c39d2c5493b9a51f40b51050e1bbc8d9af0b60e88e6c4442d62a7f6bd234cc8c

Analysis

max time kernel
138s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260704-2sc8faey2x
SHA256 c39d2c5493b9a51f40b51050e1bbc8d9af0b60e88e6c4442d62a7f6bd234cc8c
MD5 8448c3ee586a07db06be1f10ddca7c5e
SHA1 30e522dfbf07d22cebeb6a24c53a1b528ac7bad6
SHA512 0c8ba41144262607b6ee657c1ed0620badc45cbf3217d9852b3f659ad9108d3ca0150bbb20b5f2a779ded01941c94c2ae8075fccd07065ee756f76d8be9c015c
SSDEEP 12288:Rq9PGxTszBAGubvoXmH3pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3WN:85GtI/45sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA75016172C080B7D973093046B4EA71683EFE315F2449DB73952B6EAE706D18E38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5400	elevation_service.exe
1984	elevation_service.exe
5012	maintenanceservice.exe
4776	OSE.EXE
1848	PerceptionSimulationService.exe
3004	perfhost.exe
4548	ReFsDedupSvc.exe
4940	SensorDataService.exe
1280	ssh-agent.exe
2108	AgentService.exe
5496	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4848fbb34a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004244f388070cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060420eca070cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d62d6088070cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000001782189070cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fe18588070cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{63403805-8457-4C4D-9EED-B7846A5BA014}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{E38BAFEF-E62B-43BD-AD3A-879DF8DA9462}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3432	explorer.exe
3432	explorer.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2108	AgentService.exe
Token: 33	5496	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5496	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5496	SearchIndexer.exe
Token: SeDebugPrivilege	5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5712	2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe
Token: SeCreatePagefilePrivilege	3432	explorer.exe
Token: SeShutdownPrivilege	3432	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2392	sihost.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe
3432	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	StartMenuExperienceHost.exe
4968	SearchHost.exe
3432	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 1628	5496	SearchIndexer.exe	99
PID 5496 wrote to memory of 5672	5496	SearchIndexer.exe	100
PID 5496 wrote to memory of 3068	5496	SearchIndexer.exe	101
PID 5496 wrote to memory of 6076	5496	SearchIndexer.exe	102
PID 2392 wrote to memory of 3432	2392	sihost.exe	108
PID 5496 wrote to memory of 3840	5496	SearchIndexer.exe	115
PID 5496 wrote to memory of 4148	5496	SearchIndexer.exe	116
PID 5496 wrote to memory of 2236	5496	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2236

