f154ac02b42f5caa0e2193055fb4981a3768824be42fbabbf6c07d1438c674ce

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260804-dgjn3ser9x
SHA256 f154ac02b42f5caa0e2193055fb4981a3768824be42fbabbf6c07d1438c674ce
MD5 494b81fe3fe54cafb3a25b02e980f9dd
SHA1 36d186a0692ca513b4424468e58e64eb189884b9
SHA512 733966046f3e0ef8575b5d78bee15d5f7cbd659d36b41a33a33aab200babef620c8c3b501ea38b69d46756bd51b3d8e5cd4649f66b12eeaa44678f1304e9178e
SSDEEP 24576:E5GtI/4t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cGC/4tLNiXicJFFRGNzj3
TLSH
T17A65015132C080B2E9B704344AB49970696DFE345F7549EBB3842B2E9E747D28E38777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5872	elevation_service.exe
4348	elevation_service.exe
4200	maintenanceservice.exe
4188	OSE.EXE
4756	PerceptionSimulationService.exe
3400	perfhost.exe
4044	ReFsDedupSvc.exe
3192	SensorDataService.exe
3944	ssh-agent.exe
4824	AgentService.exe
5692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca987939e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000516b437bd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c1c479bd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000400f863abd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cf2e579bd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4044	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4824	AgentService.exe
Token: 33	5692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5692	SearchIndexer.exe
Token: SeDebugPrivilege	4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4484	2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5872	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5692 wrote to memory of 4480	5692	SearchIndexer.exe	99
PID 5692 wrote to memory of 4896	5692	SearchIndexer.exe	100
PID 5692 wrote to memory of 3672	5692	SearchIndexer.exe	101
PID 5692 wrote to memory of 5412	5692	SearchIndexer.exe	102
PID 5692 wrote to memory of 4148	5692	SearchIndexer.exe	104
PID 5692 wrote to memory of 4828	5692	SearchIndexer.exe	105
PID 5692 wrote to memory of 4576	5692	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_494b81fe3fe54cafb3a25b02e980f9dd_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9db691c238ec0873999eed091c1f823647d4eb657a3288b4ea503048e64a3c4d
MD5 7c40235f6aface412ad1670c94922976
SHA1 ce7d0ed12123b9b486c6875ebce29844af732fdb
SHA512 2feeab2074c0c46d5b63e41f3e2d4f38c8aef140a2ab621f5f7f0ae37d2dc821bc540d8269cf364ec5cea825a1648dbf9e7c86c677629ce35fd07bd664b3e327
SSDEEP 49152:Wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnuLNiXicJFFRGNzj3:I3q6mjBl7wRGpj3
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ee5e484185bb647dde1ab5dae63b83e3d1eab3977a301538b82b51c377da6279
MD5 fab793430c0189f69dceeeca6064b969
SHA1 40367cd1ee00d6f8e64830e31daf04932af8ff11
SHA512 a6d84b4fa2974537c07b02234f21857fbd79101d428ecbc1aaba15caddfd09141e0f2f65e93d0a4c1074deae683a6c2fdaddcad2d0ce8153f1690265a69b0642
SSDEEP 24576:4XYfDtczAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vtcoLNiXicJFFRGNzj3
TLSH
T1E275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6d4ef565b4ffafde84a8a6cee5ad1608b15ebd7b4563828f9d12a11d0462ee65
MD5 4c1c64b5844a53932cf05972c231f60c
SHA1 22c56cf92ec25c8fc731dd83a5fd0cbfddf3bfb4
SHA512 45a660ac3a4969318eede4ee7282ef4dcae2d1236c5dd38e49a9826ef708a8897e49455f4597a002cef5bfde302c5a9c336715e8b9c0ab85fb94005d36b2811d
SSDEEP 24576:K0Le5ji0hmxhrM2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KPji0AzXLNiXicJFFRGNzj3
TLSH
