cead6eb41a70f8f2b6729b600a9277c886858e988c42ef7f03b29d8258b5baad

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260930-ann1lasgpb
SHA256 cead6eb41a70f8f2b6729b600a9277c886858e988c42ef7f03b29d8258b5baad
MD5 5a74af4adfd1811714ba2b8809d7aee7
SHA1 6114e6d5dca50bd864d73798209f541b63bdc7bf
SHA512 01875cf391b32932e67c703d76e931afc61f2b998ba3e9a3428a02f99ed1db3db8a9d54d0942c4c31161bc51229d31f303ff2ad4bda9581ccf5cc468dbb03cf0
SSDEEP 12288:YUYJ9bifRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bta:lYJ9bUEqgfmM0+Tx5ARt
TLSH
T16E551231B1C2D0B3EA67053508F1D6B59A3DFDB15F1199EF57502BAA4E302C08A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5344	elevation_service.exe
2056	maintenanceservice.exe
4168	OSE.EXE
4092	PerceptionSimulationService.exe
5288	perfhost.exe
5748	ReFsDedupSvc.exe
2428	SensorDataService.exe
4312	ssh-agent.exe
948	AgentService.exe
3472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da9fa6cb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cab5e1c07150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e60a4c07150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9940ec17150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a73c3c07150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5344	elevation_service.exe
5344	elevation_service.exe
5344	elevation_service.exe
5344	elevation_service.exe
5344	elevation_service.exe
5344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	948	AgentService.exe
Token: 33	3472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeDebugPrivilege	1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1616	2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5344	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4292	3472	SearchIndexer.exe	100
PID 3472 wrote to memory of 4104	3472	SearchIndexer.exe	101
PID 3472 wrote to memory of 3104	3472	SearchIndexer.exe	102
PID 3472 wrote to memory of 4608	3472	SearchIndexer.exe	103
PID 3472 wrote to memory of 4300	3472	SearchIndexer.exe	107
PID 3472 wrote to memory of 2772	3472	SearchIndexer.exe	108
PID 3472 wrote to memory of 4784	3472	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a74af4adfd1811714ba2b8809d7aee7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5288

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2571b844a27ab48a39fb9fe1ab473825bc4428dcdc7379949979800e4351727e
MD5 bb6ea9aa62f83642a6fba818b0f7fba8
SHA1 1d54b992ebb92205fa7e6af9a4c9b915fb0c85dc
SHA512 f5e3422d33e7bcd9de5c9e4ebb03c05751962a332d657ecf29fff350eacf66352f761d872c54e2ab348eaac0818f672e0de63e95250ae449afc670c969df7eb0
SSDEEP 49152:Lb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn6EpmMbx5AR:Z3q60jBAIMd5A
TLSH
T1EBD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 222fd54f6506928404ed438f524d2da6c7bcca826e031ffa5a21e99c93196ddc
MD5 c1c16d49c61b2173958583e9cde4391c
SHA1 2fe9194881d733a101779f9268639d11ebc41301
SHA512 c14bef1a6c74ba227155cc9fd1abcf1593b56b7e40cf088bcac76c4f36a0a40f76f9698dd8f2c1058dbb57d3475fea11a40241a16b90b51663e2a78c61822f19
SSDEEP 12288:s1XLsswWkxy2lRq2czAHRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bt1:aXYfDtczAPEqgfmM0+Tx5ARt
TLSH
T1D965F129B7E109F9ED67827CCCA28415E63378854760F7DB03A49A654F336C85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7eea3bfec670bc639bf0e03014002a262d1e22f433c26e78fba306f09fca85ee
MD5 cb26de6a6941c5a0bffd973aabab437c
SHA1 cb6347520c5e8d96e75502a0d9078c7a4034d003
SHA512 ab642638a52635539981c94d540ec4331e68a78d915cb393cb9abfde6f675523953014ce0b373432dfb24c0aa21f316e52393fb4c3d0f8caeb450153d9fcbd16
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVu0rHs6RlbwqZYZjfmczaAcTas04nAuflc4VWxd:Q0Le5ji0hmxzrMSEqgfmM0+Tx5ARt
TLSH
T1F6859E16F6748335D073C0B9C5D2A68EED7230865B308ACB4286D77C6F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c4e8f524d69d20090ff8912027af2b45b9c945566ae5bceb5ac26ba34f939be
MD5 de4fe1a4755344e535d50fe073c3eba7
SHA1 34fc0083aff5d5654fd5cc83aafa5e637f4562bf
SHA512 9f50b3cb4a08e3e1e00b3029c133cf6f0b8e18507a243540eb17d5b098443f2da8609e461041e34a6aa917bcafe7bd23b51917d70204d54e7e0bcb61423473d2
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWr6q8wyukEqgfmM0+Tx5ARt:t/ezSC6vUzPviHjy5EpmMbx5AR
TLSH
T186756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 73938668e3cb1eda154316bdb5e79a84d130d13f77d61e805e5092f3999e74df
MD5 f960f1386a1d88562acea5781ab3b276