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3432

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5afae19fb24e7a05e311134372df2e1cf4f55a3da3f1fbb886ef00b9fed3e21e
MD5 58befb1642d2c26eb368d385a739dd2e
SHA1 d0ae48e421c3800bf8e82a7fd21835a3204c313e
SHA512 adc7a7fa983c9700f1552ea994a5bfa46782852eb813854bdd4338187aebb1ce204597c5319a443b4f27a65de57c2c0a8103c9b7467fb0a5c5a4092f98204a0d
SSDEEP 49152:8b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsDmg27RnWGj:m3q6mjB3D527BWG
TLSH
T15CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f44fb077faa20b2bd9bd4eb9195af45c4ad5e317f9929e353d545e282d404b7d
MD5 3e9d8652fd740b5e1491b537d55f50a4
SHA1 00ba2860cf8f627e9ccdec11153b6cf5cbb4a9a1
SHA512 c2741e1d6368a319edefda086b5d74213a837d441c8117200de8b5d3e0ea530a5f9514968b740e1969e4ac4ea240950f7b9c3a5bd8195671315ca56f469c7940
SSDEEP 24576:CXYfDtczAfsqjnhMgeiCl7G0nehbGZpbD:JtcODmg27RnWGj
TLSH
T136850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fc5ac8b3b245a73cc77e08f508b794bbf84a9a355c2c7d1a736abe4ab745290a
MD5 8e3d792b65d1f1058c8642e8d5465380
SHA1 6baca6f79024f0ae4ab5a052a7463e7593743f66
SHA512 33eedf73a7e9ded93c8ad0066e983614b798956b54fd233d80e4084196b2e9aa343fb594f72aa36444c5e15191b44a3a4a7cc70243a5952e2d9f95d879ede984
SSDEEP 24576:F0Le5ji0hmxUrMIsqjnhMgeiCl7G0nehbGZpbD:FPji0A2pDmg27RnWGj
TLSH
T1B9A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cf796388ad0538cdfed3a91c23e3de1e11f2a2540f9366070b31c136b4ce553
MD5 d6cb6e2a56c0d858bbfc808ef574789c
SHA1 244e2c334326b0cbb2e0971ce7d5cb81fecddf1b
SHA512 d9e927af8c1bea7401814ca1446f47e7a82c288dbb81003ee8554834e5e18e2d9e096d791044c04997543105b29a697575e2081abefaa14e1b10074d4e287339
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuKsqjnhMgeiCl7G0nehbGZpbD:F/ezSC6vUzPv+HjyVDmg27RnWGj
TLSH
T1D0755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 69edb03f9c4ea399104d73a16fbc24428607ae0b62abc30fd51df16aceb31f0e
MD5 1a58702e2c793a4f9867ecfdc352c46b
SHA1 38ae3e8da8af1f11c82743a02d4f81633a470686
SHA512 c8f880b69c598dc0164b2f1640939a592a22b6e84ab1df7c7b7882f27ea7fe5a02111df42ea7355b7b7268ec372871b767a4852e9ab153cb38295d83dd17cd6e
SSDEEP 24576:2VbqPb88hv/l+BDsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+JDmg27RnWGj
TLSH
T1B0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 c11fdf0cac5d3d5f8561fa705398026b5a30efad51629f71a08d90c651113cc7
MD5 e01fdc62c91d3e9f9e23baf214f53d92
SHA1 ff7c22a314644d31dd2a79b65428caf986aee362
SHA512 4d5f7c134542e06a1a35d1049535cd759a146669fabc99df16c089da29fe263c508a30d7ea7243613463153f0354f9e0ab04dac429b822538ba555bc17208edf
SSDEEP 12288:xkcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xkcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1806523BE825C10CAEA7608B5C3EAF11EAC137E5698201C436A637DFEE5B5454CB3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 175c145b3242057b6063f9288427533fccbc15d97cd90540b673ca0fdfe54279
MD5 013bd700ad2b1fb2184ed324c9625e87
SHA1 bdccc3f081b999862001b00b055d8e99dd5faf73
SHA512 ce01cbdf6e09460e36ed6b242e6f0d09ca2f6acd1cd981a74969e57ec30d2308933c363b20f4bb84106c7814e683d4f93aba1e05e4898eb79361a1d2691c7542
SSDEEP 12288:FeBNUbTVO86UbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:FJIUbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15185CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 25bb404f89a7b9df2b55881f7d687b3b24c75619433e0ad866ffb0a36f580932
MD5 682bd2b4407ecfd6bbb7102d9ec9946a
SHA1 b094e2c102d6f0afc45ad8a3f65e6651a8d0f8bc
SHA512 6b19c02b6278990ec64619de739a0f7274b97e3e5e48cb9210837bdda123fe0c2277fb0984954bd71030bf6ab1cc176e90aecdacad8aab6594f6609d54703382
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:gQvGAdlCEL8c/WRNw5CuD527BWG
TLSH
T179266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6768c3a5ef355759a12b22d197cdf876724a123e4271c399127da58acf1fee66
MD5 c169f3d93b31a2af08e5f4148ca30277
SHA1 fe4dd7b080aea306de4db30531bcfe9c50448ba7
SHA512 42a795c4f2668696065eb51531091832517544a8105e22f30d91c3c8e7d1a9ea2ae296171af40ba47df087e66ca713f5f7a926e93a27166fe796ecaf317ae1f9
SSDEEP 12288:hAwSfxL/2Dc3RDLLmt0LDQewsAjFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:CAewsAjFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12795E031FA74E036C37B0DB20B76D71A582D7A204F6119C3E3E89D9E99702D1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 902dfc6e51fb20d4346ade28949105121a75424280e24aa313445b6566658cf0
MD5 0f6c7a8c14b6d62d490fa7cfa8f33113
SHA1 7d5fb2d308a52e6bff01456ba9ca61de18baec88
