4837a2544c35ae5f9153ad18b568034cf6cc48d3978cda1f94bcf2074e3b1aeb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260803-paandaam41
SHA256 4837a2544c35ae5f9153ad18b568034cf6cc48d3978cda1f94bcf2074e3b1aeb
MD5 352773b50b9bae58d8b62d9e986ef0ce
SHA1 0f7cb4c643a417f4e6dc24329fe00fe1ec3cb195
SHA512 54b97a3615f730cc00dd417c42a8a9eb2bbfea52b8f60c2f370a8d49a85ddc0e84937a42d481961ea6d5f800ea7f4ad9e8f4a259452dc33cfd8aaab69e270972
SSDEEP 12288:z93G6vHzOASubviBNDYa30GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:zVGGTWBZEnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18165012136D0D4B3E973093048B18A616A3EFE702FA59ADF7384172E5E743D14A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2676	elevation_service.exe
4116	elevation_service.exe
1524	maintenanceservice.exe
1336	OSE.EXE
2120	PerceptionSimulationService.exe
5796	perfhost.exe
3700	ReFsDedupSvc.exe
4360	SensorDataService.exe
2656	ssh-agent.exe
3200	AgentService.exe
3396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55db2554238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008954cda54023dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000177b8a34023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0d3f7e44023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ef2e2a34023dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b15bbda14023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a961eaa34023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	3700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3700	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3200	AgentService.exe
Token: 33	3396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3396	SearchIndexer.exe
Token: SeDebugPrivilege	2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2676	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2952	3396	SearchIndexer.exe	100
PID 3396 wrote to memory of 5392	3396	SearchIndexer.exe	101
PID 3396 wrote to memory of 2532	3396	SearchIndexer.exe	102
PID 3396 wrote to memory of 5220	3396	SearchIndexer.exe	103
PID 3396 wrote to memory of 2824	3396	SearchIndexer.exe	105
PID 3396 wrote to memory of 5544	3396	SearchIndexer.exe	106
PID 3396 wrote to memory of 5728	3396	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_352773b50b9bae58d8b62d9e986ef0ce_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 103b1a9260a873c423956aaaa596a597f1bbc928c6279ad9757ee9bf31c91716
MD5 24b9ce51bae891dbb50cff530d609365
SHA1 2afe493981ba42b1b9d3df434a1d2f138703affb
SHA512 ac2e479c633b304d0ab104c00d60f2f8c9de2e7235fe669f91f720a47583a972bec663be7f5deffa63b4459603799474751956b26bbedd4418af46922d6b834c
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMQ/lFTjN4:d3q6HjBcLm
TLSH
T148D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2bb312101475af2101485436889ecd3b2d91a97ef22215b6f533d34909a1dce9
MD5 75e87325f34732e77b6b75274f100abe
SHA1 cebaf58afb0352155782bc6e91603715ce2c648e
SHA512 bddc13f780d71281f34eda616c14bdf1799f8cb0d0d8bb6630295ab180f2c334e26302f75f80d3c72b72fbd86b9fab2b2a7d0a85a3d2d8def0b024b494c824d4
SSDEEP 12288:k1XLsswWkxy2lRq2czADGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:iXYfDtczAznQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1C065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 734b4ecde0d67c9037e913aea457cec3d9e9d0b5d0dbc8ccd6a6038257d25829
MD5 c152ea23a75815415b81f0bc5cf74f70
SHA1 0afa6d4f14e31b69b92d595af2c0089a83c9d1c7
SHA512 2371aeddc664e7d632c28f17ee752b81959efa85c75d49d4475ec3305650a69aaed1bfc28b1975ea6bf7c0fd1e81824695057a605d0301f3d382b8b4e9cf740b
SSDEEP 24576:30Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0op:3Pji0AlBQ/lFTjN4
TLSH
T1AE859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d9b7d92b72500c4df644b2fccb67caf0f492022df5ea216e1c616062e3a65932
MD5 174e1463f2f65830c6793850edf5e075
SHA1 a9bc1a063891b11ccc417073b28ca1ac29a347ed
SHA512 11f29eda1158882c7ea667f22c10bd2acb5a2b96a06da13d34a1207a4f290b97fa4aa0b38d2f2e1b60ebfd65d9c16f85bba430fecd34063dc03e65338f2a355a
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuenQ/tbw/2Mkjy6Fr7g0oc:N/ezSC6vUzPvxHjytQ/lFTjN4
TLSH
