119f36fa53d392c0127857227e8d20f3d3481a75686548f62a861272799e675a

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.5MB
Sample260712-vspsxad19m
SHA256 119f36fa53d392c0127857227e8d20f3d3481a75686548f62a861272799e675a
MD5 4a4acfb871e0278fc430c8826ea25bf6
SHA1 cd1c3883d606db144603209ef4fb35ea8298d211
SHA512 849af3d5c8f269204480a7008af6cf6c01e25e8f3dc3875a2d076ea5c0573d95e494b8e7626d2b921721f080f40af2aa4f05dea2c9db3ca4183901eb13322c17
SSDEEP 24576:IJX09FuDu9wpeGeDYQ3x10n+1W0VgpynJg9zT8j/:Iu9FR2peGeD/gn+1W0Vgpac8
TLSH
T1BC750202BAA58032D92624729D66D7765E3EBDB05F2154C7A3C43DAFEF30AC0973471A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001b89b-52.dat	UPX
behavioral2/memory/4384-63-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral2/memory/4384-220-0x0000000000400000-0x0000000000446000-memory.dmp	UPX

Executes dropped EXE 13 IoCs

pid	Process
5696	elevation_service.exe
4848	elevation_service.exe
2316	maintenanceservice.exe
1752	OSE.EXE
4384	fx94F41E46ABE04D953B643C8BC51475F3.exe
2116	setup-stub.exe
5384	PerceptionSimulationService.exe
796	perfhost.exe
436	ReFsDedupSvc.exe
5812	SensorDataService.exe
4520	ssh-agent.exe
1964	AgentService.exe
3912	SearchIndexer.exe

Loads dropped DLL 7 IoCs

pid	Process
2116	setup-stub.exe
2116	setup-stub.exe
2116	setup-stub.exe
2116	setup-stub.exe
2116	setup-stub.exe
2116	setup-stub.exe
2116	setup-stub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\64d05db5e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001b89b-52.dat	upx
behavioral2/memory/4384-63-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4384-220-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsbF8C7.tmp\	setup-stub.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fx94F41E46ABE04D953B643C8BC51475F3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c986f152212dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000349544152212dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cb1d3152212dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e614532212dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005370e0152212dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	436	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1964	AgentService.exe
Token: 33	3912	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3912	SearchIndexer.exe
Token: SeDebugPrivilege	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5696	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2116	setup-stub.exe
2116	setup-stub.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 4384	5128	2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe	91
PID 4384 wrote to memory of 2116	4384	fx94F41E46ABE04D953B643C8BC51475F3.exe	92
PID 3912 wrote to memory of 752	3912	SearchIndexer.exe	100
PID 3912 wrote to memory of 3812	3912	SearchIndexer.exe	101
PID 3912 wrote to memory of 2852	3912	SearchIndexer.exe	102
PID 3912 wrote to memory of 4488	3912	SearchIndexer.exe	103
PID 3912 wrote to memory of 2480	3912	SearchIndexer.exe	105
PID 3912 wrote to memory of 5184	3912	SearchIndexer.exe	106
PID 3912 wrote to memory of 4264	3912	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_4a4acfb871e0278fc430c8826ea25bf6_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Users\Admin\AppData\Local\Temp\fx94F41E46ABE04D953B643C8BC51475F3.exe
  "C:\Users\Admin\AppData\Local\Temp\fx94F41E46ABE04D953B643C8BC51475F3.exe" /Prompt /LaunchedBy:desktoplauncher
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\7zS0216ACC8\setup-stub.exe
    .\setup-stub.exe /Prompt /LaunchedBy:desktoplauncher
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4848

