64436ba1b4061ea153d82ba997692636d822f030f66cc570e93d8841d2711c40

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample261104-28tkcsgt7j
SHA256 64436ba1b4061ea153d82ba997692636d822f030f66cc570e93d8841d2711c40
MD5 3bdc1aa0fbc69c3d6058d31ab7c4dae7
SHA1 b9db35735b6cecce2704e1a6eeb08226afe61d3f
SHA512 4e0d28a64a3ab9e3f8c8a22ffbebb8b22b73bb37542fe4021168a937263a0b005b679daac01158c555d19301f4145e0b7b9075f862c2fb84905d103762aeb862
SSDEEP 24576:0iqiwYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0iqihILNiXicJFFRGNzj3
TLSH
T16665026271C084B2EAB704350AB49670AA7DFD715F2448DBA3543B6E9A30BD0CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5732	elevation_service.exe
5184	elevation_service.exe
2784	maintenanceservice.exe
4704	OSE.EXE
108	PerceptionSimulationService.exe
2752	perfhost.exe
5060	ReFsDedupSvc.exe
5200	SensorDataService.exe
2636	ssh-agent.exe
1084	AgentService.exe
1888	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca2f27434b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e648a6eb26cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab6cff6fb26cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b239cb3b26cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da747471b26cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0083373b26cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036dbacb3b26cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1084	AgentService.exe
Token: 33	1888	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1888	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1888	SearchIndexer.exe
Token: SeDebugPrivilege	3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3908	2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5732	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 3916	1888	SearchIndexer.exe	101
PID 1888 wrote to memory of 2564	1888	SearchIndexer.exe	102
PID 1888 wrote to memory of 1428	1888	SearchIndexer.exe	104
PID 1888 wrote to memory of 3796	1888	SearchIndexer.exe	105
PID 1888 wrote to memory of 5496	1888	SearchIndexer.exe	107
PID 1888 wrote to memory of 4624	1888	SearchIndexer.exe	108
PID 1888 wrote to memory of 3428	1888	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_3bdc1aa0fbc69c3d6058d31ab7c4dae7_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5184

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 93c9c6f41f31633de8668f6c353a5072cf13078df220dc08d57e2b37071ae7d3
MD5 6791a6532520f43850256a9beef9ebfc
SHA1 3dfb8a70863bc059e51d7339b939d2352eac8b06
SHA512 1a6d92e09660d8dbab6ca0f1998a5ae4fe3f438a71ea8870268f2ff481e8fcf5b4f635b9f73235edd903a4c822550b00687bcade7f30c6294d7e0f88f69d72fd
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+LNiXicJFFRGNzj3:63q6mjB17wRGpj3
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6b5ff97ef55ca63a1fb8b6c99dc19addb5ff1800f2e6ba18d04545a60ead601c
MD5 76e37cc32ff01110dc676bf4dfe52f01
SHA1 ad1d73d460ec581aaf5b54fb0a940bf6bad3675b
SHA512 97e857a0ccf08ba64871037514925f3bec8fe4c71e4faa9cec8d2ab5279adbb921df17b0177871d7b937a2c9c479b87f0ec0e57b6ffdd1bc9be71d56b2faf8f9
SSDEEP 24576:zXYfDtczAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WtcULNiXicJFFRGNzj3
TLSH
T15375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 044c1abb256fe2ea4ac9274ecddb6b896129d08e97c74f260d22f6c377d089e1
MD5 a2b23783e5871ac0467145f3d4bf7a8a
SHA1 85a5b1c9b9a2cade52026ebc6d17657fb7cfe015
SHA512 1e8881b186d2960008cc8d2acc9a7570eb62d1aa06a4aff3b0c28ae79d116a8c92eccfb41c0e2d5c6c666c8d51670e9350e13f86366f936a800d14986d980ab2
SSDEEP 24576:m0Le5ji0hmxhrM2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mPji0AzTLNiXicJFFRGNzj3
TLSH
T19F859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 775c5db8c81495b5a0a6ae6bf1b15cfa0147578e32d0a8d7b9050a87968539bf
MD5 7d8461568bed893be2e0082b21a70dd3
SHA1 ad8276e22cdfb55c8d28b20a7d088a3250384285
SHA512 cd199f0c4d7002d4c809b64da559ef3041312f6d77828d069de2814ef7492c43a39217dbba27e727b9a4e175cb49844d33ac3ff19f393fef4243063e93696832
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWj6q8wyuk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/ezSC6vUzPv+HjyHLNiXicJFFRGNzj3
