9993aa70b97ad08d55fcbe4ecac36bddc5ac839477a26efec7dcd6b4d92f87e2

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.5MB
Sample260709-chmlpabx2l
SHA256 9993aa70b97ad08d55fcbe4ecac36bddc5ac839477a26efec7dcd6b4d92f87e2
MD5 87ce99d7201f83904052c4ffb56339d1
SHA1 96bd7074eb77449ff76c03ef4a3cd257641edc31
SHA512 793cd212d64d107b09a1b78d81bf40aaf78b8ffd86c576a204e2d1de2742860653598750c56cb0a7bb11274d8c8633c38cb6a4e4ed5077ca8a9706b35a9e41e9
SSDEEP 24576:sG1x2+uCjGcGYCSnnrFb4PM4MYgLxEVyGLs:ssx2RCjdGY9j4MYPVyGLs
TLSH
T17775E02172E180B2E5F72A3059B4E6B55A3EBD319F34D5AF6394166E1E30AC0C931B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3020	elevation_service.exe
3288	elevation_service.exe
2464	maintenanceservice.exe
4968	OSE.EXE
5296	PerceptionSimulationService.exe
1512	perfhost.exe
5456	ReFsDedupSvc.exe
2144	SensorDataService.exe
4264	ssh-agent.exe
3412	AgentService.exe
840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a473635514575bfe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\java.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4be969c470fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000476a325a470fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cda42859470fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7fbdd59470fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026b2559c470fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3415f9c470fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072bd155a470fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3288	elevation_service.exe
3288	elevation_service.exe
3288	elevation_service.exe
3288	elevation_service.exe
3288	elevation_service.exe
3288	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5456	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3412	AgentService.exe
Token: 33	840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	840	SearchIndexer.exe
Token: SeDebugPrivilege	5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5816	2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3020	elevation_service.exe
Token: SeDebugPrivilege	3288	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2924	840	SearchIndexer.exe	99
PID 840 wrote to memory of 2540	840	SearchIndexer.exe	100
PID 840 wrote to memory of 3400	840	SearchIndexer.exe	101
PID 840 wrote to memory of 1340	840	SearchIndexer.exe	102
PID 840 wrote to memory of 2092	840	SearchIndexer.exe	104
PID 840 wrote to memory of 3892	840	SearchIndexer.exe	105
PID 840 wrote to memory of 3280	840	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_87ce99d7201f83904052c4ffb56339d1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2488 2400 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2488 2400 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e96bf32d2e1646ba0cf15f17e33767aa51c1f3d70d996b130082006140b89235
MD5 4cdfe62336c7830ea4fa72310290015e
SHA1 7a4161e91de387fcb3d33e859e8a115ebeadadf6
SHA512 d0d4f48ff2b221a8ac8e0d36f129c829fe2d53e9afb1e18e01f127f8ca9da542eebd445671de21af5b3cbb9cc8c42d45d39debbbab4a13d78467f50faecb66fb
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrj4MYPVyGLn:x3q6HjBHVb
TLSH
T110D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dec40183838fb7396659b20c3887ac6b228634c1a3298b9cb67c6fbb8caf4307
MD5 ddac3c0ff1a2129f9ba04ef537c01187
SHA1 1897b2e0068dfb6d017f9aebacbd97bb78a338c3
SHA512 4938a87ca50c3e36099db94e1b7e2b6e9bb859a5134107cbb45981b84384761b88aa500fa1a83f6d723907fa6968318daa6616a12b6e48be5695ce122f95462f
SSDEEP 12288:61XLsswWkxy2lRq2czAq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn98:QXYfDtczAZSnnrFb4PM4MYgLxEVyGL2
TLSH
T12E65F12977E408FDDD6B8278C9A28545E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1ce9e2f11a1cfc4ce43296befb95a62a040a3346c26e2f964182f73ff70b9ab6
MD5 a447373c01bb1c115447b0454a4b38c7
SHA1 ded5b3537042b35c0553cab3a3357580b46eb6d7
SHA512 a832fbc9032a6c814980edd6947529bbfadb21022d59bfc680becc11d98d197279f5a820ad36d24ae6cf5dac4b4deb30688619245a5c0d1422c5727a3cedc907
SSDEEP 24576:n0Le5ji0hmxirMASnnrFb4PM4MYgLxEVyGLM:nPji0AcQj4MYPVyGLM
TLSH
T1FF859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d36465ebc45ddf59fe55786b5a06ce411447b8dd9003e175021039c7eb7fcd0
