MD5 03d6bedc29a76202979ebc71a47671d9
SHA1 b50fbd085c731f31578a1e714aaf36cb14bfbf09
SHA512 a6fe27a2ca88bafd28f66fa459b3458daf06fc466c28f14805927b33d9932d7c884c60281e98e5306d9841f1494fda1eac99f349668186f7b8d58b7d8ca18fac
SSDEEP 49152:kCbRquA/m2yL5zifFiV+XenmE3/zGy4No+gaC6tES:toqHVjnm1NgaC6N
TLSH
T194D58E0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 78b4a733ca470c0ff14b7d56a4373e060340122faa0ba9026f85605e3b53da81
MD5 d4f3e9f06b41a853e060625fcfb07475
SHA1 c26dcff1524dff88989d69f75951236a627dc8d2
SHA512 6e23a7cabc55efae3ac53356f72ff22fac5d5b0166eea409a98c88649eed097261404486a98587ddbc46d86270d1f3870ef89356f6343721e5f3c88fbb3fad85
SSDEEP 24576:YAhGLJIFoiwtA5l7S53Vy4b4qo+QdJacNX9gHliOVeVE:YAMyFoiq5Fy4No+gaC6tES
TLSH
T15235AD80E7F945D4F5B3AA7899B69171EA76BCA65E31D20F2160D20F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1bfa677496f1edd20ed2ad54ee75c9c14656ff9649d3511942d341445919e26e
MD5 5cf48457ea73421a85118dfe5bda1385
SHA1 015f023290650013398e2c57ac45a8e002b9d212
SHA512 2ce4911cf6cdcab289f57a0f79f7834002ffe82eb23cfe97894076939da85536ec38611fa9a35360c341a4207059246a1e02757f00aa2cb7362bc1dea8e66d3d
SSDEEP 12288:Lmw5HEjsChNJBFgl0WDm+CDdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCu:KwukOWyy4b4qo+QdJacNX9gHliOVeVE
TLSH
T12E75F10963A90CF9E96B8239C557C536F7B2BC012A65DB1F1760C75B6F33221AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 3a68599e660b53cc163bfe971564757c99bdabeea7e0ee0344599d9cb6e65e67
MD5 d2ebcb9789cfa452f79e221e5e2f93d4
SHA1 720c7d70f2c292fd1c7248d5b5570c310f0c0641
SHA512 67d375cfe168390f19d2640bd427cbfa0ccb538e6002c7977b5da2f869c5f29f9d9fdcac8baa75fa9d557afa380aecbda833eecb93ff36b3da34e8312f09b6e5
SSDEEP 12288:NGZ1Iy6dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:8Zuzy4b4qo+QdJacNX9gHliOVeVE
TLSH
T18065221D23E820F9E5AB433AC4F29A01E7753C5227B653CF2260A7566F739D15D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9b94994460179f6ccc4c3902fbd53fbc7138222f0503620a10364ec5d2f64be9
MD5 94eb6a08cfa63f3ddcbe62639c4c3e76
SHA1 fe9bcda4e048eba0303db123efb569cd5523fc53
SHA512 a8ce57397e47e8460e8c537beacf3390ec07271bb89d110b1d83bc3de6575cf8f32bbc6ec4fa444a479a6b9b1203f72c0c4bcac5b40639dca95fb38482792398
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:uQRQyi36YOcPQLvw2gAf+PN3kNgaC6N
TLSH
T1FE666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 67324e57d677ae668f87b0911eb07ab2411d8052e65b55affaa051cee0e4bdb1
MD5 7ebfbbf558189f7c5788718178d575ec
SHA1 369175a44e6d9f88b40f23606a69dfdb32e66465
SHA512 dad9b95e4104ad77819aaacf08376ef2041c708eb096b0a5891661f7a28a68d4c074df52d252f54c8bfa2f6e377b8501cf75ac484709d7a767b3ef44cffb394f
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:lQRQyi36YOcPQLvw2gAf+PN3kNgaC6N
TLSH
T118666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c5e5c44b7f964e18fc4957cc3db84fe49b01604e6f0ffc062c636e529dc0202b
MD5 92a7f0181f429766855d931d0614a067
SHA1 9a12fc4983e47cf3a5fa097d7706c8c345ba7d1e
SHA512 d343e3574ba399e337f392d75b348bdda8e23851f18fa03bbfa29e198b15950d0db684626f604995fc8d27fe2e33086ebb2515b8e873ddab9dcc28f18c52312b
SSDEEP 49152:A68Qg55nhheWu7PNU3/Wy4No+gaC6tES:6thWRc/WNgaC6N
TLSH
T1A0B54933B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 31070420d303ac0ad631ca4281824ccff2cf4e64e90d67830103b975623cde74
MD5 9866961dfe4330926888e5a75d47c683
SHA1 64011c6895739e11ce0e82d949c5ed1b8a30b0ec
SHA512 e853884ac9ae5512354edb8fda5b1785b8635a1f6fbcbd6750bc0a1a10b145718a1befe2930697662cf247ed4cca68dae30129e79a64940fe2e080bb65b19cda