TLSH
T149756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ad36677ea7eea2bd38aeb1c46ccfd3a0abfd97da5b02aed4281e16d892b699f5
MD5 89952d00e490b8d8ffadf4e2e650ea77
SHA1 df06e1064dce588de0e2038e96c80314e4db4433
SHA512 973ff944d086e2c3b6c618ab647633f4e7c5d93d52448ccb5af23fb080a9355224256b179eb1db4819a4a4a5e181c18ea01d107dd07511afea5feb3a1304c8d9
SSDEEP 24576:/VbqPb88hv/l+BF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/VO88hXl+zLNiXicJFFRGNzj3
TLSH
T10C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 63ffd30a5fb0cf092c2d528e87ce2765a012e207116ac6227067ba41810d71ab
MD5 982aad11cf02956af41bef1fc399c458
SHA1 83c0a60072b8b44d525f55bacb4e2ffdb62be2ce
SHA512 ef518c8582ffdb5de993e00c3ef08f8a6f0a27783cbf817bbeef3c322bdeac5152d6577d012093a9db36a06e76e7ad36a2fcb6fbdd03e2025cfa131d7e7181da
SSDEEP 24576:pGS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1175523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 148aae582c7ca223c5316ac3022e27252eb3e4756fa26cb8486b73ee227172ba
MD5 8b8ae9463af806c051b8ede4e7265a52
SHA1 caf5dc176e3de2a07e70274c78e2bf3d965aed64
SHA512 126c77c3d0ea4bf7fc4e5d7fd0275c535e07e66ccf6234116620c056895d4312612686d54d7f03242642b87416d364c2e4227c78bb8bc397c6d56743483481f9
SSDEEP 24576:EJIUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJIUdLNiXicJFFRGNzj3
TLSH
T1CD75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7328d2680699855bee574c430087baa3ab401acf1753a2464e4a99073fbcdb23
MD5 42d44247de15de02adb4521855ed2f37
SHA1 90072badc040152bb654d9d7404a1c9bb273aaca
SHA512 c95e0f4f0894f0f7c28ab7c0b4c8f7b8442dc16501c41910af1be72ec5ae61a1d456e71a72091db3cf81a6392ed3d78ce36ce50d25d3a267d32f6ff26be8ce4d
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:+QvGAdlCEL8c/WRNw5C07wRGpj3
TLSH
T163266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 935302273fd647d6663cd72b989316a3897a68af3b79dad56e18fb7bc9ad45e5
MD5 aea36ce9b627c1d0d5e2042ac1ae2242
SHA1 cb0f8cd61a4cbc9ccaf805e132e4589f75a5c973
SHA512 da54bcb28e5988cea59085c589eb7b63388304dc187ece9d77a549e7312e78ba5008304d0cf75abed07e4cf47be4fb1ec598c0151216f1686d934aaf504bfa23
SSDEEP 24576:dfewsAjj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hljjLNiXicJFFRGNzj3
TLSH
T1F075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 448dd2a33ab12c0a2fc546d01b7fbe64054f42b0aa485f9956546add1a61900a
MD5 5ea311a4e1c7dcaa0a5e34fb1017eb3b
SHA1 b4d378348d1f33a934cbb90bb38846b0e46de11b
SHA512 04eab8cb2d0ce69f1736753cc42d12732246540125c8e71b690aa4de21315d4fe97038d9c2feb6c431bc3dd1339c1e3275092e17df3c0435600295097ad67d37
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPF9:hUEtQevvqc2W1cpV20I3299
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 db786073447bca5c3e13b283c8566a83386676abf931355e222ced860dd0b721
MD5 64835588c583e1f32a27c289ca3dacf8
SHA1 8f51f4a113cd38fa75c75fef87a223ae9e15d7ff
SHA512 7d517257e4f3f137696dfe7390785c8f96be2bf26e4b48d99992bd9adb77674b82a3147742dbf541c442ed8dd9fc0a00b2aa81655021a1392cb1cac9f3a41ceb
SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/zDLNiXicJFFRGNzj3:qoq2VjnmY7wRGpj3
TLSH
T18BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e6e26688b6f01f514897e18ae85501bc20d30fe6cfd6b48582457d0eb0d3a326
MD5 a4d89cf1e102c89378068088ea928595
SHA1 592274f3932da7cfd2b1104b093fad867c3af9ca
SHA512 825de05578382481734a511b42d2910d8c4e8e119974d91d7d0341c9df8f460ba96722f23ebbb316b095c1962c8e8d067f7a517c0ff72feca592b1ebc00c4ebb
SSDEEP 24576:qAhGL6IFoiwtA5l7S534/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qAM5Foiq5oLNiXicJFFRGNzj3
TLSH
T16A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 eae5a2c70e4de6a1bc2919a8adef522e9b6fb6a22e9a2176f35b3499061eb57b
MD5 651ac6d0b8782eec1c4719f883c3c341
SHA1 746c665d7c89ad216d0a29bda1d92643c45da817
SHA512 4a862d13d436fd4ccf28f216ef4d4c2670f9383e5c2e7cbc656fee8ee542aeef55b65ba25dc9b060d58ec89f207a97e74c2269a5d336bc56738732f4e47f83f1
SSDEEP 24576:OwuROWn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwSO8LNiXicJFFRGNzj3
TLSH