MD5 f4196c414b4ba5b8f8bbf34757ea6f4e
SHA1 d3d268afbefb167f306711fd90b3ff0bf712a32d
SHA512 c14a00f0331e423d51ad8ef9dd38a2c65ee192845b8e8594e054c529a7218fe47c8857b3e695462d141c56484dca4c560d2c33d24a89bc68b41353a24416dd99
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuSSnnrFb4PM4MYgLxEVyGLf:T/ezSC6vUzPvxHjyMj4MYPVyGLf
TLSH
T189755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 217153429d3832edbc0ab7c47e904f88a2fcbc0ca3b8d3e94ea81b4a901b4da4
MD5 122a781eb796bb6062925a2b6aa1c336
SHA1 42ce7ee9aefbdb2c63d0eecfe43e3372368d1fa3
SHA512 878391715a347d6c896a4372243096be6e7a15e6aaddf8cf63b6d611c93a212058721a00a1d2478c4f3fa44ea4af0187be88a1d4eb7765657b887d4dd66caa49
SSDEEP 24576:YVbqPb88hv/l+6tSnnrFb4PM4MYgLxEVyGL4:YVO88hXl+Pj4MYPVyGL4
TLSH
T154559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 74cbef98e53cefd21d1c75e9f049f0fe71bf8a61557f85d658ccc29bc9e9bf2f
MD5 d0e0db11fb2d0561a6a0d4b900071818
SHA1 c7282fc1fbd72dbedcb8b7ea465f3d26da286fd5
SHA512 da55f9abbef57b38a818d89a54ce10e2931095daed8be29619c0eafca3ff647c00ac1be1592fd34cca96f4f126aa86239b70b04b3f642375785c56a2830c5d7c
SSDEEP 12288:MR734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:MR0SnnrFb4PM4MYgLxEVyGLv
TLSH
T1CB4523A61BDC10EACFAE15B0D1F96AC8E615BC61F875B20B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e72b5653feef34c8b0a4f720c1f89102de92208f852fdf84845e0eaf4b2a8804
MD5 fc6422b4f734db54da8f8b56c38f929f
SHA1 3d19eab0e806d244329ddaa42c24dfa0f5121e92
SHA512 40a5c7e5c555f26cf2d0ee161b77cac8f32af5a6d6bdd1783b48c05273ad68f6dbf9f94251a1c0f8c16e125937956520ef892bdca768dd5a33b4b3709bed47ec
SSDEEP 12288:deBNUbTVO86Ue34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:dJIUVSnnrFb4PM4MYgLxEVyGLj
TLSH
T1D865DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ebfa0afa68836db060f305f26591b342201d62a0d76b694a40dd590001cf0294
MD5 886cb8fbc8ce6d79da4116c2d1b088bb
SHA1 f17a8b74bc0c05c8677fee63a197adf6fd495287
SHA512 c6215601150fefc91e2d8e9dde8c55e96489172f65588a2dcde3bcc210a68660724988afa14971aa5cee56aaa946828f83055cc62bc43e5956e2de3ef59235ec
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:/QvGAdlCEL8c/yRNw5CmVy
TLSH
T13D267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 91af33f020d50643c5c236a1a18cf5e5d6e63b8476c8707c75cc330ace932fee
MD5 f0447630b4401ff4d4df475bcb7e0c00
SHA1 829bc5c898109fbb09cea39fba229930c889bd12
SHA512 32c95b9e3e86cf9ebe2cefabed73e1ecab62958239b4cf11f1c63bfabc4cd0715827bb945ea964a999ad06984abc71b609cbeca8bb68dbae80c4493914a1540d
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAN:OdewsAjnSnnrFb4PM4MYgLxEVyGLa
TLSH
T1E775E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f04d23e085a68e2d5424c05cb77adef2931e4eb9a64554de9396b0ad7a703f75
MD5 1b667238e218b4262c865094b2929649
SHA1 15c2b0b048375ec4a91506214d01daec968bd9ea
SHA512 b9057067ada410e9872da14102e3c7635863eab1143780c94aa6da2f1c2994f283b73954437534f1068c9b6c2f222fd8fdd3207a49858dc16538f02f8f08be07
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:+UEtQevvqc2W1cpV2EI32
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d2fa65a57df4f8c9f4f3a0b745dfe738508a33bbeeb7a7ef3719a2634236c0e6
MD5 837d6b04fd7ec779a9ec5b4187bf02ee
SHA1 86a99f1158f5d31dc673691ebc2150bef5aaace6
SHA512 be0694aed4258f3586a0cda5ede8e999c12eececed14e51150a7e5afca1c3339449c6276db5fbf364bb1e2cda28e963762f9be43fac7076b872e812619b663d0
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zAj4MYPVyGLk:6oqtVjnmyVY
TLSH
T163D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5f6b10e829acd4902534f611d38137f692493cc620002e7795e9433cb655ac94
MD5 d56359eaf2000af481b88ff6a55cdb26
SHA1 d2226a9a0da1770b4798d1a01c665d5222179476
SHA512 ecf0ef7eb533def129b65ec85942b8483e34cfb771094863d7f3c705edb9e6ad668f2335ddd65d037be3bad60a1a6ee4f36de10890a5a86c67ab8881d08fa7fb
SSDEEP 24576:QAhGLJIFoiwtA5l7S53uSnnrFb4PM4MYgLxEVyGLe:QAMyFoiq55j4MYPVyGLe
TLSH
T12935AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3f52f5316f3f79e679334d4a2ea0454a565f84adfb5ea9bcc43d25a14b455cbe
MD5 1246cef9bba5f9f982521cfe56a9c0b5
SHA1 f33e7e1a7a1782e0404d3a8d9b928d931ca099c1
