bb9de62b3238a798a31df7792f023a2661f31d0dd101392461ebf93d6265f8e4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.5MB
Sample260922-mc1w8stdlb
SHA256 bb9de62b3238a798a31df7792f023a2661f31d0dd101392461ebf93d6265f8e4
MD5 c1e87c72ad72b29d60b67e54cf3de4b3
SHA1 31c14f2c58fbd30de4d5f4c6b4923ba77e0090a4
SHA512 0b56cffaa99dd6fd5e3a0911d3a079f51e80c9711c94f356e7c9bf0fdb9ff4f47ab4054ff56344de153479ed41db4b18647ec6ef2c28bb939475a4be28248590
SSDEEP 12288:KUYJ9bigSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:LYJ9b08tEihPh8eRbXmLx79AkpGb0q
TLSH
T18C751222B6D0C4B3EA73543009B4C6719A7DFC724F6049EB93916BAF5A346D089397B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
928	elevation_service.exe
3652	elevation_service.exe
1944	maintenanceservice.exe
1820	OSE.EXE
432	PerceptionSimulationService.exe
1652	perfhost.exe
268	ReFsDedupSvc.exe
5524	SensorDataService.exe
2696	ssh-agent.exe
4920	AgentService.exe
5700	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6297e9297465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fde823f77b4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000511545f97b4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000410365f67b4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000403971f67b4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	4920	AgentService.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: 33	5700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5700	SearchIndexer.exe
Token: SeDebugPrivilege	2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2800	2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 1120	5700	SearchIndexer.exe	100
PID 5700 wrote to memory of 4872	5700	SearchIndexer.exe	101
PID 5700 wrote to memory of 4924	5700	SearchIndexer.exe	102
PID 5700 wrote to memory of 3744	5700	SearchIndexer.exe	103
PID 5700 wrote to memory of 6048	5700	SearchIndexer.exe	105
PID 5700 wrote to memory of 6020	5700	SearchIndexer.exe	106
PID 5700 wrote to memory of 3752	5700	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_c1e87c72ad72b29d60b67e54cf3de4b3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3652

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 37dd871c1906b33b05e289d0d300e15e15fd6a0c6dfcbe20a06ec853ed3d2171
MD5 f7907d4398d93550acf1f40bd00be541
SHA1 f8865c243e4e5d554ad3642e8eb5c64874966be7
SHA512 0d372dfe7a0f7393c974925c70e79c85d66b44aa1d5ba874b690ee5258f32a56dbfed9a0579a259960ecd64eeb60c71845c4137aa9e2dabd61530ce9abc57959
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnThhPh8eRSGbX:T3q6HjByh5vSGb
TLSH
T194D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 fb88480b8efc141acd2a19620c5af61e8260aca2c625ef50c61ab6c97498c68a
MD5 071a8bd78fcceca9e553a46d06755da3
SHA1 dd509191e52ea6b3b1bff6ad3ce77ca54118ba7e
SHA512 4d9fc3e71944915e4bb68da6852ed2095f5b46458a3e27ec904d3331170fe53ba160dbb97e8469f3e71155c26529ab55d1b201fdc1907ed1341dbbe1b894219b
SSDEEP 24576:mXYfDtczA38tEihPh8eRbXmLx79AkpGb0q:Ftc5hhPh8eRSGbX
TLSH
T1C7750129A7A409F9ED67823CCCA18411E673BC5547A0E79B03E4D96A0F337D84D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 fa74b99c6b9713a2c37087d1ad08dc8abe94701d0581f5a066bbe7993e026950
MD5 14a4b9449b80569196324a330986398c
SHA1 ef14d7a74b4d1f59eada510af9f8ce0fa627adbe
SHA512 9f5a75bcc08e55307dd341262c50992340bba6a2b979fd74df36a3e934416d56aafdcb30793a7b8b62d294702b403a80d2461faa589fca8e42a8ff8dc25bc8fa
SSDEEP 24576:J0Le5ji0hmxirM+8tEihPh8eRbXmLx79AkpGb0q:JPji0AcuhhPh8eRSGbX
TLSH
T16195AE16F6748331D073C0B9C5D2A69EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 98f630e0ff3cdbb4507ea1ee40181e45898256d952b1d4bdc7f800391463d435
MD5 8286740ca021d965fd7a6f1d41bd9fde
SHA1 b865a7976216f28f7c3be7924dbba0e6b62c4c91
SHA512 af2020a6d5ed6d3495857494cc3b69d65d33bdd5e6ebcb6f920b3df7ef38d47121b3009c675d3a2046fc012036b48d05f04afc646e4443d8c566e5912214f06c
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyu88tEihPh8eRbXmLx79AkpGb0q:T/ezSC6vUzPvxHjyahhPh8eRSGbX
TLSH
T1B6756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 497d026b0c85bfce01e733508045e8073d9496aaedb26a71cf3985ed66a6c04b
MD5 51c4de35fe9a31d60c99a994a42b31ad
SHA1 fff8e67c86213055b97a4f56881f9ba659c66e54
SHA512 9c43b5f101bd0673fe477d76e3953f9c74a12b07ebee3c289ed3ce0a24330d3e2bdad3010db9ae40084a3019c466b8ec4dca0d1218aee6894d6215352a4fe62b