T10665F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3b2826ee2cf1b7f2a296e5bf87275fb778870690a3af56f6910ff864ebe36cd5
MD5 5020348aa9d65f71448eba66ea7f54a8
SHA1 4f1532705a2c978f2fa18acdc5eee95cd737fef8
SHA512 babccbaab34080558d25c9047fcdbabf96899894a09e37c0491d792f5d622e9037eb295597e27a8b0d430aa7f074a04b522b5df92cdb0aa88e891ce4c8f8bd0c
SSDEEP 24576:IZuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T10955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a84710388296e7b0016b84f6e250ffca3dc733c8fbc5b16e2d1286635b857e70
MD5 86f3f224ed3089405c8fa7caaeb13517
SHA1 9f12f34068598ed51744002bd5bd93a9bf480f15
SHA512 bab0735cbded8f89027e49dad9c4f26a1505f6b20627aa6e0547159014d8d6a02e3b1686711056091ba1904899b514492ccb4eb60fd29aa33c1a7c82659c4182
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN3x7wRGpj3:rQyiKanX+PNlF9
TLSH
T1CA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d8c5851019efbd099ebb827df7739efb6f977551c5c976e3eb96513dd082b37f
MD5 79c88b0047c808b0a5570c1a18f86947
SHA1 6dbccebbbae4affda2d44eab1c3a77fddf931eb6
SHA512 c4a99908a604222b8072d8f3fbd3b9e76aa4889e2a0f9f52105744b1fde436118e7d2ea212bcb6303dcfba8d95628cdfff6eda586188f295157bbff185cb2525
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN3x7wRGpj3:DQyiKanX+PNlF9
TLSH
T1A3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fe7686ca1645873cbb9a1c12c671909567b4e18ca32ca89c7ff5488d0417edbb
MD5 3995d417908292b59018723fe8832a26
SHA1 8a62995b479002c98bfd991e2d3f215889148711
SHA512 d23050b42ad4df395b4bdd3bd9a1fe3abaa4cdd503c3f8e6bb689daa980ec4c7fb1a7f29414b8c33e4b32ab668dc86d6a685b1d5c83370cbfd30c02e0fdadbd2
SSDEEP 49152:a68Qg55nhkeWu7PNU3/TLNiXicJFFRGNzj3:IthTRc/T7wRGpj3
TLSH
T107B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bba8d941f43cfe6a62715d443d0ffa245581f5b79c028f00882d18f7ea4cd995
MD5 0d8c81719eef81758efaab5148e49a87
SHA1 457c1ee0aae108b7fddc528de64aa5fd683010fd
SHA512 3b9cb4ea1693c7edcb9df9a32d6d429a58e51178abd0f60d825968fb0bb4c9109149657fbf873b724b22a9a86d5c23c4d8f20358bec35d21c2e59740aaecc708
SSDEEP 98304:My5112gYy5azzVvU69nLKnhZS7wRGpj3:NLIHRWh8F9
TLSH
T11B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 996096ec4cafd1a72cba7822f6cd0506ae0ec5e04a71334faf99114114a2c71c
MD5 f795fd046664af8d9fa80aa7fecad969
SHA1 9fb664ff6f65b0c69f9eb9c28fafff09cf790a10
SHA512 5fa61a02e66d7cba5d63d2294927316908b21b3ea4310e87ead9f89957978037f7eba4e68834f88993bda87a0580bf68484c51dbbe842e6cc933cb0de9518856
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:Ru6JmIxd2dJ7wRGpj3
TLSH
T1ECD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a882e16c35552ce1c15c1b0fb55cf23b16cf054234d7b9313e24bfd3eb9193bb
MD5 78704285759e92753f2f4e21506b5422
SHA1 4579cdddf253412d002ccbaab0910c4a54b72f89
SHA512 c61661c2a151c6655321d0ea659d5375e9e1f5af195af9d6403257f88f186708b2b3ab5609f70e0be45e458831cd569efc7b11be924b9659abf2554854cd8cad
SSDEEP 49152:91hpsNoJpF1A67U44CwH7R4x9LNiXicJFFRGNzj3:9mifPqRY7wRGpj3
TLSH
T1A5B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c5a68346a1a10112426ea8ae3ebf578d96f2b93e0cdf1713c0cfb5eb14ba6f30
MD5 4d9d0aa196d69ecc960c3aa328cbab15
SHA1 92ca20a70a31365b02a5d02186e580d13b22ffff
SHA512 409d1d475a94a3e42ec0972557f3f0915983c492e9705c2cbead56cf5d309db08809a9fa9f96c62512bd946dc941ab3ecf90fcd3d3b672135706b9d297b1f178
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqOLNiXicJFFRGNzj3:N5dKqi61O7wRGpj3
TLSH
T1B3C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f565928aeb64142ee5eb8fbc03b5e45717d4ff701b4f941aa93d28d81498911d
MD5 d57b745dcd14c52ea4b7241e49c56989
SHA1 1fe471e3984b7e4bf57176940b30410e70422256
SHA512 83d210cf285eae80935a06bf7483ea673f64c5496016f6acf7fddcc8e21fe282190fa824f8dd5c4edd60e73a9340c4c675c41f0d57f30d1f9a9de6b2876e06e3
SSDEEP 49152:zhtSn8EApI0figjgiDn0AP5wZLNiXicJFFRGNzj3:yX2iWphc7wRGpj3
TLSH
T18C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 177017f500db79bced0696e515861831232c175667a356f3ba5925b7fd40dd5f
MD5 c4550ba5c08b86b32330297220f426c5
SHA1 2f34670d369e52bb0dcfb947c7c1648986e917d0
SHA512 a2b2d30ff41376dd2408a9d2d3c1f6875f1eedc6626ea1f63935f2273ff41ec6eb9510b74f8abb0afac599698929ad1c6f11cc03ff454435da950484ac10895a