SHA512 58c89c48c6ca1b6d929ceff78a4c56081ed2f58c412ecc40725553562536a8d93106ba28bf81ed2c477d65456532153cd0e28864fd624422f355e636ad48b996
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHxVQBWG:rUEtQevvqc2W1cpV20I328B
TLSH
T13A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a047c51f18d377366566576afbb8885dfb91f6fe42b1c976d22ceb032ddfe552
MD5 cb210d154f7828cf13b1168e5e7b1612
SHA1 10ab42965cb58e11bfecf26f1fb4db1d1be6c8a1
SHA512 c20431b5fd9ea0c86575d68b1e61d4b1539d89ee94a882ce1684fc8c0eac4840c0d720a757fadedc18c129405ffb5af0757445eaf4df9c9f65f8d92f8f3cc66b
SSDEEP 49152:TCbRquA/m2yL5zifFiV+XenmE3/zZDmg27RnWGj:soqHVjnm6D527BWG
TLSH
T1D4D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5b909a397a4cd28d2cdf7e22ca26fd9d5702da80337430c3009daf6fa0248260
MD5 6e667ce7ec08349a60acfa915e898874
SHA1 a290fee1fe6947d5a50eec780640cd1636d7884d
SHA512 aea6b8be2e82507b132f775af171f3b71f19d8763b006fd51fa8f5fb87756ddd6d864abeb9dc01b75f9a16f1a27de8387bdb5ed02d1e7b9d53df1c10482af3b3
SSDEEP 24576:LAhGL6IFoiwtA5l7S53WsqjnhMgeiCl7G0nehbGZpbD:LAM5Foiq5KDmg27RnWGj
TLSH
T156359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d9186bdfd183fb4b16c4574c8f7bd22d54a5312c2cb5c53c4df7cb22563cc588
MD5 fdff17a0843209e6b13b7b5d101b8b3a
SHA1 12d844e297cdf907bcd5b767991372f36f08f874
SHA512 a30a6aa08096b8fd321f1de51f6f008cb85813147b3d7e2a9a6baa7c319e8f8b98b27bbd34a36810226c5699dddbd921bf01ba511aa56282686064f178fc6501
SSDEEP 12288:dmw5HEjsChNWBFgl0WDm+CqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Ywu/OWhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17485F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33250AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5548a84f52b4e390f1455b046a60697afbdd7bbfc2dfe6aed37070b864982fc8
MD5 598c6141a15f007e12a8dc1474a14d03
SHA1 6e8b7487cf130b6e9a322f8a0b26706d8a2ac144
SHA512 b42b0bd270199e63e0fac840562c4f52b1ad723a0c22fc58793660168e8fd94ddbb3e7cce9c1cb4f41df763b44fbc9ddc2669cf6e0892f3494a3b7b9f0b4f169
SSDEEP 12288:dYZ1IyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uZuAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A97512AE239820FAE167417CC6E5D609E7333C62673043CF166655AA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5c60407ea01f45a13f175669282a1002d15b24ed28b6938de4cad82d01d2baf7
MD5 86d62b98fc82289e7f800b06e8c6849e
SHA1 89141f68f89ba918cf7b8ad370d7603a4efa9b06
SHA512 60cd207a7c869169459e132e1201e55b05337d2139a9f81bc9a90051ead2ab8e8c26c63f4fd16688beddb612e8c16ba5361d282693b9454851ad79bf1a8e2405
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3rD527BWG:9QyiKanX+PNbVQBWG
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4296df8b889ebe0f5c79763b3fdf7f777bb9e7db7d28ff9b503e6959a7e3d2a1
MD5 8bca019056fe79ae75c7e4f8fc405a5b
SHA1 804d936b7e92eebd4e826b6aeedbfa28aaa9064f
SHA512 7d57bc530b75ba416df269745f338425f1266894daa10b24f4f7707d03512facf6bba238085ad9be280e5b3595c91d675f5c9ac7730436dc723460fb51c01f20
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3rD527BWG:0QyiKanX+PNbVQBWG
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bb54a67c24df50cc0524b4344d9d506f4e2b8954bc3f48d51c1d5e05395b2f18
MD5 5f117572a311b9d60e70d101eb66dae1
SHA1 e30d88466a014d14b109b406b7431bf9b45420c1
SHA512 78537ee799e3c8bebe675c4c822e5d2e004e9b0aeac7ce93b32678d08dd9cf9ecf1f594dc886c2c231f9aa4f2f8870b5cd6452406fa94749dc92f9d7731441f5
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0wsqjnhMgeiCl7Ge:H68Qg55nhkeWu7PNU3/pDmg27RnWGj
TLSH
T123B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac8f33d61344d77b5975831e7762f2c9f60d05cd68984876480aa05e3f9c94e7
MD5 b61636c5055272ee6de3bf0d74c420ed
SHA1 6d2355597360ca4d90dda0b719b60651433755e0
SHA512 8afdb0e7d7fc5028d5826a2cee7102d70cffc3c73c912054edf71e7347283196666dd1d4f6c9332f3c25cdc4768b61b311b357e869b4bca9efebe30a408bac07
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZID527BWG:7LIHRWhyVQBWG
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8b4bb16777e1cf3a8b7d610e1239d5e00f89f039a24f48f3cd15ccdcd58c86e2
MD5 05c3817b8acb9c959526cea4cfa92168
SHA1 83e511ff7dcae6e3ba52eca948ce95075b754d8a
SHA512 b651ac2279a2fb1f6d3465dd23056100fe33a31b03f88cd33e2c77afc4752a5c408b025d1540b77670e27ca4da5dc251c05b17df51d601cdc53754d4a6c5ec00
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzDmg27RnWGj:ju6JmIxd2dzD527BWG
TLSH
T162D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 82fc4045ee9665938f46041df507c2dce0ba90e3b14cd34a9a1b4322338d15f2
MD5 e4133fe6425b4e2947687e58fd841827
SHA1 67e33f37f98b68b84afb4c75586af430e073fa50