SSDEEP 24576:zVbqPb88hv/l+6z8tEihPh8eRbXmLx79AkpGb0q:zVO88hXl+3hhPh8eRSGbX
TLSH
T1FA559E66F6748331D073C0BAC5D29A9AEE3234425B31CACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 724a2df691774384912d80660789dd74798341d79d9e0126f80ab33e017ddb52
MD5 f579942ad33b400e11f1760d64c5969b
SHA1 bf296bb8e7042182367ca60f6bfb1d7acfae0707
SHA512 a2b30dad531b3736f5b175d58da28f81b49fcb9a24b23427e0524881ac0e6feba3233422fb3ee8d244e0c551461a866eccd6b35b4affb6918a4c2e5c480013e3
SSDEEP 12288:gR/SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:gRK8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1E9652343CB3496EBE337A6702D24847456BBCC9985D48D53C6A1F8AF80BDDE6C0D52A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 0dd3db7bfb07bfa6c6b67a1aade52579a1435998287f7adfd0a2dd40dea43a22
MD5 934ef8306d1a71ae6eb67eba3306cf72
SHA1 1ed1a2d180108282c2c0e0ac3f7cf5c08cd49a7f
SHA512 f9309e363ea6c2c407a3b5e812a40d926f448308ec4ec35915a0197815e2dee1510877120c307801f3d48a050603c95219ae388e0b2a03a9adae9f4898a64988
SSDEEP 12288:HeBNUbTVO86UASwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08O:HJIUL8tEihPh8eRbXmLx79AkpGb0q
TLSH
T19E75CF3BEE28FCE2C27A9DB85A518640D77278704B6293CBD175C20EDE235E14E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 469adaa88374afa08a4ca4c156fc201aea4c7b2e50d07af80ab32e95bb854154
MD5 d557595f0bc3609a296df463309bb60a
SHA1 89d009726ad33c7aedf87c2567db07ab2355c1c8
SHA512 e5aa84bac714beb60268a7a4baafb756cca22864a51232480f7fb4a9943a897532ca11991b0ae007f9826bc262476839be2008f5838275da6f78372a48a24aca
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:ZQvGAdlCEL8c/yRNw5Cfh5vSGb
TLSH
T13C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 31cfd15238adcf25b03b2f0fe7c39650454f47fc30853de5e4eb99c05c4fec24
MD5 5aa71098f48a44ba64d2594fd8be37e3
SHA1 f233143013255ae6fd4a7648d3654ae01bb00e65
SHA512 0a46b08471525832d4b039f07426d2ed7bb36ea35dffa18d22a51d540e88ce7300728d6b890baefad84f8a03de4e85e48c3a306f2b166a53623a8f8851787047
SSDEEP 24576:0dewsAj58tEihPh8eRbXmLx79AkpGb0q:slj+hhPh8eRSGbX
TLSH
T1EE85E031FE74E036C37B0DB61B25C716147DB9204BA11AC3E3E88E9E59742D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0dcf9041d1313e1338f87683186f90fa85893c6489c434e335e4f1c6d1f615c0
MD5 c586e11298dd305f9807ced0ee062cd4
SHA1 efc26b5d3b86b1f6f7ac569707a924b5c62b85eb
SHA512 0fe28ce2b8f368dbc6ecce0496d92be7342426a597afd0ca5f6ff12cedc4e91f13d4804d989b1f0f7a852ac418c68631a7ae24c6f3c68569e78e1f2bef1c024b
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHESC:2UEtQevvqc2W1cpV2EI32
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7be69a229cc555ff82ed8ab4e59c9f0c4723ee65aff8a641be620bf1bd353d27
MD5 43ae5576826ecafe18b9d7ecd6a65ced
SHA1 e968a6449e2e575703ce51b1da2cb3f61f33e715
SHA512 d19a6a80312c0bc81e2e289a9aae8a9d7306f8527bbe7ded01fe409574cc407164403b10ba8a6d8efcd0fd72268cf1030c140245f3caba2d6a23fe3e9cf8e369
SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/zehhPh8eRSGbX:6oq2VjnmLh5vSGb
TLSH
T181D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3a5f878b5c533dc5d0c26f8aab8e680be7e3965ac2a27d1985ba8876587edfb2
MD5 787483acd2f07290a249bd3b0c0b332c
SHA1 7096364f8e75aa8c119c74aebde728488fc9fac8
SHA512 50c99d360d862fe96cc3ecf0776e6d71959ffc74fc23b0d125a3a75c4f5aad1bc3f1e3fe14fc1e4259c474292781d597f56b11eb632aa499a6f2a931f91c1984
SSDEEP 24576:DAhGLJIFoiwtA5l7S53g8tEihPh8eRbXmLx79AkpGb0q:DAMyFoiq51hhPh8eRSGbX
TLSH
T100359D81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 5e72b7293fcb500ad02a72f73a4dc80ceb8fed8525540d8b2b90468fbfd24543
MD5 d8b42f78986484f43119bcb9b47322a8
SHA1 21645bb5ae418f66ac71220b8fe9de32c454b395
SHA512 33038a09cdea615056c4c971ae8f51453a5b88246d457cbe41b6de834434a9b8b6a9e41649c95c4d9c8754e2ca95f90178f18d9e47650682651553435398a952
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CpSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsK:9wuoOWd8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1F975F14677A41CF9EA6792388557C136F7F2BC022A21CB1F47A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 caefd22ec4c92f0bfa5f4584e3efc678ce982985610dc5a92045a6d994660e55
MD5 c7d17b169ec6ae33664fb9226abb52c1
SHA1 c739bad24a579e3675848afd900745e24d8dec74
SHA512 5b6a6aaf9b778a878631036ec406f1f49cac53b1ca6c1a45c38f624857675285ced62a04582c55be008f6eb9b69d7ce47dc81fa28b4c42a029387f2b3856c48c