T127859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8b066ca3667aad691c06c16a9b61649f1fc4e94ae4f483f4ffd5fac9a8656c0f
MD5 b613aaaee3a5fddd96c4c37dee946e5f
SHA1 d9efbbb66c97892d883c83a0cf80e7384eb09f38
SHA512 8e4e6fe34c424c678d6fff66a972f3993885d021e35283d3e700ae1b5369b722b14a19f3129ab652ae5db207df29de633bcaae66b8784e9edc5f1a1b2b1c3a2d
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWj6q8wyuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/ezSC6vUzPv+Hjy7LNiXicJFFRGNzj3
TLSH
T104756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 467b4a44503af20250bec79031c11117c1ee0c04ab681b667b0b491d8281b3c0
MD5 a5018a99082b2d4ca572622089a09070
SHA1 e402d5767cecfcad0b3bc05c85c9d49d34926201
SHA512 f02518b368b9fb4fe31be356e263098565219de2ad9618d02576b02dc47f38e205ff52c25eb07cc9579e4b71b81b6f171e1362eaac44040e7496cd11807bcfb2
SSDEEP 24576:3VbqPb88hv/l+BV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VO88hXl+3LNiXicJFFRGNzj3
TLSH
T1EF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 31e781cbd880631ea4bbacaa9179841c199aab03ef574d4c11f2eb45ef3edc84
MD5 f375efedf1f9e288406ac377676bf5bb
SHA1 83487db3945353ef671ff7d93df6173941dd201a
SHA512 f20b4c303aa2e7eaf0331f260a2355532747f7553d64c7084356e62847bf309da1236cff01ee4da28d7c2a12c6d356dbaf238ae74e6ed9e75d37b9c820d605be
SSDEEP 24576:SGy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T16E5523D3468864B1FBFD003A867A5828B5845E2C8A555DE2D2543E5EE13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 327afb05309fe5eb74d82653ee8f143052cc2fbd625a45c0af0a3778456444fb
MD5 296a0bfe2a7dbba06e374c6682c26bad
SHA1 1c8bd8c17af0024eadf0cdd16281e2ab98f51517
SHA512 9e9ca3c591d1cb0d950cd5fb798f9990f0c1cf68c2aecfb848d83fe4a0350d3f8e169454072e8f8d17603ae35a35ba2b709efaf49f1ab239a005020d2cbf8d22
SSDEEP 24576:OJIUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OJIUdLNiXicJFFRGNzj3
TLSH
T15375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e96e68677fddcc6464403693ee156642001ecd028e2fdc6c23847e13ed570188
MD5 49d65f23ea8e2ac6c09eee61a582e000
SHA1 37cb0f1189658fae53203eda6669936965099a46
SHA512 cff3d665cbc0b4d285d0c820c9f03e39196540fbe608f2cc539f76cbf964699fbcff00adcbbd7cbc8e16e4ff242764254aa1d4d2617485d433fd6e6f5ef46237
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH1:pQvGAdlCEL8c/WRNw5CI7wRGpj3
TLSH
T10D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e84d89d146ef148c5fb7b8b938ab26b91f0dc5abe019904e2838773c11bcb616
MD5 b7ab1fd6d0b181526b9b366ca8bee45a
SHA1 e81bac9b0ca4f2f1b5d51aa2c28b93bfcf39c519
SHA512 8cf52b5c37a20716eeb99c1f4e09df74f33337aaed47034208f42efcd0f9f93996866f16e064398c653bd154e7ddd277c0378745d3a355275868065517969135
SSDEEP 24576:zfewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DljHLNiXicJFFRGNzj3
TLSH
T14F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0bedcf94449a837aa8f63e9a9eeae696fec697b68ee6073b3780eb74df2ed0ca
MD5 e72609895773776e3c4d7e49cc811100
SHA1 3178d0687671fe7eef51f075fcd5cd931c73ce9d
SHA512 c98e6054e36dea99cc80ced140d066a1c8575726d7f2e4f24ec23fab847d304cc7c111f984ee59a8867f516419a16c60d1464002c908b922962bf4af978d6334
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjF9:5UEtQevvqc2W1cpV20I32B9
TLSH
T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2ad3499b51a96374aec21371f17044adfd4d7eb91aa62cfa8f1bee42d8df4bdf
MD5 6ef75f3cc40818a604add79630948127
SHA1 6796c80037a8e0c5cefafe9cd35bc567bb0695c8
SHA512 5a3ea01b1a2ea92948d1edef93133e13a87113915555c35b68101e49d91d93c298febbe181d1ffac7177bf2b0e6a29a88de1a02d8fd5b4cee5f1be01e676cc9d
