Analysis
- max time kernel
115s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 1.3MB
- Sample260706-tyttdadv5n
- SHA256 b1a8756c7ae13e43059d00ab313f191a20b127368d022617c199973995c2083f
- MD5 9d7ffc4d4e1b19c3815afd550df4b6d3
- SHA1 c55086d7f67d3eaea628e1acde867cbf1a96699f
- SHA512 f74916438e0030c102680fbb9947ab585d031627d6d09a31eb527aae67373d77e7a16226a5d3c77236a965418582bb9d5d9dbaa45dfc3a8672d603e510811a30
- SSDEEP 24576:lVGGTWBZQnlr8/3nu+xXHFd9Wj3HghePjYyU:zGyWBZo4LzH6QMPj9U
- TLSH T16455022272C0C0B3D9A3593049B4EA712A7EFD341FA15CEF6384136A5E742D19939B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 6128 elevation_service.exe 4944 elevation_service.exe 3656 maintenanceservice.exe 4148 OSE.EXE 3152 PerceptionSimulationService.exe 5328 perfhost.exe 5720 ReFsDedupSvc.exe 1852 SensorDataService.exe 1128 ssh-agent.exe 4640 AgentService.exe 2992 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\baf684a8118c7e83.bin elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008713583640ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000c26dd84640ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058b4aa84640ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdb8d584640ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa28ce82640ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{70AD1E94-6B8A-44E7-B8FA-D368493E97AC} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{93C22BCE-CAC3-43FD-B1A1-646E990F2967} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2764 explorer.exe 2764 explorer.exe 6128 elevation_service.exe 6128 elevation_service.exe 6128 elevation_service.exe 6128 elevation_service.exe 6128 elevation_service.exe 6128 elevation_service.exe 6128 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeBackupPrivilege 5720 ReFsDedupSvc.exe Token: SeRestorePrivilege 5720 ReFsDedupSvc.exe Token: SeBackupPrivilege 5720 ReFsDedupSvc.exe Token: SeRestorePrivilege 5720 ReFsDedupSvc.exe Token: SeBackupPrivilege 5720 ReFsDedupSvc.exe Token: SeRestorePrivilege 5720 ReFsDedupSvc.exe Token: SeBackupPrivilege 5720 ReFsDedupSvc.exe Token: SeRestorePrivilege 5720 ReFsDedupSvc.exe Token: SeBackupPrivilege 5720 ReFsDedupSvc.exe Token: SeRestorePrivilege 5720 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4640 AgentService.exe Token: 33 2992 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2992 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2992 SearchIndexer.exe Token: SeDebugPrivilege 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4408 2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeShutdownPrivilege 2764 explorer.exe Token: SeCreatePagefilePrivilege 2764 explorer.exe Token: SeDebugPrivilege 6128 elevation_service.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4280 sihost.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe 2764 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1520 SearchHost.exe 2008 StartMenuExperienceHost.exe 2764 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2992 wrote to memory of 672 2992 SearchIndexer.exe 99 PID 2992 wrote to memory of 6076 2992 SearchIndexer.exe 100 PID 2992 wrote to memory of 3668 2992 SearchIndexer.exe 101 PID 2992 wrote to memory of 468 2992 SearchIndexer.exe 102 PID 4280 wrote to memory of 2764 4280 sihost.exe 108 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4944
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3656
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4148
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3152
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5328
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5720
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1852
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1128
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:672
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6076
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3668
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:468
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:988
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4804
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4196
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2008
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a7644c47ccbea82823e7808df1d2c2b004214707d05292abec9c356ebe103294
- MD5 ca4042252f4f57ac269da972fb3138fd
- SHA1 741cf52a48285613d5581119d0b35e67f6989751