SHA1 9d8d2bc44e9e31e172baf43a50657c44f533207d
SHA512 d7189942f872e35600b903a42b1ca47c5396e9aefce1b8329639987e29fc4282af3c63f6a753a5e493d27a116813b11443598fcddb96d8ac35aa46758d65247d
SSDEEP 12288:HVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98rRlbwqZYZjfmczaAcTas04nAufy:HVbqPb88hv/l+bzEqgfmM0+Tx5ARt
TLSH
T16B559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6d3bb9ed33c79d7f8385447ada90d95f4f3e3618f7aa1040bd21923bbe297228
MD5 e0316e5333a6bb4af37b285161f34156
SHA1 fa6adcf5a785829081c87fd7507f8e6c076a5695
SHA512 876f5fa5556d5ded9b7b6a78d72f2e4b79336f705f2b36705898226e1d1faceec196f56864f6fefc94aebd55046799ad2718aa3e0ed8296be6e559424c33afed
SSDEEP 12288:jNORlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btu:jNWEqgfmM0+Tx5ARt
TLSH
T1B3452352E593B1E5F60F4679B85390DEE76F2FC87881F6678B017F9189B88818712C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4335729844884e5c4b94e59acb1ab21dbbb2c2ef50da0588ed745567f57f004f
MD5 647e983e88845379c5537e55603ef8f2
SHA1 f3413864e74333ef818d3bdc657940d06007b98a
SHA512 850b9fda7548e43e20bcc6c3b5deaf0f61b2179a590229f14989424c3dfc96c1806deea3145214c785d702517789bdfb4a4c5955adbb9527941264cd380519f3
SSDEEP 12288:5eBNUbTVO86UzRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btZ:5JIUrEqgfmM0+Tx5ARt
TLSH
T10B65CF3BEE28FCE2C27E8DB85A918640E77678704B52A3CBD165830ECE235D15E76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e3678fcbd3f354a47126b3f17952d3df71c6cedad7ef58c60ac76f7574e77633
MD5 a9eaf6e9fe15280a268aad5b82d20bad
SHA1 b37a123968766642df611c87dc85609850559432
SHA512 36fd40d9417fe3e34b695a877f2d0744e8af3eece7d2e5059a2d00b4ff4489ba99698517e8688a85a8bf298ba50ace21a341131200857862edb5a881a73e1f71
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH5:FQvGAdlCEL8c/RRNw5CFIMd5A
TLSH
T130267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 99ed88e421be755bcfe96bd9d8b4f85d9b594aa886ee93885c46e9d51fc6a740
MD5 d49864e0b1a89b6823653fcc316f3a98
SHA1 f310fa3c08c7068388b46625a9e2556a4573b649
SHA512 5c8e6b02e6f35ff9b948275a0fbd7158196828f783df41da4012f84b1efc165c2378d0f54d0994b1e3cadaf2bc1a8345f65912d0ce45398e3e94bf0a11d389cc
SSDEEP 12288:3AwSfxL/2Dc3JDLLmt0LDQewsAjFRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntO0:QcewsAjdEqgfmM0+Tx5ARt
TLSH
T1C575E031FE75E036C27F0DB61B22C716547D7A604B522AC3E3A88E9E49742D22736E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d8b0eebb914ee62dabd2f7a5602a98304c18e72cf17e91622c209c1a662f1652
MD5 10ba339667b8f8a9a000fae65fa62c61
SHA1 b1487afbed575a4edf7df30e386b1a5ec38c50e7
SHA512 ff19a0f9a9990217954b01b5c5f3fcc25d143a2b9252ef7b5d2df48a58fc53779a1115d284f46c32760c20e0161e54d64599555a70a1ef91f50f88041cddb7f0
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHM5:zUEtQevvqc2W1cpV2RI32M5
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f7c2bb20c2eccb7f0ec4c300462c8b16ff30a3291cc51eac4cdbbee6f272a52d
MD5 11931eb7023f82e828e4a863e80db6c2
SHA1 7dfa8ca91377a6cea0dd3bad70a31fe1530bf29f
SHA512 3e39e3f2c4cfad1cbf6b44abf597234e75436cce568b798ba095db6e5c994ae669db2a2d0239bef3bd4060ba336f9f3d9a29b7abbdc89bde63c1b5537b78b6e0
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/z9EpmMbx5AR:ioq2VjnmxIMd5A
TLSH
T151D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc6cda40157bcb98779fcc201238e868151922422adafaf23b1b48c6e06f78e5
MD5 55a29a0a080c3fb00547eab2fdb4f5e3
SHA1 7c3887bccf88a316450e848c3bf59495aca285a0
SHA512 7027317a272c5bcc2b9c7e4ab9a85294f94906628ac8c69d9f4d9e4aa7c8f604d5f562a885e2ce3eecc7d25438166117fa71fa36ec7c809dedfd1aa4db53d77c
SSDEEP 24576:aAhGL2IFoiwtA5l7S53QEqgfmM0+Tx5ARt:aAM1Foiq5gEpmMbx5AR
TLSH
T15835AD81E7F955D4F5B3AAB899B68171EA76BCAA5E31D20F1150C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6b27d52e18934895fd157929f324b8790e2cae8f74df06f75eb1aec34c32f751
MD5 d4f9681eedaa3d8f7d29918a7116a08b
SHA1 ab4d566442069b7448cd8e636d0c0e2ae9af5c8d
SHA512 b35556172ec7f1eb1436c394882e99eac0923ba6fac65df16e1e4c092cb771a95fae7a05bfaadc4d3de42dfb60a97ae794592042913fb514093f97a3401fcad1
SSDEEP 12288:5mw5HEjsChNIBFgl0WDm+CkRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bte:UwuROWZEqgfmM0+Tx5ARt
TLSH
T13D65F14676E51CF9E9678238C593C036F7F7B8412A21D71F0760C65B5F37261AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e2e43856ad643aaa53d5455494464cb31a643efdf7565efc84b1968a52abc15e
MD5 06ffc02ac4113b4b78ec352bd3c688d5
SHA1 7b4069f56fa0947335438b377ba2dc9df509c6f1