SSDEEP 12288:dBZ1IyWSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:7Zu28tEihPh8eRbXmLx79AkpGb0q
TLSH
T15465128B23A461FAE273923C9DA04515D7B2B856637183CF426082AE5F77ED24D39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d1ec94b5b90fdb60e67c34da4229d6a189eb6398166a667fb25172ffe317ac3
MD5 da29aee00ea32922a4eb5f3623b7e289
SHA1 eb405e4ea68abf8a5f007997b1840ee27c6b1d14
SHA512 61a663e387a9b511e47b28b663dc36b795c2d263a05073fe09a25120bf87d8fe06fe4b3e4d5020bb4b14634e6efdb5a01922c88e3e4cb4c670f10ddf9f8e2af3
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:TQRQyi36YOcPQLvw2gAf+PN3Wh5vSGb
TLSH
T187667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 49499a2c8e613b0b78ee7106137c4a6dee43ac1d578d916ed9e19d160d4f1358
MD5 d2ce56a343c4dce556da3bfce9d658bf
SHA1 f24790b359bf587ad0f77f2632bfc4258f3ffcca
SHA512 54f0cd728be2bc9db5fe4f75d1f6b4e871d608285d46eed2d4e5457c098acf4b7891e0b8a0c9e7948c6d39139f8c10ab3601557f066ff885c13f52d93f86c00d
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:mQRQyi36YOcPQLvw2gAf+PN3Wh5vSGb
TLSH
T17F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dffe44e5078d0cd69399191fa8e593b9ec208a44ed424075ed5930a02ea78b70
MD5 baacd34eac7615d2230cfca687014a76
SHA1 91ba2a15efa20914c08e069a993baa2b8c9fcf71
SHA512 2f5eda390c5ab7695adc962aba3adfdcce4ab6318632c668fae8066dc78d68d497a18211c476a078a8af85e9f5297eeed31c3f09cebdd99a9a1d9ebbdb6d1a8b
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0G8tEihPh8eRbXmw:K68Qg55nhheWu7PNU3/uhhPh8eRSGbX
TLSH
T170B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fd0eabaed4624b1fe9510c5229cd454503c9271f80d66b1b24178a58b77e43bd
MD5 39cc05c3261d392be7ea96e5c5cb2d97
SHA1 b903df5085f561be22fdfddc7d333a14e4563c0d
SHA512 c9dd41c44c3c133c0dcae350dbbd3e9cd595ad896a5e41af6dc209ede9e2f28768679b30dd69b0e929f6de6d1371516cae73e0c8b6e739ffecdd7158d2c62911
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:Qy5112gYy5azzVvL69nLKnhZJh5vSGb
TLSH
T1DB168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d358d075dfe97f09d62717f17d2055ba33db55ca37fcf76014e752b7154ac862
MD5 409fc48936415f570a1b315bca5103d6
SHA1 c51f563ef8ad710d29d6c5c859177a7d2052ebb5
SHA512 f60cebc967da34bbb095fd558f5d500869586f56c55a5871458d0b5461a415540815504f08e5a82f22fb5b60000035e4f7e4b66f89869cc0ceefc7781bc901d9
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glchhPh8eRSGbX:gu6JmVxd2d+h5vSGb
TLSH
T16DD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54f8f3b76d676969266ccb6e5822e12709d4c71e94920a2cad5c0205719c1d19
MD5 88ee586673192cd40eb30cfdc3c14cc0
SHA1 6368d784c675329a9a1618ede154c584b3eb32a7
SHA512 b5a413936ba5ae22fa5a0fd8c6abeb582da1df774c62a2fd5dbce875e3c7065bcd786bd86e05398699678c4e13481cf794c1428eb072aa6b2249d88e0a6c42d5
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xohhPh8eRSGbX:OmifPbRLh5vSGb
TLSH
T196B5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 32781982bd16d8b28ea0c0cac4bab416dce888c142b1c7eeec1a082f1a03a277
MD5 c9431771fa13abf327a57d75859861f6
SHA1 7c6a3fdf3af9f9db76d693918ec389c18415ffc7
SHA512 9a8ce8afa5e7e57579984c3f87f8994800c4439587a088242be05a6db2a59b60a4289a768309607666294cc44e75931404b6fda02818ad63d11ed85fb8e3f62e
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqjhhPh8eRSGbX:e5dKTi61dh5vSGb
TLSH
T1A1C5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 940bda25416b1125289119bae148276ff5ebbf530503d2b28f3693af23bbd878
MD5 d94617a8276ae49ded57f72a425b4040
SHA1 52ac592454366df82e4d262119eb05516a361751
SHA512 56ad9895adfdf27090b86f328bec8028257bbe0e2c5868f38803375853eef6bf759d6250e96546f13e5dcdab0bf14758c5f991227379f06d505d9aa0e2c9d8f2
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wshhPh8eRSGbX:3X2iyphXh5vSGb
TLSH
T12A95BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d75e0a3ac863ba62f027b52f4767953a3956abd521c06a465d424101eeee5a63
MD5 3517f53bddfe304504b98a30ab19e26d
SHA1 69b7bbfc8b65803856ba84a029dd8d77c6defa4d
SHA512 062a8dbc1fa37e9f9ab3c1e6a96607c463955ad5db2bff63d186f19137a261a511446d5efd77a0f6f6f8352d0bb14862aa2f6a872ad65d8ea479cc8c4f08c8a4
SSDEEP 12288:2XSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:2i8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1D4653343CB3597EBE333E2706D1040A4A5BECC8AA6D18557C6A2D42F81BEDE740D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ec7606e0b041789aa3fbf8d8a11f424b5ee2b0c750c5ff0dad6186f38840bdb5
MD5 f280457b896a72b4dc018c2fd4ccb97d