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2316

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2840 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2840 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 250b0b427c7944b6eea35f4662239ec274f92ec1568f511e1a7898f041610fa7
MD5 5394e4d29655e714151a2194c1109da9
SHA1 5b3457be26248944684546a331f7155f71226e5b
SHA512 097a60084dafbfcb1904a906060a218fadaeed9a41ee0c07db258cacce991270ddd83436e85af19978f413307d7b98df6934275c0fbdbf4c26547a4542fd16f1
SSDEEP 49152:Yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+D/gn+1W0Vgpac8:y3q6mjBDy8Y8
TLSH
T17DD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 33e8cd0f7249cd1f96af54ae2b375ecabee938da732a07c976cd3235de5fa30c
MD5 ac4247cd144c8aa560a5397ecb53daf1
SHA1 956e22d1b5a22e9d06d1e263c40f8f6e09481131
SHA512 5e61eb50935839cbab7f3829c8f69aaa21130d26afddf4dd69045e03c3f0cd9c46b27d279ed5a7f2be4a665fae772dd7aebaa4749882e5a6af15130bc2c09ef6
SSDEEP 24576:tXYfDtczAbDYQ3x10n+1W0VgpynJg9zT8j/:4tcQD/gn+1W0Vgpac8
TLSH
T15A650229A3E408F9ED67827DCD628116EB33B8554760E7CB03A495261F337C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cfd4cb31b815a330d3edfcc88a6c2db6d980fa7af253146378e6e81c760cf346
MD5 b3e8da42837cbc6ae5ad77f68bd52141
SHA1 9a9e39126b8e165e6ce0337d58ea5df0cf0bf378
SHA512 c5cd16859153c1ccb11ebcd027fcadee21a3712ed15525f1f9c5ebaabf0336e1289bcbf8a14a9159e3383c6a820eb6c47115effed2d7648fd95239f0ba33f44f
SSDEEP 24576:A0Le5ji0hmxhrMGDYQ3x10n+1W0VgpynJg9zT8j/:APji0AzRD/gn+1W0Vgpac8
TLSH
T116859E16F6744335D073C0B9C5D2A69EE97230865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a5735e8790012a981c415b81cd937ded9df9698fa037ab0a4608b645052d4af0
MD5 af7b28b18effd2c37edd9a0d61cc7db4
SHA1 988de6c95afe3be0352c8b5cc9d841dd0a9a15d6
SHA512 8d6eeebb55aba2ab7d8212982a4f9d658c97faa6e01f1d11cbced0b4a7ed21e7faa0b5d0d37575ac80f81548843dfb52b527f2774353c34128b1c39555642660
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyugDYQ3x10n+1W0VgpynJg9zT8j/:I/ezSC6vUzPv+HjylD/gn+1W0Vgpac8
TLSH
T1E0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 12a14edc2b5a98be3980ffce9b01c094e81064b477bf629e4bb466b54435d200
MD5 a29deccec0164ce5d35fd9129017cd17
SHA1 324faf537197726108770ea6cb84c7abb437b7f4
SHA512 f85beb2fa90e713c9d4c8ce1853ad897f845f388042f04350a9d19f2d800bccccca5b4b8dc97a47c8b274e08bc86898af22a4936c917ca1b6c39e311a4ad0c91
SSDEEP 24576:tVbqPb88hv/l+B3DYQ3x10n+1W0VgpynJg9zT8j/:tVO88hXl+xD/gn+1W0Vgpac8
TLSH
T107559E66F6748331D073C0BAC5D3AA9AEE3230415B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0db5d00782b25c90dbb0becf4de71aa5f496088d4e128aac5e45b2034127aec1
MD5 2de1daf5cf5b3e3219fd7b9ab02eb41f
SHA1 0ed66518b6d69d882f4f6c2012e84e379d266e29
SHA512 40f9539c816c2b22c7c355afa2baec4483689f4626be36a83cc675dad129d690e9bff7f00931214b828bf1738692d8c1ecf892db644fe70ce8920ab8dc801e74
SSDEEP 12288:tGiDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:tGiDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T151452313C7A51034F73E16B2AF13526B7E7AE858F92884834701335B2E78E4DD6456BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 db87ef2363788caadffaf95256d6089893eacef3ff53a5a885d19d63d38508b0
MD5 d1fda51023b211a49e2ef2f81a4fc471
SHA1 a7696a762733cc0c610edb96bfbf65ffb2f7add0
SHA512 215a941fb841022b1696e06f6ddaf3f52bcb180e1e013c92ce98345513394ca06967c61eed838fc4b10cf5370729a183621730481423c6df75fd53e5a3820d1b
SSDEEP 12288:1eBNUbTVO86UfDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:1JIUfDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T10665CF3BEE28FCE2C27E4DB95B918200E77274708B2193CBD165830E9E235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0be9dc058ed3732e294d58ea69761f47bc5c5c343eaeae4bb3d83f7f17ceb6df
MD5 ae7dc666a5a5d14bffece775d4f73598
SHA1 f9c3e742ff85176cae87948302f96210d5d0494f
SHA512 59f2c65973f8a3aaaace6d3fa8a4321890fd55e9e5cdd91eeb1ff833b02e29d160c9f9ea3dd5f2ae7c5a7f6c89f161e0404d931b4dedeecb78ef2f6bbb87cd8c
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:ZQvGAdlCEL8c/WRNw5CEy8Y8
TLSH
T171267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 db77606a7fc771d28fc9cb18e304b70504640ad8dd2e4681b1a6bc8c81384305
MD5 a85f9b8075001a4d45357d1710e6b1dc
SHA1 a462b5a5767afa25105c0ecff9246ef9fea5dafc
SHA512 e2954a804b42823e263d4c7a17eb85282673763ff10b6927c011e8452381f11a7aa959831fb8a18adcd7dfdaae77b9b352cc87b4a9529be273f93d65d88ce884
SSDEEP 24576:5fewsAjhDYQ3x10n+1W0VgpynJg9zT8j/:lljhD/gn+1W0Vgpac8
TLSH
T1C175E031FB74E036C77F0DB21B22C716283DB9204B6119C3E3A84A9E59746D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c186a82f2e6db0b5c0719fdc1e5904199af76a46f31787ee6df4cf5285190963
MD5 9cf19c38ea4fc966cdb4d375f3558855
SHA1 35c3c94f2b571e8cdb61d2c95b6193345679a91c
SHA512 da7664ad4505379d35c64cd9cddd00473dcf18d99287359253a3a03a7a18b6deeebb803a74364e06e1b1946a628bfe7ad7a7a1bbb7aaa0848725da495d90e00f
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHv:xUEtQevvqc2W1cpV20I32v
TLSH
T1AE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8b2ce4d38c5aa79371f20a68e0ec86915957ca6b96f8089f026dca6b3993726c
MD5 a6cbab85ac27d8464ccd32a3e234d02d
SHA1 626650ec3ccedb6d8a60b15c25ea2dba593c1327
SHA512 3dfaddfaea30db77fdc5a6036f31393c345caa0d27b1ee2cf433a584689f4cb6e0cb38f4c80972366a39fcae9248c4f5b3bf93b36a604a3ef03d674e8ee832ad
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zBD/gn+1W0Vgpac8:WoqtVjnmQy8Y8
TLSH
T1D8D58D0976B882E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d2ffcf3e51d5444990d898b67ba2daac5f95949132500c879acaaf42d105255
MD5 7d0b05e7054711b29824246a7b3d7ab6
SHA1 23647a9465849d0dd7ddf3a608d9e7b2e0f8075d
SHA512 2f5a99036651d6390d1c551e1da74390fa3e59c754d1421c002fa38a8c0340fb973838535b328c8060fd229375fc75f79166090eb7c6c6676c9d70d088a29477
SSDEEP 24576:PAhGL6IFoiwtA5l7S53EDYQ3x10n+1W0VgpynJg9zT8j/:PAM5Foiq50D/gn+1W0Vgpac8
TLSH
T1EA359D81E7F955D4F5B3AAB899B68171EA76BCA95E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 82ae11c887077498adb781661a9a72cd5b130a6eaae4f421fe1e66e039e1d05e
MD5 436afc2f73ab66cea5059a36daccb555
SHA1 0f736a390f1bafc235eebbbf669df002c4e95761
SHA512 4dee715c858d0947759b98639aab1370bacdf029b99bbde3038cb46a469e7236a53d187be31a84c4a8ae73a89d64589d91ba254a7666b45169a1a9140c8d6d1c
SSDEEP 24576:wwuROWFDYQ3x10n+1W0VgpynJg9zT8j/:wwSOID/gn+1W0Vgpac8
TLSH
T1FA65F14677A40CF9E9674639CA53C136F7B2B8152A25CB1F0760C25B6F37351AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef6860b4268a662f31dbcc24cf89d82690e5ca86d8d308eb2b6992b3c496e4a5
MD5 577437f850a3d2f39bd9c1eb373b537b
SHA1 e4cb4d396152470020d7f59f3aa21f4cb904da95
SHA512 e5c5fef9e5c5c448cd6118d74b4b68c19b3c32e1c79ceb6f779e2f646c085c43b70afbc15adda36e3f8893b5bcfc856f4f536796d8ad61052dbefb3b026eb538
SSDEEP 12288:PyZ1IyxDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:qZuODYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T12955125723E420B9E2771279DEA2420AE772B465673583CF0615026B2F73EC69E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f5d776fbfa5d96d62fd925004e8f81b4d6f08b429b539ba1fb47959ac39a5627