SHA512 39ca2d85026cb48af7f5b8692b15659c6a1c371e819fa3c57dbe4b9864c93e1aae8246460df8ac08622f10d3b46f03f2910e40e6ab3bf983570e11c7f8f73ddb
SSDEEP 12288:ZFZ1Iy1RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btn:jZuqEqgfmM0+Tx5ARt
TLSH
T14655129A32E131F9E157823CD8E28549E7773896377293CF061047A64F76AC25E36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04e171577b1bec460f8e5f9e761fdb9d80a9e4573834c0d711d4f28eaf16770a
MD5 9ea0c9b1f86c6af01127ff2fe7cb8055
SHA1 31513c546156e0507b7a25eaea8f8891e312b361
SHA512 fc04f5c501c43c8955518cb5065652eb5f5e3d48f2b58eacce72a24182bc09f08af40bbda7b24f801bc5f2db12f18c877b78184de6990c982062ee552643e0b3
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:aQRQyi36YOcPhLvw2gAf+PN3EIMd5A
TLSH
T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4c0f3d81dd7ebbbbd4889df83fd6f5c0bdfe015bc2a1c103463cfc3b2121b26
MD5 d86695b80206ea869e2e30c477f3573f
SHA1 61452794e08cb5394bdb2a8d6f7a095c4f812e9c
SHA512 1b47a53ba69fa92b03a224d070c74655cd1bb04d575b2d5c41fa18a3f81e0ee3d6b1fa5beb38de627e86c28713724fa1066bee52fd44c6bd618be88b8d3a90a0
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:bQRQyi36YOcPhLvw2gAf+PN3EIMd5A
TLSH
T1E6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c6f8e3dd9e8f775e9ced8619599525e3cb2ad8ebfbb7361ca9e573d9e075f004
MD5 37d5beb9c2581786620693e9acc576d7
SHA1 272a2148e424afbcd526524e9fec8c9084c3e518
SHA512 e55952b2047bcf7a285b5ec6d9546f5486cce9bbdbf439954bc644058cd1d767cc779778f4c25f72fd3b15653d4a855a6b1e28344e58e89b10906c6746a62b3e
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL06EqgfmM0+Tx5ARt:J68Qg55nhceWu7PNU3/tEpmMbx5AR
TLSH
T10CB54933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8509d783d34903a5506e199058d6041a73624c20d04d70597ef386a9efc44703
MD5 4b2a54473023c51d28196802005c21f0
SHA1 d51b9c8e7a50fb33dcbcfde040c6b96fac6a038b
SHA512 80ffb7315f7afd8fa72f6866059213ba814a794adeb125beb3a3ad0d1aaffe124833d7892b37283021098e474f7271d44ebbea269d010083cc0eb7e5c81cd0ad
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99j:uy5112gYy5azzVva69nLKnhZbIMd5A
TLSH
T120167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e3121ff306b64015047b51c1fcde3de5481bce751e469a8ba3b52b25b1d7e2e8
MD5 940aa7c7760749f83d3f2f74f359e9ac
SHA1 03d739fea488b2bbd1b1636991b5674394f9b4a9
SHA512 d27fefe8eb98c6d943f85305ac093654231f9936f6273c64de555ab690f8402303fcb52b80d827f9b7e6352c1624fd4bed0727eeab868314021cfcaab845448a
SSDEEP 49152:A1hpsNoJpF1A6BU44CwH7R4xLEpmMbx5AR:AmifPkRxIMd5A
TLSH
T1A9B5BE13F2D901E8D05ED17887569232EA62BC460B30B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6211fea7cc1460b5a8b8c0522a2d79dfbdc2b27c58dbd909eb39abe79d53f085
MD5 ee5e0a29de67720f9ce750a4a1336aa3
SHA1 5106e9eebb54d5b9b0982e097b312229fa097137
SHA512 2e7da9a94bc4de45ebed353d1928dbd4f5c9e784120fc3fb052e3cfbb7a2af6a51d7918688656549ba744cf08ccc4767a8e2ab9b0f0c635d46e7615566be766a
SSDEEP 49152:3SuZQIY0Be2KNRVtOnks6NMHqqEpmMbx5AR:t5dKvi61vIMd5A
TLSH
T1A7C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f5ef9da195ae85212f591e551e5471facf9ee0fbfa681669d37b99c4bfd711c1
MD5 da449b0e10917d6602eb44a93a39a5fb
SHA1 72e3aecd9602ef665d6cb85b05a41ba01455fe4f
SHA512 8c16ba2c5410d48337f734422983221e732e344c8c32a7e514b88665c4974716f0dae1d3ce2598d1300616adf1f3e632a9ca981ff600af4c13a9172bed3843e8
SSDEEP 49152:4htSn8EApI0figXgiDn0AP5wPEpmMbx5AR:pX2iyph9IMd5A
TLSH
T1C795BE13F2D900E8D05ED178C7468632EA62BC160B35B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 33c0c2b7bf1d749c1fed3724b475cda37a709b690b207c1ca6d6f15fbe127019
MD5 bb39b8ab178f21389079c0007d972da9
SHA1 dc543dee2edbc13856840b1d5653e19fa26de05b
SHA512 5b766bdd68e9aa90df8ec09a61fe6be00120f70744f9e33ae1f942e117eb79173173ec31c7372744365c2b794ac69bd78763e261f64533bae6996008c61cac4b
SSDEEP 12288:lWRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btk:lOEqgfmM0+Tx5ARt
TLSH
T189452356F4D3B2EAF10B8679A45350CEF65F2BC97842B2AB8F0156518AF89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b17957846aefa4b72de28a31ef6e8358f8444d86aa0ec22192512a1518e03565
MD5 b08cdaf715fd3ca66dd55354a6565097
SHA1 b5e6c25743a0955cf9593a9af16dd227b37376e2
SHA512 65d168b8561de17609928fb9e9e5aa6d6428ddf2180235b839ee92ee0c06fcd5a6b8981bce22c19d7a17b2b5654f6bebcd6c4b530d22d9cce2914622e12b0229
SSDEEP 12288:DJRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bt5:DhEqgfmM0+Tx5ARt
TLSH