SHA512 a53fafb76c009ac2e85d6beef1fca7c6c9bdd6947dc51afeedc1b1f798c5df0e07b4985f290cd9f9d7118a76336ddf163a5204a98675d21d7ef42dc2d14fd146
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+C134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq/:cwuoOWjSnnrFb4PM4MYgLxEVyGLl
TLSH
T17465F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b7a11a698be3a691ecd2b86d69f54b883419a9952e74a4ba8a430a8c6da546ae
MD5 4a8e814f4c5578bec8016a77dae75e6e
SHA1 71f95f4ea8dbf0115ef3036013a6519628e8a544
SHA512 a094eab53839ce48623360c118ce51e570301b3ca2e0f1b39bd47d77853fbeb68f4413f91a292d0d3d12c2001e1314a0712f8bc166444e5e59ee3db2bc67eadc
SSDEEP 12288:oBZ1Iys34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:WZuoSnnrFb4PM4MYgLxEVyGLN
TLSH
T1765512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 595da29a60e742b02a5bec63c57fd8e2f94f0d709b6da7d69bc902df66640150
MD5 708370a06a6916d60292f69de9b962eb
SHA1 07fe452add99f47d860fd71061b17e81da6ef169
SHA512 9d79cc6839bb284a3b3e0a7986ede28166f7e70f3f5a6465ccd218fc0968b43e08680a62d54716b7e7701215a11d56270bf32f99dafeef4376560ad0db7a9c6b
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:wQRQyi36YOcPQLvw2gAf+PN3bVt
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b2efce91e55e4550113c7e0f346e91c8ce487a3a6c2c42fb090efa1cfbbbddb7
MD5 3c5b3590da7da5dad32518a9711b5623
SHA1 3cb6f9fe4024087ffbd65555d7f8a846c31339eb
SHA512 3c5fdc7b8464cdb0c9b5044010feba498adcc7b51b8f116191238cddc2b8b3be7778140b1cb496ece042f4123eaaf7bbf2ac88d158b4a900e0924d09a7195797
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:HQRQyi36YOcPQLvw2gAf+PN3bVK
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a834cc3cbbafdfb4532fd3c8d9359baf8f66762869095790bd2c289da57848ea
MD5 b5785b18d0be822768ad2646f3dc5c04
SHA1 629bf9c576b17bf725e1a0a01bfbf84d1e4ca3bc
SHA512 6440000be11a208b961b9a1934236f1372bd86e9af0e142c6356a8a86c8389525e4ceec524d4ce21071e68d76521f7cd0e93e2ddf65ac0275687178307f10c4f
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YSnnrFb4PM4MYgt:i68Qg55nhheWu7PNU3/Qj4MYPVyGLa
TLSH
T116B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8debc2ebe358191b74f810a9adbfa379acb84f463e4b3ebac867400faced3b70
MD5 6b7d7e03bd7cd204a42a8adc52eef1e9
SHA1 d23c2cd7e16bcbefd6534e93788976fd82466f8a
SHA512 f97fd877a7f40bf48dfd823367080bdab5a89e85321e20a64428eadb510af025586c0ea9addc809485abb3a5c45642724419ac6f7368ea448fae6a41864e2346
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:ey5112gYy5azzVvL69nLKnhZUVr
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7ebfc36bdaf3afa82f60353359cc5212210315bfa9bbb63b5f28e5aef4f9bfd4
MD5 b234e4e5e97752efb56c3b608d5da5e3
SHA1 4c19aec0f353178a591674b93048ce2ad6e19c4f
SHA512 b1325906e10998c2528286431aa08988b36473feb28d8438a8dd3996e2ffd8a21bc28a3f1c815ba547dda92a041574121501cb7952cf95c509fb478b81302424
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCj4MYPVyGLL:Ru6JmVxd2dzVf
TLSH
T104D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9b6578114f744d419e840c21eb1a588fd8ff1cfeab38d45911c8392ebca8426d
MD5 94ba31af5af1e33b5468f132a882e439
SHA1 64c609e5a085af25543255ff8aaae11d8a36f733
SHA512 d3f4f7349c3b34300f13bcc42944e7388afa7de3847bf079ac3d7a6d913d69548a326134675f14d29759bf623c32e3f5587e54a245a993e3f56fe0a47bb7c774
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xOj4MYPVyGLA:QmifPbRyVE
TLSH
T129B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 188db731e25f99971971f0805a990c385e22c35e42067f70aacdc6eeccd4d00f
MD5 230fa836ac559e95cbe731cbe098963d
SHA1 d2f01b11dd948e284b544ec8ee436e76a802b809
SHA512 e8ba38d897be42d581326224af40cb1bfa173994f81a6fab5f84c553e16a0887bf7a29a31563674f757a3a048f301744909a0b9503d1495cc87bdd59cf54230e
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHq7j4MYPVyGLV:T5dKTi61YVp
TLSH
T126C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 41b03c328ac0b96e3adf638902ff646cd0d0c1c639814da5cc1287601f057aff
MD5 02345e16c440dd7ac64c1fd4f36033d8
SHA1 2d9fe23de787bf26bf4ae2172b3c2b7d521fc0e4
SHA512 4ea7ee71fd175a3225b5a9bb4f8d9a2039cf0672f19306f04bc604113d32f2fc10fbd74a7d24c58bbc280d4ca702aad5d516cab14340b40a13bae0f7cb703a42
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wSj4MYPVyGLG:1X2iyphOVS
TLSH