- SHA512 ea06ab22600218b7d6598f98ebd2746fba126d631279adc7b12bcb37e077b38959f6e31db5a83544100c1800440c8c36a64021808f850e584ef8d834081e91df
- SSDEEP 49152:fb+632BuPkFKRrdE6ohrstBhuXjfS4LWxna4LzH6QMPj9U:d3q60jBwLPMxU
- TLSH T187D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 8b76e23f6605d189c92ac85d8d75b9aa6fa467fef1c297c48a1cf440a601c215
- MD5 175e0513d0e4f8b033e5c505721b25c1
- SHA1 2ce5e4e3a4a85f99d0909a4536fb4d741365a705
- SHA512 bf406665ae13bab0171b0a53a5aab9eded4649804c76c7df0ddccf47b997971aa65f4932341d4aed07d52fcbcfa8bf2461e2c06ec9aa699c89f431c6776436ad
- SSDEEP 24576:gXYfDtczAjnlr8/3nu+xXHFd9Wj3HghePjYyU:XtcU4LzH6QMPj9U
- TLSH T142650129B3E049F5EDA7817CCDA28506EB73784547A0E69F03E485261F232D86E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 5a7f014fdff51b7297acd240242adbd934b186562e6bef861d50a73ee7275ac1
- MD5 e9c72bb0491df16d2a52f71d0e717021
- SHA1 96c29ebb2fc700bdbaec328cffaa85d2b65bf789
- SHA512 b7bde66f142b239d234ff94e56e80ff28ad757702f65f9250c1eb89cb6e7ddd9735359225e25a4bf039b80acd72fe3af494c42b41195f7a0245bb3b0feeab204
- SSDEEP 24576:C0Le5ji0hmxmrManlr8/3nu+xXHFd9Wj3HghePjYyU:CPji0Agf4LzH6QMPj9U
- TLSH T191859E26F6748731D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e0ff460080c59c1f519e1e46a6948d7567e0a0e48efe74cc4e9c1438ecaceb5e
- MD5 7997d290d7409261ea07f9527088422d
- SHA1 3d097128a8ff9b725ac99c7008fe0a2e0c337d6b
- SHA512 a0f8bbc9a4d751d8452de7aa53e90080673e868040161edb787a614cfc0e56fd51afd3c7d8a672115f457a20c02264bf821d4d6a0792f70ce616b2827ccea9dd
- SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWr6q8wyuMnlr8/3nu+xXHFd9Wj3HghePjYyU:a/ezSC6vUzPviHjyL4LzH6QMPj9U
- TLSH T1FB755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 8a76cb75e2030b40ca6cb03ade3bb273c2d63df02429de0ccb15ce54dbb2e206
- MD5 af61814482c0c8ca8167136b6e1472ff
- SHA1 762af9019c9b05998e77335d5e657a618aad4db0
- SHA512 d3300be9694e60db560cd374df0df7a836d4fa5d0e45dbe7a348c9246755e99b86e949a15d07577b7140287beaef1b54ee1852244a4f36319f72d9b12c54aa48
- SSDEEP 24576:OVbqPb88hv/l+b3nlr8/3nu+xXHFd9Wj3HghePjYyU:OVO88hXl+J4LzH6QMPj9U
- TLSH T1AA559E66F574C331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.1MB
- SHA256 2e8be8c92625d949196030db26ab3394dfb3b5ba2e2f82c78994b88ceb426113
- MD5 1ba82e43a8c838846873c241936eaf86
- SHA1 dbead13c39f425b3a80c9c2a12798d77f0144351
- SHA512 a3089726c039f90925a4dc85d687239e7849541977f5dbb24d1984e083c4df16e678c934932f4f0c852b0288dbd99b705bf3a91b3dac20c12052ce5422a446f1
- SSDEEP 12288:2IRc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:2Iunlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T18645237BD714D782EFC9E8B19BD9B50A2FBA0D0C4DC16C2F4058A2624D391ACF53562E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 0f211a5f5b90fe6fbb8b8227d74959b904b63a25df98a521287396b27fa858bf
- MD5 14d26ecfceba706fd9c5879015dbfd12
- SHA1 70e2831f6204e72d2da7d54b975c46dba4308efc
- SHA512 d9a341bbc24dc538cc0e1eea958cc67e714f92ed31676d4a1d28f3c318b4302997e3d5647ddd77a27d37821880cc8b3d2ef4d2a59744a392cebcc78526f86b9d
- SSDEEP 24576:LJIUfnlr8/3nu+xXHFd9Wj3HghePjYyU:LJIUt4LzH6QMPj9U
- TLSH T1DF65CF3BEE28FCD2C67A9DB85B918600A77278304F52A3CBD165830EDE235E45D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 42b9bd81e13e304d89f8140e4c64a64125a7195724552aa61bffc9df230d4ccc
- MD5 494fb216750488428b4210573c1cb384
- SHA1 cc64ba1c0453957b68881420905040321edef0ec
- SHA512 1f5188df4ab5ce3ff5c69c8de0114428e94ecd9e3ecd818b29f325a4c3c5b465ee06edc8d7c4b649febf713fd4bd87e7cb75cace89136393beab4e33b96a1957
- SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THY:MQvGAdlCEL8c/RRNw5C9LPMxU
- TLSH T1AF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 0f0fc779d2228a20fe6bbc8109c628ce4423df5ede37e2449826f8e6340f2112
- MD5 ccdf93aac78d177a8a88eaca4704856b
- SHA1 ea04e189158487c77c3620a3bce1f34bcd78043d
- SHA512 6ae1a533e27ffdfa05d49545bc61305a9664f2db3e68840086ae99e3e869b369b83da4344e74396d156cbbf9da8fe3f36ffdd93c6ebcb32227a807acf9940d03
- SSDEEP 24576:YfewsAjRnlr8/3nu+xXHFd9Wj3HghePjYyU:uljv4LzH6QMPj9U
- TLSH T1EE65E031FE74E032C7BF0DB21B26D716187D79204F9119C7E3A88A9E59342D26376A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c7ec34b6600ad3294b09bb8431a489147c88ac0d86a242ad46ccec0e220dce68
- MD5 7ef6b5ce5f95ecb37a017877b09aeed6
- SHA1 eef9bcd901efd19bc4cc0b0ee65459d6027dae42
- SHA512 e33961d908f70b6ecae615d578a9909aa31d6bcde0da8f8e6d72f90c5b555b17f2e8c3909e29acfeae0d35d98ddb1a34091bc75ca82456027faccf0d497432ad
- SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHCLk:yUEtQevvqc2W1cpV2RI323
- TLSH T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8a2575c0e9a7d0bde41b28557eab6ec43b5048575c087028b9997f38832aaca8
- MD5 ccf3a232af127f8dd59d5c7a1c3b0898
- SHA1 867d07a6555bef297145e49be51cd973a5f7fd0f
- SHA512 01dff011d09ba2889a69c882723cac0c3d9ea1218074758e4b284b41c63ad0ffdcab747a196a7bca0411aafd4c36a882640c06bd87c78bff0122b5622e46ff24
- SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zP4LzH6QMPj9U:boquVjnm5LPMxU
- TLSH T165D58D0976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 0aab1cccefb44a4a273a109a2a1a2be2a1105b6152dc707e6e11a01083ad14d6
- MD5 bae5bca1053f13d20c2f87f7a1b81938
- SHA1 696216eecf1290876fd7a5b05268fc7b954ae712
- SHA512 383e385dce2f71644824f8c7f933eec1ac0a602363687da8eaf90fb020702d6f540717503b4d47a8ec7d95d80e0685dffeea50cfff8b6af059e1d3337b0631f8
- SSDEEP 24576:qAhGL2IFoiwtA5l7S53onlr8/3nu+xXHFd9Wj3HghePjYyU:qAM1Foiq5A4LzH6QMPj9U
- TLSH T1A435AD81E7F955D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 da9a46891ed9b58b31d5ff63e90e27cfe6fd92977c93ed6729074d1ad94859cc
- MD5 8dc690c6d84bd86c5467e3e494eba3d2
- SHA1 91a6d7c30abb7616580660c603f2f1cf25ecb1f0
- SHA512 300f889fb7029e8aa40820ceddcf2394fd669774127da217614d0392cc1a378bf725523855f988fadf1c16b3bb0c3dd146ea188612c308cf7543454180c8f688
- SSDEEP 24576:ywuyOW9nlr8/3nu+xXHFd9Wj3HghePjYyU:ywNOc4LzH6QMPj9U
- TLSH T1E665F14A77A44CF9E9A69138C697D136F7F2B8052A21DA1F0360C25B5F37261BD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.2MB
- SHA256 254c172e7baf674ad11dccc4bc69f50eb58df30758f1f1650f44ef049e0f7683
- MD5 533bcd3d430dc76f693fa53bb930665d
- SHA1 bd485293728113e0414b33c672ee85c8ef953584
- SHA512 573e1eb7bde056eff00a237796b76cf75b50dd585ebc476a57811f60cb7c38bb8e3aebdbab91b7e90992eca1e798ff90244e28520ea0d6d2164e935df49702e1
- SSDEEP 12288:A4Z1IySc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:7ZuCnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T12145126E33A461F1E6D79178CEE5A60AEBB2381A177243CF016442661F33AD46D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c5068e5ddfb07d61461e5cb6a1c734640f1976e16afe95d0061472ac6bec4c2c
- MD5 fb27ec3f6985044e25ff7af7b2999758
- SHA1 41a8f714671cda62b41e925aba80c1a14b0bec1a
- SHA512 a7b7bcbe97d59350ad914b99d4221ef0c7eb7f63f711c2ab47d294e22bdd0d92570845b750c6f6901bdf294840e2f409604c718777d09c438eda3dada00288e0
- SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:0QRQyi36YOcPhLvw2gAf+PN3ULPMxU
- TLSH T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 6daef053ff1ca0e7915fdb22eabc9039774833b2dbc2acd990f1b9b78a3e3bcd
- MD5 41c4263e8737501f16ea46f1e24cb30a
- SHA1 f68d55aa82ef754ee530c4e15ff8fb0f2969a73b
- SHA512 25b6cabaf57fcb986a69c0f9d15303e0edb2e6af4808b1da3e1ced9ac5e967b69d34bd9eab8ec77de939244c6953930d11b4d4f6556f9e2c713d5fd744c9a72d
- SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:GQRQyi36YOcPhLvw2gAf+PN3ULPMxU
- TLSH T127667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 8039de14766b0cd86cc5cb42b332c8c05c4846965f27d6c6945e4c6e39120961
- MD5 e3751027b83e4e41acf0609901daa32d
- SHA1 3ba13e34e92ff4ec5b1c5239ef4f29dd8f11f48c
- SHA512 26d94ff31538c7992372f5aa3cb81ff87950f4bc51f2b6a538b9f336678965e2d21b456c67b5c763bf7f22353ec0cb2c36721868c142783ca22845da91d56093
- SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0ynlr8/3nu+xXHF/:m68Qg55nhceWu7PNU3/f4LzH6QMPj9U
- TLSH T150B55A33B2F200A9C44DE1769F4A972196D27C758FE0E3DB851572061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 5a03ea34ccfb367c6feb0b1a66542430a8df880895b4e8f613c85f6a808f2695
- MD5 2497dc61125fa1c51dcfadd9b89c1e72
- SHA1 89e9e3d5cd71c91aaa50f987c98d6ed89ed3d9b4
- SHA512 e99463806bd26a04f10a34199879945730be5330f1f7af78b3fc3960aff1afa30c3732ac302d61d4cca85fe19b1f07954cd768b802bcf1a7818b34d265491101
- SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99+:Hy5112gYy5azzVva69nLKnhZ/LPMxU
- TLSH T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 73486021e56c34c1bd2a6a578eaba2fce31fde06ed370bea8d2395447ac047d9
- MD5 392977b5448b5e525cde17f309ced388
- SHA1 07283b74b3ccd05669d378c53e4c68d32fe4edcd
- SHA512 a74acac76a1baaba0855ae127354c9088a382e1dd3f61aa7e9b1d2ca9fb64f4ca3ec602ede5251f6fc4f9acab95e30c162598392c8c50a63e5eaf47a9de9de16
- SSDEEP 49152:3B+taZ3usBWOBr4tEG20bqx0z+n217aau1glR4LzH6QMPj9U:Zu6JmUxd2d8LPMxU
- TLSH T128D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 5d4e62c1c93e091dbc1a4742d99a5e283dfe5eb6b3b03473ea6d41043aaa00a4