SHA512 f444e0ee6fe629a5c79a84f61dfe553a99d5d817d15f1e1152ac65d775fd16624f9e535f930975be52c0fe0dc7f76cbc47212e95d86e359d79361aa47fa66c47
SSDEEP 49152:M1hpsNoJpF1A67U44CwH7R4xvDmg27RnWGj:MmifPqR6D527BWG
TLSH
T172B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 02d044bba43a4acf98bce3c4b84906a6371c0b7052b9faab49429fc8e025970b
MD5 1bd5e79fafa24337a418a41ea8221d9c
SHA1 9ab92ce3ebfa374d4c9196cc2d49e48ca6996fcc
SHA512 77fe7b95f627623a82138dd86a1270ec6216ec681a315904fb5dd9e62d32fc2bce9eebfa8a4edf045499fd9c7b9ad6d169c9c1cb1524539f5492d3a7a63e985d
SSDEEP 49152:MSuZQIY0Be2KkRVtOnks6NMHq8Dmg27RnWGj:u5dKqi618D527BWG
TLSH
T116C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be50ce52a20f28cdd6bf0df55d37476004ca68e13c7e7a10af18e436bbc4639c
MD5 c81c95c7f7243900991577f3e7b90754
SHA1 4002244a035bf51750156fea52ba9334c5d10b5c
SHA512 da411592b39b5c002ca0d1ed4c3a996c3b9ea020a65e03ae3402c42b6c78c155c3b2aafdc9a4f104f6cbe40735782b7ddb6d3777fe1344e83947529193197ad3
SSDEEP 49152:/htSn8EApI0figjgiDn0AP5wDDmg27RnWGj:uX2iWphGD527BWG
TLSH
T12E95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 70f03e4f2e152242d14a09d4fa607db2d3d34035108c7ec46c6a94d16aa41398
MD5 d0dfd4c47e039426fdc7a532197a81b2
SHA1 78915bfe2a24fa54b5eea24267214e2ff82011ff
SHA512 a5fe06c717540887e3c36fb5b46330d62b39a3867d002d5b259cf7d38784dd503165467e69e6d57531340291bd12e28ee71f54cb5ef9c7aa5804756cc54fc1cc
SSDEEP 12288:3UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D36523BE914C01CBE52648B5C3E9F15EAC173E57E92004937B5B78BAF7B24584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c9b511c63877cb0c02020fb3d082d1a3ac9e5b9272c5bd636b3d965fec922cb4
MD5 a7c01cf5076e3ad6ecf6aaa466800b89
SHA1 708551be4474eb16e01e0abef961a5edecb2c607
SHA512 29a0a3261dbeea7959c85895acabcbfd6b87001df56c6609e18977d2a51fb5e07de9dc502eeb6f94d6ceab9c089396f3e1daabc0c7481589e96d4b5dd9c5a4df
SSDEEP 12288:opXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:opsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1826523BE915C01CBE52648B5C3E9F15DEC173E57E92004837A9B78BAF7B15584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 81d6bb5430f66b8652b83a52adfa079cac7be23361b5e3709270b1ee03547d87
MD5 9b6194c5e542e99d6c419071af492a6d
SHA1 06b2d391a1d267f29a5c6c4d167aaf86c7e1ebc5
SHA512 f83c95642cde6158607d9c9877350554d8bde773831addc66c02f01e465e04fc49b905eca7d41b179634e1f717d03565601e7951875be2f13eb442f858e79174
SSDEEP 12288:bzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D6523BE915C01CBE52648B5C3E6E15DEC173E57E9200483BA9B78BDF7B18584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0c4c952a5aeda098ee5eab1a81ecf342f234ad8f38004d00be35acaac509dbdc
MD5 f61c182d52de8e62f0e5d9e755c7e209
SHA1 21c03f0c51f32fcd148f31a0975c1dffc7f438ba
SHA512 f029f2fa6f66e72712233b1629122f7a985e23008385d2f0180b8af3a06e3d3bdcb22f1e59e3a55ac6d9b7c602aee918d41d9c212b74d6ad59d0a1a1826eda69
SSDEEP 12288:RV2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C75236E535C01C6D83285B5C2E6E11DF8237D56EA3005DB6B5328BEAFB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 dd7a0b567cb49ba6cb4bf0f2546233b8a030e577b55b59ee555a1c6974d27143
MD5 732b0a8ea2b3da68a073d1258890d987
SHA1 6b969ffa78339f30af1fdbfbba7b30a97625ea30
SHA512 526d45e786b4ea53b0f3087f72ccee27874ca3f324d9af0b4508b4882bad3db9ba2051fac879a8fa8aae3e4f956ae1eb926eecec89e7f85783f75b196ddc71e4
SSDEEP 12288:4+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1496523BE915C01CBE52648B5C3E6F15DEC173E57E9200483BA9B78B9FBB14584B3C862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 d600fd2beaa863c9282bc7610a5252c00a7a71bd58eef8e1f21f4916b9517c65
MD5 17424ad31905a6d36edab86ec3cf4ec9
SHA1 284f57861932b8003dfb1d344b8199a765e215a4
SHA512 a2435283d666dbf4aea98194f8c357f22a481fe4861478677a6fabdf8e4782fdfbfcc9bb32a6fd622de360348ab51c5e6acb10f49aa7785df30a7f9620b9dfcb
SSDEEP 12288:EdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB6523BE915C01CBE52648B5C3E9F15EEC173E67E92004837A5B78BAF7B14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 b29a0d5abea8457814ace88c698f165dabd27c396db7d00528c6d76a5fd0542c
MD5 7391d50423449a5adcc0f1e7d5b5331c
SHA1 81e1ba688ffc568e557e963933d7e726a5e374a6
SHA512 e69a06a6bf2a97cf885f251eaa4e04f29c3bcb50f49a84c6a41014f78fa704f2d1c405888e47bb6fe830a017e563b6ac68699e9e638cd7512213951b89a96c10
SSDEEP 12288:QRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C6523BE915C01CBE52644B5C3E9F15DAC173E67E9200483BB6B78BAF7B14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7b77216103b762e5ac39b3ee5881f02f41f902c3607fccc90e9dfafd36db5b6a