T16E755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 01ecde9e29448cae0bf3b18bd8c1dbe3499ff914f750498372741f7020a9a63f
MD5 9a2a9395a2f96651c7cfb90375d59087
SHA1 7fa48482a564511ec8fd21348a5ca7094a5064bf
SHA512 8b27683dacfd4ba1e3e39e60b4230eebdcba4fd838aa5f84bf275c8845f78f3aeb91873ee7c6bc66a2ef7762c26d4acb198d6f1701c6db3f0e862dbfeee594f3
SSDEEP 24576:qVbqPb88hv/l+6nnQ/tbw/2Mkjy6Fr7g0oP:qVO88hXl+AQ/lFTjN4
TLSH
T1A1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7dbb569c83b56eecc27111255a7da6e63a64b8218ee32649a5db26950e551475
MD5 f190bdbf8e7dcb7ae0f4ee182f724ffe
SHA1 005bc02197c6aea113428cbf1899faafdb9358cb
SHA512 90fe33da2438b44d48ec5c9787b9b2786543f393075dbddc99a77a38180f3276fddbaa5bc1cdd4903fa4c7fe5c01b81445e66e5730eeda153946399a347e5dd0
SSDEEP 12288:VzIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:VzInQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1635523696A24F897FF2B06B15C9284826B7B0EC1BFD4E74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fd105e70b3e5142daaa234d78e5734695e6a4b5ac0207391905054addcd9247b
MD5 59b8bbf6e59938f143780383c09b3fe9
SHA1 eb47b19a97beb687605d2bedf42639cf083b93fc
SHA512 2ff4d2e4b34d6c78315d3e7a7862fee1310873f53d978e5330e331e3b579fe3aa32ead56a0cf0a4f629a96c04c1163586f70e1c7cfc56d3c94686d7d260183bc
SSDEEP 12288:eeBNUbTVO86UfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:eJIU/nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 75eff373820ae4b9220e414d33e8a30b574252046f858a8d3df527f19d1a7a17
MD5 ee0643038240aac7b2c406fee5736681
SHA1 811088f48cf7c91402c1e730d7a375fce7ec2527
SHA512 c912bbeae0b95ef234213018e7ac561820b850718a381c3a5e59efa1696e45c5cd575b9e8f60d1f76c631be4295ccf41054c7aa2b9eb856e117c2958c49883d4
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:iQvGAdlCEL8c/yRNw5CpLm
TLSH
T157267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f22b04b5221f0c530733312f85d722bbb657bb434bafd41db766bcb9ea9b30ff
MD5 16885d88cc07197d113d7929005f2a0a
SHA1 308decc0085b9832c184234f061a4aac2554961b
SHA512 818cc9eac36afa7d871f575eaa855f2075db87e078775f7be2bed958f521f374cea777d57f95067e514437eb200d2e0e2ba2cc09c1f5344c12337d507e45d792
SSDEEP 12288:RAwSfxL/2Dc39DLLmt0LDQewsAjhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgx:yQewsAjxnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1BE75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 545cc2412e379238544d76d80ba189553bea7111d962e24d3cc06432955070b8
MD5 2b1bdd90006afef08ef3bdeaeede19eb
SHA1 330adbee66b17a2c798d1f6935875a06474c077e
SHA512 b69c99426f4c97981e5b4063c4b6b68f49a8e0e1aa73eedc672cd2ea84803b420d884f6c4a9f81972c130355ea330824d1a026c3ce8f8176062fd3869f30625d
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHuL:UUEtQevvqc2W1cpV2EI32
TLSH
T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d43909c49ba1101deaf5579eea99047135c11b12e59b1dd76c47abf7f98893f
MD5 1a02d165ba955b64fa30a2b3afda2b7c
SHA1 5be0f682c7d76a62bff4393385b9e3fd017158e7
SHA512 14dbe8ce5c6d9b11bc3bc586759b88130b83c4f31460112611f206d4604fd5d157dd2897f20b06f681eb9280c087f20b12eb9c56742ea94c01be23b9ce2aca27
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/zRQ/lFTjN4:eoqtVjnm1Lm
TLSH
T16CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a2ac94097ac5b34d427e6ab5d8c02251a703ef18021a34afd96ca679a6f4448d
MD5 dd270d75f69032b965d0131c7909eb24
SHA1 2dcf2404b424cff923592c47c774b545634c2b9b
SHA512 78bc52f78040f307795d5dadac80329dbf38770fed5a4d0a7a5d9acbf42665e7c6a1523426eef3be34e316215fa7855e9953dbd9a41092c4e23bdb2c3a353f78
SSDEEP 24576:OAhGLJIFoiwtA5l7S53anQ/tbw/2Mkjy6Fr7g0o0:OAMyFoiq5qQ/lFTjN4
TLSH
T16235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 92d4a81e6656eb0b16daca28d2a7f5e561815e1dc72ca4037f277aeb2a829719
MD5 56538ae4091db44a2f0f36f9a93edee4
SHA1 6085955c189d835ecd3788c4f47f342f28ff0157
SHA512 de16635f40a683772393698d570d9f95f1e89c4b3353fb69e1828311ecc24df2044240d7b37314238f74639f62f976c02e7726b17308a4b2261945f7dd8884c7
SSDEEP 12288:Qmw5HEjsChN2BFgl0WDm+C+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:NwuHOWNnQ/tbw/2Mkjy6Fr7g0og
TLSH
T18D65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8b47f18799714e2febc86fcd9adac19cc2e4ec736eb213a374cce45895d8a929
MD5 60dc659f6aa0a9cf23e20f43c1c749ea