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:oy5112gYy5azzVvL69nLKnhZfNgaC6N
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5461cdc78b9e8033f05ef130d92b3714fbd14360240cbea3175cfd7dbc281a98
MD5 eefd282700fd6fa4fa28b39920e5a540
SHA1 8738f3ebb745414d4c99ca95d56d91162a197668
SHA512 c71f57e0e3ad3fe5c8ad503c252d0c42fc9d3d22fae16a85ae48945ad7298f1a6d0305553e73839dde67e272ef9528e43860f766ac8c97dfb9a49caddf979fb4
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsy4No+gaC6tES:Vu6JmVxd2dsNgaC6N
TLSH
T18DD59D13F2DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0260ae1f0a4da82a075020ee3f9167f427424d68362428787669b8616101b956
MD5 1cfc6f9c0470f643916e6c427d708792
SHA1 cbfd1fa992d48353464b0665ea00779ef05644f1
SHA512 4c2a4167b9190d6aaa64bec8c2b0fd0e0aad4d2aa8c8c9d2d5c2f09375452db18edb96393ac2cafdb87f1ccd1c351b39927057a891e46d02690f7287ce2ad285
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xYy4No+gaC6tES:nmifPbR1NgaC6N
TLSH
T1EFB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 401c431f046a15103819540a440252a85b2b4ad0026594898a362871acca6257
MD5 e8b7e322f36eaa7f343e01915a14f27e
SHA1 1058dd381f3ad771c54a86f69282adfb35c50415
SHA512 0b412dd007cea0020a07e0d24724d9d4a218e8b43704889447a5ad007b2e9ec87d4f97e254adc61911c86689e850b6b87074a45fbc8776d99298e27990bd1c41
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqzy4No+gaC6tES:C5dKTi61zNgaC6N
TLSH
T15CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b24f642f0f493640f57fd222ee4f24eb0c2018b63e2ccde46397e7acfbd57724
MD5 4f6ceb725643eb1e2722ad5f0c55989e
SHA1 17145932f8e7e0a70b7eb61ac007cd0802e6f220
SHA512 bf78808045fec77dd9edab8a6fbbc63583da116822e91f90191d10e6cc203f45441bc84497a8da01df69585c7380e64b86e9e97be01ca28dcfdf1fa8b2867c93
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5w8y4No+gaC6tES:tX2iyphhNgaC6N
TLSH
T1A795BE13F2D900E8D05ED174C7568632E962BC160B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 31cadd1e8f6f4430d6ae248e0dc3b8678d05a93626ed116ea7e4d0fe6f4561fa
MD5 6f4ab3432eb35d51de7a87e8e2270eea
SHA1 42c1cda5afb30e1acce5edc062415bb848fd7882
SHA512 15853efecaaed41239007914e0b834f0b20f7aa73858b39dc63c1cbd84d2ad8743c89f4927096fdf3c11492f5daa1f1e9c8e5c3afdccc1998f869028c22ab2d5
SSDEEP 12288:PddyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:PHy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1D955231D83AF4866ED0C4B33D033A555E43C1E997ACA7BEC7766B602AEF08755C1708A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 def90aae23bf69bbc5a899362bb4358c7bf55000e0f49f25ceec6a31aab561a4
MD5 925c1dec61b2cd075d5c21f93cd5ca8b
SHA1 c40b2b13de6512511246023b829f4a8b4f2d3713
SHA512 f96ef8816df5c6962ec5a0066fdd4eedb8d7451cd83fa35c362ccfa1f08ad949eaac57eb2400fdae3b2c93c4175e735ec66e3b6168542813b9bca9c183781178
SSDEEP 12288:aedyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:aKy4b4qo+QdJacNX9gHliOVeVE
TLSH
T16D55231D83BF4865ED0C4B33D133A551E83C1E997ACA6FEC7766B602AEB08755C0705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 4d1785ed75b4e0d7c32cde17ed2594c09ba32de9ef7d2f50026baf3f57eebb40
MD5 794d7b80a02395485024a64788b45d06
SHA1 b79f130f303dd58a22497ebb6ec667eb09d72724
SHA512 0abefc516aefc7fda3d6297fd94ab2ab60141e4a21f25e8b5a23147a89e00434a6f9e6c8e02d688eb79e83043a82a340ddc4fc73bd674abc259c77ac82eca039
SSDEEP 12288:f4dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:fgy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1A755231D83BF4855ED0C4B33D133A551E83C1E9A7ACA7FEC7766B602AEB0875581708A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0b3b3963682d061d8054ad00974777f2d71209315d8b5a8822b23824bad9f633