MD5 7d87d3f92dd16b90819767f218d664b8
SHA1 2c2a1ab5f23e4d3a48e40b3259429dde356f7250
SHA512 046193042d30ffc0be38ecc4c7f6f071b8c1ce3e1790abc0eb83ae0cd26e7400fb4e4502828a6acec748d2cfdbe11d2c7bfa610d1aa56db198b0041346894600
SSDEEP 24576:7ZM0zFVSOJsqjnhMgeiCl7G0nehbGZpbD:7ZM0zfRDmg27RnWGj
TLSH
T1E88501A9B35418F8EC63813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 78475276738cb8b5103e69116bdaccedf1d0dd33f8fcebf4002f1261926e78af
MD5 4766d5cadd869dc6acdcfdfcdf680c5d
SHA1 9d796a3347ae823ccceaff2b7a8d0a969f600783
SHA512 6fc8c125e3425aa255b9e489f9ca49c6b59d9c851317877ca097bbcce32c8f488718a46a469de3a943574fbe1b7dd79ce0e50f1040c89fd0e89a35cabf8dff8a
SSDEEP 12288:1QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE6523BE915C11CAE52608B5C3E9F15DEC173E5BE9200483BA5B78BDF7B18584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 690756dc513b1db74df5b1420b1f11e89bc9cb63bd12857dcdc76d5de9bff142
MD5 8daa0ca503ae6176c0d5b2e3b33549c0
SHA1 4010a299edf87971def556e1ca6a461675cbacad
SHA512 7eeb11d2aaead33c0badabab0439a51e93033f8adcc0fd15381be18f695c8dad481a36bb1f148ffe3a3d72380ab978bbd433e2e8be606ab0d375d36c3f0c7a78
SSDEEP 12288:dsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C96523BE915C01CAE52644B5C3E9F15DAC173E6BE9200483BA5B78BAF7B14584B3C827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1d42af3af0d43cbb5069243642dabc8e9726dbf58dcf18e45fb4d52b68495ac2
MD5 cf51fa2d22a95de48fb83ba4f5a423aa
SHA1 3c572faafed046d778f52a32b04ea67596eac9aa
SHA512 23c3859984b53ce15f03da5395ead5bf67970c9efd14d0a606f2d213735520d8879c77c2fa89c0726aa31e0eefd325c6c8091d86f6a73b6f4f2ff44eb0162b5a
SSDEEP 12288:8yPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B075125B73A530F9D1378178C5A29606F7327C324B204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 2136881287180eaf97bd0fc7923a8163a660028e9bb2114a00febb24cffa8599
MD5 ebdea059e98d963917e28c39bbbd1fd9
SHA1 38666c6f618ebfa3aac281adece9b823f45a746a
SHA512 30c2239640a60072d242f08dbc35c91477c31ab7658b5b11d8504ec805c33d182c0c2bd6ec0701a0c14818dcd372b8e8b07a038ec0800e9f8fa193a6de22c949
SSDEEP 12288:EQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E6523BE915C11CAE52608B5C3E9F15DEC173E57E9200483BA5B78BDF7B18584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 19ba484014f89c058ab14519bea71d14082ac1e6e14a70b63c9f8c040ae1de76
MD5 7199f5e6e5ab3933cabc212f6a34396c
SHA1 fa7906439bc8f5dfb8c6faa7e331c995364b355d
SHA512 a14c1c7cb733f7e26f20aa8ed41b5c0a70180657f9728e7db16101bc716642d86f0277d1b41b5c123c0391ed00444ef8ca7a3be3396d3b201b693cc518ad716a
SSDEEP 12288:0QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E56523BE915C11CAE52608B5C3E9F15DEC173E5BE9200483BA5B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d8357229e30de1a79d07da92a740ce56475c7e2755b48e1b3a8e8523ffa302da
MD5 8559861ffbaca857566fe25de45aecaf
SHA1 6e612ee7f52df84e9fadf1096553028e2fd7ebce
SHA512 90ab2d1941bfdff3c2f088e99bf9e95d9cec5dec7f002c942bc443470d2bf5eadec0d0e83e8c51856200318d373f545c2cd9d2adff93186707d7a2547ed89993
SSDEEP 12288:jyPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F75125B73A530F9D1378178C5A29606F7327C364B204A9F17A516BA6F336908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e062c3be057736b958fa851925f7fc40ee473afb9f073520b1588a5612a56a67
MD5 ccf47aebe818f98ae797416e1901f5da
SHA1 e08b69e101e959f70e7172db0ce502238ed9abf7
SHA512 72c5fc125f8269909983572868a58e9cf2e26b896f91934296c42acfd07a9908f11337528eccb993d29af1637bf073fffc37ce1c546377b39174162abd15c021
SSDEEP 24576:jTBaLl3z0zDjsqjnhMgeiCl7G0nehbGZpbD:jTcLljeDmg27RnWGj
TLSH
T1E58501A9B35018F8EC67813EC965D90AD5B27C5A0B70CA1F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 87e8becc168127bc03a52b1d70de18e3adf665e2105438103e82ccafcc5ef5fb
MD5 70ed92a9d7914631f1b656dbd1f96a86
SHA1 7e9df05d6cccc4a7488c761e24613156043ee9f0
SHA512 89c481a6f543dd12ae642cf3e53bba927d37278f4c4dac9baea3ac1881b79624dbcb5bd505c37d52af05ca77553b9f12c9120cf82f53e5c62e8dd3f5cb0bcc37
SSDEEP 24576:93Bd9CHKy7GZ3sqjnhMgeiCl7G0nehbGZpbD:dBd9CHKyaRDmg27RnWGj
TLSH
T1BF95CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 0e833bf514b84c452f1379d2176eddbe3d53831167d7b66b0c8c5929a77c3b33
MD5 2152a091dc477e44c3f9d0a58c051cfb
SHA1 9eca350e63861da215deaaf353451798af13975a
SHA512 e491ffab38a3aff524ca6cfc6ad7cc78f4d443e39a197846cccba3f61a8542b3a9f379fb043298d6f4e2a7703f4f5200877fa78ade2b2c29ef1c7aa63f529aa0
SSDEEP 12288:KTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D86523BE915C01CBE52648B5C3E9F15DEC173E57E9200483BA5B78B9F7B14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 2e56b54bc7ca66f7702897024773455f68c57c6370374f5313b521fcbb24b28d