T102452356F4E372EAF10B8679A45390CDF65F2BC97842B2AB8F015A518AF89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 de934ffbc01e4fea6462e3abe22d2a32fb080cabec985d789c62ccc1c5304e1a
MD5 34abe9d09313ce981ccaa0db1eb403f5
SHA1 a88bb44212a7acabbd31709c4d70345db5dcb607
SHA512 d00176e2aa23f2cf054c525d6e4d504da17ad2e011cb0f2c610fa8509f036caf5c4c98f62ce942e2c2cfc299e17d067e8a865730e7ad765d61a0414f1b227748
SSDEEP 12288:s7RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btA:sDEqgfmM0+Tx5ARt
TLSH
T193452356F4E3B2EAF10B867DA45350CDF65F2BC97842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7e621270949bb70bf213cda36bc963b1c2d3e80809392f75e812e3a494e4bcfc
MD5 2a453c44323c9fcfac7d7ef23abee5f1
SHA1 f880ac29b60a7d305b0dd1fd748be9c976d218b6
SHA512 80fee9ce69641f8f1dd7e4ac0b5e72a6544ff1d0a842f47fd1ad42e655d3da94617f71352bb9c85e1b28b49c1cc800306426ab4913a6d96dd36fcf3d142295d1
SSDEEP 12288:XVgRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bt6:uEqgfmM0+Tx5ARt
TLSH
T128452352B5E361E5E40BC67DD8639099F37F7EC9B812B3EF8B000A454EB46C15A31E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 122bfa68cdae4ef567919b29b2fde1c81eaab1818f0091c12862ae1bc1b95df8
MD5 a55a07c8b9d037addfd9b0a577e6436f
SHA1 65c517269ccc3eda53f3420313160c8cabab3a3c
SHA512 a2c59905753b888a6bd386586cfbbef22a967b042d8282b813f9200ae97bbf8c0f40905cd020721215e01a8473a58f0ed72ec700ff19e64135864393f9f52f98
SSDEEP 12288:h4RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btw:hYEqgfmM0+Tx5ARt
TLSH
T140452356F4E372EAF10B8679A85350CDF65F2BC97842B2ABCF015A518AF89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 92f9b263b3784ab8c5d222a6b7c16c403ed0a4f8fe356eff0c18c69fbd3a0808
MD5 3477038acb091ad234c5494893ef6fb0
SHA1 98b2a27e398ce1416d0eb2de272655e21436137b
SHA512 eb6577c2e154d068047b6c4eb21f0ae10b619fe977d801c16c5625427f5f9df5ac2c59c801f3b13932c28f926a68d1f4d437c72cf252f87f392415d91cf2fc39
SSDEEP 12288:wNRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btu:w1EqgfmM0+Tx5ARt
TLSH
T1D4452356F4E372EAF10B8679A85350CDF65F2BC97842B2BB8F015A5186F89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 854b8b05b5cc6e2d000782094fb03b725cc35252e16bec0adbc403b7593b3888
MD5 dec5f16efb8efb4ad0ac78f62b19293b
SHA1 00b5b1a4040219761db186025b876f408a5e0131
SHA512 2a09729e60608fb6f9dc74b6f40a9b3b9173940376830dd32be69c75e6f3013b7bd39764aa60979ce6e0b4839b05ccc920cd1d646f792ff8be1abd8b4aa1f556
SSDEEP 12288:YhRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btV:YpEqgfmM0+Tx5ARt
TLSH
T1A8452356F4D362EAF10B86B9A85390DDE65F2BC97842F2ABCF015A4186F89811712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c339bb56454c4191e319aea16f3219c04738790466138b83cebbd37b49029011
MD5 37ac39c4c590f76b9ca24c4e1057e87f
SHA1 1d66e7faf6a4deafc5068e775a7b6e949cfbbc02
SHA512 da20628ed7dc15270e13fc5af93b9ca90ebb002fb02e83a039b68d6c3790f7f8d0ab5d5c0b42ede4530a5e41c1e3164ea16fc78d1e7b81d923bb12a0147c6458
SSDEEP 12288:EiZwbKzzFEoS2cPvypRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btF:nZMizFVSOBEqgfmM0+Tx5ARt
TLSH
T11F650295B39118F8EC67823ECC528806D6B37C5A1A60C65F07A436674F733911D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c9bd8d944e5edcfeaa612839fab109b6188316b1d6bf78fae698a2d9b96cfe14
MD5 db3af083b49ae4154014521d1e7de1c1
SHA1 1eb3f48b5fd57fbdfc1a429dfa38ed99b80a091d
SHA512 9adf894f3f84ff2ba9827dcf4e7e2460f566ffe966dfde5c41b884d0202b1fb07620f86ea7f6a8fa509201a42d359b11910256003d19b4c558afc3f8bfd44c61
SSDEEP 12288:SSRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btN:SaEqgfmM0+Tx5ARt
TLSH
T1F8452356F4E372EAF10B867DA45390CDE65F2BCD7842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 476574a9db5003a8016eedbcda9e2a0e434e2d74932508f23a1a64db32cb6a5f
MD5 14fc5330bb77e9205077c9dba130fe0c
SHA1 428855038deb01a23ed620df533dbc7d8353c8cd
SHA512 4002734db592c0cb0010c091861473c3be970cbf6fb47457e6ebf87f4338075546ff1757df45b25d79511545b0cf14b5a974a8a34b27bd8db7949f6971da265e
SSDEEP 12288:l+RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btc:lGEqgfmM0+Tx5ARt
TLSH
T154452356F4E362EAF10B8679A45390CDE65F2BC97843B3ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2a9d55b1d8c6be036ace7e325eda61155990234c5235a7bd55e98a0fa88d6d95
MD5 a882744d82263923fbd6f305a92fb43a
SHA1 ca82de93a0cc90ba06d3b821d2e9cc3b12ac98f7
SHA512 fb29851121d7c5d44ddc69c22b69beb9947f87b6639c6ee86fc493a9a82e8afb5125fd5d758909d07c88c674fec775d50179a77875882259eb813b5554c996c3
