8c9eb12950ee3b5f87570f77dbe1198a53099f9d7924bcdc808f9c4f9de9f8ff

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260701-vxm5wabs2m
SHA256 8c9eb12950ee3b5f87570f77dbe1198a53099f9d7924bcdc808f9c4f9de9f8ff
MD5 20a161a40e5e6817f84f62ed568e58b6
SHA1 e0de7ed0cef0a73f86572b249dabf93dee69e490
SHA512 a383e78e2950dfcbe7f17c0cc5fdf2e2c31405f79e3d04a93b996a81d38232954e35f363c904b98c5497465af78c4d6d258a83e4e93f27092362aec0c339a99b
SSDEEP 24576:25GtIv+j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6GCv+jLNiXicJFFRGNzj3
TLSH
T13265015132C080B3E9B7043449B49970A96DFE345F7549EBB3842B2E9E747D28E38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1424	elevation_service.exe
2604	elevation_service.exe
2564	maintenanceservice.exe
4364	OSE.EXE
5648	PerceptionSimulationService.exe
5124	perfhost.exe
5324	ReFsDedupSvc.exe
5172	SensorDataService.exe
6100	ssh-agent.exe
4124	AgentService.exe
3196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c75db20c4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaws.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000379aeb357e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050f76d367e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074ec98377e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b0edd777e09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000842d21377e09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4124	AgentService.exe
Token: 33	3196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeDebugPrivilege	4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4672	2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1424	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 704	3196	SearchIndexer.exe	99
PID 3196 wrote to memory of 2928	3196	SearchIndexer.exe	100
PID 3196 wrote to memory of 4156	3196	SearchIndexer.exe	101
PID 3196 wrote to memory of 3440	3196	SearchIndexer.exe	102
PID 3196 wrote to memory of 4068	3196	SearchIndexer.exe	104
PID 3196 wrote to memory of 4556	3196	SearchIndexer.exe	105
PID 3196 wrote to memory of 3684	3196	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_20a161a40e5e6817f84f62ed568e58b6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3044 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2916 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2916 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3044 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 590af1660b42b99ce2825f0af7afdb16727c1c619b27fa24a56e0352b97d5c55
MD5 e1d2bae6680a0fbb2ed96e8401c43be8
SHA1 475a346738f48a95653d38a8d4673b2508bc9f0b
SHA512 7488fabdb5f661fea1adc7f05bf2193f6e57a50102d18f2925dc3e191bc8375e96ec27973b8ab1e753a70ae7872eb2c20c6c7bcf565c988ace7d7d991769a72f
SSDEEP 49152:2b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJLNiXicJFFRGNzj3:o3q6mjBC7wRGpj3
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 33fb386487eea81d8f645a89692637fd2a614475f21866c0a873a25c2be28c19
MD5 74f983a3039c056bb0400d70acbbefee
SHA1 61f10f6ed69d0fffe6d5feae227bdef6d8ea6c9a
SHA512 92c29976158aff2d6e028d974a6960f91690bc815edcaf141ba97af149e95451ba36092c30b8f7758034409d3b15c9ac2977be761a06ab85d4a40734b1f2aff1
SSDEEP 24576:iXYfDtczA2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ptc3LNiXicJFFRGNzj3
TLSH
T1CD75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1c966620874009c09e06125500e4a2370bf6bf6cae8e337cb9ce13f5b93427ac
MD5 9289ca3c520479c4d5258569a19c1986
SHA1 24e1e7a545fdbf5df9e2123482de26a48119c6f2
SHA512 9cb672569b19efce0d50a1474ed1f957a2293d4b8fe32c2fa48fc472ce8459b24fc7b0686bd0e86a31df1c156261bd46f7a5cb4a8800c6535a44cf2ecbe5d72a
SSDEEP 24576:M0Le5ji0hmxirMB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MPji0AY4LNiXicJFFRGNzj3
TLSH
T1C695AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 190a21b0cace9ee03d692e5f257a0c137da48b9305a3d2fe7db3d17599209eeb
MD5 962084ebbdce3a47ec23fe37fd251f0a
SHA1 d8c4fffa97ec3542f172ef17a44e4462bf573701