SSDEEP 12288:J4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3183D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a6f05e0430a7e838bdcc117bf514d2317b0183324dde0895874b1a406661499f
MD5 8ac55fe2e4d4c29cb07c5ea991176be3
SHA1 7351f1746d7449f41c02a0430c2de7f9d3608b89
SHA512 5b62b916c42fcb9ea9b150ed4032da78f5850d8d6e1f283c35b8eed6a29087d143327c6ff977671ba26ec6485d9ea79694374c650fe49ab4b66b28f4af8614a0
SSDEEP 12288:vbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3558955B1FABC003986754428F5882E2DEB5618E3E3183D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5ab5964d994ae4f08574b8cff69648acef761cca7536be031d9c265817ccaaa0
MD5 828b8c15a640569408416028f278b907
SHA1 814a402107c34207002c912e0f3552dfabff7d3b
SHA512 6c84b68c1770c88b09f117e76cee1e65433baf47453e09abf87b174fa8cf1b51294a6fb29bcf8a1e8e26af5366c677b1799debc5f4f6d5169d73814383455e65
SSDEEP 12288:dpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D3558955B1FAFC003986764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 62beabb28f5c500b1542f9e0ca2fa7571861c37d1064a0ebeeca0ba9c1c45652
MD5 18cbeebd07da4145c2052626eb7b4ce5
SHA1 e8281ef7022dbe2e4f57efa767ce5b0508211611
SHA512 e4dace32b3170bb7bfc248047cdff0efd6635c53e9bc86214dc39131a30e229cf8b622f94bc57e322b293a1c16c173bb7a6ff3754393cd8fdfdbdc0be21f1ae3
SSDEEP 12288:hVuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BE552393168900F1E9FD8039C6764428F2A47D6CD7325AEBD3003D1E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c877ef3c804134a69f48aeae1a9b2667a4f7af3aad834907a27e774a69b3743f
MD5 9542113b0fa0128301f0adac82274e53
SHA1 b51685336b47da6f0d3765baa08c770e08815ece
SHA512 110b3131bf3cce76729dbda9b9a55bf96c5385f24c5e5b67500c9daaf319dc6479ea6bc022b2d532bea6b0ef4313d69ebc11e962ec28f34c8e6027a77af75a26
SSDEEP 12288:K2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fc82cd9733de4bdec2a4387ac4afc19358a005d1c237db03a969756b479010be
MD5 717c8b77ee495e3a5ec271139e490ff4
SHA1 338b0eeb5c35a134804c040ca0526f1c097ab248
SHA512 a9f4be5e68131549533ca13d6838bc62b4548358ec4064790c2594a315b2a48a9f7dd800c4b61288b47c2a04659ebb858d964e45e6fd8e16b8a23aa2701ef2eb
SSDEEP 12288:hPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3558955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5d545432323b8fc8804a03054922ff7aac33de532beea950691a215b803ba9a9
MD5 cb2fc2851298da2dc37f7e8cd23456d8
SHA1 d5c01637ed18e28a5caf98fdae88de46b6f79f3e
SHA512 9cc9826a676399ca26fc815d9722622c8cfb4eee8305c54f7433b19dd9c99f7b3cd8e25793f36a35a59596dcb10b3b2a0f7f9c5a72d7a58addfb2f1f3afa353c
SSDEEP 12288:+jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D3548955B1FABC003986354428F5882E2DEB5659E3E3183D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 82a9a51cb04ab978e9c0bad22a67e67211b2ceccd3db07a077e87299f114fd82
MD5 314b84e6fe280a0006686222b60faef3
SHA1 fc8e0416e11b6b9c3d796f6b7f0666f64aa6b459
SHA512 ab0b87a3197d2a239a44986d3f483343d2ade838c3ac2bcc132569db2979bbe8695ba20b4c2d85b5f3a754c5bade01e17c563be738da46a0f1d0d5efdf37796a
SSDEEP 24576:oZM3zFVSOv/TwSfVcYG3K/cJHlnFR+IGNe8j3Izz:oZM3zfLLNiXicJFFRGNzj3
TLSH
T1F4750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0908e5eddd03e207c7a136d6b8be4c687d27f796c28171241b59d35f73351527
MD5 726759f095abd3913d11b29ab84c27fa
SHA1 b9c48253f23a04beb4da440bbe9f15dae7e518ac
SHA512 ac9a31445a59c148f101b71cedf1bb0b08b7dcd3921e1dbd6d99c00c99a33d6bf5af88730593504a2ad89d7e09b233660699894ec991d496857c68c758590271
SSDEEP 24576:le/TwSfVcYG3K/cJHlnFR+IGNe8j3Izz:oLNiXicJFFRGNzj3
TLSH
T1D75523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4084345dbb83061593f6f379bf33132fc32353219009250ff06c6760d4a28d2e
MD5 199ad5bfefda21319b7c3c2f98e8f733
SHA1 ae49a5dbcb445a091b0541fc83055326d49ac8d3
SHA512 fd0472fe6557ceb9e5b27e696c41c466c26f66284a295b048f39e00e8ee39c941fcd98719be31088c6ba244a689adc773ae10c6e4f1a7837a691821e3d9dbbae
SSDEEP 12288:JwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ji/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3558955B1FABC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 18d3b8c5af501915745e269bcf89f62846ae7bfed059b168ef2f446fd180ae21