T11595BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b0de83a4ce1aca7ff59ce562746a471375d1eacd548b9c06582c7a4d212a5cce
MD5 bc3e1f4c0eddf1f62334bcd95d212290
SHA1 782a581deeb14cefc57be28c5c31c8abd81862bb
SHA512 1e9c26b781e12dfe01477033b51cad3be56adf0548f6979346353957033c08c216e35ccd472357f7b4c099d84ce06817cd6090b9495b560b448e5808d8e178a6
SSDEEP 12288:mD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:mcSnnrFb4PM4MYgLxEVyGLn
TLSH
T1AE4523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 83cdbf209b644f0f6eaa1d5994c8d016176dd539da20b7a182050371a74d2adc
MD5 abc56db8e44a0845c06a1e3b889055e2
SHA1 fe8f0a589e52cebbe1551dec80a0203707667847
SHA512 03064deaadadf75f4d9cea5bcfa864a7057210dcdf08f39b3d5afe1d0ad8aaf9a00d289488ab8ba676b3dd20c8b426c239a5ba6b10fae19ee22d1d1508a05a33
SSDEEP 12288:Uo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:U7SnnrFb4PM4MYgLxEVyGLh
TLSH
T1634523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B4474073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bc2b690b936c786e180af5710dd27b492eef99eb6361c4880552e0868e651dbf
MD5 256b8db084fcf911557fcfc6a7d20c3b
SHA1 8dd60b38e8aa43a1813c9759823a1d2b8e94dab4
SHA512 d9c4016434494aced52b7738c85d83924c08fa13a70871e9eedce16b9770813af8a3ced5258f87c81a57fd499d94c650de7e88a25b656410de62c9b824c7a60c
SSDEEP 12288:Vm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:VdSnnrFb4PM4MYgLxEVyGL7
TLSH
T17E4523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9eca69d8350ee15626f583511b0f2a068ca1cb1ff794b0a7a429ce84beb3902a
MD5 944066593952e3c5ecc7bc974211c77b
SHA1 8700ca7318373a53ce74cd501ee84b4914f3805a
SHA512 1c749eeea39cf557741da0744183f8ab71f83fe179f1fceb5d7f41817a057c57b1da1ce7373e69f3c80d61b7a2db2ec1197f27bfddbabca432cb813afdef0c82
SSDEEP 12288:9VJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:WSnnrFb4PM4MYgLxEVyGL/
TLSH
T1354523662BDD10EACE6996B0C1B556C8E2257C62FA72B35F6740381B3F373485C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2ea7138dd48d2102aaccd4168d4ec0db6a90255d3ea145f8f296822daff8da9d
MD5 3328bc8bb8b47c03d73feae19979ac16
SHA1 3618d4c837fa4542ee0cb17b29876f8e32259b35
SHA512 251535a04fb65b37cbe5efb5b2888ec9eac6d92e2797165c8ccc2d1009a98d48c45c2509ea84bc5d28f81916be3f36bbca5e5a021d31c0c3ac94f4b446bbbd3f
SSDEEP 12288:1h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:1mSnnrFb4PM4MYgLxEVyGLf
TLSH
T1DF4523A62EDD10EFCF5D06F0C1A666C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0da75165a0caa9366039d56e916b33c25039eb95f4bcd3176ed99e96614da333
MD5 d3398d4ccc23631497ee37ae714852ee
SHA1 8b477a03f8a226060cce81b7b8149d635d8ecc13
SHA512 2e78915a3c49f6c4aca08728b7c7e42b63b2387cb5cea61ad77939e22ecafe33fb825c082fae9ea61858385045993edb0b834f519baacffe217629e3b65763d3
SSDEEP 12288:rE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:rPSnnrFb4PM4MYgLxEVyGLW
TLSH
T1044523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 96b459d52c1db7641fc98f67cc2b0cb245cf20a4b964fc944cc4e8dc739b97bb
MD5 c47e98bb92391ce6342fd481af6509d4
SHA1 63481e48715beb66eea6aa89cc2077e28043d604
SHA512 d0097ccd1f85cefa4a2c9d1bc2b8280ddd1f3f3eba5c12b3703b61eb97d2adbf80612d3e6eb51c7ca5e2bd7ca786ad5505c88c1eab95c19b730c64415a516705
SSDEEP 12288:cA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:cTSnnrFb4PM4MYgLxEVyGL8
TLSH
T19A4523A62EDD10EECF5D06F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 438c9a40fdd3688ef13ae23536dee07f98cb05835d22c67972cbcf4a2203ac4e
MD5 e3a24d7647988d847af2f91c6a8ae1c3
SHA1 563c5adc5dbbb0ec0ebc87d0f304618a2cbf6b62
SHA512 90028cade923fed2253617bde79d8fda8150a6e6f27814f4fe923ac3c34ecdc69bd43da3b991562b5f1919ae551ae47bea73220349fd9d7b0f9b64118c47e8dc
SSDEEP 12288:tiZwb6zzFEoS2cPvyI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2h:wZMSzFVSObSnnrFb4PM4MYgLxEVyGLc
TLSH
T1656502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b840e7be77a0a0f535d818b008f72e55e0920c47aeedabbbbd10767de40cceaa
MD5 967f17dd36670e20b84d465d487e6411
SHA1 09e6433aaa112641fdb1c3e202864c368d1b6543
SHA512 899dc8a5dbd3acd99bcdd327a1de184b8ebaa6b2a1d3a76b037b1a4038a127ba490710e59d5bee11c6019107017041c5ec6d2a282c2765a8b7307259fcc50a4e
SSDEEP 12288:1334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:14SnnrFb4PM4MYgLxEVyGLB