SHA512 1db135d6daae38fa7d7c7980a1b77e2a212edd67274c54fa81a9b158df395f0dd78b740fa4e85b40a154a87618b7584432fc69ed357d6bde1ddf9d642b779bcd
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWj6q8wyuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u/ezSC6vUzPv+Hjy8LNiXicJFFRGNzj3
TLSH
T10E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0e55184cc811a9f2b3e4a98b2dc08972befcb08e380f34f51df8b7f6838f4df2
MD5 fc9f89192a0db5d58e9fad246c034c06
SHA1 c6bff194d479c449ccb22060dc02949425e34c4c
SHA512 61520c8046dadf0ff483a72a712080482bb8339700f04bb2dfe705217ffa110a0e5d1153bf76413597be7cd96bf982181ff4e8132aa2a9e69ca1f7f3e80d054c
SSDEEP 24576:hVbqPb88hv/l+BS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVO88hXl+YLNiXicJFFRGNzj3
TLSH
T199559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 8d7d09aea866f53cea060159e7e88290df5a4fcd0aa2b2c2ff3f663d6bd5ae43
MD5 df4f2ff22bc5247d4bead3702b658df6
SHA1 8b12e68e5a5587a5bd3bb0cc276a4de02ef358ff
SHA512 efea9892a2122c1aa73922e268e97bfd11be887f912cc36bf36f440d43a30d68c2ec7fb6983a9e100257f74cca9daa42f9bbdb9bee26b8a072c3f79d420eb752
SSDEEP 24576:Ra9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
TLSH
T12C5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b5edfffb5e8fad0e7dd23c1436d722d0d7cdacbbc57ded9a4008b2c67cbb8db8
MD5 7bfffd4a4f4119d77007d37254d10911
SHA1 8c87ec1934f007c197cea7fe2e0918eb078f3984
SHA512 18214d0298a65790bb05478071be3ba8b260782da1f1a2faa6354d31b36ecbbe9f2c4d379101d23eed6935c82f25efe40791bfb6701490770f339e98563005b5
SSDEEP 24576:3JIUK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3JIUKLNiXicJFFRGNzj3
TLSH
T12C75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 01c01d5c66869ca4351f29c1cd61f77cef933136fdd677aaa43de61a55205de5
MD5 f9c8302b597be6e21fbce72d8727946d
SHA1 9f2cceb866bdafd4efdf1627d62dd2a66d3b4abd
SHA512 cabde3a01805af461fc43e2ab5b77f45d08be3883038b8d554054e3726b5f67aa18d2f67a3e68bf10daa2cafc35bd645a55d333371ec50bbed6b92c40c4cbb7d
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THf:cQvGAdlCEL8c/WRNw5CX7wRGpj3
TLSH
T166266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 dbe1ec8fe0dc2dccd6c00501ca2788cc915a42f7af2d1e867dc6de21190a4678
MD5 e7fb3a0df48c0fdfef7e4423032921ff
SHA1 06a4e027b1450c78ded5e3d8fb5a3eefbb87b500
SHA512 4776e559ddd1ce160a47d458839eb7344bf99620f8b4c69697f32d8cd26cbb0ab8785377b9c85c2c334ae1b8330924f76a4e610f2ff3e340257ad93a8bb2ea9c
SSDEEP 24576:0+ewsAjI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nljILNiXicJFFRGNzj3
TLSH
T13785E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 64de174ebcaf460c0048881de44e0b84b12c3861189f349ed4156497c2c67fa7
MD5 7811135ee4c36db88614c1e224e36f7b
SHA1 02dbd90268765e5a36a6638bcaf29a468b148ea6
SHA512 b687b85bad3847ac505791319cd848abf4b779a54b1b7697e186cd348402b4949087695aef1f90fe952328123f5bd4602db61a3cc8252c7b5c7378e56236f5f1
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHsF9:AUEtQevvqc2W1cpV20I32Q9
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c8498f7f8410660832eab67ca047c6aa050c516949b27ebd97e43f467eb69d48
MD5 5fd5dd636111c6f4bb09cd56cdd332a9
SHA1 e7ad45f19d1f67cef9dc0cc7e0ee5a3bd407f0d7
SHA512 6f4e9e609f3a30828df501037433b456b3f9e2dfbc735fe590ef79b1948b47af8a2f129d422cae2ee9589f1f0f8a7bce7ec990e77166debd6c37564c36d8da48
SSDEEP 49152:ZCbRquA/m2yL5zLfFiV+XenmE3/zoLNiXicJFFRGNzj3:2oq2Vjnmb7wRGpj3
TLSH
T12FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8441c51fdafc7ed66c7ac0d08ff4bef27434a0fa7e167f58be818a68d5644d72
MD5 264965af080fef946df9bc09614b9331
SHA1 05e1064e56adb32cc8312a867ffa5252e25bf3a0
SHA512 39ec92dd00d71d9035922bd664646542bad65adb98ab7551575b991997db5dd33cee7dff7823ff7e0a37d2ae684eb16b4a03ffbe1045b040e085e9b81130da7a
SSDEEP 24576:nAhGL6IFoiwtA5l7S537/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nAM5Foiq5rLNiXicJFFRGNzj3
TLSH
T1C5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c9af33e6107f40b4573512803c07c22ffda051d12ed14a649ffca999b8de4dda
MD5 a6b407e313284c2511f769d2699524b6
SHA1 47bf37e048c961e74b62e027032883dbf63c3b9a