- MD5 ef9fc15de83c60d7337a608bc978d8b4
- SHA1 c0a21bb282cfcd8a474b38a9913c7f62178bf4e5
- SHA512 4732e6d102e67eed000c910686cb52bf7348f4f74e19cb42b437ee0f9ca68357d04e9e3f4ebfbbe94d67b7fb3767ed6d7e9dda59eb6da0571af92738432a9422
- SSDEEP 49152:Y1hpsNoJpF1A6BU44CwH7R4xN4LzH6QMPj9U:YmifPkR5LPMxU
- TLSH T1D1B5BE13F2D901E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 64b48800f1e805f52b62a865b67507a40c77d11e0263042113aeba0a7030e1c7
- MD5 69e529a9cc65abd571441c9aeae9be65
- SHA1 dca5cd01b1ff2a36a46ada71e051f22fd1515e63
- SHA512 9e5539bfe1eaeb3cf4511ef3abed09bc12caa067a89358c633f20d737a1c55ec1baa43b2af57caac73f62ae72168b4eaaa57d97bb56d9540826b0ee99a18b966
- SSDEEP 49152:HSuZQIY0Be2KNRVtOnks6NMHqq4LzH6QMPj9U:d5dKvi61jLPMxU
- TLSH T13CC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 9c484729a3876821397a7ed7e3599660ff6a23e78d3963aae82b39287a9cf9c2
- MD5 7577b3e6a25e5676a83e2c93e1c90d4a
- SHA1 6745c05a08175dd1fb515f5ab257603f0eba0b10
- SHA512 241c49f8617d785d5902319fef55bba21a2e9f551942c49c654f232505bcbca8fe250325099f0ba31377542bea0e37913ace1cd5dbfe2669ab532691581ff12b
- SSDEEP 49152:qhtSn8EApI0figXgiDn0AP5wh4LzH6QMPj9U:LX2iyphVLPMxU
- TLSH T12295BE13F2D901E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.1MB
- SHA256 3015481aa497d97914572ebcd0a9063caa88a9531857ddebd2ba92eecf9adb51
- MD5 9042f5d56f2a34fd3e1d7a382c323efe
- SHA1 c1b43bec097a87565e5286df94533e834237a55a
- SHA512 031017b5fb3a474f6f170eb296079161c27661bd464d580f475dcf5fa0f6baaea1b0b187b5fd14988486e29c04e78076d7f958c393cf4c8a1a9719446ef34a3b
- SSDEEP 12288:FZc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:FWnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T14245233FE615C782EAC4E4B1CBD9B50E2FBE1A0D9EC2286F614C82125E395EC703556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.1MB
- SHA256 bb35f584b9392bc94a96c71e19904b862e6b474812b691cfa2677154d1390ec1
- MD5 02a46911dcc3f80402041b98a552c079
- SHA1 71e93c403d5a66bb916bf43af773252282924767
- SHA512 3347ff6db1d259add2813132fd9ec00a569d23c1c88b6e3466e11a41a2022a82c2dfe3d0421d56b8d0b731d818c1ad42e787c36dea5f5f96ed9a734e6ad3daa2
- SSDEEP 12288:oec9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:oVnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T16845233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5E82586F604C82125E395EC743597D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.1MB
- SHA256 860802da5cc506971189a412176dda24e0a55e0558738967c1f42b4a3c2cd3ba
- MD5 0e6447f0f09231886e65821f94fb9950
- SHA1 3d44218f143aaaeae0f3346c414f7fe4c6cd99fe
- SHA512 681368c2d5bb33346f3025839d43f15c33f5b7002942782d47f1cf94ae44f594652aab24a6397a64aaafff217d8b2b0cb084cb24b49de9805bb570ced87d32a8
- SSDEEP 12288:BAc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Bnnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1D945233FE615C782EAC8E4B1CBD9B50E6FBE0A0D5EC2286FA04C81125E395EC713556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 40785d468c824780888b78746435a66838f156240c9aa7447da4286a85fdcd12
- MD5 3b2d9773b0249be58412c20c651e2ca8
- SHA1 5a3d15a7a919b416e6a25d6dc260b6ead2260ce3
- SHA512 ba2406dbf65b9b819edc8343aec210d334612bdb2366f353252e75a3e39e33d741710cf18eb57a13389d1c0fcbb17c84d20333b193db0dfd339922df2ba11956
- SSDEEP 12288:NVjc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:gnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1F645233BA765C3C2EDC5E4B4CAE5B10AABFA3D0D9B6258AF510441520E353E8B434B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.1MB
- SHA256 4086eea34bc32a8165da9e915cd01eba6534a499c43b5c46fb9d95dc39b75af3
- MD5 493a9e0e1441841180fea937c7604c1e
- SHA1 32ce998354ea633cd5b28ababecf651e6a169987
- SHA512 4d910d2d66f6ce4734f8c3960ee9a98ad3671e042df62c0a165d9113cd9eb2aef9b2832e9c9c4a2a6013484d543094255fe2dd08c1dfddeb7905da7b77df6652
- SSDEEP 12288:B7c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Bgnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1E345233FE615C382EAC8E4B1CBD9B54E2FBE0A0D5EC2286F604C82125E395EC713556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.1MB
- SHA256 14108b4a1d855b53a9f390e85774786c10448d06fd0cefd6fe627b34e25983c5
- MD5 0b80949d4b99ad3705e45a97bcbcd4e2
- SHA1 06f4b871fd9d4358cc8340f9c2c1dfcf19473626
- SHA512 8450de39976df2782a5738e37f50227b8056402bfceb6b6fd0a9f4667fdb63315411347913f1af5f2927db3a346d2160f23cf623e0cc9bbc6146b19c45fa9e5a