SHA1 6492455f283a619dfc9a4495d66125e8ec2d39e8
SHA512 21cd7a55d2e5780aea188429079c54f58356e253a539bd67666fa3ef7a6d367c4027f4ca2b0c1c18b741559e8cfeda403e82fabdb9e3d46baaf004af8375d56f
SSDEEP 12288:naSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:nl8tEihPh8eRbXmLx79AkpGb0q
TLSH
T136653343CB3597EBE337E2706E1040A4957ECC8AA6918557C6E2D42F81BEDEB40D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 39e86455508fad0d9f65aa625f5f945f3e1c961e8d64405a6717ccc6cbfe180a
MD5 30c8297d4ee5146742954408805b36a5
SHA1 e93839d933d31737c8e817750fde2131a1d4af3e
SHA512 49301971ca268fbd46d355abf90d46de2deb0ae31797a42bc2f054c31349cac8b11aa33ed11fe30fa7b6716300a2a3d985f9403b65cffff346fefa5bdac6b094
SSDEEP 12288:9YSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:9D8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1E2652343CB3597EBE337E2706D1040A495BECC8AA5D18557C6E2D42F81BEDEA80D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 d3b945cd782552f36e298761b4bc4e7060aa3c2c1b8fc7e10b43f724bcee44c3
MD5 8ef15a2b4a3303c17fc97a144e759237
SHA1 41ace59ca63d4438a4661d714bcce6370f2ba2a9
SHA512 95573fe75fdf2c06eae948f82bf8985c7c8b0c63e903aee4e881fd164b0dad59b4f0bb6f722ed6d13072f084efadd1b7ac5e0a19c043e20bf9894f78e0e3d28a
SSDEEP 12288:nVVSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:y8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1006523439B3942D7E233E2748D208064E3BAFC999771879FC751886F05B6BD584B4BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 50055e1db66d072aad48f785c74b72dc1e68bf1ec3a767c050e0783c1686a916
MD5 bce32d6646ba2b0fd2e565fc9965b1dd
SHA1 b5a3c1fb6751cccc4a1c8f250681d03d65f2ccb7
SHA512 2d2594467bae3679389329c365fc577532016a8e05f397feaf283fd185bef1b1672ad0e35e4fd8e8e914af959781cdf82bce44c5c5ef1e42d0edd228be4e3652
SSDEEP 12288:W9SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:WI8tEihPh8eRbXmLx79AkpGb0q
TLSH
T18E653343CB3593EBE337E2706D1040B4A5BE8C8AA5D18557C6E2D42F81BEDEA40D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 19489b0aab79843643c414f7b17c7067b0e67a1505811780026079c959c11ebb
MD5 741f36470e3a8a5af1c50dade626e793
SHA1 3ac45a8c38640e5bb39d4d3e2108ddc16ecbceae
SHA512 2c28cf2a1824d5cce29fda912f5ffe4179128387f8ec6849a7e547da75d722e5273dbe51476030fa9706d84516d7a48ed52d0d694f9641af0bc1a1821570d58c
SSDEEP 12288:CeSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:Cx8tEihPh8eRbXmLx79AkpGb0q
TLSH
T171653343CB3583EBE337E2706E1040A4957ECC9AA6D18557C6A2D42F81BEDE740D46E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 439bb38f0d84342daa36950ddcddebfcd8e78ee87e7352f2cbe3c33ccc921ace
MD5 a716c1485262a0521698a0dca0a9cd80
SHA1 b0fe6a0766a3f0c30d0c2b32302917f5922e8850
SHA512 f85d94574d1bc1b211849c110f4cdf2ffd784dc32014f4edc4fc705b7dec7297b649ad77695b77a9623d1fe08a44da9cbc38a27d83671105177fcdfc469813c9
SSDEEP 12288:niSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:nt8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1B8653343CB3587EBE337E2706E1080B495BEDC9AA5D18557C6A2C42F81FEDE640946E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 be0d19d0a1fb88a5c4a2a2e9892845cc017a2b496496e777e9da8769ad9f0ddf
MD5 71fd3467f045f222de8ccff98db198ab
SHA1 210d360580bcd26e0cf4ab495b5c3c31a934e613
SHA512 b8a1c06929af3526f21c4b1b2b57899e53e457368fe46d5e0ee0512bd9a36df4b76840eb9aaab9decfec09c3eea28776bf13c41f0dc27738cb4ad308a6ea53d1
SSDEEP 24576:gZMSzFVSOF8tEihPh8eRbXmLx79AkpGb0q:gZMSzfmhhPh8eRSGbX
TLSH
T1F7750195B36018F9ED67823DCD158815D6B2BC5A0BA0C61F03E4366B5F737A10C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4ddd4b8f4986769302511e6eeb96642ac8319d8dae06372455d5001798a36358
MD5 d0d362f14aa61008c58b52c172a703e0
SHA1 7d9d96247005fbc98bf5316bfbc47accd343a2f8
SHA512 d659e9fbe859be729e027d39937f7f70df6941d75044439a1dd57b8f096a41d32c72f830721343dbbc1a3a663fe5c24d34056b452b6fbd3d41e4e085ff4d6510
SSDEEP 12288:yjSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:ym8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1B4653343CB3597EBE337A2706E1040B495BECC8AA5D18557C6E2D42F81BEDEB40946E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1ebdd9377988174e06bb6d2d8ac42cb36ec353c593202f20a0a997284ca35597
MD5 b1b446a58566fce181da5d020fa1d4f1
SHA1 629d1c1f7b62210c3211ab381e95d805db7fa38f
SHA512 79d4d8f3261d21e15a7dfaf8098b08c92fa69dd8926512dd9821ad2bc2ccd9fe56350d811ec4d4d2f452a6841eb53c72e9a48e8ea04966939e3ef5a3964c96dd