TLSH
T1264523A62EDD10EECF5D06F0C1A666C8E6097C63F976B20F7B4574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 54e21f6750e1683ed1d3ddfab0d999d11c6b205bd2786ae0c78a214ecc867978
MD5 12a60e2fd711d52377693045ac3ecefb
SHA1 184c3b20d231d1c9805f45b80edda2ab43d12473
SHA512 1955f8eaab96897dbd4a07f96f0a071d0e1bce4799825ecc610f553c525ff9f28ccc19593ce129b91a5ec93ea0e57321b1e784081d6506262d6ac3fcb4db507f
SSDEEP 12288:UL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:UESnnrFb4PM4MYgLxEVyGLf
TLSH
T1E04523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d13918a434b4c34b867ffb5acc5e90f710901b36ffc2e59f991726e3300665ae
MD5 b1c05d5d52188b7677c126895305ec76
SHA1 4110e0050cf63e356cd94ac3c128d33fb022cc98
SHA512 ca1ef7fd7f7df764ab4a8059698b741267ba8ca7d0943fd07301298da294b3b8ad456216418fa83908d0e615ffed77ad64ef575af40cfbda0d08c92f3388b033
SSDEEP 12288:5yPz5L8s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:4zy3SnnrFb4PM4MYgLxEVyGL2
TLSH
T1E455025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ff3b575c617936107e02c0214e40d238e93168fa54d20eecfa54d6131aeae7b
MD5 a02bde4d1539d9f16339ef7b9e92905c
SHA1 beba00dedd888f396a8d2f2ea83ba785bdc12b86
SHA512 30a258d073b34d2acffa3b857802585bfb0d87b756cbd925f3cec6e0a48b542263e1e5b3341f3cef46b3e68397ae3e6c03b35ea5c1c5651a1edb061b6f73ba00
SSDEEP 12288:L334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:L4SnnrFb4PM4MYgLxEVyGLC
TLSH
T1C04523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 614eeab5d026209d25fb05bfeb8d8ce4c14ec94582d9ca41311c16eaf51241e2
MD5 2b2f0bf572b50db1577d9c0874817b20
SHA1 666b1a4833cdb5a5cb1b3ae6549ea9b042170295
SHA512 f17df96bdffb806c1d1446113ada41ed8035700bcb35570305c9d896bc3c79cd6c36d90c7669600de1af6c8ab989b939c1e349d98893e4c1d89810a0576bf854
SSDEEP 12288:X334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:X4SnnrFb4PM4MYgLxEVyGLw
TLSH
T1164523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4cfe4aaee024598353f18f48760c9d0258c61c4e3d87640f8fa56bf9429767cb
MD5 cbcd22e1ca03b473bafdcec0a6b8f298
SHA1 3b5928e9a74a22c756cb0b7425c743cae32d4abb
SHA512 4a3092666f9b3aedb9b7abe019acba5eba98e083331fecc69337c2abbc6bb57c5c9e088ef1b48c388e767eb1106ad93b8d0e921ee9736311aac5c8575137903b
SSDEEP 12288:IyPz5L8s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:Jzy3SnnrFb4PM4MYgLxEVyGLu
TLSH
T16055025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 96e83a7041278da75572954b145121ad72540932b800002990c54cd717226514
MD5 7f6d4472d9a4d1e3c7ee6c251652766b
SHA1 aa405c9e7a1058904ffbea11fa0bddb6028b57f3
SHA512 6d611c25ad833a8525cb07c0cc60a76af948a3c3a05d7497c55f960a4f31b06f9b2d36fae87c61061384d05cbe31684c3adc46c35f4cd4347ab7626bbfee2102
SSDEEP 24576:lTHaLl3z0zDNSnnrFb4PM4MYgLxEVyGL1:lT6LljNj4MYPVyGL1
TLSH
T11D6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 64651ac8f01c6bc149db666cf0938dab32d126b8c33e59db8cc9a2295fc4589c
MD5 e5299ae3155914005fdaa4efdceb1598
SHA1 81e0435b6094e484f891f04103c17ef7eea6e478
SHA512 c035181c9fec10e524e193c10e1244e24c240275c2d526cf17cbfa63b252f7d17aee3a27667a94c0b2fa21c4310552f09f8552ce91aaa1c41cac4c4cde8796d6
SSDEEP 24576:l37d9CHKy7GZBSnnrFb4PM4MYgLxEVyGLa:F7d9CHKya4j4MYPVyGLa
TLSH
T1D975DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 195084327fac25a65f09f5b329b2007e0e090b402c4d0742498b7c3e11a20ed6
MD5 ff59b1f8951fef13d1a61ec03decdccd
SHA1 5a78a2b9c15a31df68514ce5bd902a7417253438
SHA512 c9df2a41d99b5947691acd231b69b4a0db9008de24587be2b847b941ff0051eae0a3ab5a8234f3a234c7c2c8825746d2fbe4931ecf05d532ad700a13ab3fa3de
SSDEEP 12288:BG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:B9SnnrFb4PM4MYgLxEVyGLb
TLSH
T1294523A62EDD10EECF5D16F0C1A666C8E2097C63F976B20F7B4574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2d9dff620455695732f2d6df46c00af7c41c7d810a77f8ed8b8708f2749da35e
MD5 67d45c45b08a90bebfb0173bf8b7781f
SHA1 32d4c13eb13f625e64e7159f940bf3fd95c32b1e
SHA512 ec5a57946e05f5417c94c1ce2c4bffb89b765321710198ce907fcb0d23557d4559c3d8aaddff871a97062017c89df72ac14152c1b6a4a0bc16708ea40d5fa119
SSDEEP 12288:RM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:RXSnnrFb4PM4MYgLxEVyGL1
TLSH