SHA1 953e0b7493036e5f0327dd8b41457a61b5c3587f
SHA512 7e21f997d1eab8cd8ac62f122e30d3da807e29da48e133eeb546001f56ac8ed2dfce2d1c92f09f6cf32f163c32303d18b9289b172480abf876603a8059ed74b1
SSDEEP 12288:YXZ1IyRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:gZu8nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T19755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 63d0c8503961e88d7c97bcc685336000876138058f4db2696c687ddc8f70ab76
MD5 88f95cd70c89b26d51b40787ae82e9a8
SHA1 332aa8865bdc72bb46d3f6173affee22321d1836
SHA512 32ae0368ea84287aa15f02d409902fef9bd1b3703b65c8d567c9b75a512224b4ae087345a7a0b0a27eb8630fa7f17a64b461b2b16ae5c98f1e995b690b4f4ac1
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:sQRQyi36YOcPQLvw2gAf+PN3ALm
TLSH
T129667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fee9b2aeb50d637fcdbe1f623567f3d6de7c90b1c1f240b515a96686f8dd8d75
MD5 f87e61f51f0e3adc124faa82d6f393e9
SHA1 7cf71089a8954ad447d826e8e123993b67af9f5c
SHA512 1647cd68f1e9878c219af00411cbe02da5e3bcc221e3d6af3d5cb45d87d4348147b020cc7627e189299fddfaaf74ba94528df0ca8e771e5cadd260e85519738b
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:hQRQyi36YOcPQLvw2gAf+PN3ALm
TLSH
T1A9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 07433b24f7aa4f9138373d0b1f82da0e551b409215423b5739013cedd747979b
MD5 376a1cd77a949e4d83ba0c75f65f9f5f
SHA1 4a18568c5e1e957a99f2853c02cce6a1ccbeeed7
SHA512 a3494955feeaedc7a9d4add0190daf1c0514d137b12e4a53085afbde229b9f9bf468af001336259666bd922c803973f2840e9d48368c9f879b8deb560ab1444d
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0MnQ/tbw/2Mkjy6E:w68Qg55nhheWu7PNU3/BQ/lFTjN4
TLSH
T128B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9941318046b6526eb1c84c1534e4433f5f4059ca464adb22e61e2818c242d0de
MD5 cd9e942d6e2ebe6dd63439a9d94830b0
SHA1 5707cf4f957418149ea59917553eb70d3b5c8439
SHA512 5d659b222dace26fe1d82225e6522ada13641f513570fd014089f83e0e21fad743b251eed071a40cc2824ecfabf0d966e6cbb8baf1f6efdb8e6521fac004cd6e
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:wy5112gYy5azzVvL69nLKnhZrLm
TLSH
T12F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f869569bbd96948480de660f2ed7a3ad26c3484d9b62706afc89275d047e19e7
MD5 c1560104aa154e2e9bd02925f464c31f
SHA1 df8018eb7e7d5bcd1911f62168120b418e437876
SHA512 67fc5cfb6186730772ff29cd397a609819bf2ea3acbfbd77515cfe0c388aa14c4d76bcf8e042f0e69ca5bd3481758253059faf6c806d6f109f4ac34c14b2c133
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDQ/lFTjN4:7u6JmVxd2doLm
TLSH
T11CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 61f2f7d7b1f97066d49702ad9ca4fd222e8350a1bc12122f0c16a0c7134ff040
MD5 c8cabb755d5432d364271064fb0cf48f
SHA1 bd875852878e6ee47cf9912b4b0f3f20c7ae24ac
SHA512 df64092c94c7c61436484d996ec6936a9d7d59db5b05080b5c055da5fe8e60ee7e68775ee3cb78add09e9bad3894ddd9a18b7c1f58fd6cb7efc43af81e242260
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xfQ/lFTjN4:nmifPbR1Lm
TLSH
T17CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0897bc2db60aec92df791312c97359c7f6471787b8d0a87d1cc6b9b7bc89636f
MD5 170bc1941466209d7c426ce98cd89598
SHA1 40710c02a5f28d70070569089a69ff650b40b4e0
SHA512 f51097513055fa9a5508415d9a2de2db650727190018518123f5d970af66bf91a2dbc137e8bfc99b7c0eba9882029fad5b5343991d2966cf3fb9dfdc957d7d72
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHq8Q/lFTjN4:L5dKTi61fLm
TLSH
T1C5C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1c29935f732eedc5dcb6df042278c0d8d00d9dcdaf8933cda19ec5c20b62f1ba
MD5 8cacb3cbf0d2a8eee9d26b55812019fd
SHA1 b53c1984d3312c710f877e9b668343f111cefb14
SHA512 92b363794c33b790b898c481c0d9f57e3f20416b8a8eb66e7aff30b1017c40c23260ba0f635e57a476a5330e8eac0958ce2087b30978c533e88adcceb3df3347
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wzQ/lFTjN4:YX2iyphhLm
TLSH
T1B995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 049e6a259fb1da2e669d8b0db82dd286e8e24d0b6a6f35190381d26fbc3fceee
MD5 290b470e047b20cc625117a773bb7ee4
SHA1 798bbe567c4fe97a97d666735a1c6e8bc99a02a9
SHA512 0e228f15c6bf391f87d92a322d89029d431ce49f3c7960bcd066bc49248b27b4c7aa31f15ef6bfb70cede704c6149d5a5453a1766b36baaa2200eb6e7ba994a2