MD5 f4ce5bca5c4782f2c08453ecfb5ee154
SHA1 00ab7ed25bd440ba7765c6881b64a317674121d6
SHA512 5e96101324e5a935b828558830416562bc66095b04c996439afa6b3a2806699acff1206ed30870875b7aa2e3facba585e175558920452201c51906dafdad972a
SSDEEP 24576:Ozyz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OcLNiXicJFFRGNzj3
TLSH
T170650147629530F9E17A8139C9620915F3B17C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3868f6913d559bcb5d7e3f2ea2e8418260ecd72fc97a0eda47aa54ded2c9d58
MD5 920d85f2a5a4c5c451fd53bd1a8f2dc2
SHA1 c094848ca128d5fb836f7b39f61499cd68417eec
SHA512 45562d0f95f107a7e848b52566b2e16e66564a4b43ac45b87282ac482a1508befa8a43e8d5b0d70664df5b4f1ad600d03925f2217d778fd60f6994a33370e752
SSDEEP 12288:o0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6c216b17f489cb82812eeb3e5c056f9be05c4e9125484ef1c1373f9a7e0e5915
MD5 866dfe2a02158d19c9bb152375ed2452
SHA1 e7189aa8eea5808f5a59fda26d1a6aa1eebedd8b
SHA512 fd0447a6e8c67a3940d031a0e256532b0dd193d5a13c4308241595b99a339e5822ff259bb0e8b757bf24737b7ed8d8926daeadecd65ad886758ce76f6ed4d476
SSDEEP 12288:h0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:he/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 509c24c777040b3ad4964c496c5ef0b8f49e094d856a697ec5dcd9b99015fa13
MD5 3bcebe472934aecb7c32972e34c2707d
SHA1 c9350a7f52c74c2d743101409fb4e0d1a809087f
SHA512 d252bb1b2d035cc0d98dfea7070f996d25facf54cb3725f9ad903c886508d617fba311447ce7f715fa3c9395b248c256d56e58f1ff6e4fc19f2cf567ce4ac7f6
SSDEEP 24576:+zyz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+cLNiXicJFFRGNzj3
TLSH
T1D1650147629530F9E17A8139C9620915F3717C3647208AEF53642B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1f547a21bcad52e44ca8f4acbe23e7619ff3a363c757d8de876593fa2219579a
MD5 adcc2cf5e1e9897fef3459c9be08af79
SHA1 705b78debf7ca0bf1de72a071b3293f88ecac1cd
SHA512 89544b71c9890aae3687446aa4dc748226c922ce19559b1ced3396c51d8bdd20e979cbb681c09014ceefff08ee8d6ef7487b82e8a57ba516975eda84ef888e38
SSDEEP 24576:KT8aLl3z0zDl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KT7LljkLNiXicJFFRGNzj3
TLSH
T1117502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ce81d34f0ddf1b419e2ea742f30802a36ee3cf3978a478009f2070f9cfec5aef
MD5 e5eed1c3f577e7b6b1cce88ad39e2f30
SHA1 977b762b67bd94c7d5d51c29a2fd975a823b628c
SHA512 a0524c5d20bde05dd3467f8bdf7e09c40336eba6aa3656c21c0bad8caca6996d5632ae5774d3c5a4198d2a85050abc398cbfc813fef2b4a46ff3bd94374aec1b
SSDEEP 24576:y3rd9CHKy7GZR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Urd9CHKyaLLNiXicJFFRGNzj3
TLSH
T10B85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 86001cc29695e3e3834359d2fced1d4e227b35ac05da2cf268066b2d5d21bd51
MD5 89c8a1aac1934e3886c6ade110750f5e
SHA1 50ca6204ec4993b610221a9653d5ac976e5df6e8
SHA512 18801ce94dcf27fb8dba089826e7cb4b31f2967dd06d5c25e565115647e1f69118db14fdfe1a5d0c31e1cd4ba72807c093adcc9f7cab78e080316d896f6a4a67
SSDEEP 12288:0JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a20ce144c815a289388c1244b580753fa83825eba5df934131969d75e6971e51
MD5 d1171b4d1ab47e3c59a58aada2d1e1f3
SHA1 9fcd816bef1a71bc593e425103bc7b7d745015bb
SHA512 bdc5c99f099934ff1c550fe4147bc04a72e2f091f3ab2eaa3464e1093081010094597c2475b3a5cd0e0b70f17d4b1ef048c7e553e8b725e30281b601229b46a6
SSDEEP 12288:nniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3558955B1FABC003986764428F5882E2DDB5619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 01b22b8012bcd2b787e9f7c0e70218da2d284abe703fe01e8d5957402b4ba386
MD5 4b483ac127d0c9c689fde18b31065804
SHA1 07ef70b5d57c0e10c1b42eb933b4ebc20b748068
SHA512 02affa347946d214da6870c8af691062b012dc385236036490a35a1f711244d7e9447a6fce8b6d6ff6a95832936321b216ce4c8074a45a225ef1c9bfee4fd09b
SSDEEP 12288:pqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ps/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 59ca2eb54f895418e9f49aa110fde0c68d278895b5a0bf9d192a35a141eedbbd
MD5 062dd6dd5bbf6599b0598f6953a45ab3
SHA1 95a68535c00a8d96332aaa241d548d4d447a9da0