SSDEEP 12288:lyPz5L81RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btO:szyNEqgfmM0+Tx5ARt
TLSH
T1A855125772A230F9E1278238C8A21946F37A78761B20DBAF476007761F776D15E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a2237dbee339ab45b4aa1ec441d7b26c27686cdffb00d4a94da9b51a8cf0c724
MD5 dc1b1b6acc93e94d130c73972612c17f
SHA1 1925d4d5fcf54ab2f650912662992dc2a6956380
SHA512 5e973c87b9522822bb600f461b3f8b188c19daafd668cdb60bd43dfd4129fb2127b9dcc562c65685d573da758e2ff4c9d6f326b7b708debaa88a3b4ec1e7452a
SSDEEP 12288:USRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btwyO:UaEqgfmM0+Tx5ARtH
TLSH
T13D452356F4E372EAF10B867DA45390CDE65F2BC97842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3c7174420aad5039456117c38bbc78be4a2dc72a872cd7c166c2f5b1b353b033
MD5 6640452aac52d6fd81986e865b06a6c5
SHA1 4d468e9dea6d4589334bd641fddaf2817a011e8e
SHA512 990ebfc3b396185cbe78d8bf7371f10d890f71ee84b6de2a0867c4b30c5a200030877cad0c6631daca7bc577d4b2b809a7c7620a98e6888095ec9a8783d4453c
SSDEEP 12288:QSRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btf:QaEqgfmM0+Tx5ARt
TLSH
T1CD452356F4E372EAF10B867DA85350CDE65F2BCD7842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 46f67cc5db83fa943e8a37d39a9141a16cd4517d9b448ab8f438a06edeeb75b6
MD5 03bc2fdfe15ebf252de1243e19332535
SHA1 f96abc19613d6f460e9999921e2b639a9e7b9e7c
SHA512 40d3a44a9ddbc60853e38f8fe94cc6d8bd8d0d6324659233abe08ae50b35d99543f4976130f4881f167cc636678a68ec43b540a81dbaf5c50787eca20ddbfc75
SSDEEP 12288:/yPz5L81RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btQ:yzyNEqgfmM0+Tx5ARt
TLSH
T13A55125772A230F9E1278238C8A21946F37A78761B20DBAF476007761F776D15E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6771f5d814469546781757a0c29c3856b57945abf886c21bc0d7cadb5ff0c511
MD5 44811e249c044151a6e24e1266b4ef6b
SHA1 e80fcbbffa2ae57b9a5801330ea02e7605789008
SHA512 17de1b0838eb836bbfdc270e4e6a0cc7e8ee61c0d5f0d50f4717dbf7b79a2ca26ab5dc501815c535ab1fa9b97c5187c88368f085243cf19f6f599513dea32ea7
SSDEEP 12288:yCd96WYoaLHF3z0z04PDvhLRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btb:TTbaLl3z0zDTEqgfmM0+Tx5ARt
TLSH
T1D86502A5B39118F8EC67823ECC528846D2B37C9A1A60C65F07A436674F733911D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 27570fe653b9eae32e53f6f41e03b3440ba4826c72a28216c506feff9d648daf
MD5 ba4f298bb3ed1c26aaae02fa3f55719b
SHA1 0460ab0739d286ecd8cd51b9c08711365c72f3de
SHA512 e737df7da91a2a3a299b1d97f4f306cdd7a338d5f29227006c7e0852d6b1c0ffa72b8000ce6eaa3fc0fcdcbc98c883cf95fffca2f0347a0d74d69ee0d3a238db
SSDEEP 12288:ei4e7uRdTfgwCHKy7GLbbdIvcRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF78:e3Pd9CHKy7GZHEqgfmM0+Tx5ARt
TLSH
T19975CF90F3E414E8F0B78A35CD725511DAB67C991B61DA8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fdc379e3b7147ae4f60d3cf261def8ab32a17b7d20e3787f48bbb43cd6edae71
MD5 23431666e54787d2288bdf03144f6747
SHA1 64c4238e3b08903dc0e5d0d0e7ff61d1a32d88f3
SHA512 276479a5749ba970671159bf523204dd1cb12eae942315a9546cd1f14fa70f8eb3f838f831c3f26f6898cd750b5c80d4ab95be6a1e2ebe627aea5435f5fd63c4
SSDEEP 12288:+bRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btV:+jEqgfmM0+Tx5ARt
TLSH
T17C452356F4E3B2EAF10B8679A45350CDF65F2BC97842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1eee7ad510973282633c82b34086f1ac6a6e59299c09bd063bd052c233c5126b
MD5 b88d536d8525d7c8fa9bab8f7b1f8478
SHA1 0c399299d4a54b7f89950362e6362d3237afe8a5
SHA512 d13a0a4a9ddff3355973d3bbd4e2e1e7d5ba76e33d827fd50fa09147c6ae9e7d0efec004205e341abcca83a68b295dd8e616f6b6803a95a217bc7a40d30e7f68
SSDEEP 12288:kVRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bt3:ktEqgfmM0+Tx5ARt
TLSH
T178452356F4E372FAF10F86B9A45390CDF65F2BC97842B3AB8F0159518AB89811712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f5af8932c80a07409f92d527d50b083eb772fb67d5497758792ba88a72ff2041
MD5 86f5a2ce026544a3f5fe2c92b80311f7
SHA1 605da4a650c521868fa09639b93e4afc77252dda
SHA512 ed5af60d9a1602cca96fdc43a350df33dcfdd64d4e60223e8adfc99e34b1b1b25452cacb962740cfc22376006c3bda2c951372b5a03dd853963873d46f2be6c5
SSDEEP 12288:/cRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7bts:/sEqgfmM0+Tx5ARt
TLSH
T15D452356F4E372EAF10B867DA45350CDE65F2BC97843B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 671dd5d73c41be43171553d370f17f9fabc48c1d9ab5cdd9c3f2d54599fc929e
MD5 f4df7b507ffe5698f72aa43c1df0fffa