SSDEEP 12288:YgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:YAnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E45523697955F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 850e8502ccce515bacee819fbc7efd985f5a420488bd921ac20c1f03d5cf1930
MD5 5ffb229bd789e4004b041340c3b18096
SHA1 f3bb74b8566c6ae0ca55c358bf8bd685e091cea7
SHA512 426cd329fd1a4f8c2cb90af574ab96bf640dcd751713d98d5699c7982e2b3dba6a10bec90ee9cbfed5fcf2228ccebc567e0b6244446b78fc7a46b5f25034bedf
SSDEEP 12288:z1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:zVnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1695523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 11407802a44d3cbf750e7fdf59e59a288c8041e7a817fd325534a270a299b396
MD5 7542771e5790788e2b8c62f8ee015b03
SHA1 53c0347d4812dee3e404d36e794805ce4f4fff31
SHA512 055d6032dd79d08237867a5bcd8e7b54d7d28d2e16ecd655493c849b4af47c62841200b9c9b1b42516ad5b6778345d42e152291c4ad72495767b50d624f59e9a
SSDEEP 12288:EXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:E3nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T15E5523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f0e8419784d44118ddaa4f2bf9db5804a8c271bd2b1537530ebe1e4e027efa88
MD5 e296f793817906eb2303992a25f84e55
SHA1 3c48b149475d0b630da72a4280aac4f6914cfdb9
SHA512 c3e865b24e3362c02ffdc4db9839820f5366cc40b6af14b5f4f5cf64596164e6dc5cc07227c3437efb547a9bf3b4d7753ce9a339700c005196f0d28691ae28ca
SSDEEP 12288:hV6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:unQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C15523693A69F4C7F92742B4CC928142E77B3DC5BBB1A38F7B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4b78308421d297a972a5abb372c6171aeb7b736aacde0e1313a7e6f22bb67ffc
MD5 b8b42f42d69133cee6fc94846a298d60
SHA1 c41f63507419b842798939747f1c44a87577a1c0
SHA512 6ddd240814199c0309ab3f9ffe7700cbf3343c32bf0be3588d09f21afa843800bd0717c72497b1e29db602bd3550ec22701e9a147249593c4c9ba8beacf01eee
SSDEEP 12288:wiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:winQ/tbw/2Mkjy6Fr7g0op
TLSH
T12F5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 093e0d588c72f5f7a5828f0abfaab921a4b0b6cbbbb755e9941439c541840bde
MD5 3b7fffdbd4efa95fbc4c3ef4f89c4526
SHA1 7dd6566243007bbebcc9ff2f90a3ff7fdfe14441
SHA512 17dd2a6f698a63ce71022ecb94ff2eb320ee7f4e9b0bd1848927772cfda5cfaf8fe47e4911bb79c14ad20b634d2aa72875a06236d930bf566c86c3633f04616f
SSDEEP 12288:nZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:npnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1FC5523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0075aaf4d10c7c6911b8d12e8bbe49060713e04b4ad74e192d1435db53cd648e
MD5 dbebd30bf018546e1592f2d01658dd21
SHA1 19526875f126f332708c7db91512c9c55c029889
SHA512 76efd9ff4e4b1bb6f6e99b1b45b84b94c9c168cbc853c58cd5ed2c9f5bd79a27ecf1d3e4ce5e38d26c3f8b35823b930bb839707536aa7235c38b65435208e085
SSDEEP 12288:p9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:pdnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1025523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7e0ca54678eee8a0d57c1d9c4cc3ca764699b25f24aa3cf68201b497f31fae2b
MD5 e6e2a867102a2493c163d22287ca14be
SHA1 c105867c74a132b151d43f34de9e92b4966f3cb4
SHA512 dc7d62a46341d06bd0b718d50997685f5bded65c21672be67bba3533b545c33e002687dc2b9011dbbc03b989769893faf360a3453f161ec7c92dd63b26da4f13
SSDEEP 12288:TiZwbDzzFEoS2cPvyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:+ZM3zFVSO1nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1377501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 af90be799849c7862dcbbec406a24c9facf24b1a5cfeba9ee4ef831305e51aa1
MD5 4ca3911489de144ca49bea30ab7323eb
SHA1 547c03cfa082f1972fb3404a0ad633728c0a9286
SHA512 b4bfbfa8cfd2061fbd1057d0865c332b8a6db6abe2bdfa027ca0df27293dd76f2580fdab248d1a1039f794c239395d5461c4a7ebd3bb7119ff36b20ace29baef
SSDEEP 12288:CsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:CsnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1895523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0c88d113befc64b187d205f988dca07b33223378ba2b319f393714c916d25228
MD5 afc9ab14c2db26a5864dfa01cd05187f
SHA1 10293bc88b45c41ec3450e25bacedf9ddd0a9c2c