MD5 760f15d0cd094e26f3d49ab99d43e145
SHA1 12aaafb8b67b4d9b7b246f87e219ad485dfe0b80
SHA512 f47068ee19f1815b8b8226a74d5c16ccba186612e70060060efa463514c239cfead2635a49142e469d295d2a48d44a2e2e7592a3a0dc12dc2dc63647e1cc68fa
SSDEEP 12288:/VPdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:/y4b4qo+QdJacNX9gHliOVeVE
TLSH
T1E255231D43BF04D1DC2DC732C033A521E47C7D95ABA6ABEFBB117A425EB05A0AC36256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 7abdefeb982fae5c13d30f48cac6b89081098b78d9a807289db29a1addf72fcb
MD5 1b9654b3907e3f9348b53770c856e212
SHA1 c65f1f89b34605df1028e1ea7dcae23179670664
SHA512 2c803397996ef20dfe7a494678e21082c789759669bc669a65d67d3b8e2000c99de3c2832df761d8c349df2bee2fb482a403907337dc16d843613ea57a15e8bf
SSDEEP 12288:mXdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:mNy4b4qo+QdJacNX9gHliOVeVE
TLSH
T19F55231D83BF4855ED0C4B33D033A551E83C0E9A7ACA7BEC7766B602AEB08755C1709A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 3a4ad2ad11d6deb0949be699d27bc3baf2e492a2f4647d248f5aaaa52cbe884d
MD5 f9c5065d085063fc8854a7c9e2759b95
SHA1 afa4b11aa9d6881a01756688fe4ce92af03cb2c8
SHA512 a18df93fba95dc2db802898a37f7a6ec10a4a6508676471b8a3c5c692c31cd556bd98e1744055a7bb07720167abd5dd3c43fe11d2c41cbfb66bb6d527b2c3a00
SSDEEP 12288:cidyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:cOy4b4qo+QdJacNX9gHliOVeVE
TLSH
T15355231D83BF4866ED0C4B33D133A555E43C1E9A7ACA7BEC7766B602AEB08715C0705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 675e8eeaa7608752bca2b9497f687a378cd57c9c2bbf3d21f461c02417ed23d3
MD5 9f5c131d16ba00b33988658827e3ab15
SHA1 9c19f98682453a68d12c54af896e3d190715e020
SHA512 b8d53286e1bd5bfb28efb07ea90a0062203abedefa29fbef243375b92457b5185a3cdf07d01e190538fbbdcef6cec6e4fc31c42c5fe33b75dd021dc1aa8e84c0
SSDEEP 12288:EmdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:Eiy4b4qo+QdJacNX9gHliOVeVE
TLSH
T10455231D83AF4855ED0C4B33D133A565E83C1E997ACA6BEC7766F602AEF08355C0709A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4712207e140bc36cb365f4c6e971beaa74d1699ffd8953ec8bd70155679eaa24
MD5 72156a1eaf9f8812690688bf6ada4cc4
SHA1 8dd0f79d93b67b4b4625c7bc56d6b4743a88143a
SHA512 0b03547664f267717e5caecd5b0dd66621a1930947f2c55a8761832aff679a67d8fa5a432ae814e7627680e6f4110ba3bb77fb31ed272ca236322ad7afb33b29
SSDEEP 24576:sZM2zFVSOqy4b4qo+QdJacNX9gHliOVeVE:sZM2zfey4No+gaC6tES
TLSH
T1D2750259B3A108F4EC67823EC9229906D5B27C590BA0CB5F13B436675F733A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 245ba623958826dcc4341687a8e2fbb462e4cf924ffef97e0def34c77d136826
MD5 317a452ee1bcaa9c6956dc73ba5329ca
SHA1 cf3dda50c76b6b3eb1ae05ac98df15552e23e5eb
SHA512 30689ac928d2e498b8035bf8a879b5a20e43520b8532ddd9e9efd3171fe659b799cb047a63030ec59eda213bc7755dd0356cddc455872c55186622d4b309f0ab
SSDEEP 12288:QJdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:QDy4b4qo+QdJacNX9gHliOVeVE
TLSH
T19055231D83BF4855ED0C4B33D133A555E83C1E997ACA7BDCB766BA02AEB0835580705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 941d65e323dcc27daaeb7f9b019038ae589c25c0b422685268f3f83f2e8a59e0
MD5 31364fbfa2250d2c65e0e62e515ead3a
SHA1 713af92ed44213c8c23c968d9100f101488458ae
SHA512 1576dfa6b05bac531e0c76808ed37b306072f189210f2a7222b84707e9691c67cfd22a79c4dda978f625e8504077669cba332d64a5cecec1c26d893d2e4018fb
SSDEEP 12288:J1dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:Jvy4b4qo+QdJacNX9gHliOVeVE
TLSH