MD5 52ca313ba2cdcf6cf9798d159ecfa979
SHA1 cc3ffc6382e0afd0a33b8c9a8df8358095f0fc9d
SHA512 11612bf8f8ba58fd1074da2d75a5513cbb05016e74acbfe97d38494aeddb5235bb8c2957b29544b3214ac5e1f77b2d65aa6a16f41cec720af6810a8fef6c4a05
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ut:yQRQyi36YOcPDLvw2gAf+PN3ny8Y8
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2039f37e9b3f68978f74eb9fd9598a9268615d627b8045f97de2a0a4819c6c2f
MD5 003819e89fed882638336e743c9adbd6
SHA1 6ade5caa42bd60e02bbb722aaf055ff855869650
SHA512 07b14c1af2791a8f1af9bc65c7a25335a5fe4b0dcae103942afa1667a51fde2f568a6f4809d32067436b8b5fd539373b6281d94720b094c048c212c6a05628aa
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ut:SQRQyi36YOcPDLvw2gAf+PN3ny8Y8
TLSH
T1EF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 decd7561daa320c0073e69ab299352baf0b172a4d55074e7f49543a02de6c77f
MD5 756e4c1dbfa39e0b88ead209552f6134
SHA1 ca0f5f1d0b96429b39484ebc7760af2f3411327f
SHA512 82f0a3af1094eb7ba7a3359f84b5f76d69ecdd28b76f57e14f3db4349676013e8087391f985d73bd6a20fcbf668dab5ec73de4b3dd27ab5d465017053d811924
SSDEEP 49152:x68Qg55nhkeWu7PNU3/RD/gn+1W0Vgpac8:vthTRc/Fy8Y8
TLSH
T1B8B54933B2F600A9C45DE1769F46872196E27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81930bba97f40d3106ba0fcf362f2e437256b9bb79c9ea2978249064777e7e1c
MD5 b5b1aa2ad339912a70b20c2ea03228d4
SHA1 b6f131bdbfb4bb83c36c58073e432dbf15021b9d
SHA512 d9ce46a9fc03a56e35d24cebf2e1ad56f7cf9fe53e31149d553616589592510113c2856cab32e03844acebb1d443a40cf513ced0526c8a1cb9ba924051a2ae66
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99n:5y5112gYy5azzVvU69nLKnhZ+y8Y8
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 09059d8a4af0eed01ee603b128126ac2a9b17aaf45245ce5c7c575b66baab553
MD5 acecc605d9fe4c87570236ef36c1a460
SHA1 e09579a304db82bd8b77b8c7b75a12b06ae1d4b1
SHA512 cfc80acf04301a292e0055b702a73ac2a23ab94ce0bb798b938c516389f122289fff45cb1871b2894af1a2feb8ad5a115f83cd96f8e1970c61190a2be98c4a89
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLD/gn+1W0Vgpac8:ou6JmIxd2d/y8Y8
TLSH
T1DFD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7148ce3ec1f60a1d50b32c96b3d4b231ba1cfb44a970d4e1e3256a6457c37daf
MD5 6681ebbacc45dead4a8cf4ce5463a37f
SHA1 ac4a52e155466412d8d503a0903a430569cc10aa
SHA512 04a39cd8ba28affa76746ea85f763e08fecbe9163f9d2f1e277d33d74eff617d939ca777cff6c13b70668ff86a915bfb6e6ba40264659356f9b34787baa95ba1
SSDEEP 49152:p1hpsNoJpF1A67U44CwH7R4x/D/gn+1W0Vgpac8:pmifPqRQy8Y8
TLSH
T1B2B5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6b25f6cdeaef057d2e7baa3c3915ea9d8c3c817b42ed56b2c6ec9842b622498e
MD5 27a488d577ea6656e36d16ebb6168171
SHA1 5e94fe01881e167c9c16562d949cd71cce343aa8
SHA512 668dc0424d5d03096be4728977beeec0c8b08573d4ab1361277da99b5425ca7283b15fbbab7e9703faafc815a2283fe1d0d213efee4ed2530b74f9afdea06505
SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHqOD/gn+1W0Vgpac8:w5dKqi61iy8Y8
TLSH
T139C5BF03F2E901E8E0BED67487669236EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e82488c1da004bbf49c4886ce159ef7e5ee1764033ca04f0711363921778295
MD5 96fcb1a62d932ea0fc7f662d51a67601
SHA1 b6f47a00ecfe2da1ce8c27902043bc62903a2051
SHA512 58016c36d3a2d58fcb97c7885c8f4d8701b755a1aa58abdfc772a4b83d8128d6046247ef0c67d27a01a1bda00957f25cb9714180707c065682974d0b43ecf777
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wbD/gn+1W0Vgpac8:bX2iWphsy8Y8
TLSH
T16E95BE13F2D900E8D06ED174C7468632EA62BC150B39AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2b7975326b489b73822b46e1d9614e7ec7a959df9c80ba33cba2b1aac7ff02ad
MD5 00c16f394fdd1c5e8dcb3577b26b2ba1
SHA1 8cf563af58522d46a7bd691c9596132061dc5b36
SHA512 1f13cddadcdf7dd11c3d28895911f85d7c9d3d1b94bd57d25ba9cc389e0d5984b86cc602c77a901e686a67d5faaf7dab8b78c1823aa7e4a3bb2854d3bafb1774
SSDEEP 12288:0KDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:0KDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T1FF452303D7A90039F62D16F29F03526BBE7AF46CF62440C3570612172F79E8DD6499AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2303364c5cb1d68aa0595a2e83a5b05fce8c8be5aacfbef0528586a939e04f1d
MD5 d724a76c8d155f382c5fd2c4feeb53d1
SHA1 a2a1d40f8555855afe4ab33f34955d8ef2006c08
SHA512 b0d67ae705e55ff19f703b4ca34682348805a8bcc672b24c026e7d306051c77e3abab301c762e946b381411e64324048d9bb488f74686cdd1754a02bba51974c
SSDEEP 12288:O9Dt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:O9DYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T1DF452303D7A90039F62D16F29F03526BBE7AE06DFA2440C3570612172F79E8DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bcac2d172b4c85b025fefe0d8420b8c99edbe376b2c07d4caeefcb93eafaa3c2
MD5 7700abb401a6a9f5e7f858364c47a490
SHA1 b1f8e7f141586d2187c3f91ca656cc27dc5d0de2
SHA512 937db464a1aa8e8af92808574901f573c40907eb94eeaef724b392609dfba9b3f73d48505d0f373c4827b21e624bd12ae1bb422816ed3d9e9977983feb8abd17
SSDEEP 12288:9nDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:9nDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T136452303D7A90039F62D16F29F03526BBE7AE06DFA2440C3570612172F79E8DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e5f9d63e4d3f868529a33dcdd0c65804322e7f10e3c85667dd2c2580c224b2a0
MD5 fe7e1ca21667bc4d5e1b361636e11e22
SHA1 f32463b1c766abdd9242775ba811d26eda6e4f0a
SHA512 6ba60565b41d128504a47f71f3a533e60b449545a8b6e3579abf4938dece0584e635c3f2591a9fafbbacd4ce734cce38f77f5ff2ff89ec3991cc13920e70c3fe
SSDEEP 12288:XVkDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:qDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T1EB45230397A90074E53A56B1CE13822AFB7AF4A8F73581CB5701121B1F75B89DA14FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f140166a3f89c08d85db35a6339eae8c73ecd4a5e8060f92499f42ec9abea95e
MD5 c1f43e023904e89a121917af29657375
SHA1 a306246c1aa57a09ae01cfc537da34083283fc6c
SHA512 fc593669820060602c191e2d490c940077f5868cd2ee5f80a3a628efdcf804ce8addc5ee19d15913676ccad89c302ccd500c854bd77f81952921df9be0f3c86f
SSDEEP 12288:UcDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:UcDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T1E6452303D7A90039F62D16B29F03426BBE7AE46DFA2840C3570612172F79E4DD6499FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9b0f888e0a776148b096f71022a521387fa414b88b05a4e5393252715e3efcb3
MD5 3b9e421caf6d53b1bdcd48b186db4851
SHA1 dd546b181f4601467b8471ad67f74ada44022f88
SHA512 4770f166cc6a89bf971b2f1609ab3ed403111941f080e86e4f536e09e122fbb29d17ca0cce9fb0b2f8c695aa7b3381e040f04102a40bde56dce2cc862131604d
SSDEEP 12288:zJDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:zJDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T179452303D7A90039F63D16B29F03526BBA7AE46CFA2840C3570612172F79E4DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7f12b8cfe75ccaf9724e9229ae6201d3ce49493718eb109ddd29b86410496f0f