MD5 9707ed098774859f8421b4fa888741b7
SHA1 41269e542a9c57a162f0b5f0959f790c090ee5bc
SHA512 972ffb6b74ddf7a735657b58c104852d06cfbf4013bd3bdddd8b1419b3d413720353d2ef1d06a9404a5c00b201a5461af06dadb6de40e5e84eece38dd822bd74
SSDEEP 12288:K1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C6523BE915C01CBE52644B5C3EAE15DAC173E57E9200483BB9778BAF7B18584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 5c8c42212db6f0dff685750820c972f96a24ce0eadf4c479c46863238261ce2c
MD5 5fd8b9b613189879d92395e429d99020
SHA1 147e90b860fc3a7b3d7482f2465c13b6a1852014
SHA512 7545f4c80bb27f676dfa17e707e5ef249ccfd65aae0f0b4a9c8af59423f04c528fde69ba0ad18de041fc9b3d7a16d32badefdbe85eab3ab337442500bad78f2f
SSDEEP 12288:LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1016523BE915C01CAE52644B5C3E9F15DEC173E57E9200483BA9B78BDFBB18584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 d249d72dbc74a5753ae51e28726523298bb59a6ebcfe35cc8f7b5d283915e8db
MD5 f36dd928cc791fee700cc447281691e4
SHA1 667009f1f9cd683bf31d7626a37e85bc5ac36510
SHA512 a2b1ce6bb58ebe45302a4a1782d4c562d3297fa612a6db91febd34d05a564d46fa0dc1de6b69e1d554352d192993560f4412576a427f46ede0c6d850d7cfa29a
SSDEEP 12288:uQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C6523BE915C01CBE52648B5C3E9F15DAC173E57E9200483BA5B78BDF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 86833fb715f118c087581a0191585b295f81133249476b42c755c260b81b7e8a
MD5 49360879e2a6eb3828aace6de66a982f
SHA1 6c942f4dfae044492623f179edf6cf54ae08c367
SHA512 5e629a84e2d7cc81aca0b38379cebcc1d94b1789fdc56f6bd2dbc3bd1b89f115943ddc73d32b95ee0fb5459cece8537de88d017c2789a75953cdc93070d33c6c
SSDEEP 12288:vTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1796523BE915C01CBE52648B5C3E9E15DEC173E57E9200483BA5B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 1a8e963c18e444618dbf01a6752bd91f10f5c27fe2c753c03ae9084542674849
MD5 116d2c1accf10e47f7a20286f0c9d498
SHA1 d08547210df9c88efb269977ea5b046c9b92610e
SHA512 3a04f64383734c4d43988066c1d99242d6c0dd7543514e68bf66daa7be6fdb4eba6cdd8e65bf838da54e1fc83034b07e2e2a4a6b75e4b8a8537b36986353292d
SSDEEP 12288:j4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A06523BE955C01CAE52648F5C3E9E11EAC173E57E9200483BA5778BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 c7a156dc8adf6256802ef81aa8fbdf14825176c78dafbda9c4aba30835c8ab31
MD5 e49821daa04ad0e84a0537ad5184dd2b
SHA1 c31048cf207febf2eb86be2dee42e3d8475a1e91
SHA512 2faa6ac5714557e73dc424456e6cf3924f080d61518942e97afbd17e0d3998a52c5513e24c5b2a4713c0810d5f996ef0bd3792e24f2dcfc3781522fc40df8ba7
SSDEEP 12288:q+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A6523BE915C01CBE52648B5C3E6E15DEC173E57E9200483BA9B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 7a2ade6deee9facd856c15d8dabf053b57ab49777351847b4cc0d26380bc0a35
MD5 13df0a09994023fefa0099a2e47450e9
SHA1 01a5dd20748bf37f26c3d67fd88139fd1dd9b75c
SHA512 3da8e88eeda080b9f543bf76a14fd4ea570e3409fa58fb9a51bc2cabffcf4d34f18b51efa56da12503bb84cd397ebf848e702424beb17aea92285a4aa616215f
SSDEEP 24576:Tfwvak9RX6wkyAI8sqjnhMgeiCl7G0nehbGZpbD:vMnYIoDmg27RnWGj
TLSH
T14895D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dada2f992061ad534af0cd19daa2967b0a41a38e073131b39172da5694bffc4b
MD5 0c35834733506c193a16db5c6089d003
SHA1 f6dffcf1228050afe6ee33e582778515b63cd1eb
SHA512 b4615ed364a00503a467b248b616216c702529ab97e36a000159f1321396e113bf8b8c01401a378499a366aa289c468ed41e145ba57810e8fbd5e6712159e449
SSDEEP 49152:+YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jDmg27RnWGj:hySzPLD527BWG
TLSH
T15B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e540e6d636c31f5b8735d3ea148f1f65c6b60a7df0a667f18520165a37942601
MD5 8725285e151bc4075c6a947f92fcc005
SHA1 2b4cf0aac5f67ae458170f0cdb10bda874465ace
SHA512 86d5a7296b4a1b792a075e88e5c00d365f1f39a6cd659e9328c06417caeb8c41183fdf3f395ac99a142c450f8b4824f16d92bcea4fc5f06195e629c0477557dd
SSDEEP 24576:W47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYZsqjnhMgeiCl7G0nehbGZpbD:W47JUQjqirIhCnDHUPfF/zDmg27RnWGj
TLSH
T16065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 27254c634cf4e65c7fea87d850fefd6b1a822f88f2845395308835eb9b06b358
MD5 cf95419b4234fe91f0ef8c957a8c388d
SHA1 cdd93e6b46647033241695b15509a40856ab4d7e
SHA512 d1d63d5e9d5060d7453215e5f7e53bb462675266db6f4eda31cb76a9ac2b2d4544ff53e6776ef4ae56d90faf3ab373e4c31550a9f3140e98efc96647d0df364f