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/znLNiXicJFFRGNzj3:8oq2Vjnmc7wRGpj3
TLSH
T10FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 508f0e4806df91773f2dd79428773b33fa0101dcf2327dfd65d07886007e76d7
MD5 8367154453b7326cc953eb00fceb92fb
SHA1 a51170cdabf1f6cb0bbede661a10807a31f587d3
SHA512 8848f35aa9b5d2689e2e358860346743d1b7ad73bef4cf585f2b039c1831b0e6ceb846990f68045d7e11440b0f64f0cdcad53c63a9226e600e4c2d80bcd10069
SSDEEP 24576:LAhGL6IFoiwtA5l7S538/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LAM5Foiq5MLNiXicJFFRGNzj3
TLSH
T137359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8bf62a33821cef1f2d06deb749b2d699a95ef5c80b0153d58d036c539566aa89
MD5 b4e8b76b75cb671d6d9ac2650b30b848
SHA1 70c5b28da97bb9da084886163f18316304323d2e
SHA512 079ffd04739fa3a77d832f44ef9b57b285766087a5a3ef261f1b9f7237961812d587f7376ffc23e48488d153cd0e471d72238f7f23de9ad436001066c603661a
SSDEEP 24576:RwuROWb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RwSOgLNiXicJFFRGNzj3
TLSH
T14F65F18672940CF9E9BA41398657C036F7F2BC152A21DB1F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 975244dce4900d8445c4d5e4c274eda8f5206873821b5c03845d989009ccd4e2
MD5 22a042898c2842808ba3fdf791399329
SHA1 747229e62336041e28186db332fc60ae1e6b9199
SHA512 5bf26daa6e5cde7aefd9e80899def278d221f78db1268857fdecf50f8f48ae5758197d9618d8b264750bef7a59635e8a6b23e815ed3f0f303904591dcdf0122f
SSDEEP 24576:NZue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
TLSH
T1F455129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 48869d8b721d87e164204c58303f7416c639135a8ee348697346b66dd99d9d13
MD5 5f072edbd503b55d74165312d010803b
SHA1 d7b16554e266e51b2b864f740575657bac76c615
SHA512 3bc8aef3569addbd8472066a9f65e00f9649f7f79ce49f7f0b26b8eca6292fc8aa3eb92cf936cac2d6ced61b6a75682d59bd94aeae82fba7bc293e997960b30b
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:OQyiKanX+PNlF9
TLSH
T16A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d03fdcc49b1801745ea7738464835c14f8595516bf62f0a37ac886ec5b39f32f
MD5 f50463b19da6053f28cea32083934e30
SHA1 beb8505a0ebf7543d4bfde995527a2d158893b32
SHA512 651eb2812011e137723eb7b22620801158e2e94bef9e17924f38714567c5c89d13a53bb6dbc9300c322bd35e1ab0f983e86b93f9ffd3112e5e0c251ea0ae1532
SSDEEP 98304:fQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:uQyiKanX+PNlF9
TLSH
T12E667C03F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e5332d759b05885a4c364adbe821a166d1b9262e1921514b74db6a0b91359afa
MD5 05764481f0e8dbe0284f48a9dbab362b
SHA1 3f1e834d4c9bee6b5d01696e79dc4e14aa3a5553
SHA512 f46055d197fbd48a608a02f998dd515c40923a4d42b76440915877a9515651aaa227b79373426cf6f3fd5298fda5978c42558a2297babf53612972ef4dfda2a1
SSDEEP 49152:668Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:othTRc/X7wRGpj3
TLSH
T173B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 56dc57bd88c16edeaa7f978c87b640d7aca453411e7ac581a6f94f9058bfc373
MD5 435ea026370728a7724783d607ac1574
SHA1 1d8b137e8e11a6a29b100a9885dab62e561b7b2a
SHA512 386a5585514342b8ac7ddd5f15c2f2f6bfc7093683d0545db2aa8ef04f477b2b143146ac6c3b65cedd8c5afaa4ec16885c07c232713b555c826dc6060c09d7c5
SSDEEP 98304:ky5112gYy5azzVvU69nLKnhZy7wRGpj3:lLIHRWhAF9
TLSH
T10A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4322c755872a9b61fb56ea0ce95d49d7ad3a7e1ed70feffd4b7727ef8dc32a80
MD5 4680fabe13f0c40043dd0cd148725b5e
SHA1 07881d54bf5154df035a412535292936fde651ec