- SSDEEP 12288:bKc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:bZnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T19D45233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5E82586F504C82125E395EC713597D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.1MB
- SHA256 67ae51e68c2f132b48a32bd64540638b671074397dbf08e472b95c4c01d923b9
- MD5 7cbde306de51c17c6066b841b939d5fc
- SHA1 efb40dedafad548b00d0d41d80151ade42f5ad7b
- SHA512 fee9e0563329daace77cde74168960d961914c454e68bfb9becc038c6bb316dfea4dd4782f2671a556a5ebee3db281c9e6c21e34d1f16f05cc53e09d8161988c
- SSDEEP 12288:K2c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Ktnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1A845233FE611C782EAC8E4B1CB99B50E2FBE1A0D5EC2586F604C82125E395BC743597D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 b1cd5ccd309e0e9cf864a67d1ad703ba67ae3b53f943e3f82f0fb9cd7069cd7c
- MD5 af9f864aaf04d8d8b18c5f1f55b87695
- SHA1 af13b7aa0a13580a51633ff92a7eb39898d29e7d
- SHA512 f7da37230f6b2fcc1c916bab191e349214a75202760ecb1fddad5efa32e07eba9cba3ea413f02e41243309e2c79d43d65f72d4057d39d6cff6dbda0eff7fa514
- SSDEEP 24576:3ZMLzFVSO1nlr8/3nu+xXHFd9Wj3HghePjYyU:3ZMLzf34LzH6QMPj9U
- TLSH T1826502A9B35058F4ECA7813ECD559906D6B27C190B60C91F03A832675F333A15C3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.1MB
- SHA256 9af1d5b05593b24757f182ab686b28a4d51c67c65601ccfecf2216a2c5412316
- MD5 e36adb04b1f5030205045d9ba1603736
- SHA1 4362de822beac9e96065aa2ad5c81083bceb02af
- SHA512 20032f9139a703b71ee144c40bff91c18638f7846c0eb4adee8fbf3ff0a95762ea37e01d5fef5535040e5037307c871b4ecfc5a5e72dd791db87c87af08b983b
- SSDEEP 12288:gNc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:gSnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T17245233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5EC2686F904C82125E395EC713556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.1MB
- SHA256 3ba33b1c0c4fde4af5542ce980a73de49654d192af6a2202189a2b1ae4780e3b
- MD5 8a2d4cbe3a35fef46b7e9bfb260bff23
- SHA1 055056e1aa312b6d02a44190805290ffb77f520c
- SHA512 e5ae92dd0f3a1a2f44f13ac2876334cbb58e93359cb2d237b1ab6c4d92a92e191ec1e799a9c49d708bb57a5459793faca18813e8c89bee07bf04a282b2fd2fb1
- SSDEEP 12288:Ahc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:A+nlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T14845233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5E82686F504C82125E395EC743597D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 92d37e1b7fa5b789a9594cec96a568dde2f7d8dc9c22b2c10fd7948e24dd9617
- MD5 4b880dac90b89adc9d75052723c23c61
- SHA1 c63065384d6b68e5a01119d164a2ab36612705a4
- SHA512 c481ae9d1aac2080ba9e62a8936b7885195f704f6224adc1e67414b10a0fddc96c525e57540e79700d1a1c70858983d8a172d9c8667d87d3226c9a2b241a23b8
- SSDEEP 12288:nyPz5L8Sc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Kzyhnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1D155121B73A131F5D5A6D174C9922A06F776783A0B608DAF13A443731F272E0AD3AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.1MB
- SHA256 fc4052bdcec9601ceea265af4bf1e2514727953d0b0e4b42777ba245f98502e1
- MD5 b6586dcc95708b400bb21215a09a4b98
- SHA1 22c66deab8b9f7fac7b0b017be5fb46b7d0a70d6
- SHA512 eb98e3c9c2ef2d4897f73507ef433a497206518fb3142bf8a52247b6f4b667da501d7fda67f51bac08d7f593e826fb02126f48157b066cb1aca7b4271f52fee9
- SSDEEP 12288:VNc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:VSnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T17545233FE615C782EAC8E4B1CBD9B54E2FBE0A0D5EC2686F904C82125E395EC703556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.1MB
- SHA256 1a4c4d6089ddd7c7acfe14ac6e9090e819719ebd66627986e7b7b6869a30444b
- MD5 3ae8584eda71640b68fb6cd0db062fb6
- SHA1 1a9a7ff04aa00252fc2a20c05fe9a68a03308e9d
- SHA512 863df9fbd0e662d79361274890aa6babdac38cfe3259c29520e09ff079fa7a5bbcdc317b7fc0672f4eca4438ab6792a979334a910ac50d4f839f102a3e0098a9
- SSDEEP 12288:bNc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:bSnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T15645233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5EC2686F904C82125E395EC703556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 23d3f8162a7c13d8b76417736a5e1b220473b64d0ec4133de331fa66162338b5
- MD5 84e91aacc1f6796748457d072c0e792e
- SHA1 b67637b4b4aa669e8b63d2b938d74102caeb18e3
- SHA512 9684e7a760713da3a64f5574565dd969f95ed244f2cfa5c689de938336e5ce2e2f24f3b3e551ef160b402805a6c586e86d905947e71f9e645b68cec4ca685bb2