SHA512 b1a3c9296733abfe69ff79dfd0a985725b81647ea58f63310dbd914c8e7ea177b4b2f3761b195cc4acdf8b23539b68c9ff96f6f70f917ad67e842262f4e3c5e3
SSDEEP 12288:k0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ke/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 27afdc49ac8dafed4da02e39fbe45e7f793acd79a3631f3c70d5222cd4fb9242
MD5 54cbcb9c5417ed90e86e793178ef60ef
SHA1 9e65e598b94419597ca2837a1c6ae920f274f14b
SHA512 8cd6c508d98e41dfac402718b6eb09c1d20c1662af3b081f7cd7cf665ebf4c6e1df1c8c64065b79961639f5502a28d70de5b2923a7d45963e93f318b69a9a02e
SSDEEP 12288:QJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D3558955B1FAFC003986764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fade19f7c46a57501b51958a366d3747cb8b3d3210ae2e6e08106fd18ac775f0
MD5 bb70fc360e1d89f5fb6573417be4d3bc
SHA1 adafd9f022875758a488663c32b41fecad290817
SHA512 6f6859a1ba1e45f2d98369ed33c68bd5c5b490400d248228bcca450e80a1a7542148f2bd6884163a6e099755654a63e49afe44b80ee4660ecbe61699325a7eba
SSDEEP 12288:RciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3558955B1EAFC0039C6754428F5882E2DE75619E3E3183E1EA278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b6c118368ad814a5a52367c21f2b86cf3204867c794330f9ccad3f82acd86f38
MD5 de1faaee7df3e2ee8621f024996ae265
SHA1 07ad55f0b4e5dec65749dc2da5d59f1988b7a7d6
SHA512 164f6f89dcd2133ccf5a8e78a572ebe9d91f6ee2361700f7f5c3f1acfc89b9497b0e45eefd1777a6a162e56a0f5887a88febe98a76a3628251a42f49dae3c0b0
SSDEEP 12288:v2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14E5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 97e3e0eef14415553c1bacde2f3fdfecdf1f5807dfcd462bef125c5331c912db
MD5 d854360914ea5d012e76b8fd70e82e45
SHA1 03b11440b7f0d391bafedfacc46cfd52c0026789
SHA512 20e23d27a2be1661a7dda1f9515ea68102c0a4e608819167b49557070f04b9bb092540246432150ffa89e08a72a09db8ef881ae366f1a3336682095177089a5d
SSDEEP 24576:cfwvzk9RX6wkyAIy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HMnYIyLNiXicJFFRGNzj3
TLSH
T1BB85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 05b16e19d706ca8b3fd25f181248be23b69211016999eceafff6decd892f75bc
MD5 594491dc8879b18ea2a91b428fa49e9a
SHA1 18e3d763feee8da01bf3827ae54184368bacdec2
SHA512 40293101090ddaff537421677ef434667c74e60bdb3cf7bed19188980d3bedc34ffbb5d1d2a3a6c56ad8fb99d740fbfd475e6b5b8a240ee5ea4d319d8cd3096c
SSDEEP 49152:6YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05LNiXicJFFRGN:lySzPR7wRGpj3
TLSH
T168066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7668703c209a1b9762fb66570549351439e01520d5f79626a1b16ab1d9bcbc9b
MD5 1b15eb379cd8b37a980b91e66ca82067
SHA1 d16c0363fdcd112fdd32ed8d55bc52f1920cf863
SHA512 fda1056c0a63f6be7cb975161ecc5141422dcc38a5ba79ca6bf9e944d430afba10adbd6a8f52f7d32d0f56d45915e10c6dff35b1aa93eed476f9133cf352c3a4
SSDEEP 24576:m47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m47JUQjqirIhCnDHUPfF/JLNiXicJFFS
TLSH
T13765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2d042ddd686de40b4090d1d5c2235f208b91c2d117dfe1639d021ba8705bde68
MD5 87983df1eaf92a0f21d37f48ee8c8613
SHA1 3bb9b7efd4a7db8e65c9c40529d6a3cf4a484894
SHA512 8139bf451e4358fe35e393f8a751792e9c0ce64d9c01c2e6df36df2c2647676ec2db03ec245d1fbd1446971543756694af857286b151877f2aef1fd695057e00
SSDEEP 12288:xpsfEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 33e03c4010cb3c65b316a4b862e4a262649bb9a28280e0d4a2bd7656e22147a6
MD5 d0f9ad9bf7be4949c2f471d165e5c9a9
SHA1 8a086270ef978a8bb520ccf2dfa94420a77213f7
SHA512 963495815dbfbdf236e709a47f2962f62013217c05531727b7475665f47d231aa7f42d4a87986d9da0f3ce452b3a303d17c8fea0a721a64e02f9c22862c6a07c
SSDEEP 24576:GfOmEUP7g1ZOFz22MCGQz66P7bZv+y19i:OEU81ZOFmCPWmfZv+y1
TLSH
T1534506017266CB8FC6A940365E36D6CCAB707C05EE446F0373C9873E9576A59B6E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 2a2ca3cd5380df606779f1543841c05f168c2a1f3369b8c6f5fc8c91cc25ba9a
MD5 74a527f6244272364732f47eef48c86e
SHA1 d668e59ff23fc02f63426755d198ec29e9fa3886
SHA512 5ab13fa6829ac8e0bb6537850a234c0b8a0a10298dcffc09c7ad4cfef7d678d935baab1ea3f438873e5ec4803c91beb8d4592b6506f5d83b108f74057c12b59f