SHA1 04def21bb815bce0fed5754e61d1d2af14ba5664
SHA512 92b693b3f45c1144d3f069e57b459cb54ac4ec69114e0fc9ebaf46fea4dda1c2ccef2c38610422bc5a355cb14dab83abca08c86e32ddebd23e7c7e3f99a2fdb6
SSDEEP 12288:fSRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btn:faEqgfmM0+Tx5ARt
TLSH
T13C452356F4E372EAF10B867DA45390CDE65F2BC97843B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b9afd8929490483bc952c8c03a79833faf85c62e89feb3e0c8632b64507d07f1
MD5 739b9b78a6dbca2a33b1b921f337247b
SHA1 01df8056f82ab9c3e4fa2b6ea5fc79442962a09e
SHA512 2f3b7d8f88a3fc852735e4438c1bdf018c75958cd5187bbf0a3eadd5f899c04178c66daff42d140950bc7d9562dbcb3ade864b0377558797ddd611c7e8bd68f8
SSDEEP 12288:RbRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btO:RjEqgfmM0+Tx5ARt
TLSH
T1F8452356F4E372EAF10B867DA45350CDF65F2BC97842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8cf59c1ad7e604c7a4152e4c615c7fe4abd062148d861de692518d4a81f2a3f0
MD5 32d9040a9d26f1ea72da04625c96ef72
SHA1 2e0d3703be1328d3d8593609bdf45675bbcbd9b1
SHA512 d617df45b8f2530d54986c1888b18aa6957aeab1d245c290d4d3af36477ecd0243c5f675fe32957a18100dd4f342f39bf119874238a2e191cd585aa444ad69e8
SSDEEP 12288:PKRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btn:PiEqgfmM0+Tx5ARt
TLSH
T1EF452356F4D362EAF10B86B9A45350DDE65F2BC97843F3ABCF015A518AB89C11712C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 58b998456cd01bc78c2f7cb3c20f4ec35824d455116a8e78ffc62b47d40574f6
MD5 eebc52efa8e0b071f9a507e6e283b5a7
SHA1 c9442e1b5b3d4ae34c4c80196cd46587406763cf
SHA512 e35011249b2aa64ea80a070cd58402090a417a302a8e1542e8b672ae15b76d512306e8b591061b22a53b786d756bd6323142a26b5548e6547854b68e49a466c4
SSDEEP 12288:L4RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btX:LYEqgfmM0+Tx5ARt
TLSH
T1A7452356F4E372EAF10B8679A45350CEF65F2BCD7842B2ABCF015A518AB89C11712C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 cedf709fdd94c738d5feaa60dc81ba5c46a965cf68d2feaa57b0a4140e2cdc6a
MD5 34344afcee1d0a489d47c4fa8c8db6ba
SHA1 57271e4fa1aeb3e2e11dc8c1f9d7e3cf134062d2
SHA512 599de03a9f509f6b0d1ebe84a5ff3e2b3e46e268bd030d01d061afe47568885d30ae762c08d389fecb0ec72b91f9a2b0793510a90f6b87d950ad59973e4d5aaa
SSDEEP 12288:7jRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btO:7bEqgfmM0+Tx5ARt
TLSH
T171452356F4E372E9F10B86B9A45350DDE65F2BC97843B3ABCF015A518AB89C21712C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 371de74e8981beeffecfa7f9a2b226584e4b7a53357f8fb214cfd9cec58adaf4
MD5 40add4f1336b78a51edd70423a2dbb5f
SHA1 e6930060373ebaf04e154f16f300bc5c1ff023c8
SHA512 b5d631618aa511da449919f19d3d954df39ae99b2ecb3b4b862036e5c846bf03aa9c7203a11495a34ca04bd43dd2074f9f2073c26cebefe5b6c8e390fb6ddedd
SSDEEP 12288:0fwvD5u464Lk3tRX69qkyAI50RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7x:0fwvvk9RX6wkyAI2EqgfmM0+Tx5ARt
TLSH
T10A85D029EBD844E5E177923C9DB3460AF6B278591B31C2CF025A53AE0E37ED05E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ce39fca9e25d89eaf5abcb7702383f1d08a47006e26a29b1465b7e4d4dea8ee3
MD5 c6522ff95e7746b4b67b28d860ee76df
SHA1 8bdab8190840266bb88dc10bc301161cfafab935
SHA512 91a28dcf97c01f923e61d8c1cd5b720d6d14960c2b0981a89342502641138cd130c24b4c7be4cd4b2419bd3133d0c75113de6190f0f8ecf3e3b3a0bdd2a856fa
SSDEEP 49152:LYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vEpmMbx5AR:1ySzPkIMd5A
TLSH
T126066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 136274ed8a0b4e718492fa8bd6bbda8ed263217630dc84a71ac17aa3d01d7eb8
MD5 76a0c4c365c1dcff14d2c2115ef20246
SHA1 79357b4bc4226dcdff54c14bbb87e712f0acc100
SHA512 4a52bae5d4dddd5105932cdf0a83c664d74441bc5d4a8fee2c2fa207cf45db25855c3cb7e68a7b1d807d0f659b4a52c231d6f6cfc0784add81e1eb901da758d1
SSDEEP 24576:g47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYxEqgfmM0+Tx5ARt:g47JUQj4irIhCnDHUPfF/fEpmMbx5AR
TLSH
T1D365AE1EA3EC01E5E1BA827885154A5AEA71742E1F32DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 22be280ad41e83f705cafb24a3bd5bdb2ecd83077c090bb228ea60c02047f737
MD5 3d946de6058f3531ddf3a797569fde54
SHA1 e7380d9ede9079b2882ac73b50bb5a3a88e3b371
SHA512 ef09436bf80946fd830774f1d30b64ddf284f6849f6b690cf1917490a418cb8d7a65e047c6fa6bc669def0dbba9be662a45b4885194187c622c14477cc0e2f17
SSDEEP 12288:sMsfiRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btF:CqEqgfmM0+Tx5ARt
TLSH
T1FF55F11AE29512E8D01E5279CB524685F33B3CA597E1E3CB57C0F53E0F796805EEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 74d56532d19a7fd2990fc719bc175a3c1a2c6496e62916e17c2f73be05d5286c