MD5 634c517438bcfdb955f97208988b948f
SHA1 1defaf84fd814d21c2b239308d59dc5ea4b015f1
SHA512 7a1baf768c4766f0e08752c9e6110d95c76c60cdb1af357239d09eee53fe3ca0e0bff2889765bfd438d0b842f138fb1ca88df184bc77d75ce9d3c7b4137a2284
SSDEEP 12288:m1Dt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:m1DYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T164452313D7A90039F63D16F29F03526A7A7AF46CF62480C3570612172F79E4DD6099BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 172d8381f68b849806ce8672ed9c4dd30b22d1b1ab91138889206e66554ae310
MD5 88cb916ae2ee3c6b2bbdd0907a54696d
SHA1 700d3089c110836148b4227c949e3821a491387f
SHA512 d03717681afdfb04d9b6070ca4682d0a86fd713e07e92af477402fc92932bb686de0b8d1fa546586674bcfd72d7a25fe5d888846901575ba2d9ee5e1ed9f4368
SSDEEP 24576:OZM3zFVSOdDYQ3x10n+1W0VgpynJg9zT8j/:OZM3zfZD/gn+1W0Vgpac8
TLSH
T18C650155B3A018F8EC67423ECD128916E6B2BC595B70C65F03A432271F337915D2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b5139a8961f33a8e2e163ca98ae1f3b85659c0af09a026c1049450910d68c71f
MD5 0acab00c7a2c4260496c93f97cd87471
SHA1 bbd8eb4601708ea2b72658e98904422c42b24cd9
SHA512 a8bda76f140e90d915a4d422bc1a8363b628aa0c114cf44ed35e7b9bf4082c89b9d16678a15d5c24fc7934ce3214a21205bfb77911c0210f19be6fa9fbc0690e
SSDEEP 12288:peDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:peDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T158452303D7A90038F63D16B29F03526BBE7AE4ADF62480C3570612172F79E4DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e417d4f7ef3f33a20a3859db07bb733e6c77ab6569979f75eb3d3b8e852186ad
MD5 1081332bcdf8a1c9422ba13eadb9d3c7
SHA1 2aa7387055f1982ad60a6882590d3e7a2eb9ea76
SHA512 35c6ef00d94a49f8b6feb4e85dda6899299de4db7826c8714c32555314c0c66551a9159f8fb4694db41bc6ae39b42a43fadc9d903fc36412a6e1a3978bd682cc
SSDEEP 12288:FyDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:FyDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T14D452303D7A90038F63D16B29F03526BBE7AE46DFA2480C3570612172F79E4DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9a734289eb364628679280938addec3e0f1eb65edfc97e436461c28dae490e71
MD5 454b2f083bbf3443f54e53dbf93fe1ce
SHA1 11fbbafe872cd9f2601a3573f17fa70b7c79127e
SHA512 1b3df65184a893cff4b5b62a895635161d6f8b943ae12d08cfa5664c6d0d3136f9f68f677a708066cba5a08bf5eea0d2c50d1a97d819de579a4846d627c2bb8d
SSDEEP 12288:cyPz5L8xDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:FzyxDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T159550107B3A520F8E13A4275C9520616F776B8365B208AAF1750037B2F37A959E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1837577ed00c9a0e68443808f7ef09723a403cbad8dfbbb82a4fd7dd4852473a
MD5 a9ffe3f2c382c325001e3a06c081a118
SHA1 b0f51caf2612b20cb9865b714585d27ea078e156
SHA512 cb5c55e7c150d556f5283c146c152d81ea03e94f600d2b3644f06e97e563fd1e30479a1f3b8a7868b9fdbb1d8fb0834441cf165a5bd418a8cc47a75554b07b51
SSDEEP 12288:keDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:keDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T1BC452303D7A90038F62D16B29F03526BBE7AF4ADF62480C3570612172F79E4DD6499BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ab3af058d0084345601c7844caa5d200c3ac13a4531f78c7f4476bf0c1b7b863
MD5 e12984e471f87e2be6589c6662b5d239
SHA1 8293dce61b228b5fd1f7dc2b4e132540e884df05
SHA512 170c5999cf659efe5a7449a3b5ac718c4184e29327a706919055feec33efbce5a6b0fa3085abad4aeeaf133e72dc0084bfa65f110b3f1031b42dae551994003c
SSDEEP 24576:Vfwvzk9RX6wkyAICDYQ3x10n+1W0VgpynJg9zT8j/:sMnYICD/gn+1W0Vgpac8
TLSH
T1A585DF29EBDC04E5E177923C9DA3460AF6B178691B31C2CF025A536E0E37ED49E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c55ee5b858317ea66c826b4dd29d08fff44f1d693eb07a116a6be4754d7eff6d
MD5 0e99a41ec6d3d54cbb8296520a87e235
SHA1 509af27d8df3eb0a96e20857d7534e01c697a0c3
SHA512 a7169f098a7d4e215b9aca088be00ccbcbb2ddbc6eddf0649dee723cd751c6099bc064828382d968573da4c82d0000f1b678ca91a1892c08beae6e47b2428931
SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07D/gn+1W0Vgp8:BySzPHy8Y8
TLSH
T1DA066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 156f5d240f03edde4c5e0e4725dfb4acbca1a93d233ea77e6484441237867c2e
MD5 75413d262bcd8f5e564ae36c0d90ab97
SHA1 c4c9067d775ab4ea05fa007026eca311b72f4681
SHA512 6d648be688a74a022d0039595da814ee9ce3318f9b1d4f2ae8e449e323f7ff25fb5526619880b9816d32c1461021b520dd352d1401be7f560488a56a3baafc2a
SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYtDYQ3x10n+1W0VgpynJg9zT8j/:Y47JUQjqirIhCnDHUPfF/LD/gn+1W0V7
TLSH
T11C65AE1EA3EC01E5E1BA927885154A1AEA71742D5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0029e0efad9e14c2f9641968b1963c89528e0baa4d5a843e537e5b7aa84dcf13
MD5 222722e8331330f22d5e6c4c0d2d02c5
SHA1 9b9957df782db5a31ff635d94c8a1501b2659f61
SHA512 4a97b03f42f90e1f7265055b4ac8318c7b85615e87bac493d75428c327ca5f4cb2e5ecb6acb544cec35c2229e7237a2f4fd98f9dacf2ed021144c591998edfde
SSDEEP 12288:xpsfODt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:iODYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T11855F10AD29802E8D06E6275CB424641B7377C6997E1C3CB57C0F13E1F76A849EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 900KB
SHA256 4860db94244c5c011df9866f7780535ea75427668956db0db43cc53777643dee
MD5 dce2560a1f4fc5bb53ad1864af5899ff
SHA1 7589c79529a1ef2ebf0177a4bc1ae3d2b9673162
SHA512 238f8a7e90bbe3f80379db50a8dd527ca216e7112387a04e6876a20fc792b91a0d5012899c95c44b8bccc33195a574394187a6ce5bbaac2fb4b795333f085376
SSDEEP 6144:VasBC2na2x9n9D5yUAEjS2CotMxgnUmU3ftkPZPnvNAkf7FNIS6ljQrF5zhSXj1m:tra+nU3f+ZvVAkhAljcdSTEivkVvsdj
TLSH
T1AB152710766BD75FC6A940321E37C2CCAB707D02EE059B0372C94B2FD576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8818b4e2945f678f161a568409f5e1e69dfdbd6a7f67f94311184120139bb335
MD5 d699263810f03c14c63c17d89801015f
SHA1 c63d51fd913bff18627b97d5ce79330319bdaa9f
SHA512 ef3fda72bd00eb4e669b6f8edc22293b40de9eb4f893462de939fd0f36032f22a537d3fd0b00baf559f29b7abd90642a723e3ddad6aa3abedafac20502960d42
SSDEEP 6144:H9DPiNIYC1RvAK4AFzuLOtWf1yTR5tpTHVxL26tMxGixgcoKHjboIsaEJBONJTEx:HsktsHNy3H2MUa
TLSH
T19845A6816437A39FD4FA2132072A5B4CAB64EC07B3495F2763C8053AD827B65B1B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup-stub.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0216ACC8\setup-stub.exe
Size 833KB
SHA256 5f6ba73d875b92498ca71cd29abb94d74cb57ce6ddb2a18861d8b7ca7d648fc0
MD5 924f5679c351e3b2d7701b98deaccdfa
SHA1 c603561aff96a4a5ba3e4ba7c1c9179242139b85
SHA512 06cbbbb1ea24248692a0441bc8368f2c1600d0f2047dd05f9c66506b297601010d267a580930ab54d51fafeb016f010eb8c19cdec785db65f492db9592adba6e
SSDEEP 12288:qTTgANBuv7OzhuW/sTIdvPi0fWLKeVKw6kcUelxbdUnhasLv:qTzNsv7pcAMprZddsD
TLSH
T1FD058D12F3C2CA62D76F053478BCEE72173ABDC06F90859732167A5C6E70B504E6926E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fx94F41E46ABE04D953B643C8BC51475F3.exe