T14C4523A62EDC10EFCF5D16F0C1AA56C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a852278f414770b339ee214ab7606db21b385f66febed450f06e225776cf23e2
MD5 9bbd9c516d48a04184169eb246bd78a6
SHA1 3004503951e68b3494e17a2fc5b9e633b72e3687
SHA512 70a284d5dc001dbb334ad55f831d1cb3b686603828aa5c3fcef39e93775c756b6292bfee486bebaec7d76d8a7801995f09692a1f1bef172858eb3973c5b9dcde
SSDEEP 12288:Kt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:KqSnnrFb4PM4MYgLxEVyGLn
TLSH
T13B4523A62EDD10EECF5D06F0C1A966C8E2097C63F9B6B20F7B4574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9a616f306d54bdc55c8dfb91ccd98e00621a57d0bd90f7086abd2ac81637d341
MD5 fbbb7c9282ff5a981041bfc296b538d8
SHA1 aa065b2007c98a644313c5694032c12c6f627c16
SHA512 b837ddefa0e9195d09bd5fe73fc869cad5edb5601f6ebba0e35dd4852c415b7e33cf34cd495e0cf050339628c9b643e7719919e77f43f5f4474afea10a017355
SSDEEP 12288:F334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:F4SnnrFb4PM4MYgLxEVyGLp
TLSH
T1BA4523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e07b17e255ab1aaacff3eb251ddff6e2dfb541e35f03c07c986d4270d78f56da
MD5 6cbb2d4ded77175e853afa7ba1c0c236
SHA1 7679381e9eb404db9b939c3b4db575a328b44903
SHA512 5a767407aef6271485040026e4cba72e2b378f850bb643265d7be7fe491280988c5490091b0ef251bc07a674731de892f6340ecb3a422443387b0b71675809f7
SSDEEP 12288:vG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:v9SnnrFb4PM4MYgLxEVyGLY
TLSH
T1A04523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 db8a20e12fe7e0a4d616f95af03f7fbe0f25804a8537cebf33a2ca98f96205fb
MD5 d8c7c9dad95a511b5b1b68f9f0289d2b
SHA1 c44e88c38e73a00912e682c441939a9e9aa4aead
SHA512 0cd7599b0e93e82dbf6cb6cbaeefea810e66bd87df854314128f1ff0cd7f2b17ecfa9dc1f710f461eae6d961566015eb9b5143607e136eb4177cf273f121179d
SSDEEP 12288:kv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:kwSnnrFb4PM4MYgLxEVyGLd
TLSH
T19E4523A62EDD10EECF5D16F0C1A556C8E6097C63F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9f7ab3e81ae5fab7bc131c4a78a045be65a6a1fe38e2fffbd68e8235e025e467
MD5 8bd8c545225d45cf88859dfc15ffe288
SHA1 95874987f694de2269a7367f1b6599469676fb18
SHA512 e1ebc164233cc0345364b4c82b281b3c367d75e22a87d678a05a8b40e1157ac6197df3d0d1c413b819b4eaf918017be74b170f72c3e5b5a83644558eaceef2f7
SSDEEP 12288:Sh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:SmSnnrFb4PM4MYgLxEVyGLT
TLSH
T1644523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5ba5be6d2b019b3bcdb26183ad8d09c6a2e1cf3f3f4fd7b3636245514fbc0130
MD5 a0b86f0ad1dddb8f3a57801bb80b8b06
SHA1 5d6881bac46e79bd1cd24d77feaba918930d9d95
SHA512 e796b2bf793d1d45764ccbab402c90b53c9c3411d0fedde5fd6d6f84f04ca71ca837e2babf5fdfd60689ac7646333f475d901aa187f8fb36e7a9ec131deec3d8
SSDEEP 24576:Lfwvok9RX6wkyAIUSnnrFb4PM4MYgLxEVyGL4:tMnYIHj4MYPVyGL4
TLSH
T11985D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3e55d016c9e4394c923efa817e2589fcc2d6ff74ae00047f8cb092ec84c7a7aa
MD5 c55f7ad65efead802bb51df09827e39e
SHA1 9b3c89a37ff0e786a6a7c0d7f2bc328c080e1353
SHA512 f58ca316f7ab42c88db7cb2559c75a7c653bb9d2f57b7b0407ad990b2b69b6fdd7502e4b86f63a9f1e9ea05704b7ca03ed9e15d69ea99973cf9e0376cd7493a7
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yj4MYPVyGLj:cySzP7V3
TLSH
T180066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dab960a0ca1d6312d539cd0af91bffd64d479e5ff2e79c5385f69cdf4203a8de
MD5 06036685f5190746c53e7f8d459bc90e
SHA1 bbff048b2f19a626ec9e3ad55d974697597d7566
SHA512 0f0a52fdf9b6a816c6bfb5e43b2d1dc38e5953a2fed29c61a2bdbe6476bd01d40e6814fc1660cd553ac8cc5abb5e12447442007d0675c6559bfb5110ac1c1a1b
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYrSnnrFb4PM4MYgLxEVyGL8:v47JUQj1irIhCnDHUPfF/Cj4MYPVyGL8
TLSH
T17665BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4b31e31a015b17b493f2bc6373fb25b5f90f8d7db56d1acc9b2761777d066eba
MD5 59c591b6128a11ab088bece1e3b1f7bb
SHA1 d57d99c34ad617879873802b923d48ff07ed717d
SHA512 7f9c489b6382f04c2fad0a49070ab846fc84807a4e55949bd9f0c979e63602fe7102847d7a326d6ef9724c8d0cf477c33ebbc49fbce4844d0ca3d4dbf9776fdd
SSDEEP 12288:fNsfn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:8oSnnrFb4PM4MYgLxEVyGL/
TLSH
T1C155F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 ef79676be2e3558485e4623e2d7c9021b1f703eede534292b948cc547a7b1892