- SSDEEP 12288:HyPz5L8Sc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:qzyhnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T19355121B73A171F5D5A6D174C9922A06F776783A0B608DAF13A443731F272E4AD3AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.4MB
- SHA256 c9cb0e90b24b659ac8606aa755953c97d68462815aa1fbc07032c51272f1805d
- MD5 c5bd3dac123a1907b35890aeb522bec7
- SHA1 7877d21301094ed45c6ad920a8e14b7a837d58c8
- SHA512 cb794ee534efb332cc7c5913c5bd243a4cffccf26ba955568899cf122c2f126008008bf176ebc3a2d9de6d87c62fae10c04f040eb777eb168b6df38ca8caae14
- SSDEEP 24576:2TIaLl3z0zDXnlr8/3nu+xXHFd9Wj3HghePjYyU:2T/Lljk4LzH6QMPj9U
- TLSH T19A6502A9B35058F4EDA7817ECD559906D6B27C1A0B60C91F03E832675F333A05C3EB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.6MB
- SHA256 cb65be8ec9e08d4173555160e7a4f34d9fceca7b0e81117f2c5e54ae125df8eb
- MD5 8a89e4c481feff1331ec4eef02b8ea59
- SHA1 bd41817da59693693245d47113c87b6fb80b4cef
- SHA512 6e98c65f3a4eb9269eca92fc23e0c03dc6a37ad826f2c3f97de494237ba7f31c91ff1c03677f6fba6782685a0ffd57b99dd3824a20873fa518721c73504ff7d7
- SSDEEP 24576:53Md9CHKy7GZrnlr8/3nu+xXHFd9Wj3HghePjYyU:JMd9CHKya34LzH6QMPj9U
- TLSH T1A175CF90F3E410E4F0B7DA35C9769502DAB67C5A1B61DE8F03A8261A1F336D19D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.1MB
- SHA256 68428931011ddec45fb981053809071a364df466d44d10cd9000a13e7d3b53f1
- MD5 2d79b66f64935c53e6357cc1b533ce38
- SHA1 d758a9129240ad78ea76d5e3eb744690ff81200e
- SHA512 79a38498f4ef8dce12afe3683a9d00f1f9b3ef553dbf595d9777f38bab062209b52f0a5d35033a1b89d4966eb69aed4c63c3ba655a567e24f7b898ee977e3787
- SSDEEP 12288:Jgc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:JHnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T11D45233FE615C782EAC8E4B1CBD9B60E2FBE0A0D5EC2686F504C81125E395EC703596D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.1MB
- SHA256 1a317c9cf04199f86c3a10394fabff7ab99ee2ea4a3e44fb3abe2459d2cfd954
- MD5 b290acff669e9262eb719dfd8442b3ad
- SHA1 d642040947ace9ba9a336770a96922c37285890a
- SHA512 136a31d0baaf0bcffa8e75a54a1f41bf368066caef0afe742502846e91ec9fa97ede47fc459c13fd8cbe8dd4c3ef8db1b5a9539b1e9296fc1cef8fdab863ca3c
- SSDEEP 12288:xyc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:xBnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T13C45233FE611C782EAC8E4F1CBD9B60A2FBE0A0D5E82586F514C81125E395ACB43557E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.1MB
- SHA256 19cf6307f5bc0feb6b4cd005fbfc85e5b35acd8732f4642b1919aeaa8a161e98
- MD5 4295549e0929d565d618dcd444e29760
- SHA1 aa58fd3d9baa9382f2111c2fbfe0fc56a4312cd5
- SHA512 8cd1489dca05943b183ee1561bcf5acb8b7530e95c7a94c9197a8f1b2e4821b6f717efd3f9457f554dc0e503b08616e89e16ef0e1f5be7b5acad5ecc57a1ad49
- SSDEEP 12288:P3c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Pknlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1B145233FE615C782EAC8E4B1CBD9B60E2FBE1A0D5EC2686F504C82125E395EC703556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.1MB
- SHA256 801a7ddcfed727b10d02a9f801de5b0bdec94509630ded921070db2aa967ba6b
- MD5 1b252c5ff1ef02f7827664880157cebc
- SHA1 3b223eb6384063d00cf759668f79a6c1ecf0cb75
- SHA512 3b6df166f88faf3597fffadb5782f262d489bca520c7971289ffb45734436c632e28053e7fcda3d725541d79c0f0b2e2ccf81443580fe335ac1aa20d22a1d0b3
- SSDEEP 12288:KNc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:KSnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T17945233FE615C782EAC8E4B1CBD9B50E2FBE0A0D5EC2686F904C82125E395EC703556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.1MB
- SHA256 bede5719835a349085a313e1567dd1b091fcaa346359f01d990cd0002f0a107f
- MD5 0ac7ce800c59d7f7df1013b13aed04b9
- SHA1 27f000227c59573a5b80ddfddfd25afafacd14f7
- SHA512 febdd14e534b1e2f084353f46bda4f09e7bfe8e9ec69b7e9c4f271e865b3282acde724c219b04e003f853bcae8b730f0e35d2e994bbd75e844ad5750f886632b
- SSDEEP 12288:ngc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:nHnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T10245233FE615C782EAC8E4B1CBD9B64E2FBE090E5EC2686F504C81125E395EC703596D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.1MB
- SHA256 12e3f9176b38f6211ad70f8960a48f18cf7faef91dd546e22784daf96b23eebe
- MD5 4d15d7733a0a38d9f809cac553738f98
- SHA1 a0dbb4b6c31a500a69e424f99ced62a2647cbf91
- SHA512 1ab5caf62234327d39ab4e38abeac1f2209f5c177e70d0ed24bbdca675f3b6d30c5333f73131f0f2fbfaf5023fcbe5b4f545f08730c9278feb89535373ad2101