SHA512 201cf09723c6ba5cff0907e7fbbf03e0347f29b984896d98b2bbe0e7f0c3dec5f5f3f7d5f40af23be639a6c0149a76fe4311882aacc27582af2ad3b80bdeb8ed
SSDEEP 12288:Q4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:Q4nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1C55523697954F98BFB2706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 412d58a1c01eb26b1e10725673f4617c0d52402f14c7c1e7ec8477fd2ff0a2d9
MD5 08c35f7e9931b435d74d18eba0aab612
SHA1 186068597dd26289b021bd301f8ce7f032e4df32
SHA512 550c968ad612b7efeb44f77c2dbe424eeec7ec548d9e5cb6538f5a1269aa00f1080a7aa97d53ee50bfe0fe176ba9c0f716974af642d0380c5fa76d92df8e4cdc
SSDEEP 12288:2yPz5L8RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:LzyhnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T13A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 913fae426184d35b177d85e015136e86681fb4bfbdb7f33aceeedc421e673406
MD5 caa85bf5af6901534d32372ebde3dd5c
SHA1 199ba8702e2cd52232e81c25e5c68130870e5e03
SHA512 a98b0ed19619d87d331ec8437ece3dc2e89819236826fffc44fc17f3b6a23df174b4a3a11ae7f265463a4759717fa582b6bfbb436285361d38d4ed847cfadb6c
SSDEEP 12288:OsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:OsnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1895523697964F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9f3ce23fb38237487cea1c928c3bad8498d5b2fd1ad0223333ebb22fa9e0644b
MD5 ad64ce6f1b56576cc4353a23eacb3218
SHA1 7ed8c6a230b6a4b0cb510d8481c8645a6771dcde
SHA512 0a40632d1dc3a5de881ab18ca6c8aa90662aad554e42a3d605bab7c783e0ab5d525a56a1fc537ef524ac1819965054ce44343ecd5ea16ac1d65a7d932507e0fa
SSDEEP 12288:tsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:tsnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16D5523697964F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 58ce83f5de0342b7d1d05a799bdd87a3ca73a98a1e3e1bbf1894b4e7e6d8939a
MD5 3a47f0ae4c0ac0e2f451e1c2dd1f4830
SHA1 a29902879e19d772a7783500b3da943cac815949
SHA512 e9c8775ef5b0c1c2b2a017e623425287075e2c19d72b2300f649ca5397d43c50b7a0fbc81b44be36eb4e6f763f9af55e833b320b92d3968d59aa04cca5bc5efe
SSDEEP 12288:VyPz5L8RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:8zyhnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T11465021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 31ccaa5e53d4d658dba69e1d4a2682e1efa304e293534b9948e7592489593035
MD5 8770a26ee1fb3ca3c97778a3bb1a9e6b
SHA1 4e133a77e4f83dc309597329cc9e202b462e11ac
SHA512 4e3fb6eadd27557b8a3828be58381e9e460ab4d3e7a5bfd0d44a2ae100ee6e5d47643638d997550a8bcc68738e59a22a0dd17afe80eaf06785060201f41e672d
SSDEEP 24576:+T0aLl3z0zDHnQ/tbw/2Mkjy6Fr7g0oV:+TDLljeQ/lFTjN4
TLSH
T17E7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 21dc99dd604167fcabeecb8962affdb97d5740f96045340023665d363a17e727
MD5 ffcbd5b2f8c27fd1cdaa4f5924b4df22
SHA1 1efc0d8bc828c3c1720b8c08b578bf63b4a4587c
SHA512 6fbf70a5def2c142aade502acd1f96c3e9baa6855919fbfc343ed045a8fa9349b34d935f132202cd81497b0c0a630f52afdacfbe92d144502fac65c4d51493ad
SSDEEP 24576:t31d9CHKy7GZrnQ/tbw/2Mkjy6Fr7g0ow:N1d9CHKyaZQ/lFTjN4
TLSH
T1F885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1dc40d6b679bf1f5bde2faed7c942d9ec5b43374db8046dc8cdd78ec631cbd68
MD5 9cf673f77d630255be46d380034e77a9
SHA1 2886d298165104e5706ce9e298b69e94409b6516
SHA512 72aab50f6351cb734499c3a834079174de8519cdd6245d348268f37772bd43288fd746cd782a0d5c49de265efa80eb77ddf225e53659aa285fbc70744d6294ff
SSDEEP 12288:Q3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:QXnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1545523697965F98BFB1706F14C8281829B7F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 54771f3dbc97db692d3a86cb4070b1a2fa54f6df2eea3d6db2bd1fa08a369fdc
MD5 8ca253415b1a287dcac1d65070b2d4d4
SHA1 41d5af4b9b5fab7af07450b3521f700ed8ee553f
SHA512 eccd3937040834aa30cfc8d602eeef44a33e2f3225e25eeb95426238f1fbc32b793ccd3b09b8fa836184912cfaa4c060c994ab1d047779708d373f6578b2c356
SSDEEP 12288:AxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:ABnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1ED5523787964F99BFA2B06F15C8281429B3F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 be98575ec0eace1a88263a35592dc6bcba4e6e5b06342889936c280ded8fb0ea