MD5 29221cb577626245c7bffcb2561c3096
SHA1 623f1257cac7d1d0c4b0bb0d1fe6935c44780420
SHA512 16161318ae96a2c0dff6be0e33e7ca3de94e9f1d92bdb6212d37db903f5a6a3ff65e53cb19acc138afc1563d01138ee19a5602e84a406f895f452748a7af7546
SSDEEP 6144:otsBC2naIADbhfY/+dOotMxAEgKJUR7JWXK+XCI1AwPQNTOIvEfoePWgpngNjT5R:/KgLURcXhXGCRPJnbz7seRU81cj26
TLSH
T1EC3538117666CB4FC6A940321E33D1CCAB707D41EE45AB0772C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1fcafd8ad534658c1100dc536ea6e7ad05fb5c4e40e14d98f90fb148ea991d7a
MD5 6a8d9e797f62f66b7c339d7d3ceb73a3
SHA1 b8170d48e94451426eaf03be6ba234e832f5cd46
SHA512 ef7065463b69a83de7a14aa71805b40b7239d5b71d5d87617ffa90cfe4c203c4ead0897bcd4897a0b6688400d4110dc1c1435063ed53c32341c93b74a27ac2f8
SSDEEP 6144:sZwtdAqAwlSltzjNztiUApPFztMxAUSPztMxAdjxOVZE0IeB6Rw7Q2:suIf5tXApwSgWuww82
TLSH
T10765F841A137E68FC5B65032072A6B4C7B74EC17B7056F26B3C9453AD82AB56B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 95aeb7581204450b10fccf0c3a9b488ddcc1b1def085f3197420335d3cbe06a4
MD5 d9a97f8d9b5a0e7c2e047ea900b7451c
SHA1 994ddc6dce672f378bb897050c06acd3e88728eb
SHA512 431ce0a136b10304a9cd88f8416355716c0bb04a86cdb4d8c42e4f856c913a47e8e8536299fcb29bc93eba9998005004183806b1c64a0eedaca4550046c4dd7c
SSDEEP 12288:037aRlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btW:ayEqgfmM0+Tx5ARt
TLSH
T176452362E5D3B6EAF51F867864538069F61F3BC86E41E2EBDA00169189B8DC14F31D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e1c47a215cce4ef1c4881526855f62fce2d0a81cab61698734ea545a89b40f64
MD5 804ffa584d998f2fca527b3403b11e69
SHA1 d30c464e531cb8e20f811d6f9b387bef65626d63
SHA512 225dd61f45a4edae0d75785b35d917fd8e715861e35bd53d7f7d1f14771fd689d42c690747fa364790990830e24956edf5ac636969015773ce38f007ba51c5a0
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYkEqgfmM0+Tx5ARt:Mgb4mBIBhGFxEpmMbx5AR
TLSH
T10D65AE1E22E802F5E0FAD2B8DDA64417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 22ee87d1668986b1d191290c00edd39dd9817ab3f60b647ba451e9c5818bd286
MD5 ce53a8adfc55259619c90217d57faf7f
SHA1 768c2b00aab2eb8f668e87a125275891dac4cb9e
SHA512 601f1c921019a94715b22f5bf1732746ca24d644b5d9eb4d7d93e726cfa4098b7c3296308b65bc336b166385375602d293ef051dcb3254d36f5f23f5a1bd5585
SSDEEP 24576:8G88u8FpJqH1Izria7/mBEqgfmM0+Tx5ARt:/7ZFPqV3a7/MEpmMbx5AR
TLSH
T16C85F165B6E102F1D47BD138898246A7F6B2B4251360FBDF0BA88B511F23AD54B3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 47bac62bf8efdb3a911ee21477570db7fabee3f6a9722e137e657fbecf1b9ce9
MD5 8a356319a409880127eaddb194a8ecae
SHA1 0dd5d5fc45a026bf0a359167c1bad8174bfbf872
SHA512 d15d5c794c9c4e3e8f99f46ac60f95b184941f3bd8a306d040b251d148bf2b23c79abf6f32dd9c5ba3ddeec4d05d7758d493fecae8c856d6290a974d35f3790c
SSDEEP 12288:jHvUrBFrEjwaQ9RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrF7btO:jPUr+NQlEqgfmM0+Tx5ARt
TLSH
T1B065F12F62E918E5F67AE17C8982860DF77274521712E2CF0290817E4F67ED8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81269fbd590716116790fbfd1337ac8547701a5a0131f98578a4e56aa38e16c1
MD5 153ba7e573fd9878da23fa31700cd83f
SHA1 4232a651c8a57fd940c634cb3366623858be31e4
SHA512 93f3e2513992429de50ff2ba74acac302b8d9f8c9bd2d49795cccf15f8d30a4aa4c23291dc3bb6d6563acd97b8c6c9f4a3f4cc6d635e864794c3157df1f0cf7f
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1EpmMbx5AR:AG05lO43bTIMd5A
TLSH
T15BD5CF6E62EC11F9D1BBC17CD9C6460BEBB23815032556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e7b57bf81c59c32d0cf088c9b0a6687064aa3a7477388ee041d721897f77e9dd
MD5 005b06a3b7527d39e7c9a8146cbc2f01
SHA1 a6d631c9e2cda5bb7cfbbbae8e12a12d9b1fdca5
SHA512 6c46f13ae14939ff20ffb74750ce54abd5553863ed2525214a02a1a0cd9b13cfea03fc8bd12e25517304cdf6b3593157e2993c25a91abd3d82fb29fc4085e0ec
SSDEEP 24576:tfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnvEqgfmM0+Tx5ARt:da5POZ39Jt2pasx2+mtEpmMbx5AR
TLSH
T18965BF5EA6F801D5D179D17DC583861AF5B2346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1abfd92ef2e0fa817f43dad8d7fbfe00451e5472717809942b1a76264d1555f4
MD5 01073cea32dc87c0833673c10faa9a14
SHA1 71632ea670e80792b0d78218303ba950f52c2e46
SHA512 ae445050e765035f38ccc3e0cf5ba398d7e2b8996e184bd6b38f10bbb2a1609b25c8c005d575a69d2062107d41dc4182a7f4390a81858f9161f4a618774441ea
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk5EqgfmM0+Tx5ARt:6Nc/zEOVHFsEpmMbx5AR