SSDEEP 12288:sPSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:s68tEihPh8eRbXmLx79AkpGb0q
TLSH
T147653343CB3587EBE337A2706E1040B496BECC9AA5D18557C6A2C42F81BEDE740D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e4e5b9ddf85b11b218edabf2ca04dfa14d8636d581275f57c2f2a2407df0a16f
MD5 422422714416de5a1a12f49856b857c4
SHA1 0a01f40b7ba053337534c101ad36a0da1806127b
SHA512 5bf887116012c9ea41b4ad826c0fcc30b469ad8c9aa4d858359a137109e4e71ac688b8d4ea97ffc3d106a52fa8a18d2874188bd074a70bfc78134e53983a6443
SSDEEP 12288:UyPz5L8WSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:Nzyp8tEihPh8eRbXmLx79AkpGb0q
TLSH
T10E751207B7A131F9D23792388C610911F7B6B83647608AAF43A0467B1E776E18D7AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8851163e47331c58a1280758776a5d0e5142f4b50c965a790627fb90114f0ff7
MD5 6e4058916ac7d2397497d9c52d63a558
SHA1 fe5c59eb680f6a26dbb2550426fc9a10802e467d
SHA512 27e8883e7e97b2f545cad81502931038e24aa8b3ef562f621b5b3167466fa424a5f2f0b8e8717a9ac1ccadb5fd2537b1d72e2077f7f15e49363991a60b0488f7
SSDEEP 12288:vjSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:vm8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1E0653343CB3597EBE337A2706E1040B495BECC8AA5D18557C6E2D42F81BEDEB40946E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 94983ea26fb614e848df945c819101c3670378c212301aa5d5596f2d0a41badf
MD5 f61fb2d818262270c240eeaec184d246
SHA1 d02e901c911de598f5ce15db997a545cb7d5449d
SHA512 8f96e0f768e2e2088411d363bb655881de859f9d8253e985e48b976491ad9ba4053bc431e91006fc270c20b1d8f3c41d2db84c8762965f09f50b082c182995d8
SSDEEP 12288:jjSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:jm8tEihPh8eRbXmLx79AkpGb0q
TLSH
T15B653343CB3597EBE337A2702E1040B495BECC8AA5D18557C6E2D42F81BEDEB40942E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e32d745dc73afb6be08c3cc9ff545ef677b8a01058b68620684c1c5ff2b66bb6
MD5 042454dd80e69ec563705fd110b298e3
SHA1 ac5bc819d97ef1854f1a19f16a7435cd4ccfb8a2
SHA512 68fc188b1457fbb8d9c76efc565f5c0658e1727969b9eba292c104d7536158ce3e3110b708ce75b0c77cf6e99e4a6f0424d7c0ebda2bccb6ecda254fee3005b9
SSDEEP 12288:PyPz5L8WSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:izyp8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1EF751207B7A131F9D23792388C610911F7B6B83647608AAF43A0467B1F776E18D7AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 feb168f0e7c094952fbb458e8be37d0d8e612ed717a4bdf74815d7a7f717d679
MD5 608fbc0cafe0d283ed6ff6fcbdfdfa8b
SHA1 9918a9bd8a4f01739430bd4269025b3cc8430114
SHA512 803c15ec606063357cf690846e932408219a280b937a204f6e45e33af132d44f59653b770213cb83b888f015a9c35b9d533b005d52840ae14a0fa3b646e9cf8b
SSDEEP 24576:xTHaLl3z0zDT8tEihPh8eRbXmLx79AkpGb0q:xT6LljJhhPh8eRSGbX
TLSH
T134750195B36018F9ED67823DCD258916D2B2BC5A07A0C61F03E4366B5F733A14C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c822699d9176b5e48f2a3328c6b60de229d9fcaa06c2c7b087e6523dff29ac1d
MD5 7846f8cdb50d6a023c25fee0af926799
SHA1 53132a07fdca8bc294a8ed9ff05f33ed51031480
SHA512 09258d14f22402332828cf073389530e57e892ec993dae8ebd7b5ef2a6e97c441075707377e4cc238b41f5e80a17841592afcf59fab580ef9ee5c2d7c5be00f5
SSDEEP 24576:w37d9CHKy7GZP8tEihPh8eRbXmLx79AkpGb0q:67d9CHKyamhhPh8eRSGbX
TLSH
T10A85CF91F3E410E8F1B79A358D768511DAB67C9A1B71CE8F03A4651A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7ad13040a0f983ac496f56f0599be86b9e79c5b10fc89ccaf8a5b15f937874ef
MD5 bbb280b795a727a938ee8a8db8768cee
SHA1 9f45726745919905b6a8d4da81bee173163c0b75
SHA512 03054a7bba0640f6b49e8005198a50723015aa115ce74b9c2e2881d4d2a2a866be49322570ef8845f1dc5477c258485438428267e04668dda2c1180d8a000833
SSDEEP 12288:T4SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:Tj8tEihPh8eRbXmLx79AkpGb0q
TLSH
T154653343CB3997EBE337E2706D1040B495BE8C8AA5D18557C6E2D42F81BEDEA40D46E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 547d7671451b727a11456831aaf987dab560021c3b55976dc4cbce8b89ad47f1
MD5 7ea6cef744cd3665f668df5cf30adc10
SHA1 45f5708ee64562f2ecf6c67574d1705529613082
SHA512 1a0a8d5bbba7054c2804202bbbb0a64736f2e58caba36d85f9ba09830640b35776899fd575754c859e5befab04a8b497091794b0de82861f667970904050de6a
SSDEEP 12288:R2SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:RJ8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1C6652343CB3597EBE337E2B02D10406496BEDC9AA5918557C7E2D42F81BEDE780942E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 58ab9d282f53045bd043521b919b43a9d1b90f17cc2e2cf1d21395b6d5660c61