SHA512 695d7229286e34c7f950ab7c60c9329e44cc3d7a6aedb518c97e1dc3330acf84a35111817f313408b7a04f5604aa6ca206b13efd4e9a66a0ccb4c1866a22e6b6
SSDEEP 24576:0wu9OWc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0w2O/LNiXicJFFRGNzj3
TLSH
T1FE75F18632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 f3217c741f5c2cdd9401543eb01e06f1ba74b6d4aa5dd52ceae4727a31970439
MD5 72e4fb31be620df19722a0fc76d4199c
SHA1 ce88a5ca40d77d7915f45af2b3eb749ba63c903c
SHA512 f9dd01189daa392034a47122c1637ef5b294f32f6ea5c3083f27fac048998f4e828f96f78a3dfbf4275cafcb50fb3a9d8fbe238b0bd0b5b8ba46dd581ac4dbe3
SSDEEP 24576:FZuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T19F65129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d9519ffdcb1b861397f1c9889153f98378d783a48810062329485501970b5586
MD5 5c79d4496e171b5e180fb73d45278532
SHA1 7d2163916677add56ee09c91fee397e93a18ce4a
SHA512 d965f720f3d16ac979cd7bfe74a0393b3ee74bb8fcca407d8ab09971670c9b5d5ed8e4ff7f702286e290ccf7a743f9c3e3b8004164d8ad8736a45050058e7e00
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:xQyiKanX+PNyF9
TLSH
T1CE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d152cc8a13083e9cc7788a4e2a11c6383f987cab3f895b6423e33f59aa29a4f
MD5 a2b157b940b8862514095f0d9300ac86
SHA1 b801a7490dc04772216a17383290bf6964c7aafb
SHA512 00f649c49ac9f87f3c135eeaa1d8c3c40b1aebf5ba4f04c1b01aae4564b39071bdc7f758ddc3cda46e4d4624e2a8a3ea2b34f4852d2b92e0cf98f92b7d059bae
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:OQyiKanX+PNyF9
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bdcfcf49cdd3b36a446299bd398415681df8293243c18a2c35849b5ee6cc7c36
MD5 bd31ac101c6e7d7e2b229aa22cbc7e8d
SHA1 881da1ad22d1c9ffe6008c21add6d1f3b821ae9a
SHA512 a2fb46d1ee6b62142d8b41cd139f4267515e412ba2e29f2d0ff7c6d3818886bdb376bceae935f812938705b97975b8dc3dc0de3b9ee2a8899e11a4d04a76a43b
SSDEEP 49152:I68Qg55nhkeWu7PNU3/4LNiXicJFFRGNzj3:SthTRc/47wRGpj3
TLSH
T171B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5426aefa1edabe40602dcbf5303f1dcbc9930cee87bab6c8e4f665bc28729bdd
MD5 e375c5807122ee81bb7517cda101a11c
SHA1 a4fc440eb830e8c1ec35d1b711325b75019f47e3
SHA512 fb947f4d51e109cb7b55ea0699825451d99713f15d6e2a6df6bff190bddc4e7f47ac917957cc0a250924bfb81b08cbf19ad7136e453e2e429c28694c5035ae07
SSDEEP 98304:Yy5112gYy5azzVvU69nLKnhZ97wRGpj3:xLIHRWh3F9
TLSH
T19D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d41e3812bdb9a4ab4f8717ef39c236ae4c4e7a7a05e3f05ca1cff2c706610458
MD5 ecbaa3a067badea78e78fcbbc36b8b15
SHA1 0b35e00b46a9e75bfdbd15d5b422bf4c61cbe76d
SHA512 48aed54a817dbcf17da8a79b587de96dbf9f9a5c2736b58eb47e76413644faa238fec3ba9917a75ca07b5d41190a49997e69371ddb7875b4ad35bc0ce06e11ba
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmLNiXicJFFRGNzj3:Su6JmIxd2dm7wRGpj3
TLSH
T129D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa4d79a6631a832c4f75e94b7aac2ec30c3dd4489374ef9ea93062dbd43d9f95
MD5 356df98e4762f0dd45af3762fcd96a6e
SHA1 6aa23f24e59c22e3a9b484aaff6d60031f8e6317
SHA512 94dc31f61e01f8f6a097aad12704b3c50ba715c9a27220530a7c914e4d929479ff79f513313d5b4b7cd4e96146e508220a7ee4aef7e6c92c6af8fe98a9a409e6
SSDEEP 49152:M1hpsNoJpF1A67U44CwH7R4xqLNiXicJFFRGNzj3:MmifPqRb7wRGpj3
TLSH
T16AB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c31f92a00ffab2bb14ddb0af8701d4ae00edce19435555ba719c52538aec3703
MD5 5369e4f9c4fc7fa2bd89742ea6eebd3e
SHA1 02d66421139ae9916a32784f7c05768fba7a6da4
SHA512 e668ad665e71fbfb0ba600e6a3d3f4174b3a78af4d12ae0204da88dca047024e2ca46123c050839188b6bd96a4579f4e8ba48ae3c82b3afaf9217aaee9fd3963
SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHqZLNiXicJFFRGNzj3:w5dKqi61Z7wRGpj3
TLSH
T1B3C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1956453f9b7399e627a038f0545097c4ae4c20a423ecabf0b5b076c755d22c4f
MD5 02d2a49d91045ce8920e015b90f69915
SHA1 3365296ea3e4eba7ee2ac24fb17b0b899433619a
SHA512 1909c48b796c71f23db47c005c000799263ab78fbb1707d88f913d65476b222fcdf91e99904cf0a8b43940691bacc1dc7aaafa2a6229051011a88443d6675c45