SSDEEP 3:OlH/lpVtNS4eDlgtpZPU/GXBl3yjIl/lllo3mCllltGlslslslslslsl6Dqtl:KTN2gtbUGOIXymCtEEEEEEEzX
TLSH
T16D81926687202632CE92AB38140597A81312E24AF9C9A7AB31C020531C402894C62A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 2b60131111f44442fbbb7f31d1fd37882c277bfb3608229911108e554b5a3fb8
MD5 e28a84ff30091ed564ed6997aae463d1
SHA1 075932ec3c81d99dd7c2049f5233c72b07a1b27d
SHA512 90470263fcc15bac10973099048be5ba9124dec0ee9f8134c3e7f9784e0730cb5d8f7f2e51b28e8b8766148e742eebe9f158ece62cfe4ee90bd98d7d1912aa73
SSDEEP 24576:AykNgz2KSfgzrk/2Fk6GFPSyDMxopWxE:Ay7jrk/2FkpkoQxE
TLSH
T1C955190065B7EB4FC97E903B4232C6CEAB785C1ABB453F0573458C38946695EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e3d22a0bbc3fa3de591f71a946609c921a6df35186a2b05fa8d1068956828213
MD5 203a60c74c596608b2397dcd69f28c52
SHA1 d97e863f97f7c1654117c4dbf9ad8453b7b2a3ef
SHA512 cb607ef6daf0c7e533d5042939743390fb2b923da095bc53777b4fabcc4bc42d94a14eb980fce9a1ee5732198d7596c9413940e4996a8f62ecf9519d45f31412
SSDEEP 12288:3F7siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523A3468D59B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1717178caaf24bf08ff9b7aef426c832077abf3ec759c167e810f930a7599de
MD5 7c7705b8592cd8b1ef20fcbb7ccf7554
SHA1 f2eb5b33f31fd4cc95b24b0c94862263b5c1f8b5
SHA512 49d572a8b7793e9caa7486fef288c9ba285adcd930718ba20b965168b05ff4e662210899a7d6a4ef77b0a7a227befa0d001907e5fc13588f08dfc2b5957dee76
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zgb4mBIBhGF/LNiXicJFFRGNzj3
TLSH
T10565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bfd53d7619e45a2bb0ca0577aa9eb742c9f720c21f1b60d67047595cea9ee9eb
MD5 4c80b61564fe49cf25992d981e6ddd2a
SHA1 9cf4896f2e164d5abccdff1a8c11ff373207a8f3
SHA512 dad2e6f81b635fd2d2d2bc218aaf281aa0a9db7b50975a09f44b5952d628178edb2fd09bc47e53195e5314534a9b8d6ad683f7c0940fc51c252236638bdca2a9
SSDEEP 24576:YG88u8FpJqH1vzria7/mv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b7ZFPqVya7/MLNiXicJFFRGNzj3
TLSH
T1A585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b3c207143887da5de541ac63c97ab14a0adbf7c8ffa45bcea301e790010d3b94
MD5 5f20cfa1c75761fb79e24bce2689efef
SHA1 487f691c8f00a6890cb21570d549ed3bca01208a
SHA512 ba82bc4029f41eadaa716ab58407398de1c769326176e3b949b90cd00a64df51eabb562c89ada24cdbd4ab854b018358274513a95d854023831f2813074ea83b
SSDEEP 24576:ZPUr+NQL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZJQLLNiXicJFFRGNzj3
TLSH
T1FD65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c6d1064910707475afbc0933b552270aff6d91207bc6c8f7cef20d07657ddbd3
MD5 c9e8f80b7a5f563a95c482f2a8b6eba0
SHA1 d633d8a21fcf3fc4a8531beb36b47bd83e01ad85
SHA512 6cefe8722638f6ede3e9546a56c4e686336ab1d74d73e348400a07da2bdab8fe99296ae0895137c4dea294321e551e5ba97d819480752264ca79fa4e92555d01
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7LNiXicJFFRGNzj3:5G05lO43ba7wRGpj3
TLSH
T132D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 216b097e8dcc79e83d1d744595f20478a3066657f5c3b00444c74fc9f8b3b1eb
MD5 44e412cb92913e429f8071061db52687
SHA1 7f8c24b1bb915cc9c5b4e8f5a7b4651d6546f513
SHA512 804e2e554937feb50c52b511cbbf16bb5810bce9e6418a9af984391447c96fad7e14a0ae699c684d885198c7a1548fb909692ae4d0a2167bef7a7bcfea01968b
SSDEEP 24576:3fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5/TwSfVcYG3K/cJHlnFR+IGNe8jg:Pa5POZ3lJt2pasx2+mTLNiXicJFFRGNf
TLSH
T1D765BF5EA2FC00D5D5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d12ef1d609dda843c7ec8aaeb0faefd50748367a70127eae021a96f00b94c898
MD5 1b0dbf4da7bf2a90bc669514dd789fb8
SHA1 ea23e34f1d08ef555f94092d12dae75648e0ed3c
SHA512 097a5ea6ccff39443c30e48613c2482f128abcddaa9d2cd754d9ffc1c3d21431a3d4c4001069813bcc21bf96afe5a9a1f5bddce40264ac028573c7b374cef94a
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QNc/zEOVHFsLNiXicJFFRGNzj3
TLSH
T1FF858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 52301db0c8ac03309880cbea13131cdf9ab486b5bacca9cf27cce5869487d8ac
MD5 4da11988b99bb2640f3648441a045844
SHA1 fc1b7a30de43e7079a8135359b7a0d7511d5d25a
SHA512 5ea82b439f06972d3c85c0547f56624e3c46bd64cfc1d8c2d6bfb234c330c8f30ce509c1baf6ae22ffdace8fdc133d0e172b910a5dc7bf4f15a61a8c67abf2a9