MD5 0ca7216fe5960afd97c4ca54c7ff5e93
SHA1 da13cd1dd21603bf5e85f782e352e991afe05600
SHA512 bcb3e2e35b9a25c5e842dfc0775fe9f8f73d894fd1637ea1bef389bbb24bac6713a8bfd7fc78df1b3bd55efd63fe8fd7afc7846e96777d955b6decfcd7a548a4
SSDEEP 12288:vRSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:vE8tEihPh8eRbXmLx79AkpGb0q
TLSH
T153653343CB3597EBE337A2705E1040B495BECC8AA5C18557C6E2D42F81BEDEB40942E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 43c0b0a28234581060923a29e7f1c158897ac3e30593e77b0636e7047aa65a0e
MD5 a31ed0aa0685698a0e21cc37e1593c7d
SHA1 155057d7d8fe225831b04f352aa4a5a57ec7da34
SHA512 db84cf5b066e29a5207248317964fc4e1eda77109f3789b6dfadd130dd7dee5307fcc15dc4d14feff58e325ca14babbc375d4d2cd22a336541daba11f6d2d450
SSDEEP 12288:NjSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:Nm8tEihPh8eRbXmLx79AkpGb0q
TLSH
T1D4653343CB3597EBE337A2706E1040B495BEDC8AA5D18557C6E2D42F81BEDEB40942E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f8b127cb5cf642788d7e567c09048838df9e9c34316d564f6e246b00af44bd4e
MD5 1e49a7562f3b2a73887e7d43842ed83f
SHA1 0def662b285463c502eb702d3c8bd2eddd5f4812
SHA512 203c08a99f7f100d9b1d292cf0a1ed001a4a87bab08b89000d9f9df90a685175a6ae9ebbf39e3a0681433d0451f8739bd76d37fc31f64ddcf4caad58f4f018d0
SSDEEP 12288:p4SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:pj8tEihPh8eRbXmLx79AkpGb0q
TLSH
T18E653343CB3593EBE337E2706D1040B4A5BE8C8BA5D18557C6E2D42F81BEDEA40946E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4fd654e8908ae9f9f5dfc0f379d146ba8acce5fd0af951d2e75d2b2da80956a2
MD5 ab7a1be563db98c671e9e151483e75d9
SHA1 20de3f34206080971ba36adca2b00efae0d2c909
SHA512 0cf688b49b655bf30ee160a919fc7776dd5939c7521abdf4e428dfffda0098f2268f7cfb287c527f365f44d1924197ef714a3bc9bc2d424e2a8852ba54231bcf
SSDEEP 12288:aLSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:aO8tEihPh8eRbXmLx79AkpGb0q
TLSH
T19C653343CB3587EBE337E2B06E10407495BECC8AA5D18557C6A2D42F81BEDEB40946E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 5659d2204d12d1e31957915c34efed94f8bc91a30ce74a64c24d328dabe16687
MD5 c5f12c0da1c5b790e498daa4b5299f8d
SHA1 fd3c2da3ee9742359438ee4c44a1a7c2452db417
SHA512 b87603b9345367d353f738a8f4e0c17b72f8e8b42bb851df304234b040becae41de46945b14d515fe038124a91e48192f9828ef40d2d9a3378e0425b57b37567
SSDEEP 12288:19SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:1I8tEihPh8eRbXmLx79AkpGb0q
TLSH
T192653343CB3593EBE337E2705D1040B4A5BE8C8AA6D18557C6E2D42F81BEDE640946E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 6decb4ad1e5a18597a3b6d2b98b0902ff7a280cc8c6e22929a420efaed7720cf
MD5 46e3343dd17abc281d421030d02f8f5a
SHA1 cb9a48fdc8a546996ba2539c2cb7b9be868cbfb1
SHA512 de0a0bd8fc777e8c3f8e65b8f5c7a62335f00356afb2cbeb38f6edc44a6580c02e7702dc8a6714c614f728d76ccd206e3c6cda49c4e8be2a36a4607708e119b3
SSDEEP 24576:xfwvok9RX6wkyAIq8tEihPh8eRbXmLx79AkpGb0q:XMnYIfhhPh8eRSGbX
TLSH
T1A295DF29EBDC44E5E177923C99B3460AF2B178691B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8b342c394f6e1d01c8e60216fb5afdd42e077bda245076e94a034b3ac85f431c
MD5 7374aae8b1130da96fb1d4ca3610b7d6
SHA1 ae647032853283b0b4965b2e7b0f80a1769e6903
SHA512 9bd112ae9f86b9adf73cd6f37e69bcbdcd12f0b335b15f8738c0f4b38202bad948991ce2de5e57eeb77cfd565d30ca61f630b1653e9ec9871a9fe26e079e945c
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MhhPh8eRSGbX:PySzP2h5vSGb
TLSH
T122066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 66b843754907ef33f9a960502fd8436791cc90d81d7708ae0a4dcb5f34ed72b3
MD5 522171e36e615517271657aca41dc5af
SHA1 4982e3d63b181223cd036dcaa924f9dbce22a3bf
SHA512 3a2b8b69f3ea97fa00aba24af9a830e390dfa21bc81fd537b74c3cc114580382bd6142000867f86ea83b62d506d37c6500a706b5219e190670365dee18fd7e69
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY18tEihPh8eRbXmLx79AkpGb0q:D47JUQj1irIhCnDHUPfF/chhPh8eRSGL
TLSH
T1B965AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 5fa003d6e6724f9ec8cd431972a59f72207e62a97c02d7af9711390a2677679d
MD5 434ea9ccb6a89ab66f13cdfcf002c9ee
SHA1 06248544a391f3e8df326b4c6a73964605480123
SHA512 c883bc7f89a9b01a0af2d608c438c8138fed00e9033206113c82cf33fcfcc618c313a1d36fd6d06986529611924e5b8c7c6f7959a8a0813e515d35879f282dd5