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5w2LNiXicJFFRGNzj3:7X2iWphf7wRGpj3
TLSH
T1FB95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 455057747517fb05569605f6fec72d345a0d4c06e91d6d25f9fd373b84827c21
MD5 a1798c201a6431736e8dfec2f6053989
SHA1 bae42d0fae658129985d035e383a5c2a588f615a
SHA512 d5a5de5e4377b2279f68c7f0262a1a286b85d84f929e5cc46f0370ba57da6bbbb6c31dd8595e62db39b4ffcbaaead7ce8148534ee536b1101150cbcd828d193f
SSDEEP 12288:zJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 366bc09e6d75f0db8ddd57833ded1121d5b77e88a33edd7904b9ebeb6f0aa43e
MD5 b17faee1b00cf6e0c5c8ce948c71378a
SHA1 1b778e6e732e106be96c805ddcb2ffd628caf41b
SHA512 096e4d3cfee0745a4067f9981ad1f0d11317097e6ba659e0cf97357e037e5a7de780ca081b435f5cca2499cc0a3f03065dd289f33af8b7e06644b80c2dc51c35
SSDEEP 12288:ZiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 f13ce37f69424e3cd52f0c45ac2f2afb0262d474d99f35c6b418be31a6eba9d1
MD5 6fa77ecb40f0585a2eb70915c363c100
SHA1 769511ba950082bdd6428b1e8ffb7213cf55f128
SHA512 9daa7e15acab662b70f5057faae6700a50236b462022d3cb4a12b3d3b498413655dc14596955243e920379b4f6b1067bd3f7388bab585de0bd9ae88185312edb
SSDEEP 12288:uQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 d475c241159532b2758fe2fde765a13ed5f02577d80ddffab9ec6df63ef2de26
MD5 2fd428cc7941fa2a7f5575b026b1eef1
SHA1 b3515125c73d5dd2e3796dcd647ad7cdf757f00d
SHA512 5c0a81a4a10e28c01901f5e04f741ae8c03a2fce4dfb23294b41188d6780e71c425ebfb582036695f2ebf415c259195e04909534332d0595402e73b3b9f47fc9
SSDEEP 12288:eVviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF652393168901F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 89ff8c41fdede4df5eb898e4c9b4e48c2b9a4fbf64257b2ae653d3e6cc6bafd7
MD5 dd899595ee0f00c0d47a921e16d4ce03
SHA1 972b12c5cd7cb13ad8ee53e4a0db8c7778882ad5
SHA512 aae4f7e5629b473eb6cd2c187c0dd20a7d3580f0b65650aab8887729cec6b5333fac313cb040bcf7854dad09a2be81a8986921d9311dd3ca82f89f71ad35fa43
SSDEEP 12288:gXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 2dc5c1ac508478103100e0ec83239006cd7c88ed1f781a00b94903337c0a6b79
MD5 7b7c129fa1d69573818d9abeb2fc61c0
SHA1 a3a1d87be30133110f09cc40bc7a6e8412df3a64
SHA512 9b32553036560e11077a11c23c3616a286f6d572d3648e894036e34d2b0259258a09918ff74588d7eedec6982625f10f4457ed00c0dfb672db9353bcf5bbeb8e
SSDEEP 12288:B2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 471a7ee9f7beedf98a19379ee1d0a8fdca15584bec81b431d9328e8c73d7b4ea
MD5 1aac2052000c4d24bfedbe53eeb9f3ea
SHA1 34d71c4e8a443cec69e264e906c830c98d8a6165
SHA512 c5145bcc1340f85c6674f490b5f03eb59289f40079721441078022473684190a9b7fae49852aac2b9d39eab88c7f27c84bd32cc0d2fe5176693e371c19f4ac98
SSDEEP 12288:eKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3548955B1FABC003986354428F5882E2DDB6659E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1956b9d9b5912ae302a6b3ded52b9606717c624ddae5f944c9e57921985ad3cf
MD5 6a6fe9baf36692696227127348666c3b
SHA1 3a608cd36a1ee8975ff8e2ea2e0488df0e18419a
SHA512 69731a039e7d3e80fd65b483be8ad101f0cc7c809b40f506435fb35ab276ee5e94d731693083cc723e206945e77dcd3e4cc93331363d8fc54801bd473aad48b0
SSDEEP 24576:qZMLzFVSOE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qZMLzfQLNiXicJFFRGNzj3
TLSH
T1A4750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 47bbff9663ee2eca9216adf3f92de6eea412d270f3b50fb764d19a014a292b5c
MD5 beba38a2245f1dd8be3f7af524ebe67f
SHA1 62aca64e4871190734e5a3a5004acd1f8e601acb
SHA512 9acf9b42085f1441bd842b6f172cda795e932545a4c99d21d810a1f23d88dceab6f455239374a32db9483307fa6c3f3be5aa311f3f51c92d869b1d03c86d03cf
SSDEEP 12288:SliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3548955B1FABC003986764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 889d730941781a32323cbafddc034fcbac6e78f9da3742841a9cfdf20697c29f
MD5 cf6a71b588436315f5b077ac49da2bf0
SHA1 4bf150bb00c7fa1440953a905a5e7309e197170d
SHA512 679e4c9ee31ba106d684c49210684973048a146d84a204fa6bda6976552bfcb3d3ba8cb4ca2e13ecc408bfbd0adcf6505d0b22babf86eee04cdf09fd8ac63529