SHA512 2f24e4e7fa5beb4403d525aab813537bd78dae682283973508234efd930c2d1366a2b365f73bef75574bf8b73c84fb1bbe04f3b0b6ae441d1ad5774f6e018e73
SSDEEP 49152:/B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5LNiXicJFFRGNzj3:Bu6JmIxd2d57wRGpj3
TLSH
T113D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a5587287a03f264a5be82ae070c8ceae764331b16beab192344809a14372c0e4
MD5 7ddf70d58a49873391fcd3aff1ad9016
SHA1 372f65b631a709b06f053b8f4eff855a6a35adb2
SHA512 481ef75d3b1f37b7bf297c108b338249854887feefc5cb099660368ac61459d9f905bf848408264e6ed7d84bcdbe69acf45dd23052cc637285715228e4a7c0fb
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4x9LNiXicJFFRGNzj3:amifPqRc7wRGpj3
TLSH
T167B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a95d03fc4ba502a3fae31375d518239caf25cf4ad24839a64f70f32db33bd718
MD5 4104292bd66f333f54c63296893d8344
SHA1 651fe92b3aa1368131dafc884a8ddad917ea4da2
SHA512 812ad208c804db06f94c6bbbaab490514c4b3914547a66c26bd6be3cb91829cf27a83ed6bba89114cc91ffa6f99f82241cb4025f95531b6d2467546d5ba41496
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:/5dKqi61e7wRGpj3
TLSH
T1C4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 08993391af28c21596131ad8ba750af30fb6a12c696768e49716dda46b292a66
MD5 dd7e55f34320ce18081477e09fbaeb3a
SHA1 8f9dedfbbbdea1f5f59a2c036d6a0beaab756bca
SHA512 2a5d5efda3014c48f88b2ed43f674a10126d31c12a76d35827783486114948a310c6961a1904d1203616ef30e0ab1244118ecd84c377230f1dd11c09815500e2
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wpLNiXicJFFRGNzj3:dX2iWphA7wRGpj3
TLSH
T1EE95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1a3f78bc49923090455344643d3011dc07b604aa1f543b9157fd1f025343d3ac
MD5 214fe03c23b8fd5d7167f770f3447429
SHA1 7f497ceeb742c087a4cedc2de35d9bb4c1f391ad
SHA512 635b1bc7cb55bf660c0bcbfe167cffd533cc35bb6cc0bbb2212e247b99ee416fc1185193d347a74cf4f32c1b3dfdc7aa44f5c3e9cd5f85eb7309abc97e1ffcae
SSDEEP 12288:IIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D355C955B1EAFC0039C6754428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f1cbd95f7ba81b8c576b4464cfeb7709821bfdbd2806fc4ba9e7e071f1fbc3e3
MD5 8d5203e1bd81284067bbc6c523700ac8
SHA1 da965d28c500ec1ba3e4df6fc30f3f558ab07fe8
SHA512 b51cbc50914c84330b721aa209651a1b716a8f14d6d8a31dae3296cc45282481e6f1b344b534da89d474250e02a9d1d41e70339943011fe0512ea5c294dad33f
SSDEEP 12288:DniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3558955B2E6BC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cea58e3e6363a8cb30c352225b0259a1441b19ea8fd1a3e4d16c6b3af56277a9
MD5 76e2d8da4e229e86781c7bd82d2d5b33
SHA1 4b0ec8e42869061281adf936e1846fb9cdf76569
SHA512 7a910bf39a0a8ccb57b50300d895df782d31a357f77ebc12efe00af981e0d0260201fbee9b8e7b778714ec13b550379e28c029e48956b9aca1c81c777bda7046
SSDEEP 12288:t5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C5523D2558955B1E6FC003986764428F5881E2DEB5658E3E2483D1EE238FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f210eebb6e76b82536d330c0275f367b51ccc72c3e22903d0480ee18f76f57b9
MD5 90b4fb9b6070518a38496d45f31c43e5
SHA1 64d71a35057f2394bdbad0f56fbba4a6057797de
SHA512 a6eca63cf13d9530bc6fca3351c52b4d23dfdb9c68cb3a15c86cdb7097443a39fda836b128855e96af0309d4511e1fb2f7b60ebf6889eb38362cec55c561c026
SSDEEP 12288:mV6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A552392168900E1E9FD8039C6764424F2E47D6CD7325AEBD3003D1E5A75FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c7cc1483f18ae3d06b88dd3bd940d5b3d81f0e9303084b945df868ee6dea2906
MD5 e197969b89ee8b9b548e1ec4719b0c79