SSDEEP 12288:fNsfTSwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:828tEihPh8eRbXmLx79AkpGb0q
TLSH
T1A765F10AD26842E9C16EA274CB514A40B3777C6587E1C3CB92D0F43E0F7AAD18DE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fe38b00e2a8157200076de0dc8d2e79f9f8ea0d18bbce07f5db42dafb0ebb5d4
MD5 d312e3fdcd3c182a000af6d6e3d37419
SHA1 5e7a25510405660dd6df2682c4a2280300d33e93
SHA512 e1cfd7d7141cb410050548e05d0da4896813b46886c42e54b3db6d906a38f2460bf326c78089aeb2f850b381134a2e451237771322420bb63e88e54ab3d709b4
SSDEEP 12288:HyzE9XGU3fZoIOywT2ptcL1N/d7Jgv8aRMZg88aMfy3BFQ:HyzqWUP9wYcL1phWv8aRMZj8aMfsFQ
TLSH
T1BA4538417626DB4FC66940322E32C6CCA7707D41EE05AF0373C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 88982801a90a0a34aba81ce0d9d192d942022ea6db8e200ce606ee030335e8c8
MD5 827014aecb26195eb14d90736b528726
SHA1 26af70ebc2de40dc4c75cb46ad10a7f038df0962
SHA512 5eca3123022f4b7ef9440d66607caa82572ade2a6230f0fa2c1f8f246e7642f97925d2f40692dc1ec9aa0b277691b3d96e6136c36500858b5d67db3f8e73734a
SSDEEP 6144:0axnGtYuZpEk1DubEG2ZX24T/QytMxUINQytMxK36va1U1vsDnvl6NKfZ:0axnGtdnlOvl6AfZ
TLSH
T1BB65C7419136E78FD1BA6032032A5B4C77A4EC07B7096F27B3C9453AD82AB55B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7d9c265a5699c2d27414f07804402fd0eb9cd5309285d0eb68298f13deacf27c
MD5 de960cdc253531c3c47597aede9c5195
SHA1 4786507ccb45f345a819d1acdfd3dd4914bc5050
SHA512 589c2908a539e41530c3bf603162b2c41299e2e046eeefcfdbcd851feb9b1d314571810c2f487697303303a891b86ef646565f6f584fdef075775671ee87ce72
SSDEEP 12288:8F77SwBtt/cnWxoOl1h8sbnrlbXjI7LeOWC17rUkHcEsfICQfQ3r08CzdkTq:Qe8tEihPh8eRbXmLx79AkpGb0q
TLSH
T192652343CB389ADBF237A27019148034667FFCA98B90C4D7D551D4AF80B9DD688B47A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2ef28e817836c41bec8561816485a967a5fd24ade2ca18bf2912298425ca11d7
MD5 67a6c3a33b05ec05063a76fd8c8dfbde
SHA1 039799f962f8b9f9e648f6ce1d9e15c847d86082
SHA512 4b070a67b8c11d63b1a18e0b0f389788be80448be505439a3c176b04bdaa026eebdfd1532978a6e87e6e5124475e7a40a5d4967073a6753146066ddc7e2a361e
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bY88tEihPh8eRbXmLx79AkpGb0q:Kgb4mBIBhGFShhPh8eRSGbX
TLSH
T11465AE1E22EC02F5E1FAE2B89DA64417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 3be94ee346503df0da843cb191fe716fdfc5d11d3f91b14c98ebebc1274750d1
MD5 0ef2e875d558d8a04af39624f0b7d72f
SHA1 52cfb80ed264c7befeae475ca56c8ddfcdfcbcaf
SHA512 07f5237fd961ce410d43d73ec788fbd382c54771f9db2ac228ac2176ac86c25a6fa03cdaa56f9d4e4bb0c7edf4df92aab606ee87a23c131a7333ae6bb64d575e
SSDEEP 24576:IG88u8FpJqH1bzria7/mF8tEihPh8eRbXmLx79AkpGb0q:r7ZFPqVea7/RhhPh8eRSGbX
TLSH
T173950155B7E002F1D47BD13889424663F6B2B8250364EFDF07A88A561F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 496ec4a9a25e588795e6803512d51e7db8abd638c07b6163f8d0f86b6fd1c665
MD5 62f63bc39a34ba296596ac244e79275c
SHA1 39e2aefd4f98d03bad67083479096c807e6c6878
SHA512 7b541fdce03240dd8680723cb35095f86cf4fd25bddf7803f6ed5416777d07e8915b5d6e7df753430cbe6c5af815246c910fa1bb6674b31584c64d1f7b2c3741
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWhhPh8eRSGbX:uG05lO43bBh5vSGb
TLSH
T13CD5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e3afb33a00c8f46ef34e4b18e8b6c9cd2b73db9a4b79618a6250e6349e2ee75
MD5 00e43f64b4d0866b135ae406a25358cf
SHA1 2f6e50afe1f6bb0b30b1bc117ca3c07b720736a1
SHA512 33a05fdd477d732c1c0a3cce38c7b29866dd6dc6b6d0057914588f84d4d78a8ee4c080803e9bbfad68589bde289ef2b6a690f34aacda73400089587bd11558cf
SSDEEP 24576:Zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnX8tEihPh8eRbXmLx79AkpGb0q:Ja5POZ3+Jt2pasx2+muhhPh8eRSGbX
TLSH
T10765AF5EA7FC01D5D579D17CC583861AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d864b63b2b1c3fb4f9c5c24bd4e17414ca5a6fd68cba116ebdead2a5ff3eff2b
MD5 7deb046bea197026adc7eb84ce79afa7
SHA1 d0ce1e143acd47fe04ec713cd88be8e24cb77f88
SHA512 08bf45b52e0d61f9ae9eb6d9bd9c3e51a2c505042ba1fb4f170766384838a0a7a2c518b812be08c36230ad0b00c2ea96c65ea9cd835856d334ebafa6463bbfef
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fk98tEihPh8eRbXmLx79AkpGb0q:TNc/zEOVHFxhhPh8eRSGbX
TLSH
T153857B1623E901E4F1BBE1BE89679546FAB1786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2719b2e8590230ee83adf1cb8011773253dccfdb99fae454617b5f68a04f92b
MD5 fc84e32f5eba06eeac8e1dcd7baf6f1e
SHA1 c86b34831c6f61f17c0e2df34c1fc7a99a1ecce1
SHA512 46567b20c13f10120a99d71cc69ed7087e9e604129d0c4441ae21e8205294dc3dd5b8440432a30cda348aa4a3139d257276b0c10ce1e822d9a200714e0af0065