MD5 3cee916e216981af4b693066cbb00772
SHA1 ef46b0423cf15a810f04422ecc0eb6ede108b9d6
SHA512 a0281243a349af9063cf42a0b8f1d9efcef3a769c374b8e3d6c5c17f4ed8810a1e06a4b1f22359738ce0227fbf974a771a1b0f38a727cbc5d2a80f127ded4227
SSDEEP 12288:BI8MU3fHI2/VwvWeVwn5u0ec9c9mAfOvyrFy:BIRUPR/VwvWeVwn5u8+9maiW
TLSH
T1572516107626C75FC6AD40321E73D1CCAB707D41EE05AB0372CD8B3FD576A58BAA6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 36652041088d8a34cc087b59c218e4e6346ec831332068c2231851bb90c3f4b7
MD5 dc89ecf724bbfb6bbeea16de67b10097
SHA1 99a18d78ea5dc2df51db048223db9e9492ee2030
SHA512 70602421f128f0e0534d16523d4b7e21a7f91e9a2415ee74c4c4086a360644367e401837490a27d2176700da7ba607ba35ea7e2c4e44d810029348b5de8e01c4
SSDEEP 6144:jmVwn5u3zN+/4h1AjnVwVw+RHUAiAuREcJu0o9UehuSQtMxVVSQtMx3nxbWCYPCl:aVwn5u3z07VwCREcw0oqeFPCf9K5uqsl
TLSH
T12065E7405537A3CFD5BA60B2033A5B4D6B74AC46B749AF26738C443ED82AB15A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 50d22a7d45efde6fb0237074ab01193d24414a00f24b843ac6f5bcf8d37b23e5
MD5 7b50f393102152ad425b457e984e34df
SHA1 ab99fb6cc8ce8e23f9ba3c2e66553dca3695eb43
SHA512 4c3e6ac06f7cd38b1d65560f45eb74d9cb439d270b9d21d0d86d56aae26698498ab56a72e3a4313b4899ac152f3ed59f7f5a1542d80e314a1ee9dee168af40d2
SSDEEP 12288:iM7f34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:fgSnnrFb4PM4MYgLxEVyGLo
TLSH
T1404523722BDC14DEDE7D16B081AA5698B209BC21FF61F18BB740744A363B6C89CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 041d90acd9fdc650e35af8d4c01af17192b223599718fb002c7e6acb3f7750a0
MD5 1894248c593fe19caef1c8e5ead9f088
SHA1 8bf94e4b3a4283374c01fde3b2656b1cf8e3cfd1
SHA512 ee2ae1747ef066cad1c5909c208bad30fefb9084219a5ff1c61371bb476456cd89f8774754d642b48a6adee8db4e5b4cd0c0c0b11e643b4ee9f556c48d9cdaeb
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYSSnnrFb4PM4MYgLxEVyGL/:5gb4mBIBhGF0j4MYPVyGL/
TLSH
T11965AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bcdf75e905f6236fc3d3319fe34cc7cff49ffacc7040679bb9a4e2fd35241689
MD5 72f008ca893b39f735f54b017082919d
SHA1 24ef3148f31a29648033b890fca99c7910fb37a8
SHA512 04c5978a1f7bac38f0b41cd586b250941276d7c0ffdbade7b34090e1c1b779802128902fc7185350fb109e1a2a9eb050d59874391ba76e93f307beb5d24da3c7
SSDEEP 24576:+G88u8FpJqH1bzria7/mbSnnrFb4PM4MYgLxEVyGLr:V7ZFPqVea7/Fj4MYPVyGLr
TLSH
T1C885016577E401F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 00f78f9f2d2c2079c2fc2f641d07d43deffe3c526f528f6573ecf3eccdef40cf
MD5 ffba833622e29abf574ded6fd872a70e
SHA1 20d356abe30a1c03f66cabff743909cb07b63fb9
SHA512 bd46300d08c6fc5d56a27aea4e971e1ebbdb0b6ce4230a746e7c46e22ea97e22c0b501ceffa9c61993d37fd1cc6956ba3ba11b03ddfe732c343ee95492a650be
SSDEEP 12288:SHvUrBFrEjwaQU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:SPUr+NQfSnnrFb4PM4MYgLxEVyGLn
TLSH
T13365E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f7088b503fba0875ab439830ba3dde4ea404b2a420b66a4a53cd8cc1f2059aed
MD5 8c3d2a75d97330260f68055cfaf931f1
SHA1 ee575f347b54dd87496cd206b704806420441758
SHA512 19cd6dcc85acf8c50c250bdf9d83c8555083ceab5948c02415f34090c86b645fa170b7ce257e31ae1375a9a3574d4f3704d48a8414bd840ee289103489fa01a4
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoj4MYPVyGLj:7G05lO43b8Vv
TLSH
T199D5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 88ad128207dca2040e97f08ceccca4b369caf6f11f01fdca8ba7443180f0eebc
MD5 544cdc8802f75ad20ac4d198d9fe24b0
SHA1 1c5b7d875bac79fbd3815655d4625bdc836aa64e
SHA512 3ec000a11b30fa50fa9349fdaf0d660779ef6fc8d530ea41b826b1c408d9f9158585ec2813d59bfb92624875080cee6115d2e358da33faab6dfc6ecf2030669d
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn5SnnrFb4PM4MYgLxEVyGL/:8a5POZ3+Jt2pasx2+mQj4MYPVyGL/
TLSH
T11A65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e8d1683add6c46eb5aa93aeb64a275b85035dbbd5d1d0c706562efa1e6d3460
MD5 f9b911163466b1e0ba8271766ab0df35
SHA1 a0f463b585c081dd233d582ba2b92b72260c7925
SHA512 3eab3cc62885054f5ae8da54c80a8edf7bf26394c223c2138c84ae825a42524ddfdc37877e96e68717ae8f5075c80c593ee59e191da7536e60af3290838fff28
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkDSnnrFb4PM4MYgLxEVyGL9:TNc/zEOVHFlj4MYPVyGL9
TLSH