SSDEEP 12288:mhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5f176eced879ffe98a049deab7970c68a7830779bda294f1a0b73e5aa4f8a532
MD5 24916fec74cc873e27d7801adb7a6223
SHA1 d48caa8bbcf372409339d8cdef9adc4783676d4f
SHA512 6101d63c4e8367b3f3cbab8b2271ecdc4c004f2611f6b79412a6b6d61b45d24ff4fdbaa45cb45daaaa07038de2e8502d481a113970e391520923ca07df2bde77
SSDEEP 24576:BzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BfLNiXicJFFRGNzj3
TLSH
T158650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d4737dcee3728097341df0894cc264c7c46d0f6c9aa853b6b6a5af674ed21901
MD5 78e91ddd6f738b78fce9c117bb944a32
SHA1 b7cc66d4567127ae87200f7da72062e7567f27dc
SHA512 9aeaebeafc3c835df7c7ecdef6e75c657dfbe80d8fc5a684b73c48d6d3fd931dec2eb12767ea5fa5ec02b3404a6003b5532ebfad09409b70eea86a841e9ee1b4
SSDEEP 12288:9liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3548955B1FAFC003986354428F5882E2DEB5659E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 bc79e48c0f14a567e66bb79143980b1e6dea9dff7a83914fbdf698621e20e6a7
MD5 08b9979e5e13f1b860481763b50f413b
SHA1 a67345fc31ec61e0c64cbd1660c4a618fb2b2714
SHA512 4b7346011da7e0df54d3849464402f2d732e07b29d5801373058564e274abdf76bbd2bd4549fe3a8076df8ad0b200a4106d90b22863f27e6d458ec267e6abfda
SSDEEP 12288:jliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3548955B1FABC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5b023dbea0ba1601cce1844c6f4516e2fc9424879bc40d5096091238e59ba91a
MD5 f8e95bf9959b23b8e64a99014e148c09
SHA1 1fbf088d11b44ceee7f00f2b49e044a2017baec9
SHA512 edc8879c2bb8722c850585086b46ed04295144931ac096f37b10cac47139b8fcddc50749467c921d8b43eea50c19d8a381648b5b6294ad1ff88ef9574e3d4e0a
SSDEEP 24576:OzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OfLNiXicJFFRGNzj3
TLSH
T1C6650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e1c77cf4b0db8db66519c760e456764e14e123cddfa9940cda5901997cbafdbb
MD5 f4b8e243e1773f8d9a9ddf91522aff08
SHA1 09c1bace279e9288ee394b8fabacba3a4c3a4b4f
SHA512 64dc538f25187866aaa8628d065530314f5b0b824755b41cbb34f8a592da2bd74b9c25278a84e0fd4b9f3ed8357e2d51901196d87a76b1cd393237fc94b33589
SSDEEP 24576:NTAaLl3z0zDy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NTHLljHLNiXicJFFRGNzj3
TLSH
T1D57502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c44adb040c3d8e86b999ebfb19ef370062b94062155d05c84205321c2ce32518
MD5 eb77207cab039721beaeed69c613005b
SHA1 e7224c942e008cc2b2cc18ae40b9800db9383d0d
SHA512 8d255044fd29a22a3ffc21d7664189a76f81121fe52015b69a7bb8ab70c1925ab71fc54c52c5b2166b2922c42b69e9e9b87f0af49d30409bf34e961eb11b375a
SSDEEP 24576:O3Pd9CHKy7GZu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QPd9CHKyaQLNiXicJFFRGNzj3
TLSH
T13585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 f381a8cd84ea21d968a24616c782a8ea1e4829253a1c3b3152091d580206733d
MD5 34624986979e4d2e15e1e676115a9c62
SHA1 1da821e39bb61407e3e4442951017a797ab0e4fa
SHA512 556d092be6e96ff72b2e9e49d7ee1c9e67dad533d4b74fa64262a96b621a8bea17ec21954068d42ce552f8bd0580a573b56d249075d043ab1960fd7cbdbca3e6
SSDEEP 12288:ewiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ei/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 9d6109e6039a09a516264c43bbd097f058c7c78451997c345614fe70002e8045
MD5 3c0dd89ad9fda02f9d0d032ef7bf53aa
SHA1 1c1819b897b612a28be49962050d5d9cbf6963c6
SHA512 99ef24f9a094089c417ca8e7415f9748d00090e73435d156c1583898ce444cf0345481ad1b0a1f6c7154c0dcb33804b0ff2067457621e4c3004f4af7bbc96929
SSDEEP 12288:jOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 11a134d096da59adbf230d253df4a1a0807cf979ed4660efc729229fe3ea39f1
MD5 e71a833a4e23b635e0db65a8ad1b4d8c
SHA1 28fc86a3ff63d72d299fe9d12d2ec14feb11ef07
SHA512 320d10df3f59a60e271c244292a5d636922d67da6c1d53eafb130fc11f1c733147103ca00fc9148cf574fb42c272105a549944d6778b15a0093e6e2cc60dd06c
SSDEEP 12288:F7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1FAFC003986764428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 314ed03810b4a00f98f54d5793f62bb1ec26940854715271e7153c360aafa603