SHA1 5ce8a045154f10bd70c5b4a8bc58220b2a234086
SHA512 ad211082b8ccfb0c1ea39b4443c9402284628d65fa2c66ddfeb553db00748785be5612e9f1553c36ab824761267e5d10f0fb6909c0412e6a41a36b803bcca6f3
SSDEEP 12288:eSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 970af0b48e17b27c6f93899ff9872ccbcfbbc86212298015ff2890218bbc9d3a
MD5 62935635067329b8231dc2be23b701ba
SHA1 96398e353ab711616758b1db62b8d3f2db795b21
SHA512 1325f996f165cff4375c050fe82ac0f8ab02364134961ae96dbceef0b4cdcdd518b96a1fc1a5e7690e06bd90d6e49fb31376c365dd7cf3e96ff24a5f83dbaf4a
SSDEEP 12288:v7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3558955B1EABC003986754428F5882E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 08555a9b0cdfbbcca5b4ff304ddfdd5a99854e26c43498d7fc0eecae440d2aa9
MD5 2f8e7471aa713997e632fd662c619924
SHA1 7d6a18db951236d8f99a6606b0dadfee6bab876f
SHA512 3e760b1bd77b59bcdc2c4e65500ebb7567ea70f1ea47b0cd34d584e47445a4bcb8ca3171ec5e2d062aef6036673420c57b78b8a16d39a5d0c3449498f33ccb34
SSDEEP 12288:gfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D2558955B1E6BC003986354428F5882E2DEB5659E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 58ec340b375486dbce10cb94c08547392af11edcb5c813ecb3d8cc47a2c7aba5
MD5 026ccaad940e3449954ac1978837c729
SHA1 ae77bd091ca08dd3a577f315d73ff6deb0c1cb94
SHA512 6f26169c4e72344c2e3532150f74f73eee20560b56366229018c1651b8a5a13eed590707e65a2c9dc0678cf8a2e2eba93c58d106a6bf1f16bc67c0ea83bae210
SSDEEP 24576:LZM3zFVSOz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LZM3zffLNiXicJFFRGNzj3
TLSH
T1AB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d3b59eae25e9d89c2baca93a7a75d423a75ddb53db6f96893bd90ab681fa0767
MD5 7467925395b3ce5c06ef5d656ca759a5
SHA1 8f151526c64092ab8451b0eea5de69ac5a766e3f
SHA512 6622061b94952e8ca9740fe1ab79e3d6fc617179732c6731dc965926a3a0ab32bd13675d3e0f8058ed5f68f58de5cb65b795bd8ecdb3eae0b44d7cfe1e4f73e1
SSDEEP 12288:GEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3558955B1EAFC003986764428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 66416df2772721c889bb4ef85391744df5b0f5862eb490bd09720fd072b5e897
MD5 301c38031e9645f59110dbdefbeef073
SHA1 f48ff670249a5017c1df0a48e7755a346ab49372
SHA512 2f63e3db10dcc32b84505af1220fe03e375d507d62d11758c39b871b115f5032e24ef61bcfa82ee246468407c672dd4322f6d3d46f498844924f12c8e4cb331a
SSDEEP 12288:DwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Di/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3558955B1EABC003986754428F5882E2DEB5659E3E2083D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 68ad8e64332eab55d223dce517022d54e6ecb89d8e52a31f90968cfe3a4035a7
MD5 dcc80123c5aa647d87a7c5e83762fc2d
SHA1 430dadccb32fd6924628d2a1e3373ea148a40997
SHA512 1847b8b607ea8952857823df1c26dcbe4f4fdd5c08752abc2caf6516f3ab693c67d7a09415c6743171f35645b0e18fb982e77021e4d3eebf685a57f36bd3dad0
SSDEEP 24576:Izy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IALNiXicJFFRGNzj3
TLSH
T1A5650247629530F9D17A8139C9620911F3B57C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 357831ae3c039c252076838cba94cde8c5d2e76c31a7edc03b520b59fa1b5547
MD5 001f22b9e97e6746d495890e602fc1fe
SHA1 7bb805b88a58c845a20ad5e3d17638a5148f4f1d
SHA512 099f1a197f86ab18eba9bf8205f26f4370ed8f643c1636c7d4b8f2f1e9d0c500a8403f5ccab08479e5a2d80b907f5b896ac4cadc8882556860741ca71865bbfb
SSDEEP 12288:OEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3558955B1EAFC003986764428F5881E2DEB5658E3E2083D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 47b99f6f03e746c63e10b2dba56c5143476384900f4da9bb9dd5dc2909b933c7