SSDEEP 12288:GTsfAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB75015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 976KB
SHA256 b0b00c027e783f91fa77c38844dbb3799cd883ef64d671167907046f1002da6c
MD5 9e821f849a41eda39bf1b98ff19067af
SHA1 277e16dd56f59ff8a318277ec3ecb06438cc07d9
SHA512 a4ee8933e49d4af254c6fd1911daa8e4dd85a04899601acfd36d297eaee1f793bc55e3bffdf59692c174ae244f09b3a9d4114a28ed16499850767132ffae7126
SSDEEP 24576:QJRYUPK5Cmdtml3gxBdmZ7R2jkRaeuaw:0RYUS5CmdtmyBdsUARVx
TLSH
T115250711B666D74FC6AD40321E32C6CCA7707D41EE05AB0772C98B3FD476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4dcfe3a2056182e962e846ca4ea72b49cc43fcd97d0c1cd7388e31c3544b18cb
MD5 cb74be0d5b9610e43e79e26ace4b713e
SHA1 4b3176901e8271af5bcc7ee16faec1ac9bbd0ebf
SHA512 cf7db193bab083ed1f73a42ce2c55d5bdccf1129f3d1d7a511f9fb72cf9ed471f4462dd1e70f4970415093a2e5d6a03be4466fb0db8561196b14eefec3fe98ad
SSDEEP 6144:kNXXPrXYTELWdZXd9AdyI1oiuRixtMxjy59SlKP/XuXR+rd1+ixtMxCKGtd/dcpo:A7YTESdFdudGS59SlKnXSYJ1TdwXz8
TLSH
T16855D841D136E28FD1F76132072A5B8D6764EC47B709AF26B388453AD82AB15A1FC3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 a4ebeaef5c4daf2c447bf2d4f4041b1b1d8cfce6e34f96a163e1541c357d1e46
MD5 cb364801bcd74dfa2ad5f2f566d01e20
SHA1 4899ff5da1924f06f99ad352a2d0110078c88cc7
SHA512 f5fb886ca5c6c2013d34609f16e34b9713262adcd67127a4e0c568c86d9e1ca669b39e1a0c04bdc64253c8028b37ba9321f05ebbc7babdecd161c4adc03801f8
SSDEEP 12288:ed7oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qosqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C65237A835C118AE83605B482EAE12D781B7E669F1044C3BA5779FDF6B18C48F3C517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d6098fe2fc3cc9070ec8d2d7e1a3b48db03416f2d722c96e1b5ddcebe3fbe12
MD5 d9e843bb0fab2c46620c524365bf810b
SHA1 72491453c667f6456af11aa78b0cdb05dc3ff318
SHA512 d038d36839bb66c59395dca38c17d41358fd9bf402389be92dfb39e593ae50ca09e288c3cabdebef458530ed43ddd531de751be0cfc76b95df7179fd3db990db
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYKsqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGFdDmg27RnWGj
TLSH
T1D6659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 fe34fa3eddd21dedb748b7c39c45d31d3ceb7cc39972aebd06bbcbf368bc7d45
MD5 7b8c71b13c658669ed52cb507eb22665
SHA1 f8a4568b4fd13581b2b892dfb308abb4a5266f5c
SHA512 c05af6800346ccedc7342b61d6220e712519085ba4df9cccd54bde74be454318705667c53068faf0fd6739cc01fd2ebb9e441d9a0ea5cd5a1ec2a1ecd8bd8e99
SSDEEP 24576:SG88u8FpJqH16zria7/mJsqjnhMgeiCl7G0nehbGZpbD:J7ZFPqVFa7/2Dmg27RnWGj
TLSH
T1CCA5F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5e8fb5c80dec888a5c456a9f131745556b922b488002ced0e2e13ef4fa2cb07c
MD5 9196a27e776832102906e39d8044a99e
SHA1 4266d94bd679d236300cb1dbd09adbd714c035e7
SHA512 940653660c53a8082611ec9f801f49c90a10352793055447a3e5584386adc788e976829029b578982c9585321d04ebd24d30b48182f7128761cc7c10de42f8a6
SSDEEP 12288:gHvUrBFrEjwaQtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:gPUr+NQtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B285F12F22AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e0ae647aaef4aff1c9a037aeef4a618d33c8a79e39a38f5b874ee0445feec461
MD5 53845d56fdbacf3c7a4f120b7c8f3e07
SHA1 767ea6ab7c504bfe2bd53c0b4d75f954ed5f601a
SHA512 4863064500e711b3d1cd9f3fe50bf71df3d36de86070149ae3fad9aeeb45a0e0d90e4845ac183595fc4e8613395794d9e1518f806475dab7930c44fb693437f2
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBDmg27RnWGj:oG05lO43bAD527BWG
TLSH
T12CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d31a8756948deab6d4767b9c0ce3319f6057940e3d018b07c1ed18a881b2100
MD5 c29ffe5aec5748da2759293036c19ca7
SHA1 aae530a591f41516304a2e4781a067d50a015157
SHA512 2346f34976adbb694129934f5f2f5ff560f2dd78a4f0d9f541f0471cc798d38a5dbd8c0927379208617deb007587d4dbe6404c13f4109fab48f62a3f21d63286
SSDEEP 24576:afa5POZ3dpyWVM50JicR2hG0lasx2+47eidn/sqjnhMgeiCl7G0nehbGZpbD:ya5POZ3lJt2pasx2+mpDmg27RnWGj
TLSH
T16C65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d9a270f10a6a3994185033d2ec8de822caecf90f19f38de7c8fcfd9c07693165
MD5 953f19fbe0b1356391eada72f5d86f9f
SHA1 8232ee79daf4bd3bd1efb84a601d74bd26ed02a0
SHA512 4739c7e8590e8e12a6b8922971318d3cc6a1ed8c34f3460300cefc7a2de2894940c75bbba415fa9ec57c9b094acbfd31be5fe0f44e6cfce896763a887cbb64eb
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkBsqjnhMgeiCl7G0nehbGZpbD:tNc/zEOVHFWDmg27RnWGj
TLSH
T10E857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5f70acb5017e6ea04d90cb5fcae1c2b72e4ad403b45346344c99717b5e67f2c0
MD5 24fe6d39bd495f18eba94b0e1c8dfee5