MD5 e072eabeeaecd27c289e1a9b66000ae9
SHA1 c654516276b2e93dd2c33c850b5fe9b8d6dadc47
SHA512 73f438ca092195506fb6b852b8c64756565139e24b50ef197d6b3b0c212bdf0e36be399e7c6ac0812ac03e9dc1033c4046582e1383be8316554cf55a7f7958df
SSDEEP 12288:vliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1FAFC003D86354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 9ca66ed5261dbe7adc023783aecd78633494cec6be42e424a393bc79e80c47ff
MD5 f37af3362c6e557f3d06e38926b36014
SHA1 dd71c9318a039a765d9c4b9b143611f9d7117e9f
SHA512 695a33a9eebfe1df4555d5e0fb0fe584e46d9a04f8edcc6677145a9341bc4d95cab59d40a252a6f0ef34df333c08da3ee76c58ea1f25e4f011087d40bf1feec1
SSDEEP 12288:EwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ei/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 354a9928a4c2f529a94bc7cd30c0f38b70e09cf5e7cefc94132a56014d226ff5
MD5 65bc8dcde3576e16f443e4aad250dc92
SHA1 1ae62bad34ddf8f3d63f6203e928fa4369bd8d72
SHA512 21de126b7b611aa1f8b5ac7197b5a90b669cb6ee3e99a0f1837c94e9bb5f64d875fd5397568bc90646557bfa45af26ce0b0fdd9269c8dac2a9e5693d436b5aa0
SSDEEP 12288:YtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1385523D3548955B1EABC0039C6764428F5882E2DDB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 e03c59cfde5f9bbf97c7c945c4dfcf8fa652b22ffe8e28aee62a4a011917fcb4
MD5 2d3b6cd47f1919c333ba4b0ef10d469f
SHA1 8a68a0144a3e61db9e06dc1cf1bc3952f4f2f73a
SHA512 5c8858ba717c6cb00b1a481e6cd0c847abed8b497cdf43722eb5e58d221ff8f61f16fdc9af16a83be33b1e5887a21ff1597861a51a782c6b63fc20a2bbff07f4
SSDEEP 12288:nXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 62ca62daa5f3542af7a28d3724cbbdc5a4cd4acd32410c7a433b0e2d6e83438c
MD5 b17e53e382bf6dc7c583474aaa5ccb48
SHA1 934f72ba5c22ecaf01276dac8ad7bddcab9653bd
SHA512 3511cc94b9467eff792c1ae3cf287f267232a6a57724cf58f2b6bdd72faae77f97cec42d4a3a510c8f8a0b52a4290e869b1edbdf827995255544fe94856d0a6f
SSDEEP 24576:+fwvgk9RX6wkyAId/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qMnYIdLNiXicJFFRGNzj3
TLSH
T17B95DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 97badc4a6b06b090dd8ebaadd6354b074ccdebf42ceba81a9cebb52bd9f02ffa
MD5 15e3b3376a89c02949e80ac57919ae8e
SHA1 c5aec9747643d1092b824711e9b8398f424c27ea
SHA512 5af8c4dc4c09c1fa44a99a7d0a1eef00d9037eb56ae896049dd3c895754fc706a13848a9d4f90bce5cf06f8074721834c4c2767aa2cd2fe28a47ce22f3259f47
SSDEEP 49152:QYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WLNiXicJFFRGN:vySzPu7wRGpj3
TLSH
T1E8066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6a013985afbba2501615ec44f4e2373c83e3e41c2442ea66e532b4f381476450
MD5 bf8dc333dac5dbfe9722c4db62e316a6
SHA1 939232aa652526958ab5a3e209d096ddc7099098
SHA512 32976e0543fd243df56016faa346418478ca9d38f81678dd0e088f5f76e794fa8ea78b017553e48e99d8e4139b5e98120296da91855646729a1a3e7c544cde84
SSDEEP 24576:H47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H47JUQjqirIhCnDHUPfF/mLNiXicJFFS
TLSH
T1D565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 32fe9fc16ae9ffb7666203392b482e9303d9d9bd3c7563b3d7168e40d1d9ec7e
MD5 3b9c94cebd4444e736598addb5d0ca92
SHA1 b4a84e5d50c4ff52baf563e84a078d6158f8404e
SHA512 7e38a4f6d575755f04ac62baf7de2d49b5089a3bd58a42a75f10ea7941f8945c0fccceceb8a1765ce060a9402ec697ab754d2231a9a739dec498f444ad4ab99c
SSDEEP 12288:udsf1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 939fa36efb7f7542fca8a3215632881b3161e5bc3704ffbb0fae2715ac762d7d
MD5 e1daf7361d5fb831f275501104058507
SHA1 cdebc4fb0d6e57a1a5b07b9224ca3658279330f6
SHA512 416c885d01e39d0ade173cac5849182706675de1c05367a5b18000e9f5d46d1148776fb1a7cf0a6214c3087577c4c5f174927decd357a35090049d7d288d1cad
SSDEEP 12288:tgRuB//U3fnVsS1g1Mg8cwOSgaRMaO59L8:ttHUPnV0RxSgaRMaI9L8
TLSH
T102252800766AD74FCA6D40325E37C5CCAB707D01EE45AB0372C88B2FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d8800392c12e0a0d94e133adc8827ce96624a2ba6d511b6f2850942d41a18c96
MD5 1a9278bad1928a88a9b67b1d0b56bc75
SHA1 9a7c3faec869a8d1bddb4e79d3b5541e893c9f73