MD5 512d04760477ed36ae72b00a98411ef5
SHA1 fd4641721c9179aa177b1f28c6e459c38372aa71
SHA512 4997ca00cc5190b1fe1a3a557e81b1601f491f2aaf1439cb103ff0672feecaf0c1d40b666d5df7de6d40bf90c658f9ccae3357f070f82ef131277aa9854ad8bb
SSDEEP 12288:amGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:aGnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1835523697925F98BFB2706F54C8281829B7F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9ffdd45e6a2e5ad98c7d4a930697834e36d6e991ca266c1282806eab0e19e3d9
MD5 dc0599257c0cc99118eaeea0710fa6ab
SHA1 eb9a69c50455df5d0e7cf0173fb1ae108be7654b
SHA512 3fc81193f4d51c624a715ed25884b5013a4c986bc4d86320e5d8b5825e225d3f276024478ceb138bbe41b215e95d237c987a980b4fe7fe235d3b0a41bbd52ebe
SSDEEP 12288:isGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:isnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1355523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e7de86cdf3d65abad12454efeab674da0b49b80bde75ebd410d2cc4ba2d9e452
MD5 0e03ce7fff698630bdd1f6255f7e6db0
SHA1 c02bc98053088b7debc32a54d6a320bbfb82dacf
SHA512 6418333b158cded4c3c86f887a890fb5a4a48252d976c697d236050606afce1dc3e3071d8590bfa1a139a1daac5ed547a17f6f050fea25e81558dc7f3c7007c4
SSDEEP 12288:p3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:pXnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1AC5523697925F98BFA1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3414253edc75ae47ca3e66beb9bed21f14f827a30d458a1d2ee868368164fce4
MD5 8a1c0d8b82d0f9c1dbf418a284eddbc3
SHA1 8c6cbd7c711088df9db30b5d5afad82f4fa47dc2
SHA512 5c941525543cff644242f1d29e2b4bb38b33445354f81076887cd9ddd0c2afd918e12ae9f6f3ef35f32576d2d2bf6ada5228d91bf5634b063c4b78cf79d5fa46
SSDEEP 12288:6UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:60nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1405523697964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a58a30655b5308138ebd47120ad689e7fb0cc4b5b3a1862b50ef339c0ba79cb5
MD5 e4b28a49f600893be1cca04827f6f657
SHA1 b1988e0dc1381252993c27e4d4a23b3d8ba65e63
SHA512 8b3ab033635f028b4c08e98a626d2fd370f943e9883ac63d5ecfa7d5661f777685bba11d9444e15498fefbe117dc596e395b3ca1ad2f832677812e2651dd7b68
SSDEEP 12288:diGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:dinQ/tbw/2Mkjy6Fr7g0oa
TLSH
T15E5523697925F98BFA1706F14C838182AB7F0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 430af253df309896f4dde3813e5dfa042b19ad3cc673a2cc25969f7ee21d595a
MD5 34c235bc4da229b25fad04e08ec081a1
SHA1 15c3c8ecce6904be5d719bbf06cc673572db5d91
SHA512 5d7288323f7eaf1c761e56807c4eb46df479075b020ef294d0a6a49ab1c6f4d0034d1539bd901ff5dfa3949d767a56bcfe891a18602afd8be3fbae9982e56887
SSDEEP 24576:rfwv/k9RX6wkyAIonQ/tbw/2Mkjy6Fr7g0o3:aMnYIoQ/lFTjN4
TLSH
T1A785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 37b7be66a96fcaa77de32052c612a396362d731d49c4853307172a1968bc4e88
MD5 11056a2a1c34df46a196646aa6164239
SHA1 551626d8067fc6ec2fc6203223ca313d939b5a05
SHA512 962996abcc7063a5145bff6801e3d93e5b005ee75b3e19588f8c9e445aef9cb577c317bacf09312167f73275a1c31d7c6498d27e6d7d63cb723dc82272f88bcd
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TQ/lFTjN4:9ySzPgLm
TLSH
T1FA066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3612324eed342e6627debeec16d9fab5df927f5700576f27698d78caad0fcef4
MD5 7d2957ab1bc5cd449bd67bd1e168d045
SHA1 68c3e83056e9fdae5ea775486d8f0c6e67ec4225
SHA512 112532d94e29fe9b68fed66ea4c2bc3450f33beaf9eb03e5f5fdeab03ee8dc8642975a6e13d10f459b9f9c922df3c30226f9e14d48ca3e193b5ae3b971f836ff
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlnQ/tbw/2Mkjy6Fr7g0oM:i47JUQj1irIhCnDHUPfF/DQ/lFTjN4
TLSH
T1DD65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8256a719c97fb2db046e3cb649534c1e357b29a82c9b62b444c8c13d4d977908
MD5 d76de29e288a25a09e29c1fb6a4f75bc
SHA1 92bc145b42736766afe6fc496ce6967814957517
SHA512 56df4dafa085b915c08bf3ca00d13e0906ac91690ca0bf9f797a0e5f7e24188135cb7a4c8c095a0e4e307d7fc2f2bff4ceed05820ba51413a1f6745008244696
SSDEEP 12288:Rssf8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:58nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T12465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9eb59cde7030ddb3425b4e4d55fa755ebcdd3c1ded2fc5c3172a6f25a08a0925