- SSDEEP 12288:XFc9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:XKnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T12345233FE615C782EAC8E4F1CBD9B50A2FBE0E0D5EC2686F514C82125E395AC703596D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.1MB
- SHA256 b527b16bb57116afbf2bf0261b166b628b13c9dc0589acc63f846fd20edd6c57
- MD5 29690cf312ad03a9bbe200e76bb768c1
- SHA1 3111d399af092e390fb6b2462d5ee8ced158cc95
- SHA512 7a26483cc27a4fea46bdd8a5cd88f7e2b52c6025ac063e79b26f8252c164240e92b876db0b0516a8c1a2deb962be4e2393c55619c76e6f320ef32f95255e775f
- SSDEEP 12288:r7c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:rgnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1C645233FE615C382EAC8E4B1CBD9B64E2FBE090D5EC2686F504C82125E395ECB13556D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 37cdb5e946fe365f34b674eb498da17d6923bd165a424535a1aa6d4c09387d15
- MD5 39394ac28c3779580476ab83aca4c39f
- SHA1 67c63f2435f0bf98132c40dc72f498421dec4635
- SHA512 af766147dbccac2f31457ead1387be289e61083869af3c3e74bf296bca2a7e2eab91dcf8811ae47ebcbd212fbf7650c143f6f4702178e9edb17624daa0367617
- SSDEEP 24576:ofwvmk9RX6wkyAIOnlr8/3nu+xXHFd9Wj3HghePjYyU:OMnYI24LzH6QMPj9U
- TLSH T15575DF29EBD844E1E1B7913C89B7460AF6B1785D1B31C6CF029A536E0E37ED46D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a27b2ce4f64876aead1578a9d8dec25f234e9ff075cbf8c1c63503e5ab99fa8a
- MD5 3cff8e25079ca4b3d085f96c2de7fc8c
- SHA1 b2b7ae7dfa30d1460a0f5119ccee0199f6b206db
- SHA512 1af9abfeac1b82aae39b76c76c92df3ff784267a4c44e457a1c1ac59bb4ba89bca1fae976f28da1c1cac6a5d0ea88135a979c6c6cff20090df452a6fa4705d4d
- SSDEEP 49152:hYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0B4LzH6QMPj9U:fySzP0LPMxU
- TLSH T1D6066C56A16841D5C1B9C1B98F0BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 91c07b40388314acb725d2def4ada44f918fcaa23c04adb944d4df57a706fe3c
- MD5 72b4ceeec9381b53357820047e8a07ec
- SHA1 effb3bff0b4222209c88bde1b80e1f4f4e52ab0a
- SHA512 aa06405b07ec5db4d5fb6ecd265add5ca8adf7454ef4a3903500e7c7d044d4d8ccc15bac245360ffbd68b77ccec4badcbf1300799f45006aa086806e30831e39
- SSDEEP 24576:Z47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYFnlr8/3nu+xXHFd9Wj3HghePjYyU:Z47JUQj4irIhCnDHUPfF/R4LzH6QMPj6
- TLSH T1E065AE1EA3EC02E5E1BA927885155A1AEA71742E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 a0239ea52f26cda2544e839d23a5b748a284d3e515d50ec465eba572a3699a9e
- MD5 a840ee6202b187df6b5842bb72297643
- SHA1 7e85641258398bd5e951266a58af052d2db2b126
- SHA512 2fc74547b146b2eedaddbf55b2deb4a2dfa99e506fc620d57478395ad2712c8422d3e07f5920b7e686e470e7cb7b554dcbc3c5037e48929aec7f1d2f0d6b5e98
- SSDEEP 12288:Xxsf9c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:wCnlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T1EB55F11AD25442D4C0AEA175CB969A05B7773C2987E1D2CF52C0F13E0F3A694ADFAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.3MB
- SHA256 1dba8bf8085785602f866c23f6c031fd27bc4109c078adfb64f20241071ad8fe
- MD5 6615bff36a39849bfcb733e3c7ea223a
- SHA1 7458b60e69af9e6cedcedac9cded96572bd1008d
- SHA512 adfa674cfcecc507d42e8b6d8b07eae2e13fea892a017464725b81e1794de01e97dba04db6b2634cc4205639cbfb8717103c90814db8998f3e16316dbc1856b0
- SSDEEP 24576:lovwY6UPgcMnjE1QGtz1PTdnFzk5t7X4w2XbZ:vY6UoNjSQsBLdFzknX4wqbZ
- TLSH T172552800B62AC78FC6A940321E36D6CCAB707D41EE446F0773C8873E9576659B6E63D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.0MB
- SHA256 d7249e3fcfe22d390d6d29d590f57dae8614e2af59380a85baeb1943fa35b6c7
- MD5 9c804968e95b8e3a0c8053002fd8b06f
- SHA1 c7d7560c40a5b5e9d32b4e0486642fbd80b29c54
- SHA512 7aae8bd754ecb193eaec2d24ef619dec0b52f054667ce6d02968f9e951d4e58bf452f214c5cb959588b6eced98c4c6aae4f53830bb483fc3f6c0d39fd245c3b1
- SSDEEP 12288:FqMILiw3RhjHY14EtQ+QfazD2g76Wv92qypMNYMVMqMh+2+gpqgKNCG3Y2IrCX:Fq1byvypyzD2g39cMWMVMqMIIOX
- TLSH T1C0352941B177E74FC6A650730331DACEBB74AC06BB453F0573888C39D85AA1996E63E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 603B
- SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
- MD5 c4e03b2110e8235d6398eba4c822e6d7
- SHA1 679b959d6b0facd129ac0638cb30447d1f74be83
- SHA512 7a37b1dae67bc4c67c04175903beffeadc45668a301ba22c70f94c0050de9c87f65d5d8a31c80a8109a231fe28f8886da919b6c1555645507e14a693ca20f08b
- TLSH T18EF0D44BD3A16766E427133C859615D17531E9506F43113340509F5C3D27B219E034FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.1MB
- SHA256 d2431d64117af552fa064ad36a8b36b3a706dfc74838cdf2e07ff1d79a27ba49
- MD5 8f81d229b033daf58b503b53f5b336de
- SHA1 e2d77f6c1c8a2bae512023f8507f3e357b88cc92