SHA512 e9e85053a69334b40f6284bf0015364aa72352731bb18e08db7f826f05b1e0bee51321d338c330cf5f21042d31bcf2c87ad209624bc4a8566778cab5a46ec633
SSDEEP 12288:+RuerDnF7uFBTN3vlo3c0i7J1nwQAjHuBiJWV:IDnFG3vlos9VNwQAjHLWV
TLSH
T1FE65E7449536A3CFD1BB6171072AAF4DAB64EC13B3056F2763C4093AD86A715B0F93E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 3b212fa91a51f80c3f453f9a9341953091acc1d1113cf3b368a16df4a1e5cc5c
MD5 1b5c44513260fac5369ca702e4dc57d4
SHA1 5779b74c4972a0de0e42a4a082ac20514b4cbf73
SHA512 71510be4ad98762e6db625e4fb49486f0e54262bbfc732d9b8cb3b4a6f778124254fe7dcba4c03f7d1b4a3e81b57f4e3b458ac3ef0a0701979e7f8e4441bcf50
SSDEEP 12288:iR79iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ch/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF552393468D59B1FAFD1039857A8434B54C7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5d0350845cfc18299f6906fa335a626bebbc408ee2d735be650db6d5c08258a5
MD5 2c65b905bc81ac736b57406ae5e69f2e
SHA1 eff8002cb0aeefb2fb7aedafc11cc04c22f28151
SHA512 1d3a2376e3af610332e1b41bab22ec300d1be0d10a0df0edcd3670d65a7d6e7461223c2c75b2318e6e430993afc7d3a336d05bf20d668ab72d380340b9803ab8
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dgb4mBIBhGFULNiXicJFFRGNzj3
TLSH
T12865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ab5c80bad308af376c34b6a1a22335d5a6c60017d60d09541f43c26886d2d339
MD5 b3fa93cca5a7c68be53f2ec5c2afa02c
SHA1 96af8617208ccb057ab3b61a3f6280dbb4f14338
SHA512 78ade2c5174acaa638524144e2a2cb5e89b86aef1404034954ba25669a9cbdc230c1dd0e82739d0da8a06986ea42046c5a42a86df863ba91fa2b61966deb5c5c
SSDEEP 24576:LG88u8FpJqH1Dzria7/mE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K7ZFPqVWa7/PLNiXicJFFRGNzj3
TLSH
T16095F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 78a0bd0ca3e24a1a63ee9d22bf36e4e3c2c2938baacfc79155bd2025f668dc39
MD5 2a4cd209744b99c97c51a4a479b3858e
SHA1 e19d5f19c4e85487b1f4540aa632beb9f59bab4c
SHA512 3dc51950ab6f313dade05ba4916099b1b5892e3b194ba99ab1835405c2f59c14dcc77cc2306f9e801a81b5dbb0e08ddf8196ceed934d21fd124a990c0678f4a4
SSDEEP 24576:YPUr+NQQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YJQQLNiXicJFFRGNzj3
TLSH
T19C75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0d738def656d8bf39c8f737db9984ec290f685b8233c0a885acc54944d278211
MD5 56e39826bacc24fe51cfc81e212c1901
SHA1 1f83bb441ca0bdef6b1e94e4460abf31959382c6
SHA512 4ee582e51e4a0977ed317cd53904af4604149a4dc9646cd118395b0927b24bbe446cf90626e74e45950f23c6505b9c5a0058d234d1f97007f9d78cbfab29d0d2
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjALNiXicJFFRGNzj3:+G05lO43bl7wRGpj3
TLSH
T18AD5C06A62EC11F5D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 aeabe9577b88e1036c62c412d3d3cb0a47cdb471e253b3dd28874426a2c00dfc
MD5 1a91a6cb60950afefeb30df4091380c7
SHA1 9668d2590800f60b6a52a3c6f693561213b1a491
SHA512 8d96b97bd4a1b1a82cbaa96e191e190c0b02405cfa58ef9033f91a5512e4442e1c82a8d334331598b1605cf972e213132683e770696e5634b26b4f8867ff1de2
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnW/TwSfVcYG3K/cJHlnFR+IGNe8jg:La5POZ3lJt2pasx2+m4LNiXicJFFRGNf
TLSH
T1E665BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6e7f5dbef37e063abd9e121083ef72dacd6a62af68150aedf5811b1b553ea3a9
MD5 bb8df3d6428ed3401d2eb0f62437698f
SHA1 df568071690498c85bf2c6b0dcca2ca9c5d31fb5
SHA512 73105ffde7ec445a7fb677799210e44ba7e39e48c6e340ac6442812e535fbd620e10c60b4fe279986c3e4e24009ea3bab6bc20920101f7e0f52a61d66f03a7d7
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fk8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CNc/zEOVHFvLNiXicJFFRGNzj3
TLSH
T192858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d6d8694956837099639d2c187978a747beaf5a47b7af41e28cdbd32ef5b79ac1
MD5 ace2ef8614dd31ccf4690eb5cf2f779f
SHA1 87ed48c3719205f4d0bc44eca110a57cde7d12ba
SHA512 0aff3728a9f4c7ce24e0359b2d0a26bffb0fe50fad4cbac44c81552519047e2fc697087e7bfa7d28dd3fb1d3d93dc9f15dfa2b931cbd77b60917a91837932e48
SSDEEP 24576:kzkNvNnaFeYhJNtmZBma/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kzMwBtOmaLNiXicJFFRGNzj3