Path C:\Users\Admin\AppData\Local\Temp\fx94F41E46ABE04D953B643C8BC51475F3.exe
Size 492KB
SHA256 793517879d853ab612437c32c1eab603ca27b700baff487cf2962efa7c953706
MD5 7d5240470b38d1442fd0bd0e5902064e
SHA1 297ae3c523a43fad545b96cc047af72fa8ffb41f
SHA512 df811887336677c2fe471be3601aa3bfcae0a8cf5aac9c4f53b2356c4f1c442f748e9a467af9aac270e34f435549cdd99fd02b63a798cc097618b4eedd5b8184
SSDEEP 12288:GMROxTfOnMmXkHs/T2IAopwNV4BedKAW4Q6kvG3KH/SSMFhALL:/IxinvXkHsbsN/jWPD//MXAv
TLSH
T1BDB423730B984041E093BC75D97F666BCE6ABEA4244AEBE3AD343A5C7F0F5051786321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InetBgDL.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\InetBgDL.dll
Size 95KB
SHA256 3921dec014fadd1de7f3a36606ac95882a17cb96df38a5424e58531a169f825b
MD5 af9e2d138cf17b8ff4d4b8df7fddaefa
SHA1 539afa302bc5cae7022896048cb7a0f3f2ab6907
SHA512 631ad8bbb9eea42b230f2729714874c921677c4be91ac0b35ab9e7751613045eb249f8a0dd1d5ce06bf2cd544507795836dcbf42be79f01a71333570ea27c840
SSDEEP 1536:E5Hdo/N8Hu9M3hd2OR4svcXn9vh1cWir+VrdukX+ePTGnutmfsbLj7lkjDnblYWA:E+Y0M3hd2ORk9vXyk3Piuz37lIDblLA
TLSH
T156A37C52B5D0D831E9BE193E2874DA649F3E7A11CF909CEB235406694F302C1DF74AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebBrowser.dll

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\WebBrowser.dll
Size 103KB
SHA256 281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
MD5 b53cd4ad8562a11f3f7c7890a09df27a
SHA1 db66b94670d47c7ee436c2a5481110ed4f013a48
SHA512 bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81
SSDEEP 3072:XfSOjAHW06ovW1UOBnuW/0L8ieV1QWZxs1VIdfyb:KOz3U6uW/ns1VIdY
TLSH
T15BA37C40B5D1C871EABE49381460DA715F3F7910DEA08DAB3768567D8F703C29E28A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgstub.jpg

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\bgstub.jpg
Size 194KB
SHA256 5992f5deb915c3d80a1b514fac24a5031e888538dd53434137b40e453c794249
MD5 c22a1c6c2467b793dbe4b7c8542a63ef
SHA1 5a0d5dfaca6de8d9cbf8ef08dec4851e2405efec
SHA512 5eb9f2c5c6125091b35bafe525505a219c5b3834dc732e97538e243d48a64820f1b9ee0297686b52a51a2678fc4594227312ef2f5cf34c7fc11df80e6064df17
SSDEEP 6144:KeH1obw6iJwm12UelZ4nw8udaPn0dGadzPaLUE:KeVKw6kcUelxbdUnhasLD
TLSH
T16A14F177FBCBE7A94B0B842C517E7E375B6106E420C9669B40072E69E274FB4518B0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profile_cleanup.html

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\profile_cleanup.html
Size 1021B
SHA256 841c48b6725f700e10f2ee93bfe2824d630118eb98a61673485acf4e2e75587c
MD5 4c745bd2b758a55eb7730f7d13d74e40
SHA1 9c7109537960244a76220b6c3c292d0a2b79fd09
SHA512 525af6e2e7fe1b8160f0824f2eaf0f34a65e2dd106acbfcc8a43ddce4d438b32dd9b2bff654f3154101488b2ffec43598a0ef826cdbeb7fa5678e46cd4ae3ea9
TLSH
T11D11104A4CF84921A2505D207ED3B409CD446E53278A5C24B4AC00F81FDFE58D7EF6E9
MD5 SHA1 SHA512 TLSH

Submit Download

profile_cleanup.js

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\profile_cleanup.js
Size 1KB
SHA256 a58e277ede06cc98d00e34c9f9ae57908c49bd45f9f5ff99a395ae6f4c7be6a7
MD5 36148f33a1d0ff8e941ff4c453f3c138
SHA1 c1e4b8a7a9e0d8e757488113e68a7ff2c8fa7aba
SHA512 6d9b5b5b28ed5bbd7faca7773576e908148d409bb354528b373d81da8163c8d6487c8ab3e48c5c146c97a3cc2a2868304fcddd252ec773b58ba64245110853ab
TLSH
T1DD11EE7F38C6093009FB7AA4335B2255A4240012385AE8148DA882551CFAD22C26F7DB
MD5 SHA1 SHA512 TLSH

Submit Download

profile_cleanup_page.css

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\profile_cleanup_page.css
Size 606B
SHA256 1579a832e7e24e1afb415db6f5a42b6dbfddcab01aae077eee5e1083dced46bf
MD5 7028d17032e0974576db2454a1782108
SHA1 0fafe58be1359f85829f92d146b306fc302b8bff
SHA512 920dd47671fe97a0331943af879a191fd786abbdb5542c456e0f49c7be710c772239d51f893ccaa7754d998790c501d0d3903f0bf97697b78cf5fd65c9ad765e
TLSH
T1C9F002872880181135617D08FA13FF21F84909A331CED97174E0D06CC5DA5E1A763B4D
MD5 SHA1 SHA512 TLSH

Submit Download

stub_common.css

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\stub_common.css
Size 678B
SHA256 d86446129e0c9aee0288a4c9f465bb7c7593f81866110f6393673bce06d67eaf
MD5 8d627f759243e99a864f96e29496f436
SHA1 e2bce4c9378f4a24c8ffadc91ffb60c52d77c3e6
SHA512 76345c31c40807f20d08ffffd0a651a0a9cd673e1ffe4ca6b71ed8aee5b12b65a916db5e7fc8b3a4c74f4c8db1d03713cfc5a39f8d233496abfc0a1676e94ccb
TLSH
T18E01FE166796670CB089CEB677B39B14F31F04B0676A8A64E5F834A18F8F00580B3BE5
MD5 SHA1 SHA512 TLSH

Submit Download

stub_common.js

Path C:\Users\Admin\AppData\Local\Temp\nspDC14.tmp\stub_common.js
Size 584B
SHA256 7da3182de713cdbfa901bf71ecbc517a3ff9dd53dfdf9b03ab01a19a899818d5
MD5 59cf6be7a5c5073a478a65966fcab782
SHA1 438494db51fd8a89a9135c2e0b753d8c396c04e5
SHA512 7e5be15fcee394f4d6e938fc87595bbfc896d9dd9e46447f983e03fbf8081e14d7382c81e57930e774e86ae5d7273c04f319b88098cfa820bb6f5b9107b686c8
TLSH
T1FDF0E13E38C4133D40677BA0266F5643F226514231C68E9AE5BC51E2B986C369533FED
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 961bb4f905ada52c3ecbeea2316e2fba868d202660ec56b3d0079ad365b25803
MD5 5b862ae84764083dc8bb0ab8ebb73c95
SHA1 8e80c045472104cd5ec7b32b2315bb8f13455678
SHA512 e1588e7340afa949472f4e87797fd92a1e57b80524c1290e1310b6b76c684f239f2b96a1ec6f5a732f3b7649f874d7d9cf2fa88a2c0903cbf3d13a6162863226
SSDEEP 12288:HM7mDt1FsjQ+2KCNf0nueCEuW0Xz5gpypq2eiJgJ/IaT8j/:8mDYQ3x10n+1W0VgpynJg9zT8j/
TLSH
T165452313C7A90435F53D16B15A03823A7A3EF46CEF2480C3A605235B2F75EC9DE65A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cf9ba51f2b9a3d6f5cb6d9ef8c8a01b4eb34f131d35e3fb2c20a47ffc1dfc1e1
MD5 bbcf46bb0773e50438e8d940da359b42
SHA1 861fd09a3aea9005309545ed2ec2af870d727cdc
SHA512 6c6be9c0431ca10761ba7baba3a8552da15821884b1e8f187f92c81b3d2c9838f8b96fe9079f79770693a38d8ec6e8ff805e110700ef2e334101029ca76ac4cf
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYgDYQ3x10n+1W0VgpynJg9zT8j/:0gb4mBIBhGFtD/gn+1W0Vgpac8
TLSH
T1D165AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a2e3eaa53bf402c0bc8366ba60663372a918586fd778ce89e04b8db851ac0af5
MD5 a3abcf1ee480f426a27800f3418a75b2
SHA1 1ea72ac363d5ca2d2d108adc287928964bfbb4fd
SHA512 6d304b1c27b46bd61105f8b8d749d23b89e8a5cf9d6ae3e05c250d5eb5465b477bab6e2d58a555cb930fc19a5350f1a32c3b860e845a9507523f63872e1460c2
SSDEEP 24576:/G88u8FpJqH1vzria7/mdDYQ3x10n+1W0VgpynJg9zT8j/:O7ZFPqVya7/YD/gn+1W0Vgpac8
TLSH
T1F185F126B7E101F0D47BD1388A424667F6B2B4251324EBDF07A88B561F23AD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 afeb1930431e7db0ae9b42e03d825a30f5c7ba90d15ba8390680477faa4ad329
MD5 7d1cdec724fd8b11b7a6792896066ea2
SHA1 e4aebcc48e35057596d5055565cb97dc152958ec
SHA512 ca8b3c1121c14beb79537e41253faa6cdf10a4e5566b5fc72c5a0afc22a616826e5276f48ddd4a90656f5bdaac057b9812e3cc88ac034e94872822ab76510548
SSDEEP 24576:lPUr+NQZDYQ3x10n+1W0VgpynJg9zT8j/:lJQZD/gn+1W0Vgpac8
TLSH
T1A065E11F62AC18E5E67AA17D8A428319F772B4621711D2CF0290817F1F67ED8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 00bd27076232b9d7d9d5c801c9cfd0d4e105e336e01710a2bc60db0df73e6c12
MD5 9ec9a5dbad7b5cf7fc30169320139dd0
SHA1 db6edebd59e6a1e65b86cc47160369c4e7335b68
SHA512 872080aa81be5747c80d9fb323bb98637733a12ba145672f8d21344ad822061596f039d9ba13ee41800c266f0de975667dc2ad3719124cdccf29a988736fdad1
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJD/gn+1W0Vgpac8:nG05lO43bmy8Y8
TLSH
T102D5CF6E62EC11F9D1BBC17CDAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c05f2b8bf2acd2ce85f5e9dbd27bd74d55792e13eef0495ddf5ae6a111ed5cc5
MD5 6253044d12d780860276daca79dd9a2a
SHA1 cb5c7366197bce8ead3a57a71ce57e09feb45b5f
SHA512 7177f98450ab1f3dd465235aafa1c56076f5e89c029a8321d9505426f273f2232689ea169daced74ee6abd46638e1aba759557a25c5e4666b1b441ba88eeb06e
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7DYQ3x10n+1W0VgpynJg9zT8j/:ea5POZ3lJt2pasx2+mRD/gn+1W0VgpaL
TLSH
T1D365BF5EA7FC00D5E579D17DC583861AF5B1342553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 436749f06cde02ac5d85d9f9c2cdfaf0f67376e04c6ae276e933e11e88c95a3f
MD5 f0ea0026f2fa1c6ae6ec84cb809914ca
SHA1 0c761e199a1b51a8f1a010019eff075616382de4
SHA512 6da1fb57a265e54b26f4035f994d2c1f87ed88179b60a8fba3c3d3511dde0dfdc86e5b1cba42cf98b0daeaff190e8a8cc5695fb388b7a332dd35a732e24891d5
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FklDYQ3x10n+1W0VgpynJg9zT8j/:XNc/zEOVHF4D/gn+1W0Vgpac8
TLSH
T108858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef3d4fdbcdbbaaf8c17ee72441ebd21622af2234504403f5afccd161a1cbf837
MD5 c5622535447815a5c3a3f663980435a6
SHA1 dad77011af6387a53edb7684edc2f9490455035d
SHA512 4a026a8bb18590bd096c4438791fecc0e0b2c850fe424ecbcdff58e234851d5a074c629cef7b517e30bcdca01331d8a64ca56cc9132ed3d07d776f9749e17c8b
SSDEEP 24576:VzkNvNnaFeYhJNtmZBmvDYQ3x10n+1W0VgpynJg9zT8j/:VzMwBtOmvD/gn+1W0Vgpac8
TLSH
T1C955AF2EA6B806E4D1FEC6B5CD238512FA727461173292CB5390C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9b49bee06aece6e60f4cce5070d55b1ece8728b1cf1b3186fb33f836c6c10f9f
MD5 53bd71d2c3ffec821ddfc73bb4e604e5
SHA1 2705d1ecdd61e4c8d8fc1314727ac25f1280b2e5
SHA512 4a7e5cdcdb795b54945d5e1969ad5747a67cfe250bfdbe6d2c606f15f8d89219f5311c136daed4c850d208277f401f928ea13053d1191bbdcf1a2b35a6b3f93d
SSDEEP 24576:4D3FHshBIYQgAqDYQ3x10n+1W0VgpynJg9zT8j/:4DVHeBIAAqD/gn+1W0Vgpac8
TLSH
T1F175E13EE7AC04E4E57BD1BCDA538606E77138AD032255CB029481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-430-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/436-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/436-431-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/436-115-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/436-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/436-109-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/796-105-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/796-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/796-98-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/796-104-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1752-81-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/1752-75-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/1752-187-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1752-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1964-156-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1964-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1964-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1964-154-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1964-148-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2316-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2316-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2316-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2316-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2316-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3912-170-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3912-164-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3912-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3912-415-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-63-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4384-220-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4488-427-0x000001ABAF950000-0x000001ABAF9CC000-memory.dmp

Download

memory/4520-137-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4520-409-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4520-133-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4520-143-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4848-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4848-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4848-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4848-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5128-97-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5128-442-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5128-1-0x0000000000DA0000-0x0000000000E07000-memory.dmp

Download

memory/5128-6-0x0000000000DA0000-0x0000000000E07000-memory.dmp

Download

memory/5128-7-0x0000000000DA0000-0x0000000000E07000-memory.dmp

Download

memory/5128-0-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5384-275-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5384-85-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5384-93-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5384-87-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5696-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5696-20-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5696-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5696-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5696-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5812-128-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5812-396-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5812-408-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5812-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5812-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5812-410-0x0000000140000000-0x00000001401BA000-memory.dmp

Download