SHA1 f0e0adbd3828d41d06e418861edef2d0a1c4767e
SHA512 546ca7f5dbf3877533a5d17e1bfd6887ebc5dd47e36f6c60c72a030a65b981573374c59f688f24e267a622a853a5d6bcee0780c612fdb20f65c2245d7f11d0b3
SSDEEP 24576:DzkNvNnaFeYhJNtmZBmrsqjnhMgeiCl7G0nehbGZpbD:DzMwBtOmfDmg27RnWGj
TLSH
T13D55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 4d604fcbf7417c9776643eb0436cc0eedce238da145f3db50787204baaf07548
MD5 265791535f7161a9f8d457829d6dc9bf
SHA1 a50c7fa4b71fb0bd16be9330aaceea3b3fa63345
SHA512 81fac1ad6887600a44e2a84eba9b3c4b97acbfe6d463ce525f6ed52e58494d5bc2431d6812f31602597e4c0fd9127b53a2927c77054e5af284cb36b45a76e41d
SSDEEP 24576:2D3FHshBIYQgA0sqjnhMgeiCl7G0nehbGZpbD:2DVHeBIAAQDmg27RnWGj
TLSH
T1F195E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-115-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/1280-312-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1280-113-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1280-121-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/1848-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1848-65-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1848-252-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1848-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1984-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1984-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1984-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1984-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1984-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2108-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2108-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2108-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2108-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3004-84-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3004-78-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3004-279-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3004-79-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/4548-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4548-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4548-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4548-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4548-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4548-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4776-54-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4776-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4776-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4776-219-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4940-314-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4940-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4940-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4940-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4940-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4940-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4968-370-0x0000023F941C0000-0x0000023F941E0000-memory.dmp

Download

memory/4968-353-0x0000023F801E0000-0x0000023F802E0000-memory.dmp

Download

memory/4968-358-0x0000023F81A10000-0x0000023F81A30000-memory.dmp

Download

memory/4968-361-0x0000023F81DF0000-0x0000023F81E10000-memory.dmp

Download

memory/4968-352-0x0000023F801E0000-0x0000023F802E0000-memory.dmp

Download

memory/4968-359-0x0000023F81E30000-0x0000023F81F30000-memory.dmp

Download

memory/5012-38-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5012-52-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5012-39-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5012-47-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5012-51-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5400-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5400-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5400-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5400-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5400-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5496-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5496-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5496-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5496-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5712-77-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/5712-0-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/5712-8-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/5712-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download