SSDEEP 24576:x8kNvNnaFeYhJNtmZBm78tEihPh8eRbXmLx79AkpGb0q:x8MwBtOmYhhPh8eRSGbX
TLSH
T15655AF6EBBB846E4D1FEC6B48D238512E6727461073293CB9290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 be8eeae746eff5bd02a5c9c3a12dfd451dbee873d78199abdb5b001f1a1bb50e
MD5 f0b4dfbbc3ff8219ac855aeaeb412d34
SHA1 bd776059bfe4b10167c2dd7c6d2268959ba9c49f
SHA512 2e7bce667a26f875f6e94ee1ac65306a85879d79794a084bae2be9f559be0f4d3234b96973b8d3acb53abd70aa5bf7730c12eb1495b4b18d19a15344f14c4aa7
SSDEEP 24576:EPUr+NQh8tEihPh8eRbXmLx79AkpGb0q:EJQmhhPh8eRSGbX
TLSH
T10275F21F66AC18E5E676E17C89418619F772B8621711D2CF02E0817E4F77EE8AC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 ad52ff4b55eff0a51afe01755e4b899d9964eb903803c128e7e14e9cee06e05b
MD5 f5e00a2cd6392fc5a0b0ea36fa90e052
SHA1 d090ce3b2567862f2044684aed8b9cbe1a63ba5d
SHA512 592d941f0b647e8fdf2bb71a531b6c864843e8781f156b4bc1901413219e604cbf1c44619182ce188ce64be7a8e7c46f9c107236803fd0259bb1ccf1c4355601
SSDEEP 24576:JD3FHshBIYQgAC8tEihPh8eRbXmLx79AkpGb0q:JDVHeBIAAXhhPh8eRSGbX
TLSH
T19885E13EEB5C04E4E57BD1BC9A638906E77138A9032255CB02D0C1BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/268-87-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/268-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/268-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/268-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/268-326-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/268-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/432-292-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/432-63-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/432-71-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/432-65-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/928-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/928-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/928-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/928-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1652-82-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/1652-76-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/1652-77-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/1652-306-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/1820-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1820-277-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/1820-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1820-49-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/1944-60-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/1944-56-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1944-37-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/1944-44-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1944-38-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/2696-313-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/2696-112-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/2696-119-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2696-113-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2800-75-0x0000000000400000-0x000000000064F000-memory.dmp

Download

memory/2800-0-0x0000000000400000-0x000000000064F000-memory.dmp

Download

memory/2800-6-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/2800-7-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/2800-1-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/3652-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3652-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3652-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3652-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4920-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4920-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5524-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-100-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5524-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-311-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5524-106-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5700-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5700-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5700-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5700-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download