T12C55231D83BF4855ED0C4B33D133A555E83C1E9A7ACA7BDC7766BA02AEB08315C0705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e9be818e7c1da1959f7bc233466406a2542684d80e00eb00491a11939b0817f4
MD5 ac93ed71a93e0a34433625eba5246434
SHA1 05723907bb9dd1e5f617b20e23106a21e3272028
SHA512 a5c24e44669f3dda5f50c236f58acc51c9cc2fec5ba906802e44a68e66e672d6c6730f3e832df834a214d8d4dfb605139b4668140c8e8a4647a1ec8b7f77c4ac
SSDEEP 12288:7yPz5L86dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:2zy2y4b4qo+QdJacNX9gHliOVeVE
TLSH
T13365120B63A620F9D52A8235C4631A02F7757C361B649FEF27A057722F736A09D3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 bc40e8cb3d9ff60a567f1cc810e65e725d8d5ee2e813c5c4bce890838993689c
MD5 82995a3086cb4a742d0cdfb67f942be7
SHA1 7e7fdb630dfc470b5b3bd9a3495a5e8476c9f8b9
SHA512 d663b3b432d0539442d80f0c470c39067923da92e33fd8617b3f7048dc0544430d541de0ca24993d3668c4ccc195deeec29d93e421d89a20885a215900e8bc91
SSDEEP 12288:eJdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:eDy4b4qo+QdJacNX9gHliOVeVE
TLSH
T17D55231D83BF4855ED0C4B33D133A551E83C1E9A7ACA7FDCB766BA02AEB0835580705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 184d9fc8153a97ce5468ee8472b34703d71536cd4a530df15f39ef7e735433d2
MD5 9665461552dc504fc66c679e9d863d41
SHA1 32ddfe95b642b12e6524a425be7047523ff3125e
SHA512 9cef234e5ec6b27dc63787ef092fd5e234f977eba606c7e483c5a4c95740d388f6c7eae9a0a7e91abd52e2ca5e6eda191e0f18af383c9b0f0abb07243ec93b9f
SSDEEP 12288:oJdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:oDy4b4qo+QdJacNX9gHliOVeVE
TLSH
T10755231D83BF4855ED0C4B33D133A555E83C1E9A7ACA7FDCB766BA02AEB0835580705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4ce89eda2f158d7a69417cb91b0ee72f3364273c3f0b22b8e43c4e03445ff39d
MD5 a9f8ec17ff972be10e26e61cb82a1c02
SHA1 290ff207d8051fbffe0305d1c592a41e3a833e02
SHA512 517204c084f08b9d878ee1aaa689284a8700e649525c4bdc40d880b8bc4a505e09a8f5026a776f31684652cce3b2a32e266c9f2f59dfd951bf6f6f6dc20269c5
SSDEEP 12288:JyPz5L86dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:ozy2y4b4qo+QdJacNX9gHliOVeVE
TLSH
T1C665120B63A620F9D52A8235C4631A02F7757C361B649FEF27A057722F736A09D3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8aea94773648adb0dbb9c4235bd8260d7e964ccb6c8e53cf2ac6a0286d516df7
MD5 0886af7375ee7f2afa82b248263c7280
SHA1 ba3a31c27a73903070c359d39b15c16ef24b995d
SHA512 7f8bdcbb9067cf367470395c33b3701de6e1220d964557c4585c65ece07d0f2014e4e469c579597f19322c9dfafe0145da1a988328349e75aa0834f0ad57f8b0
SSDEEP 24576:9TDaLl3z0zDQy4b4qo+QdJacNX9gHliOVeVE:9TuLlj5y4No+gaC6tES
TLSH
T1CE750258B3900CF8EC67823EC9269916D5B17C5A0BA0CB5F13B436675F733A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 138ee74a92e6aa2e7ee0b34b8e26965ec522c7e25421c9c3282e667b492077f3
MD5 7ab2d119e0639f08b36053ddda659720
SHA1 964e48aff49b7ce7e0600d7aa67674b4a3f5ab6b
SHA512 f94de43ecfdbc40f86b2f81cb24555083b96db19641947ba000204aee60622e38412fdf290eff5e26b322bbe643fc5ecf07c4e91b02248c4af30468222e9368f
SSDEEP 24576:g34d9CHKy7GZEy4b4qo+QdJacNX9gHliOVeVE:q4d9CHKyaey4No+gaC6tES
TLSH
T11185DF90F3E814E8F0B78A35C9729511DA767C5A1B71DE8F13A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 e94c5501109b3d385a3d08fe722481bcd1372ee404e85db5d02a9e5b36b7fcdc
MD5 5f1246e6924d759d491bf17f062fdb79
SHA1 72e11bb2b56e87ddb00b2d3feb142c079e79073c
SHA512 fea10b1f30acaa3e0237cb21f4f637d9952a140d5dbc89d21271f85914ecaa8e714f950e78016f69bab1815b6d4eb52244783c7844489e4301e2d9138f014ebe
SSDEEP 12288:zYdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:zAy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1F455231D83BF4855ED0C4B33D033A551E83C1E9A7ACA6FEC7766B602AEB0875581709A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 4c7263a8013e60f846f24720476b0eaeac5a9a419e5054f251617534b8372d47
MD5 371d853fe60a15f4d4470eb17add55b6
SHA1 639090cafe75f8fe291a58de255ad74b9797bceb
SHA512 e3d50e3311a42abaa56f9d371cc7d6ed9b5585edd5333ae7f0206e7e34ed27a517cf8de870270b8580098b1a71a9ad0208ab80851b809a705511fa4fb287d177
SSDEEP 12288:WadyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:WWy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1D055231D83BF4865ED1C4B33E033A551E83C1E996ACA6FDC7766BA02AEF08355C1705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 19352be7b6b23d02f4f98657408be2057386e2068f928f2af4b63f1d48a3182a
MD5 d41fce67da06fd4ec4fee700a305b025
SHA1 af5b66e05b9f31d24182830f3dc15f328e6d4982
SHA512 4ac34f2b7617b9d46cb3ee08d58d4dd81946a77d34503c37f902bf669ea8999444e7e740f7a2bd29c23b2c009e0690c460f489c00b12219d3263c05a122c3dbf
SSDEEP 12288:SLdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:Sxy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1EE55231D83BF4855ED0C4B33D133A555E83C1E9A7ACA7FDC7766BA02AEB0835581704A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 3c8a83d9f97741caf8ca13feec5ebd5882ce491f37d71df841c7791c44df54a6
MD5 fd85e29921a73b1ecb605682aa71ca78
SHA1 80c98134eb0e6462668585b446d090014ed9e188
SHA512 6c33bcfe75035df374f1e591bbba648347b1a9f98acc43b0e7c28d995646a35899bca815ac87d660eafb7c56281e33a874992840085fd59be515c743b39828fe
SSDEEP 12288:FJdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:FDy4b4qo+QdJacNX9gHliOVeVE
TLSH
T16855231D83BF4855ED0C4B33D133A955E83C1E9A7ACA7FDCB766B602AEB0835580704A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 e68685382e7ab352b3f522a2ae2bb7665ed6a475223f660433996ef3b41b93a0
MD5 1c2ece1074fdebee12f468ae361e0f49
SHA1 60b39e293f6e3c5b9ee6517808c4325bd469b8f2
SHA512 b7163b8a2fa17bce1b81717fef1ca45feeece8dcac6b70ed0d44c861fd3a652df8ed6633ce351e64e8097afce89e1d42f99449dba939f4194ef5672592b38ca3
SSDEEP 12288:gYdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:gAy4b4qo+QdJacNX9gHliOVeVE
TLSH
T1E855231D83BF4855ED0C4B33D033A555E83C1E9A7ACA7FEC7766B602AEB0875581708A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 d973f5c335d8b1b86e5526674f724848f3686ccc0085fa5fa88ff831e1a5a655
MD5 51df372c16ea488b32b6fc6ec1a8ebbd
SHA1 5bb8bea55f00a4233209c9c245aba66229d73d0f
SHA512 01768e9c95d977ff90e971b63937db86419a3a819d52f0bac592ad22865a61ee046d6d1cc0effa7f8244e5e12e8cdc77e560e6573c1d63a7bdaf2a2430635717
SSDEEP 12288:sRdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:s7y4b4qo+QdJacNX9gHliOVeVE
TLSH
T1CE55231D83BF4855DD0C4B33D133A561E87C1E997ACB7BEC7766BA02AEB0835580705A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 cc33dfbdcc2899cecc335708d23deeb35d87eacab1ecf55b2a0c5e9bbce6acdf
MD5 2394baa07af99f50408c06b9311142d7
SHA1 25191b28b43122a9ec7808d3b7f84aedb2105789
SHA512 d99ca19a6a61b4d60ae205b6d53b007260884fcff7bc5bc0288585146c6f61aba32272b3ad4eb0103185a6124eba118cea1d229266903b3f8c9e7a4fb2d55d9e
SSDEEP 12288:kXdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:kNy4b4qo+QdJacNX9gHliOVeVE
TLSH
T18855231D83BF4855ED0C4B33D133A551E83C1E9A7ACA7BEC7766B602AEB0875581708A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5e1319be42fb2e9eacfdf7b10f99417305844ba4e4cc0fb353324e636f006a49
MD5 3807e5cbf3a47f01409f1eca76a48076
SHA1 66a61258ab7984fb22cfa21aae3320c281eb40f8
SHA512 d66b948703998a02bedcd0f1845e609307c2ade6f3fc1d4202581fa76db8885998702144f27f3b8191149d645d3facb66813c4d4d3af34f68c87781642d860fe
SSDEEP 24576:RfwvEk9RX6wkyAI/y4b4qo+QdJacNX9gHliOVeVE:LMnYI/y4No+gaC6tES
TLSH
T16C85DF29EBDC44E5E177923C89B3460AF6B178691B31C6CF129A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 957827f59c39cb179ae0305ab41c2df213669f3d65677d578aa706e44acee3a7
MD5 967a6a3d17054cf796a40d1cce9241b0
SHA1 f3502ac91e8be539b254814cb8d162305f49301b
SHA512 4eaf40b0337e87a8f8f89d65570f951e62a25b445a5c559ad272a3f577cd92d1d6f31a0fbbe595bade76377a43e6861c86d86fd934ff1ee84ad2a5ab3b7c1af4
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cy4No+gaC6tES:fySzPENgaC6N
TLSH
T183066C56A1A801D5C1BDC1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f6e0fd5ff9ed787794a42ff83724945b1a962d4cd8a0589e4c870e90b35c0607
MD5 affccf9009580ec8ed835123b23fc7c5
SHA1 2a3c5660b822cacf250d0e7c65730a2b634529f8
SHA512 5b178b58ab6c5e210c41372b49aaea46647c23b889728097863519fcefccf57540686952ec76dd458c4b1e49c50b697562e4d4e3308d180b5528a69613e6a568
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY6y4b4qo+QdJacNX9gHliOVeVE:w47JUQj1irIhCnDHUPfF/sy4No+gaC6N
TLSH
T1EF65AE1DA3EC01E5E1BA923885154A1AEA71782E1F31CACF2270937D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3011cf7c5da40e908e9c81ffbe005bf76e4e1b72fef2bfa76734d9aee0256d12
MD5 d22fe3aafe5bd7112ce17d5934fd740d
SHA1 1c2dec999aab848b03c4bbce7e828cdff716e933
SHA512 9062a132b994bc07e673e4536f034979e2f561a2c4973f525ed7b5d07e3c21cd43553b4aeb4c3ed883e4756f225890567a242973de80e3f9e948382f7d048d09
SSDEEP 12288:9Rsf5dyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:uzy4b4qo+QdJacNX9gHliOVeVE
TLSH
T17E65F019C3A801E8C46E5236C7629A41B3373C6597E1E7CB67D0F63E1F725A09DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d491dae5cb4a6ec3250e7265a6cd0c608edf575c68337d4996c32b920feaa92f
MD5 f7695a7a062c08a2fcef941a3f88d7ff
SHA1 3f48832bbc8701981c854f29bc89af0910e9ada7
SHA512 dab353b55aeb63cb6f9dd66dbfe2d9ff145bd84a719135a1035f35e1f6718ea548d33ebb0864f4a717a827e821a611e45cd8d8820fbd618a82ce3acbf7988a6d
SSDEEP 24576:qbHpUPQ6fMhXnQRkXSrMtoU8GpIbQ2OlCsQxW94G2/C7Se:4pU460xnQRkXSrMtVpIbxECsQm4G2/CL
TLSH
T172451740762BD78FC6A980325E36D6CCA7707C01EE45AE1773C8873F9576668BAE1381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fa274136f4d59c1673247d2401db41a212347e65404eff1674ee45f7ce7b4049
MD5 b688597063d31f4452370d7e2d6f50d1
SHA1 fb6057dd61c4df4c10841389a2eb5de314458df2
SHA512 b518ba8adf0a677ffabbf32c4245ba1dfc11389266d74fe68f5fe891faf663de9ae5c5bbba28014cb668146a40fbe35672d372f020ec0219e07d711f0f74523c
SSDEEP 24576:k6R+sprGEjVUTxE3FFWU3g0nQRkXSrAqPiQTTV:SsprGEjVU0F3rnQRkXSrAqPiQTJ
TLSH
T11E654B4165B7E34FC9FD90374232968DAB795C06BB453F0473848938986BA7EB5E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 87124b4c2edde68f610e654ca0dcf9db8d73a605dce3b967c943d9de71a88032
MD5 60c48a7dff8d13f0662e96fd5419261f
SHA1 f2f8be361c2c84e032b905fefcdc4d8f2e71e086
SHA512 bb099b970fecf36726ac68b05347cc46664aa7b51a1b352a682bdd539fa5ce170bdee86ab1a2f3b857103187ddc605b15d9837d230196235b9bf3c7f5e5584e4
SSDEEP 12288:oU7BdyzLwb4qwxUyp+E3YkJact/Xr/LlrzXglt6aliOCXnc4EUJVE:Rry4b4qo+QdJacNX9gHliOVeVE
TLSH
T14955232D83AF4855EC7C4B329037E520B43C6E645FC5ABDBB615B742ADB08E09C7620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5ce740ced28b3979614c79cd650c6bd20e8920efb8a5cf15179c45bb7961c758
MD5 57555e5c8a2e43eac04b8731665f0f78
SHA1 136a63de2f6ad2550be9669e87d27633a5f38214