- SHA512 e2449aa1aa908a00c7b5d8596c07a3a73b7698d68eebc21a2a002199c6648ec534a93754be503142fb825b3601b2e265a062a317ec4b468eea06943815dd5fb4
- SSDEEP 12288:u/71c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:I6nlr8/3nu+xXHFd9Wj3HghePjYyU
- TLSH T12B45233BD754C742F9D8E4B0869DF11A3B7F2A1C4F8198EFA00882525D355E8BD3562E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 6884df656264bef623e81acc0a83e1eee3ce34ce9f92e3d64e3403c62cbb3a37
- MD5 0d0f4d4c97730c6553a651358c5afa45
- SHA1 5a1fbc52300c1abc281e310d560b8f63b410eb2a
- SHA512 ad07f21ae6dd99b2fca37fe003814aea3b1aedfc4a7ac2e973da46d660002c048b3c46126bc671897f8dc0c58e9349c34f4b3783a5b2aeaa9dfb7aa42ff62c1b
- SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYMnlr8/3nu+xXHFd9Wj3HghePjYyU:Vgb4mBIBhGFD4LzH6QMPj9U
- TLSH T117659E1E22E802F5E0F9E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 b321413d0eb09e53ea4ed78ae9760100db395de6160352554b9e03364c04ad54
- MD5 07ca4d6eb8fd16f8ca82ee1f9dc3cf92
- SHA1 41bc5ac78d0356e0f9350d3189781f8ce40b5c2d
- SHA512 a40078de5abdaefa0e1b4672a5a829e6e94650859c02e8f5d4733514955011855044995731960cf2218a15f6114f3b874492c24d627bbd173fa30863c721fd82
- SSDEEP 24576:PG88u8FpJqH1fzria7/m1nlr8/3nu+xXHFd9Wj3HghePjYyU:+7ZFPqVia7/s4LzH6QMPj9U
- TLSH T17C85F16577E102F1D47BD1388A864667F6B2B4150360EFDF06AC8B511F23AE45B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 134da0871439768273a1f3ade79ad35158b91a446ad6db145f894380c433c83c
- MD5 5b367f583508748d00d4bdee4f05a8bd
- SHA1 7507a3aeaf75ec97403bd6686f403f5da2a038e7
- SHA512 8c1bcd81f1bda8ce1da5c01ba01281a7e3059b6ce7744b9c7727f00bc241bbc9d83a5c3df2649edd9436584ff38c36e4d0a3a83f4d8b959a040a320b65fe90f7
- SSDEEP 24576:yPUr+NQpnlr8/3nu+xXHFd9Wj3HghePjYyU:yJQ34LzH6QMPj9U
- TLSH T1C265F12F62A818E5E676E17D8986970DF7727466071291CF02D0817E4F27EE8BC3DB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c13b89fd4a265a6e98bb6e836ac24dacf223abde904e82b4cd9eae83e17cc677
- MD5 b617a69d831a3e450ca43fcf0209ebcf
- SHA1 93d38d0d8cde2531314d7743b204c3e28c3370ca
- SHA512 4ed519ae44308a5986021ed74eb52b9364b744a75ee475bc11698ebddb088d62feb1efd9ce2b9c5a0fc25134304b46c2e0f1b08f33e60860428d931c7b392e0e
- SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjn4LzH6QMPj9U:WG05lO43bXLPMxU
- TLSH T1AED5CF6E62EC11F5D1BBD07CDAC64A0BEBB23415032556CF02A486A91F27FF4A57E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 bb9da8de0141d875a7f5f573c31804c00c9ba2e1ea4bf8f499b1afd194976f31
- MD5 371ae24b5d978fab8c969a0844300cf1
- SHA1 b04e96c9c907d4a49421913c6425a1b47071e625
- SHA512 f722bb4403a897aef888d5d4ed2def8630874f761b2a9ad392570ce8d1dc3ae870644234694b368c31d02b9a8aad4e450ff0d58c49456e4a758fa964896d262c
- SSDEEP 24576:efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnDnlr8/3nu+xXHFd9Wj3HghePjYyU:Ga5POZ39Jt2pasx2+mf4LzH6QMPj9U
- TLSH T18965BF5EA6FC01D5D5B9D17DC583860AF5B1342553329ACF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 0e8fbf122b350e8592e7b25bf5fb686a04542eb2df823ea02a4ee5fc2298e319
- MD5 a2825648ed225e70af553b06aaed5d2b
- SHA1 828b335b8732859a0a7c5031395df899693da38c
- SHA512 69f763914e2e2f503b239bea786c6000ebba4efc01ddc0d4ebdf3966dac265093ae6360c27d38181c023c5c0a0bf79a61079601b7b0ad0740db2a2e420b637a7
- SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fkdnlr8/3nu+xXHFd9Wj3HghePjYyU:GNc/zEOVHFM4LzH6QMPj9U
- TLSH T191858C2623E901E4F5BBE1BE89779546FA717869173086CF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4d1f28972eee6fdbec2cd5ea41ff115cca9a4bcc3f869e57daf1a940f91091a1
- MD5 23909252a97c59666153b108da28881e
- SHA1 88cf1aa20a16ab637cd2120de57ae0bcc23e510b
- SHA512 463f705e1602be9a9ef7044de161d1af36ee0bf20401f7e0de8eacb3b18153c94039cfc54710b268ecc25a2ebec56d2612c1b1183b3f0d2421724495b7b13a76
- SSDEEP 24576:3tkNvNnaFeYhJNtmZBmvnlr8/3nu+xXHFd9Wj3HghePjYyU:3tMwBtOm94LzH6QMPj9U
- TLSH T16755AF6EB6B846E4D1FEC6B5CE238512EA727461073292CF5290C13F0E279D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.5MB
- SHA256 80f1367c362a445795eba3df986852d1530f5f798eafbbac4dc16a2bbffd2ad0
- MD5 5945558e1e7beeb114cfb3e105aa9aaa
- SHA1 739d4ca89ac693031491a3531c2ac520a751c20e
- SHA512 a775a4e0afa3d4385337654fb1cef62e3a439eb5b0b6c30dc3599acdd74e4d7b8a422f2ff5c5307bfbac7e6271f398a7274a4cdf52a7196c8c5ead9fed5d0a8e
- SSDEEP 24576:UD3FHshBIYQgA2nlr8/3nu+xXHFd9Wj3HghePjYyU:UDVHeBIAAu4LzH6QMPj9U
- TLSH T1DC75E13EE65C04E4E57AD1BCCA638A06E77138AD032269DB01D481B65F6BEE47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH