077ead3cedd83265cfa1e4d2b4babfeb798a30f7f5886cd6016c90c4e181f3bc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260720-qfpvxsbs8q
SHA256 077ead3cedd83265cfa1e4d2b4babfeb798a30f7f5886cd6016c90c4e181f3bc
MD5 5062f34c46ca171ccc3c6b99fe189168
SHA1 22047724d67057bd7fd70964a28ee49fef90bcf9
SHA512 f07f994f44c7271f52cf833515832f9accefb7a14f5c697022bbf551873e18b5d832b97de9957773919f8cf698927e64985a4dd7f1ee05fa7e8fad0465005b57
SSDEEP 24576:AxGBcmlTKN9RLLq/X4s5Qd+vwDH2uI5jUV:sGy+EXLOf445B+
TLSH
T1E755022232C18473D9B31A3405B4E6716A3EFE701FA45ADF3394276E5D306D29A39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5772	elevation_service.exe
1256	elevation_service.exe
5792	maintenanceservice.exe
4724	OSE.EXE
4544	PerceptionSimulationService.exe
4112	perfhost.exe
6104	ReFsDedupSvc.exe
5396	SensorDataService.exe
5104	ssh-agent.exe
3692	AgentService.exe
5400	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ea41df2883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae835e764918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6508a764918dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060a729b74918dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e86f15774918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b3d3b744918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002ad58e764918dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	6104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6104	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3692	AgentService.exe
Token: 33	5400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5400	SearchIndexer.exe
Token: SeDebugPrivilege	4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4564	2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5772	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 3436	5400	SearchIndexer.exe	100
PID 5400 wrote to memory of 1728	5400	SearchIndexer.exe	101
PID 5400 wrote to memory of 4848	5400	SearchIndexer.exe	102
PID 5400 wrote to memory of 2436	5400	SearchIndexer.exe	103
PID 5400 wrote to memory of 3356	5400	SearchIndexer.exe	105
PID 5400 wrote to memory of 1896	5400	SearchIndexer.exe	106
PID 5400 wrote to memory of 2364	5400	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5062f34c46ca171ccc3c6b99fe189168_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 86f0ee470eaa336c87ce9c442ab9fe9ce936160f0068cba351a0b03738a4c7b7
MD5 dc0215bfdd3956cd48636d7c89edfca7
SHA1 390789a3b35de81afeb7f86f73f21c53a2ba6e06
SHA512 d4247b81810cefe00f976cb5485cc90aaaf2432066f6e937bbda59643bb5d94ab088c39bf7b82884261f554d6adddd2eb7b7a7991c6768bcb165480abdb43bdc
SSDEEP 49152:Xb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnVXLOf445B+:F3q6tjBRw4H
TLSH
T136D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a6e32061b13d907433c22aea3ac2d6c5088a6ffb916597615448b0ca106072c9
MD5 a503f163113c1f2b5fcbbd61502f12a3
SHA1 b2b4b047c1af3ab27be15e2802d9ca25826461f7
SHA512 58191a603f1e9e15f1eed29d5812408c3a7ccf15e68ffdd86ccc696785ffe1f172104325951a35e670be265455656d580c5b179fb22009fae1452ecb47e4f253
SSDEEP 24576:+XYfDtczA6N9RLLq/X4s5Qd+vwDH2uI5jUV:dtcrXLOf445B+
TLSH
T19965F12973A408F9EDA7827CC8A19511E6337C9447A0E7CB03E4996A1F336D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1255213ed7cb89681ec6be57a8115326a62d16a8d5f0800c88102e8d4738da1d
MD5 2594ca6f1796553da320c2e8a8e47b08
SHA1 9212755c9295c8d3263344e25ba0bf732acd7dda
SHA512 8fafe1782a4c7602696c31628777ea7f11c1189453724a61a29085020722326ef6ff5c383b09d6d4d33db281971f8d67c2bfc5bf743418eac3d9f08c8a4c4c9f
SSDEEP 24576:A0Le5ji0hmxBrMXN9RLLq/X4s5Qd+vwDH2uI5jUV:APji0A3CXLOf445B+
TLSH
T1A6859E26F6748731D073C0B9C5D2A69AED7130851B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 100cf58503297fb7c1db41dea00acbf813c1f56147330a457665c93252247388
MD5 04727afb971608e3220da9023ba63d45
SHA1 255dd2be37b7ba6ca40faf91733b8fff6574f00c
SHA512 27070fc6e57e365acad5c2b1ced3f5622f3db72a548ffee7e828b7f49293ef8611e1fbfa0a28ed214e16f4dbb94bd0cc33ad4a81ae7eb20b0aa1f1449d26bee2
SSDEEP 24576:7a7/ezSC6vUyDZaqgrvWx6q8wyuFN9RLLq/X4s5Qd+vwDH2uI5jUV:W/ezSC6vURPvMHjy2XLOf445B+
TLSH
T1D9755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1a530d70ca0f82c00bd52c0e9df46be1c46918a818208e57ead70be94b737bfa
MD5 0e9909df9f09b07055da2934d8abae0f
SHA1 41c912c994a650bed3e51cf86b06cc2f4dd13b83
SHA512 9a213f66bca53e73d56b42361b90d0b87c3535bc54d90c0a1c45e024c373259ab16ce293a8b55be09154cba1530f608153a2acd628b44287db8545a204913f7f
SSDEEP 24576:gVbqPb88hv/lV7+N9RLLq/X4s5Qd+vwDH2uI5jUV:gVO88hXlVAXLOf445B+
TLSH
T127559F66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 22e1a632ceec0226834fe153d7c9337e8a0f7e2d732a400f0df7d1223ccae75c
MD5 d647066c03e1f2f012fe7c0394183cec
SHA1 ad18a47234437afa69da4e4aa2c7c44e5f06fba8
SHA512 fc20c9808441624ecb41888858734cd91e6a46bf286a0f4f0b4255f21dc70f9f7dd7e9a5705b47578a4459810a6a68d4547c8ea1faeb63c1d6d8d9b9b1c2710a
SSDEEP 12288:sp7N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:sp7N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1344523232B1D1873DBEE5EB810DCB07226719DC82CC4659F1590B69FA4329A4D2DFE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9d121c9f30933df0281624d0438405da8d7991edec6bb91bfc08d04b7642b68b
MD5 63ab4069a462a22d15a0bac4beb7e33e
SHA1 39ea33e3c879385120f0b82c61beee833cb81b19
SHA512 008a492849db026851cba95b78753bf3e596fb1d548b9c8637f016c779f2e882b6a5bcbd6a8757e8feaa2b729d110b29f306c7f1923f7071bf9301bf4979352a
SSDEEP 12288:CeBNUbTVO86UmN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:CJIUmN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T16265C03BEE28FCE2C27E5DB856918600E77278704F51A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65a1872670ac82fac70cee8fa90ca13ef1a79471759381d105e8a8987909c0e6
MD5 e91c535fb2bfe92fee9d8fe870912d72
SHA1 ceb35f765f7694eea65eed1e89b7b009f8037296
SHA512 ced5c2a6c9ba82a6d0530529b3ef9a92381bb7d86f7dddd7ad91dfcdfe6bb9616599367ad84b4a22a53d2a45eccc6f0c792be841f2ceffc88be513f7b8b6ff21
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THa:KQvGAdlCEL8c/pRNw5C+w4H
TLSH
T19B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e6dc5c8f78db36f1e3240ec83c901d5c41274e0aa93c9262bfd5239a3597af94
MD5 ea6ba5360bfea352ac48eda5d2615bd0
SHA1 7cd3818260f50e4a45b876274304c4826e3aa9c2
SHA512 94a0edccf54550921779c5b27db0da3593fdf393827f50a8d6c3b5d057657f44a0c8bfaab4a95ed9182c538f9e0a66da6bcb3709fd4f85a0a3f42e3be22ade7b
SSDEEP 24576:W9ewsAjkN9RLLq/X4s5Qd+vwDH2uI5jUV:iljyXLOf445B+
TLSH
T1D065E031FE74E432C6BF0DB61B25D716143CB9604B912AC3E3E89A9E59302D26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8d041661825d5178d974a325013fa2c6e4efe656d152d9c0930d804ea57908c6
MD5 4ef7421e3086921489036e2a57c992f4
SHA1 58fd9c996b29e85c99c6ae6998bd756c9abcdaad
SHA512 d2b006960b987e33d3d553b01bb96fcdbd501cfdc194daf1edc095455f9d82bfa5e141cbce2c58f322a65cfef3e9148f52caad46b9d11f3ee0ad85ef7a3e1039
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHXw:QUEtQevvqc2W1cpV29I32
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b3088612de9e1a47538300e7c0144ee30b5571b944a13493692e7aa8e6ab2a0b
MD5 9fdfde1f856725709e0f53647c188849
SHA1 adf6daea1c2fb3228ff871dc29c6766b7924a89a
SHA512 e6915c3d0bc46a257341323392a0fca588c3f203e1f7ae9a1c5396f39be62642d5a6df8d596564a3089880792d54d5f0536d98c1d3ea56ca3cfbe82721cbfc23
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zSXLOf445B+:Loq2Vjnmiw4H
TLSH
T161D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 194443f9195702bd4291d8d3ef550c982be8d07141232289bff09ecc217c05d6
MD5 ace7dea951942020798321e3f593205c
SHA1 5209c5d9d9eb13d452d0c6cde66ef5dd871dda78
SHA512 eed04f2d23b403022b763ae52f5db74c4fccaae52e98d4fe0722032648f8bbdd8b6d2471854a4f6ad094db093364c7f7d01629fcc0b588fe24d19e241adf2367
SSDEEP 24576:0AhGLmIFoiwtA5l7S53xN9RLLq/X4s5Qd+vwDH2uI5jUV:0AM1Foiq5/XLOf445B+
TLSH
T1E5359D81EBF955D4F5B3AAB899B69171EA76BCA95E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4815045d93ef9fdf854f6483c4cff141bcbbbf853c3fa908acea3304f8e84c5a
MD5 b70b81e1c103a45c6cbb3928d7c5beb5
SHA1 69a8a436c8eb9325ae794070653d2534197a4aa8
SHA512 9a0cfd9c69e26e7d6d19ed50dbe0ad60d1b7e42e91bd28ff30d235ac95468600348dcab44a12dae1f704cad4e80a82125977a0b6a409c6d72a173d5103fc934d
SSDEEP 24576:Swu8OWgN9RLLq/X4s5Qd+vwDH2uI5jUV:SwzODXLOf445B+
TLSH
T1F265F14637A81CF9E9A756388597D132F7F2BC012A60D71F1760C65B6F33261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 726b26f93ed0c2c62c3d2ff19803a6ba8293b4de319f047a3f4f541b9d8c371b
MD5 fbf9ad42da6a772bb36eb75e8417fb04
SHA1 9d0cd278e588d6b8d7c7403d6bb801650eeb4999
SHA512 70bca6193e3c700f88237c698f5d73323006571e6e590e4114bd26aed60956a275cc06710db7c3974c7196f794589e6373ba0e6adce248c9ab6759c191849289
SSDEEP 12288:yWZ1Iy0N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:nZufN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1C145125733A820F6D1E7527C88E46611E7727C9527B443CF166052AA2F33ED19E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb72739f1e86f9c7af82c5728d5e70db70334f985a6e7b72b98250109ae049e5
MD5 d2b72253b09f50153470a7ec57130867
SHA1 990ac67ece692e3e5e4b346bde01bab1816842b2
SHA512 59b9e3b904e46318ddca2d72663ce938bd8d697cf25f9b043daea10c21bcb842f065c569a51c5ae431c973a1e03b9aa3689b629fcf78d8f78e04269eb1a1b5e6
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U+:HQRQyi36YOcPuLvw2gAf+PN3Nw4H
TLSH
T127667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cece6df2fe5fddb8f0e3bcb4e1ee623d2ac966dd291c2130141893f9e34162e0
MD5 1c0805a7a260cefa2ff80ed4db20a502
SHA1 50195c434ec419c5328a9585eb893abb9aa179ae
SHA512 161df836759e61afdafcf7177ee7f893e1c0d3a0547b57afba85f310354603e77a246c48ce5647fea9e8019cafaec644dabe7c3d95be008eb53fd9a927620f88
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U+:iQRQyi36YOcPuLvw2gAf+PN3Nw4H
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d9e337ca50b797b106e770e49a16f0a71cf0d0d949af47ec9ac8f2321bc79309
MD5 d8674acb9151dc01d750720c4f22e6d7
SHA1 3ec96c71acaad880d557852057eafa501fe715bc
SHA512 f2d5a50a027cdf16a148eb3f3828ac0a82769528efb80be561ac09759b14c3951fee8a6225d030076b09f8336a01ea27666c895b9c2cabfa7127f3b724c462e4
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0PN9RLLq/X4s5QdB:J68Qg55nhxeWu7PNU3/CXLOf445B+
TLSH
T16AB55A33B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3a08e803c19574932947d67a5c5b518df946dda39ed74911b88b47cb74d70df1
MD5 af7946b77e5aff1581850d2aeddd33a8
SHA1 91bae952ed008265cb53236d2d1f6ca6d03b31b9
SHA512 e5d37064f432d63b7ba4bf41f14739db959ffb6aeee2ebc3144ebf23e48cfe7690b14cd7d769b27c46f4bd1481060062f9b4b4501509947bfc0fb33ba63ff6ab
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:my5112gYy5azzVvD69nLKnhZEw4H
TLSH
T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 32420ad6e5d16ebde0517ce81b950c0a83bec692b53afb84c9f5b9fcd5a96d18
MD5 5975e1d9fd08a42152a7e8afdf068eb1
SHA1 39226694395f425bf818169a7c365895520584d0
SHA512 50b422d0f800639453320e60b6f226d573c42278ccac461246b01ab47129377770876f94fea63002fb1a01aaff67e1fad4ad0fbccc3e163957a1766bbbd6e218
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYXLOf445B+:Fu6JmQxd2dFw4H
TLSH
T1F2D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b012eb94a6f6eba5821940e806efc3190ee62c38321e34dfdd6a8316a9e81c5a
MD5 9e797fed5f6167a3dfde6121176c6fd0
SHA1 fdcb9290391bdcab142a15e12a53da7ca105acf9
SHA512 b1af9bbd5756047cf42597c0b7653a25ca7bb9d535d08f2d5bcdcef4cb4641d08fed1c4841acaec1b835255a3b2302ca5e59f3be1035b2319311fc6ba1078352
SSDEEP 49152:i1hpsNoJpF1A6yU44CwH7R4xMXLOf445B+:imifPVRiw4H
TLSH
T1A6B5AE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 82d136a3b6d3a1f8fd9b5c70c8d25a166727942a0f9f354c8a8e58f7864589d7
MD5 1f1a0082393be8bba652b1d966a889d6
SHA1 84da343286248ad088f19347f9ee31e68fdf031c
SHA512 c63c85853e5ef6b968fe653a1d6695c099e142e68e9b62704d0933b0fbd0c45e396fab52348a4afb80dfe32d5632abfea0f7c46c2f389d4715df98e6db65a993
SSDEEP 49152:gSuZQIY0Be2KIRVtOnks6NMHqFXLOf445B+:65dKOi61gw4H
TLSH
T17DC5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 31a43d4667f74e966d7e32be05ebc94c8a16e59192ded07b637e425e547f5537
MD5 bdc9f9168145ca06e964b3454242a05a
SHA1 33c050c6c5f587a749ed113570e9d46d22550ebf
SHA512 eb69930b868014b6a74676140b64dc7653b54b40bdbc7f1d37e3c44b2118cad06f33f508ffba646139010fcf6000fc4bca01513e3c2bead4eb24b2cb9134f256
SSDEEP 49152:3htSn8EApI0figGgiDn0AP5wIXLOf445B+:mX2i/phGw4H
TLSH
T19B95BE13F2D900E8D05ED178C7568632EA62BC150B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 0acc5fbdccde19f478abddf16685badff5a801ea0236c59e9b4be117c6385c0c
MD5 1b4ed9076ca99b23844ecbc2d44ccd89
SHA1 033f1733453b2486e7ab5b9a5496e8d1b90ed391
SHA512 843357449d480f12668ce5fbd8f2b51d0fe2e956363a98e34055225c1bbf3ee1adbbaf4f6eea53c23dceb530ca282ccfcafd761020473e7c85cbddf063b9aad8
SSDEEP 12288:lDN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:lDN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1B34523232A6E1873D6D95BF800D8717275756DCC3DC421DF3681B12AB4339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 58cf9020345b88f5197006055c9e402822bdc84b8da42f9676fed47ee1cfe65f
MD5 a35d8d666c215b7db57112d9963eedec
SHA1 0c6e708311d0176a64fb14b624358c515ff140ac
SHA512 a68995a3a8f8cb463f06bdabbfc401c56db8e8b4966d8caa384c83a1b2175ab3ab1ba11ca5c1142f7211f7cb1255d4eb4ed9b353db3b197e1f252adaaa1ffa8a
SSDEEP 12288:H4N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:H4N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1DC4523233A6E1873D6D95AF800D87172A5756ECC3DC421DF3681B05BB432DA4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2631df7205f2d52a7e04b0f9f901a03b4dc31b5b4f8a66c9f9c629600839dcd7
MD5 24c7734e6c0ae9398bda62beeb1f5b63
SHA1 ba210b3bc20b11d8ae65a303bed71ff22205e1a3
SHA512 283764d91e717838e62b2ae382f29ed558385c1fcfa6dc828276cf88c7eb267af50ecf0e13fba775ea3f900691a3b6dbde45f2d2812db8a44f037b2b6e156f57
SSDEEP 12288:1uN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:1uN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1B94523232A6E1873D6D95AF800D87172A5756DCC3DC421DF3681B05AB833DA4E29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cad9bc789d081c7326ecec8ab5062ba1d4751072de929813d7714c36e557ee2e
MD5 2fff62e3e7a8b86906ab1a58b906fe51
SHA1 23fcccf0057d0f13496fde70fcd4cfdd1d12270a
SHA512 b4bbf5f1779f5855aa18d6a6083766c167a8c621ca4ebd356ae5a165a9ef4dcedef24dc57bd14f14f8e74ca976bf9bbe2e9c156174c653a41a7d2c6342477c40
SSDEEP 12288:qVRN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:oN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T11A452313276D04E2C9E6D7B844E4B131F2B1BCD87AA063DF1640355A1D32BA4E67EF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 55768ca872f5e594098f1e2887ab6e79c93def853e6a523852523c29b18b3ce1
MD5 6ebbf649f4bc9f0b7c532efd70330dfd
SHA1 51ffc0f4184a20d3b239c0a1132f6c1d1489e3ab
SHA512 abc79cdd0c8cb82cbf4d8f6dd186f94a23ac6b61e2d425c9410dbec05b86f6f02e2facb2bac1a5ed2ab5da0d2a5ad26087134384d1ffe42f469d768a49036516
SSDEEP 12288:MJN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:MJN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1EB452323296E1873D6D95BF800C87172A5756DCC3DC421DF3681B16AB8339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 9cfba8d28522a3df3afc1662a074f493a1ac923d5c48907b31d38d63b3e37e90
MD5 e08788ae637bb26fb7cf6d33a2870da4
SHA1 aa7034dc7a08475ae2d5ee0d58162eb25f390126
SHA512 0328edfb24eae54d316f34d5b9523f0947965e79e388c26dba57589a773e8ac819f5ffb02d63942646a7819e33212d84714d971447cc2a8c1d7a0d8464aff9b3
SSDEEP 12288:rsN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:rsN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T16F4523233A6E0873C6D95BF800D87172A5756ECC3DC421DF3681B15BB4329A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 4823d37c252cace592b58222ff468d40c493bff074e37ed9291bdebd021ac1e3
MD5 21ec2402a8c7d7328610642ea26a9d39
SHA1 2beaed687d8888c8b5199ce15bd190d445532dd1
SHA512 a4798a4f469a98499b3dad3d2905d3be410b46b04156ec64d48b6064c5d98352aba7cf890f53b8a970df3cb0508f6f13f7d25efb924a060320cc52655ee3d1f5
SSDEEP 12288:nQN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:nQN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T16B4523232A5E1C73C6D95BF800C8717166756ECC3DD422DF3681B05AB4339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ac8fc1a0ddaf238a7b44eaa5cb28c00f9446e3d62c2d7dc0bb0067475a360243
MD5 954f1ada10faa5b2d27eaf64755c3e5b
SHA1 80c2b282c3f315bc5ddb28c943b58b6b794a55dd
SHA512 6f8b281c7051f20b078c91ba6476e1e864e7b847ce17f0a2819ac169bdbfed15018ce7a0065b644a7b941c4b3a7887944056eda158ab892136e239a729589170
SSDEEP 24576:rZMszFVSOYN9RLLq/X4s5Qd+vwDH2uI5jUV:rZMszfKXLOf445B+
TLSH
T1C56501A5B3901CF4ECA7823E88559916D2B27C590BA0C65F03E4366B5F333A11D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 46e78ded84fe5cb21817a3ff22c963d01aa0f65324093d9062a52e5f1a2d2240
MD5 304854c241210654b557dd5f5826b7f3
SHA1 f19badfce016ee787425b1ad8920534468b241eb
SHA512 defe00272ecf9fc16bba75867e71268c657a3ff3d58569a8706a2149637f2f35aee895340984488bdea7d3e81a4a2dd835476894b9a7ca9442b667f7236d8044
SSDEEP 12288:avN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:avN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1C34523233A6E1873D6D95AF800C87172A5756ECC3DC421DF3681B15AB433DA4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 fbccba3b769c98f15488e7858fd448295f24e3b42bed7110ff50523cd84f8820
MD5 13b479bcc28485c738d82201ad6e458e
SHA1 81be75a8b3e5180cdb5dffcd580470db88904ca8
SHA512 f4fe65a7a44847c58b5bbecabe8393559da6f6ecbd9cb3958c474a059ae517961e62adb0ad65f94c7513dd15eed07ef8564dfb18bea1a6be19253c0eb127542b
SSDEEP 12288:RLN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:RLN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T105452323395E1873D6D95BF800C8717266756ECC3DC422DF3681B15AB4329A4A2DFE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ffa0ff6b6dfc4ed2ce32422ca1a4cbb739ec302dc3784506a6456c3fa6c97c65
MD5 d88d899c161f8760dbe429fdf519bd6e
SHA1 22a43a283d811f57e4260a77f08b7e6d91a9265a
SHA512 b3c7e4b8e0facc203543f6e1db3f10bf2dfb70e7fe0e28af8630ebbfd05211fbc1f130e415b1bc814d0b59a4ab8872bf5825db8c137af94101a8391b8111cee6
SSDEEP 12288:ZyPz5L80N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:Yzy0N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T18255121333A530F9D176927888952A12F7717C751B609AEF13A0527A2E336E09E7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 e370033989191d4c636a7f3c6ec3ca6dedda1ef09ecfe24ba6e9da357bccaeb6
MD5 dcf36fd36e9c831b702ced9cfcc14121
SHA1 ecc7f79a7c029b7bcefee5e0e26bb5834cfd5d27
SHA512 a1c0f66df681cfc70241321a24c05bb8fc743fab82c8d65b7b72cef3d4b693d7726a362b1d9bcc1bd74907d8404add2e4f4a6879e28f0d6a440439543c3a3cf2
SSDEEP 12288:uvN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:uvN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T17F4523233A6E1873D6D95AF800C87172A5756ECC3DC421DF3681B15AB433DA4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 ec0b54100ef9bb9cb7be8047ee2ff9c7598d4ddc3e2dc5a9f02b4c0462deb4aa
MD5 976d97879bf6b8de4352e75f852c8706
SHA1 7c04f9c58d8d224e5f502b9b833140a3727bbd50
SHA512 b621c4f343e8e65166afaaa516f2aca92b9a291fb595131bd0fd4321bef1d3a433ef5e1d4d94d1d81475daae8ce741051c3435fa763f8143dd32393fb5100b8e
SSDEEP 12288:kvN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:kvN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T185452323396E1873D6D95AF800C87172A5756ECC3DC421DF3681B15AB8339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8eaa764ac568023a401a6daee63b2e4733bd2b9c93e736f404b3d04e4726ad13
MD5 fae1028218d18f55ef7289260d68639b
SHA1 bdb32551862c7c9f58d2ed362b15306cc990f477
SHA512 5a5e557a52ee3ff79f35eb5c749f5352dbe88d86a04dc603b5845e97462783fd3410337c507b6c39c2c86a17cead0ca19f1a85a6dd75aa69083d902083034578
SSDEEP 12288:NyPz5L80N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:kzy0N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T15B55121333A530F9D176927888952A12F7717C751B609AEF13A0527A2E336E09E7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 aed574e4fdee42c7e2aff8fdfae506c666055132196a4bc96f552d0c5a08c5f9
MD5 795c1ef2e72ff14565c16184ad90504d
SHA1 48ba141acb8d9ec994fb01584267366e726718ef
SHA512 be6995c9cf23317b29316d87c2d9a099412b134b0f3e1c25705ff7516b4de4612b950e4b72da2887fa529e8bf8bf55491f9e8d42ff4a821690678d9f1ef13b63
SSDEEP 24576:NTJaLl3z0zDeN9RLLq/X4s5Qd+vwDH2uI5jUV:NTULljbXLOf445B+
TLSH
T1D66501A5B3501CF8ECA7823EC8559916D2B27C590BA0C65F03E4366B5F333A05D2EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2a55ed5f23113e4903d9c84735c9b18fd5ba2255b94a5f6081581ac183f76d98
MD5 4a5bbb9f2492bd3e6e71797f7e734550
SHA1 cd7dbde8c5595f85d3920dc484ba50fd3368d9e2
SHA512 a5f798a45ac2397adfd607556849fc1793ff8ee2106f2b015a76982a4f9c7e0694261595d2250d367c222ca30c875c9170f558b26cbf95ca98b0fd5802626b85
SSDEEP 24576:g3ad9CHKy7GZCN9RLLq/X4s5Qd+vwDH2uI5jUV:qad9CHKyaKXLOf445B+
TLSH
T1E975DF91F3E814E8F0B79A3588765511DAB67C991B70DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 25d2fcc15d24fd7a0db3d9f94a0c5343e8f8aa9dd3cc8083cba4c93b97c61263
MD5 24120ba88a656b55f1cf1384283d0506
SHA1 a552543f9a7c8925b222147f5ff8a3ace623712e
SHA512 42888db94cb2e8def9a84a12fbcdfcf60c93f5212922d387c5e877a215223691c3c01c1697564ac3e193118a13fe77a9b2cce2b3bf833c95e1a01ad45ca16f00
SSDEEP 12288:iON9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:iON9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1DE4523232A6E1873D6D95BF800D87172A5756DCC3DC421DF3681B05AB8339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 f9d1119e72741aee0bf9c3608f4eb13ee647f9a3796b29a79493e982ea1b5cb0
MD5 b30e5b6267857d0fe9d89a62c65343cc
SHA1 5d4153aa6c4bf4639aca5d0e3e5b3debc45e8923
SHA512 dae6fb3b7e121e9e04891b9e1186e33520f0866f8396fd34851d12bf32a6e9d6192e38ddd3775d49b938ce60be7cc5d45aced92215ab38dd55df7f0ff0b50a8e
SSDEEP 12288:FUN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:FUN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T14B4523232A2E1873D6D95AF800DC717266756ECC3DD422DF3681705AB433DA4E29FE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 dc2ba12a51ae00e5cd81fd313bccc84a52c05dc123e391ccc508f88f7b626fae
MD5 34b4daa2293abb101b646a2aaaf28d25
SHA1 7c75eafe8e101983eadc90bcca1d660a4561a53f
SHA512 1849bed48f9cc3abcbc49fea27c530e7050b67b5b965408659ca2dc03c4a44eda0b3228f9c695f8f58a8c5eceef0d2f7a402a490242c6dcf89abd5faa6cb17a4
SSDEEP 12288:E9N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:E9N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1E9452323396E1873D6D95AF800C87172A5756ECC3DC421DF3681B15AB833DA4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 33078a4979a65a4d7bfb0fa43240824970f7258ea101ecf01ce621f7ecc91dcf
MD5 b6b06d612b94402afefa76992f46afdf
SHA1 e3ec5dac7dbc6cf1ffe33c092e79bf1e5e99fb0b
SHA512 e0065ca463c2fd8e0d518a5891208b8a9a5feee501381222d630c7c31709aaeed5a9eeab3a8b977082d0dabc3b9d5bbf5324a248b1b8165b2a8e42e4b643cfa3
SSDEEP 12288:CvN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:CvN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T18F452323396E1873D6D95AF800C8717265756ECC3DC422DF3681B15AB8339A4E29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 176ee6d1f56dbb22ad098da8aee52a39d65325788b46533702ed7c2cc7b3676c
MD5 30246c3c635ab0544e01ecc998d4338d
SHA1 6fb425ca218ce1a8be3b21dc543d574a1e37b216
SHA512 de6730595f76f65c62b93d409612ce09be26ec5697fc45a681f3f02f0a6f890d73ceaeb315c4e09d1e36c1d6b93f5897fc54c7407980897f73cce0d6dced7c29
SSDEEP 12288:HON9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:HON9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T19A4523232A2E1873D6D95BF800D87172A5756DCC3DC421DF3681B05AB8339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 e6c2130a0de26c6130184ea34f5f7000db8954609944c554c97cc0d73302f2ad
MD5 8c1efbdc90ff9a7a91b46f6a0afd07d6
SHA1 2d0d9f1a6bbac410a40276339e4d89b134880a95
SHA512 5335dbea3a01a3a8e2cf45bbb85c58fc9ad528317cb97debaabebb634b9a28f3c2c2a804e09b34900fe1bcc734523d145c8e14b64355274a886d44060e94e545
SSDEEP 12288:1HN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:1HN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T19B452323396E0877C6D95BF800C8717265756ECC3DC422DF3681B15AB8339A5A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 25cbc74d8490a69dfe87f204f6353312d3190c6e70104cadea18ef293de92386
MD5 57d6f8ea2fecbcd5168a2b1abd0bbff1
SHA1 3e12c69b29b859fb7e7e2bb720ec15a41f910c1e
SHA512 8c5e67f7c6baf1e1565734a3a1979dc7de1eee3b6eae0369e50db0b147a90eec302907a4e7b773c8b65eadafe152ce3965113dc7c838f75c9ee47625026cbccb
SSDEEP 12288:AJN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:AJN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T108452323392E1873D6D95AF800C87172B5756DCC3DC421DF3681B15AB8339A4A29FE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 54df248a3960ca22662db8f26c2c97bcc4ceffd050f849959817f23a3f7081d4
MD5 a1154ffa2cd150da45e13e1df45f521e
SHA1 188fc16399cd49061028aecdc097d42b9e4b463a
SHA512 9e4560a6e3273db5edee90b2bb3f9dece9407b4f31aa5e23299e39bfa47f05270b63257b9b122b861ddcc40d995edaf98a67cd989d7ff3b8cdca8ee44abccf9c
SSDEEP 24576:Jfwv4k9RX6wkyAIbN9RLLq/X4s5Qd+vwDH2uI5jUV:XMnYI5XLOf445B+
TLSH
T1B475D029EBDC04E5E1B7923C89B7460AF6B178581B71C2CF129A536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 57e1403f01f3514f0cc4f1c1a41c5ba730067995a0083830233be5dee95d2d0d
MD5 c4293a2c2cf271bf3de6d5230f0ee07f
SHA1 041439fd6311b25c46b0aebbd2267dc0e4fdbb24
SHA512 b1c8ef9cf0c478dfb9cfcae5bf62c5b711b5aa2b3044d13c33243888a518a1aec99195113cf1fa9d5a53adab26bb5a6587e0e5ff67f84885951f58fd231ef45f
SSDEEP 49152:LYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oXLOf445B+:VySzPtw4H
TLSH
T1BF066C57A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8aca12050e19ffb61c8ac00773f10e7e8679583ddee62d3cdde3f933858b10dc
MD5 31e46f4f3737627402a744775e709cd6
SHA1 36404d4e69bf87b41d7cbc33060d4a2bca0c5d32
SHA512 b61eebde21537c93e8329f068f0d97da2f2450a78532b0cf4c824b8c1539ef76697986dd60d971722e984cad13bc8cfc1861c72bd418ae396c4b238861529996
SSDEEP 24576:c47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYoN9RLLq/X4s5Qd+vwDH2uI5jUV:c47JUQjairIhCnDHUPfF/YXLOf445B+
TLSH
T18E65AD1EA3EC01E5E1BA927885155A1AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cca9d2b11deb43759d63c9b4f22b8c874e04303f6d0fcfa2b1c82b9f804bf566
MD5 d6da0444f75643944830d718fa0413e7
SHA1 8e43c7e7aec86fe37a8189f4c49212c62559db49
SHA512 c0ba7a347d519903e7019ae52c480815b80912e9fa06bd81f992aced9751a025032537a9bfac76f673bf85d42b9568a56b412f80ee087b93c27661b5ce69a42a
SSDEEP 12288:0tsffN9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:tfN9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T15455011AD29801E9C0AE6279C7955651B3337C6497E0E3CF22D0F53E1F366909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 6b66a5a25dde84f1d9c93ae17995e48a8cc4b3a3ed6bf769119445f3b25534b9
MD5 b38e9193cbb49e51015c03871e5187b6
SHA1 458cc6609d793bce4d3e69424cff32a390a5b656
SHA512 144ba470877d5c21c5ea417b428ad1a0102930d8466e9850fcee8561bbf5385324f2a2e25e35860819c9686906548fb61b6a91f9d654496d36ff6ad8d8c99c32
SSDEEP 12288:aYqWU3f1Cl8TziNwSuBO0ES0sW1msur7vEBLTB65Cn:aY1UPtEb7NurzEBLT3
TLSH
T1B3351840766AC75FC6AD40325E36D1CCAB707D11EE45AB0372C9873FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fbc9881a4f0d3aa96f872c72d3448bd23565b6604a8302e414c946904edef2b5
MD5 732687488cbba3e8a22d24ee6c16542d
SHA1 014eaf3cf32854437b91b9ba508b7123fb19f149
SHA512 6eb7d91d8a31bde35c269da97c64dcdafb997c424b8c5a2be49a6a94a079ccf54a539c009f20c2d458b91f03adf6333accc27653d5c2c41697a47c241a2ec8f0
SSDEEP 12288:BiNwSuBOSiNwSuBOo3iNwSuBCGfSesdSiHwLiIOShiNwSuU+V/IyzueOahiNwjc0:Vh
TLSH
T1E455C8816437A3DFD1FB6031072A6B4CA7A4EC46B7055F2673C8453AD82BB25A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 2fd2b18c99737a3bef7034b42a7800623dc5866152c0c84e430c8fe51b5161c7
MD5 b73a48174eeef7c9266e872cbd8bb76a
SHA1 8a5558dad1ffaf16fa889cba1f41ba9c46220a2b
SHA512 dd071836503fd4df420eafe9e57f9d12302c91ed42b0035c95dfcfb844f943aa32a5a1cd314ab03f2bfa5f0c767d75acadaacb06473bf80b4ca8e9e2e8a0745a
SSDEEP 12288:Zo73N9RoyLq/XvQsCHqDcwAvaQ+vFCDH2Ih9I5NO2Uqa:W3N9RLLq/X4s5Qd+vwDH2uI5jUV
TLSH
T1D1452323675D1C63D9F96AB4009CB1313639BE982FC461DF3540719AA432DD4DEBAE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 205854c1f6cdca8b2747911abf1288cee2c43e0a98c05e2926ff924990c70b4c
MD5 12851e57f514f9bd678871a385c7f884
SHA1 581573f768bec3ed16a6c0848a41458622b21204
SHA512 9e75b87ce75c28d935c2ae9981c7ad1518a0ed3b413050edb7f9e43c9e5ce1a31c5892b6e613cde93ef7409fca9533de29845930f957c8a1702f43bd0d37f8bb
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYFN9RLLq/X4s5Qd+vwDH2uI5jUV:hgb4mBIBhGFeXLOf445B+
TLSH
T15865AF1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9833573fedeb1b6a26463da29bd86d330194ed87c4a65bce3ff70006d59eaca6
MD5 44ffaae092c93941c61ca137696d8d2d
SHA1 0fa61349f5a46eced2f01a24d75eb7da27ba237a
SHA512 c19baf02e91d9e916708fa6e1721eead26ae2b3459477d23afd36b1ea91ec44ffb6b0ca7d6ffb8da19a0de352fd7117bf0dba52558f37694ecd7ab40efa2bd34
SSDEEP 24576:fG88u8FpJqH1Azria7/mYN9RLLq/X4s5Qd+vwDH2uI5jUV2:u7ZFPqVfa7/zXLOf445B+
TLSH
T1AF85F16277E101F1D47BD13889864663F6B2B8250364EBDF06A88B551F23AE44B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 87fce92b243ae9ea66690d0f9dd5b9796f4ae5a962f33356980120a2bce12f61
MD5 51a3a244681aa978b3e4ba62acb832e9
SHA1 f3841e902464eae1c2623e0658b94c7595e0b810
SHA512 6794b11c02ced6f02c5bf98fedf023b8952091031efa92c7cd05984842c38af43ecb4d67672c2cdaf015a01c4c88ee84fb38aa8419f73858ad6ccfca7f5e8a15
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaXLOf445B+:PG05lO43bsw4H
TLSH
T113D5C06A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f90bc98ada4a2f03467a349e70aac933b4415f776a7ff77faf2104f1dc2bf875
MD5 dc0161288f34f9b8d8501e1841f76ebc
SHA1 e792ff8d07d83c8a8b2d7f5d65e975853b2152f5
SHA512 d3b4fd03ecb83a42b3c6472cbfcf404a23bd25d3d7c6fe604300e71675bc834cf3fb9dded09d36da7cd1ffe437b0c3846192b817896b77ff91133fa5aa4b3137
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnaN9RLLq/X4s5Qd+vwDH2uI5jUV:Ca5POZ3hJt2pasx2+mCXLOf445B+
TLSH
T1B865AE5EA6FC00D5D5B9D17DC583861AF5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d276cce3fda3f38f75fc450a8abc65530fe2d61265bb345aedb3e9c967f4e7d6
MD5 a1e6c8fdadbbf121b321f2c01a809a40
SHA1 1cf7edb7ea05e06959e2de84db1de9bd626bb116
SHA512 1f355d31e0ac0b76f7755e7364cf9cb979631c3fe4c39b9cec475b85ca81fb17d5e67d11a95c5eb60755e1f298af85ef723f4576ed93f2d8d70b812326bf20f4
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkAN9RLLq/X4s5Qd+vwDH2uI5jUV:4Nc/zEOVHFTXLOf445B+
TLSH
T106857B2623E901E4E5BBE1BE89779546FA717869173086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 be00a35efe231185bae8a0a372b7c97b739dbc51cf646c32a1f80e0ec9248ee9
MD5 5d9147cd9b8d3193e67e24452b7ff648
SHA1 529b7af8679362102e4a9d4bcb2a903a5837b859
SHA512 58b8d36280b8ffd6fd87318b7c19c1ca323589258edcdf279c08b314b339f62e89acc1822a25823c3cc654e6a8afe60d899032a92f1a95fb49bf624e6c326616
SSDEEP 24576:Q3kNvNnaFeYhJNtmZBm2N9RLLq/X4s5Qd+vwDH2uI5jUV:Q3MwBtOmcXLOf445B+
TLSH
T1F755AF2EBAB805E4D1FEC6B48D238512E6727861173253CF5290C13F5E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c9a84ae314fd7bd40de354603ffe83dcd22e64ba888c7b195b1df63f72ca30df
MD5 22beb25e7c9ba1056da8c75141a686ea
SHA1 58b678f4525921fec23d2a83c3fd4211a03917c5
SHA512 bb0a606d334d3127214fa25dc21168f7c48e4d125c8df8bd2640962a6d313d5144f548e53645e916e0821c4eeb0d337853d6d9345db8a06cffcf700ab10ec9cd
SSDEEP 24576:RPUr+NQ8N9RLLq/X4s5Qd+vwDH2uI5jUV:RJQKXLOf445B+
TLSH
T19365F12F22AC1CE5E67AE17C85869619F771B861175192CF02D0817E5E23EE8BD3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 65901d71b6d637c68afd4faa48ee147003c0ae2e61ae7820397503a3dc4c131c
MD5 f4955ce7fea72c499ba3ce4eb8f00f88
SHA1 234a875811cf922d0efb667b4b38533531e08de9
SHA512 30698f6fa48a18bb0f44fcb6d27f1297599095dd78784b90d0d32d42728a3c82949f2badac76d325934883c8bd64885cac1e466d98ee7f53de5242b706954833
SSDEEP 24576:gD3FHshBIYQgAjN9RLLq/X4s5Qd+vwDH2uI5jUV:gDVHeBIAAhXLOf445B+
TLSH
T13675E13EE65C04E4D57BD1BC86A39606E77138A8032166CB02D491BA5F2BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-125-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3692-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3692-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3692-131-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4112-83-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/4112-78-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/4112-279-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/4112-77-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/4544-64-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4544-66-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4544-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4544-264-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4564-76-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/4564-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/4564-7-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/4564-6-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/4564-0-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/4724-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4724-221-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4724-52-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4724-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5104-120-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/5104-114-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/5104-112-0x0000000140000000-0x00000001401D1000-memory.dmp

Download

memory/5104-310-0x0000000140000000-0x00000001401D1000-memory.dmp

Download

memory/5396-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5396-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5396-311-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5400-314-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/5400-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5400-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5400-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5772-14-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5772-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-22-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5792-53-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5792-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5792-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5792-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5792-38-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6104-294-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6104-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6104-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6104-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6104-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6104-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download