MD5 78d2cdfda8d0709302160ff6862d567f
SHA1 4e35df0800a12efa8697b5b22cf13bee7b3b7f73
SHA512 8463bdaa330673a1732975d12545d98d6e539c5cc9b4da4f613326114d2dacae33fc2a0153053df23b9acbd1d72c7540834c5a4b6cc49a9e4f01a925dc829c35
SSDEEP 6144:CsBC2na2iEOorERZfKDexHF4ey5o6kvkTcFQijuIC6x866rHMmBlo94hyfvOn5aD:3jK9hy5o4IXTxF6rHMAlo6h2a5XE
TLSH
T1C0350701762AD75FC6A940325E33D1CCAB707D45EE456B0373C88B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 35c971a1a1693cf8706898d3fafeb171c18b7918d7378d54c5bf27265d9a413a
MD5 077dbf0962ea6668cc1a2f3f2cc5d3a0
SHA1 e2308b17577643661da9f2176851a2c64283fb85
SHA512 a29c932405cfa08c4024458897e967973b98065640e192848deb1a00ec7f86fac1bda5232c800b1f1ef52956e0a6b0fcd5447251f02c33c7f1cafa963a80b010
SSDEEP 6144:S9s0bAh9+GgikvKkvUJpMAX3tgecKDexHo/cKDexHx8BtfPWQK6FNKEJ0fjG:StbAhAGg6pMIger/y8djsbG
TLSH
T1E575E881553BE38FD5FB50320739AB4CABB4AC1677046F1673C8047AD82AB25B4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 09938916e01ae76c77a10b2be15f08eaeeb214bcc59f3e9f53072c409c95c5d6
MD5 ab59aceabb0b9ef1152254264e9af742
SHA1 1d687d8f8eb2e7624f30c5532ec3a1c256db149d
SHA512 fd4f12298bea6bd24e44ac1df4b693a7e122a94e9d330688d1466a577088dc730e9d819b9b66e185af29a21819de26923ce9e3a495597dc65f566f15ae81725e
SSDEEP 12288:T67kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:KEnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1A25523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 549c6ade604a399365f3808f1f6fdc3321e000fdfb4573822cb53723af464bcb
MD5 beccc9376c78aefda336f5ba13ab8459
SHA1 2b179d8081293126ec0ea6fe4c26af0e096d7285
SHA512 c5f2ace13d4763f18fdf3788dee16c391d6693aecd1845cd6c5b31456b1439fe2457810fd01c3774624c7f56bba05186a456a7966d65fa9f4003530a72b1211c
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYenQ/tbw/2Mkjy6Fr7g0oI:bgb4mBIBhGFlQ/lFTjN4
TLSH
T12065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 aeef0f4a9f85ac335e9392301252d8852360f9383af6c2019ae968c7d6d0373f
MD5 d3dd50e1698e63ba6964b0b1f4018dec
SHA1 08200c81ae9cc5122f2002ae667a028fb5caefbc
SHA512 81969235fbfd6a81fcede9d330e07eb0cc68eac13b255e83e6bf282358ff3cd34e94abccead1da021f6016c8a311e380422d222f5ef948b7c719b08bcba04844
SSDEEP 24576:iG88u8FpJqH1Qzria7/m1nQ/tbw/2Mkjy6Fr7g0oW:57ZFPqVva7/mQ/lFTjN4
TLSH
T14B85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cac19f84b0f27687a1d0c3344c0963f3208fbf4e0c01383bb9971d5050bc875e
MD5 dd1a3b5e553fc780d5b4fb7d4dcb879d
SHA1 8ac149d351648dc293098934675ec2d8a88a325d
SHA512 70b8ba21a613b1cf8edeb154f3ce49c132ac2c5497c24b1a212e77e510f2682152e27d1b81325ee77ed951f3b645077d4a0e2b75a16f2cc6eddaedc71638e676
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpQ/lFTjN4:6G05lO43bDLm
TLSH
T1BAD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4ec32227d3ae1265568b0c087704338f2dbd1d3db56a5f8c34c9b1a79cd5746
MD5 931f9089392ee2cc6c7b54769dfb5646
SHA1 9a00923371c4520f5c8e37862ec4e2aad55fcedd
SHA512 cedf8c5d0305a57e6b308739ebc71db01494f717915cb12424c4d4651ec9ed73fffb2765592bcf7a32e97836583bff2f254643c218b6d45a6b667821861b9ef4
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTnQ/tbw/2Mkjy6Fr7g0oD:ka5POZ3+Jt2pasx2+mBQ/lFTjN4
TLSH
T11B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ddac9085bda34f242926424621d3ff2fe672cc0b606c5a0e6124f7ab784f74a1
MD5 9f570b22b8cddfc231cb5530dd38063e
SHA1 d980e97426e85e5d8d0b35a937bb150a1c9e7e5f
SHA512 11f865806f392cf54eda3ea039e145d7f677ae676577e0e4b84eb5b4a38e872d69800aade304d3f2376dfc1277d048c3c82a031e0bf8920f743438e8cf8cbf39
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FktnQ/tbw/2Mkjy6Fr7g0oR:tNc/zEOVHFGQ/lFTjN4
TLSH
T14C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c32bb2805dd80b0efedc5a603be7fa32f48674b6cea5e9d68d549ec725d3f7d0
MD5 806fcf6a4ee2e022b00d93affee95d70
SHA1 bd12ff3fb459c4dde577deeb3f9a457b83183bfc
SHA512 5ef3905c4a1c5f2447ed9148855b97cc4875f39bbb43b2dde9bd9bcf56a924be6effad5d99117198a1bca879e7fc5ac88b7fb9e1826908adf5723b2a2fdecdb2
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmvnQ/tbw/2Mkjy6Fr7g0oE:Q8MwBtOmvQ/lFTjN4
TLSH
T1BF55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 35a995f1c77cb20b574513906473c5934b33da6771041d0f60e7d3d97bbb5697