SHA512 2b9389b85224ea6faccb87103eb013c6a731fdbc0fe48d25371b34ff4546e53267920e61361eea022fa1c511957015f265cbe4d02f9ee4c4231fea4e92dc3161
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bY5y4b4qo+QdJacNX9gHliOVeVE:Kgb4mBIBhGF6y4No+gaC6tES
TLSH
T1BC65AE1E22EC02F5E0F9D2B8DDA64417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 21f308525118780930a940e6f2a24a58898ae074b7e4e255e697fc57cd3ae20a
MD5 992f6ab8e0c85c4b1c5dff0dbab6ef13
SHA1 2733b920662d79d19478f92f923d8de9f6d2fdea
SHA512 ab5bf8b94d8321060c9694d457605915d9e3cd5e533d9997fcc1cbe72e1e493d81bece9a3fc0f14522e7181140e439f6bba05d355ba2cf54a7f916274027590b
SSDEEP 24576:EG88u8FpJqH13zria7/mqy4b4qo+QdJacNX9gHliOVeVE:37ZFPqVKa7/Ry4No+gaC6tES
TLSH
T1C095F125A3E501F0D47BD13889924663F6B1B8251364EFDF07A88B521F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 28c580e4f8a7e0420f90121b76ab1dea5359ac5aab426cf6a8a7316c5f9a6fb3
MD5 3cfa07047f03aa0884d1f3e909eb8026
SHA1 36d8cb70a29bd284382d8d0cebe707b61314cdd6
SHA512 b438a229f9f960ee6702d63d242cdf50bcc0aa2a8452a8b1656d72e15c130dd2ee32d41fd09cf517c22e8ff59d66acc1738527af65e2ea929a7d4258edf16561
SSDEEP 24576:oPUr+NQey4b4qo+QdJacNX9gHliOVeVE:oJQey4No+gaC6tES
TLSH
T1C575F12F23ED18E5E67AE13D85428619F67178621752A2CF02E0917E5F73DE8BC3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d149464acdc1d20d997bb046565f3049485f49849851a419b3dd6ac3c236c290
MD5 f428c98b989e5be87acc605a33e4eea2
SHA1 4a8e824e6b4c6e6a7d4359c0e0660246406e6570
SHA512 c238f89530600573eefc9b557eca8a3b9288f842f65b9f4fc6c71f31030bebce80aa03765aeee2f8f9a6c477559e2cdda59022781634926b28bbe8704e8b59a7
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOy4No+gaC6tES:EG05lO43bXNgaC6N
TLSH
T14ED5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 94f415f72229f359269af8c79803141887390f662ba2c61b7fe24755b0dcc6cb
MD5 af39c6699c446a2f55e56ea45392dc36
SHA1 cf334e135b3ededb56ee9f390c6c7077a2e5b33a
SHA512 c0a9d86c3a08a4c8865eb04a9db67db648d43fc168277bea5176bcd641d685f202f9ef0781d4fef37f5fc287f7a5527c43f0edaf9cffa345739a4a5d3b838f6b
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidncy4b4qo+QdJacNX9gHliOVeVE:ua5POZ3+Jt2pasx2+mWy4No+gaC6tES
TLSH
T14665AE5EA3FC00D5D579D17DC583861AE5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01e3191ddb31fdcadf17e9b1d199b14677e98fdf1454cacc93e2cfb4680a011a
MD5 4851d811bf81ad738368fa0b35f0e47c
SHA1 6a8ccfb0a937d43e14a78c18b038f6d29bc7f6f4
SHA512 1430180b622c25812fbba99418067796b07e037ab1817eae29be29d5c6dd555a6f55df868ed7ba515be6e942a2b7ff1f451f184bf4c4aea42266140c1b7b363d
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkSy4b4qo+QdJacNX9gHliOVeVE:eNc/zEOVHFxy4No+gaC6tES
TLSH
T119858C1A23E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 de4f7a3760c5ddd9cc13d10d791c6e0ed5cad3be29acd58a1329ccf429e18b02
MD5 51e0f705ee5b260bb48ac7819a8137d8
SHA1 ec79def7cf81951b7535ad2376eafd4f1caab07f
SHA512 d24eb705cf5a653118a70e53aeba02c74f067df8121dc1db1c3c6d2456001846896a208a29576f30eca25e4efe114c446a3732269b052d2ad052a0ace1255343
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmIy4b4qo+QdJacNX9gHliOVeVE:G8MwBtOmIy4No+gaC6tES
TLSH
T1BB55AF2EA7B846E4D1FEC675CD238512EA727861073293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 aeecf83349974cc6ec3f4eade052ebd5dd5cbc646f127a87a0773621a91be38b
MD5 e2ce918732467e1b79a9b44044bb1c34
SHA1 0d4587ac264b6ccc174d1ca1b98f5b260be20347
SHA512 b97b732cac28100daa4ab47658f5c9193b338f084e8aaa22f1934d6aeb9524223befdae2e4ab215b32fc4dde23b54d184afca1cf45a35402cbe24296c189d6f9
SSDEEP 24576:RD3FHshBIYQgAny4b4qo+QdJacNX9gHliOVeVE:RDVHeBIAAny4No+gaC6tES
TLSH
T14185E13DE79D04E4E47AC27CD6638A06E67138A9032266CB12D4D1B65F67EE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1456-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1456-255-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1456-53-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/2044-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2044-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2044-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2044-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2108-313-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2108-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2108-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2108-101-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2108-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2108-107-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2480-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2480-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2480-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2480-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2672-64-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/2672-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2672-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2672-283-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/3508-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3508-121-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3508-114-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3508-311-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3772-78-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/3772-295-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3772-77-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3772-83-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4528-76-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/4528-1-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/4528-6-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/4528-7-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/4528-0-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/4716-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4716-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4716-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4716-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4716-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4984-22-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4984-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-14-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5032-318-0x000001FA56A20000-0x000001FA56CAB000-memory.dmp

Download

memory/5076-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5076-51-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5076-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5076-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5076-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5076-37-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5320-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5320-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5320-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5320-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5320-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5320-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download