TLSH
T19855AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d6b36aa26c66676ccf9afaa247dd19f50d0f0d2ac847f1c265ef554291e1436d
MD5 84cdbe9648a521089c5b6df16d8a7f31
SHA1 150ddaf94c306471e260c93edba34a2506fcefe2
SHA512 ee5a3add4c92914361cd8a0d4502db641250cfdeda3ad0eee4317761b6ab20b3725e9ef1863735f5307a7fcf03fb94fa11bd87f683705714745e27d6c24170dc
SSDEEP 24576:HD3FHshBIYQgA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HDVHeBIAA1LNiXicJFFRGNzj3
TLSH
T17585E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1424-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1424-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1424-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1424-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1424-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2564-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2564-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2564-52-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2564-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2564-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2564-38-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2604-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-27-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2604-34-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2604-33-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3196-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3196-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3196-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3196-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3440-396-0x0000020425990000-0x0000020425B13000-memory.dmp

Download

memory/3440-327-0x0000020425990000-0x0000020425B13000-memory.dmp

Download

memory/4124-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4124-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4124-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4124-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4124-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4364-54-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4364-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4364-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4364-277-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4672-65-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4672-0-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4672-8-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/4672-1-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/5124-78-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/5124-79-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/5124-84-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/5124-309-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/5172-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5172-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5172-314-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5172-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5172-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5172-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5324-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5324-328-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5324-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5324-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5648-294-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/5648-74-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5648-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5648-66-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/6100-122-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6100-114-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/6100-312-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/6100-116-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download