MD5 8d01d848db7479fb6e8e4dec3f00d1ce
SHA1 f7a46d752a327e9d6f5e478ba4dd9ba674a6ed66
SHA512 1c0a0bcab1780821a1b3b6b2a9af3c1c22a156b20a31b06e89f85f53dbaa34f292ad418c8551e93b02c726ff350d5d46cfec2fab509780fe68b806afeb42167f
SSDEEP 12288:EHvUrBFrEjwaQJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:EPUr+NQZnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T14665E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 728dadd4b257295b2819f430378a85b8fec4bc1836ac40d6571f70f897b0170c
MD5 35b4f68af62942216b1368b718a3b8cf
SHA1 320b4f5951e73f49910b998c2dc59221bd34f823
SHA512 881cb47b0fa5b074db47f52a577a4d693a99abf95a4166a09f45e6371d5ec566c69a7721c98809f04a29ed4a7d2872b4d13c31f03ac6f1aa3e124816f4263f36
SSDEEP 24576:YD3FHshBIYQgAgnQ/tbw/2Mkjy6Fr7g0oe:YDVHeBIAAgQ/lFTjN4
TLSH
T1D575E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1336-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1336-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1336-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1524-45-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1524-44-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1524-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1524-37-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1524-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1524-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2120-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2120-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2120-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2120-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2560-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/2560-76-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/2560-1-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/2560-6-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/2560-7-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/2656-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2656-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2656-121-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2656-115-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2676-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2676-13-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2676-22-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2676-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3200-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3200-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3200-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3200-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3200-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3396-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3396-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3396-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3396-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3700-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3700-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3700-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3700-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3700-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3700-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4116-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4116-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4116-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4116-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4360-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4360-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4360-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4360-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4360-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4360-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5796-83-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/5796-78-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/5796-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5796-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download