TLSH
T1C8858C2623E901E4F1BBE1BE89779546FA717869173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ba76f784869781125d6bfc01b36405d607284caf0c15d09169500351a72cdc39
MD5 a2658c1bd11be29cb70b087585de5093
SHA1 fda9473846768834c5f7725d936fa9ba43725f55
SHA512 188e6fd34503f3f18cd6240cb6e6207f5473f9edd3567d6c8728a8d8f28d93e2dfbcd6fd3239da80d4167e9f124872927cd897f0928225cd7f43a3455835d4d3
SSDEEP 24576:OtkNvNnaFeYhJNtmZBmbEqgfmM0+Tx5ARt:OtMwBtOmbEpmMbx5AR
TLSH
T13E55AF6EBAB846E4D1FEC6B4CD238512E6727461173293CB5390C13E0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2d86a7d27ca7ecc120ab6553f270a0e62308f6500f1386ffda25d62bda9e344d
MD5 15e778d3902a93693d51a5105dc04ee9
SHA1 8222135cc7e885659b90e6cb96270ade7214f070
SHA512 53d462fb7ff2f5bb4ef4712e7dae01c8b49b6390653296593ca60b434c89d08c2f316083b2c107cb80d7347e16b0291121838167de9eb0d53096778d78d1811e
SSDEEP 12288:GQcMxWDXN1Dp/fshBItT1IQgA2RlbwqZYZjfmczaAcTas04nAuflc4VWx5ntOrFh:8D3FHshBIYQgAuEqgfmM0+Tx5ARt
TLSH
T16575E17EE69D04E4E57BC1BCDA538506E77238ED032266DB069081B65F6BEE42D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-124-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/948-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/948-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/948-122-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/948-116-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1616-1-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/1616-0-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/1616-6-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/1616-7-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/1616-76-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2056-26-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2056-27-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2056-40-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2056-35-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2056-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2428-285-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2428-302-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2428-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2428-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2428-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2428-89-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-132-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3472-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3472-304-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3472-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4092-54-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/4092-62-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4092-56-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4092-241-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/4168-49-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4168-50-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4168-43-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4168-42-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4168-175-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4312-300-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4312-103-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4312-104-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4312-110-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5288-66-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/5288-268-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/5288-67-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5288-72-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5344-102-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5344-20-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5344-21-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5344-14-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5344-13-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-84-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5748-78-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5748-77-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5748-315-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5748-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5748-280-0x0000000140000000-0x00000001402C9000-memory.dmp

Download