T12F858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 db40250b88fc936619628cb5c164b1d0be07caab482ea400fc78eb174ccd4a0e
MD5 e7935313f58ba4ea7b4b3c381d524213
SHA1 e8bc0ea30d5d6394d7b8eacbfc2025b8c5c00569
SHA512 bb9c045463fad88c1dc11e45301a5c928be7d947c35256f42ffdb560241b578adf0eb33519d2b919b393d4cee8a1d933b68d9569b2ad9fb1b7b79c1f14e99da7
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmlSnnrFb4PM4MYgLxEVyGLu:P8MwBtOm+j4MYPVyGLu
TLSH
T138559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6a3b6359049c98ae5d3a57b71193573596f1cf089e05c9ef196a9c3b8767b687
MD5 d85f960de556bc54960441f75b8c9937
SHA1 353dde32445b79c5dd8f792e14e527bcec612913
SHA512 f74d1778aa4c448b5cc0d138e682b9780393db048364a2debc87fc7a61189b8f24cb9617d06a6c36ce5629906d5d83b0bf2cacab3b91f474ba9679697eab048e
SSDEEP 24576:gD3FHshBIYQgA8SnnrFb4PM4MYgLxEVyGLf:gDVHeBIAAvj4MYPVyGLf
TLSH
T10C75E17EE69C04E4D57AD1BCC6638A06E77138A9033266CB12D491BA1F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/840-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/840-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/840-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1512-78-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1512-295-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1512-83-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1512-85-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2144-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-314-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2144-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2144-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2464-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2464-49-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2464-47-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2464-39-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2464-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3020-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3020-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3020-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3020-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3020-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3288-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3288-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3288-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3412-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3412-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3412-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3412-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3412-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4264-122-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4264-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4264-116-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4264-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4968-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4968-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4968-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4968-257-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5296-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5296-67-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5296-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5296-280-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5456-327-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5456-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5456-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5456-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5456-95-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5456-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5816-77-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/5816-0-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/5816-333-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/5816-8-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5816-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5816-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download