SSDEEP 24576:JzkNvNnaFeYhJNtmZBmt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JzMwBtOmtLNiXicJFFRGNzj3
TLSH
T11C55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 54f128107c2469ccdb32ba4a1085312dc39dc4f3f577e2dd5010de1b02c107ea
MD5 b8333262a8b6226ac287100213aca784
SHA1 8817a76004e63e17f2612b20daa306fa16cf5814
SHA512 fa5a1a92289b6d80e9479abfd7bb9e1cffc1c716a402f6ba806a4cf84d0867ee9d720a480fe99ebdc182eb043ad9642745eb5e24a9afdc8b2dbdb3ec262dcf45
SSDEEP 24576:MD3FHshBIYQgAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MDVHeBIAAqLNiXicJFFRGNzj3
TLSH
T10275E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-297-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/108-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/108-66-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/108-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1084-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1084-135-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1084-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1084-133-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1084-127-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1888-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1888-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1888-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1888-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2636-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2636-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2636-115-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2636-121-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2752-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2752-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2752-78-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2752-83-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2784-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2784-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2784-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2784-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2784-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3428-405-0x000002DC75060000-0x000002DC7528D000-memory.dmp

Download

memory/3796-327-0x000002401A480000-0x000002401A6C8000-memory.dmp

Download

memory/3908-1-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/3908-8-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/3908-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/3908-76-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4704-279-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4704-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4704-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4704-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5060-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5060-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5060-329-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5060-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5060-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5060-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5184-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5184-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5184-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5184-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5200-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-107-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5200-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5200-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-313-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5732-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5732-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5732-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5732-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5732-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download