MD5 f7999fa8e52e888aec62e2de1a73ed4d
SHA1 fb6bf3caa280e8fa943ebb4f66c84a39bc47bb4a
SHA512 1d4acf2e90aa32b5f398105699369c5bd491b32c163c1d4a19955ebdc3c6e4d83d5199b4103a9eea05bc2c11a357e16ec39ca822dfdae1a5e7ca83b1f385f9eb
SSDEEP 12288:LEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3558955B1EAFC003986354428F5882E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fff6d36817aee3c68e14e3fdab4817eaa639cc81e880a331838076096c8c698f
MD5 c0332ec05b0b96cdd48127fd69fa29e7
SHA1 5fc68f272340e9925f8f0e85732cdff20d6afc23
SHA512 342ac0888883ebc633de62271d3305f2796143900fc8c456193ca16e36584272337dbe3ce211b98d1e4df1e5aecdbd29ccdc5da298b6462be4bd2183e8b27a0d
SSDEEP 24576:vzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vALNiXicJFFRGNzj3
TLSH
T1A6650247629530F9D17A8139C9620911F3B17C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 89c6c3b1f8ac8cfb8220efb93d7a49f304d8435a696150519ed59b2d059cca92
MD5 4331c9abb896423dfec9e5450fc359a4
SHA1 d0d3e85b9b00837af8da2595d3e243a1c3526644
SHA512 e018077cf2188f5741574fc2dac36a541a94e5d2e091bd2e752328906d0b985b557daf747230b6571d11b2f74b1dde03b2b73ea32b7fab92087145060ae5a6a0
SSDEEP 24576:YT8aLl3z0zD1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YT7LljYLNiXicJFFRGNzj3
TLSH
T1617502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 683d2e500fa573a322cd61506711fe57b15301f91ff2db09f7f5b39d1030e261
MD5 52a8a895da1f31495cef996cac6a3857
SHA1 52fbaaa20d9f4ac92c1989b4b0d6febb0e6b5425
SHA512 64dd1d643f762bc28eb7966c9055f90cd63b8ea4398e0611a0b9ef86c2a85369c37fc0e81306029649b936b386af25e9de3dbab7acfcdb67a63e4e07a761e5c1
SSDEEP 24576:e3rd9CHKy7GZx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:grd9CHKyafLNiXicJFFRGNzj3
TLSH
T19185CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2562094001cac0acbb8399e6b942915af3335b51f5a1782608bd7d165505354c
MD5 6adbe60ee66ae58c36ca9e3d2bfd4b35
SHA1 fe79345a1408047d45f23945d384f78fa713eeb5
SHA512 85573c033a3e1dc680b4fc4711b9f933f0747dc5cfe4432fb1c4ac660bfdce33dbb0bc842a028736927d01275702d6dd3ac1a55bed0918833aba6509b5367e63
SSDEEP 12288:kZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1255523D2558955B1E6FC0039863A4428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 42c114b8728055e606ba6e8f2f9db2bcf6d0d129aaa247d8c09803d3cfcb76e5
MD5 f87528bdac39e624b6eb981168b231cf
SHA1 b3da336dcf28c41220fab439b739ff9d90f4767b
SHA512 037c7b142540aad22d3f20b75c8e3c38d9b0b8a76ea9eb14c4b5d2a344a1d7ae3e79fa5c29d321e5f5b476960d58db9515211a2ca50c5023a46b70189524abf9
SSDEEP 12288:ujiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D2558955B1F6BC003986794428F5882E2DDB6649E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 59c7007c69c31e8ce8127598ca6ad152bbcf45d24753a571c61dd411691d13a7
MD5 525b5e338a454f0349fb6e5df510c94f
SHA1 25e0275dd5572243c0d4c358d3e91a860dd4d560
SHA512 aa3690000a77b58e3f7013293e70032ef352dd9bf2f206f7cff7d3386cd373552f5aa41b4736dd809144cff56a2f1eb4dc4db4e25d0522cf4a03357c746db12f
SSDEEP 12288:tGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3558955B1EAFC003986354428F5882E2DEB5658E3E2483D1EA23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 38645339e9db6ba050d86e5a7af3c1a42da4d34850450f753514df14935a1f0e
MD5 bf0fb31041ab0de9d464cd55c31ae32a
SHA1 a3f0210065687243f830cf784e525295eb1a5329
SHA512 35754fbc2f6597e8e1e6e7d12737f9849ce43953259e19668f949bdbc04500e370fec6339c60aa0fd56d42a8bb0f4c07082221bd240406f7bdc466172a11853a
SSDEEP 12288:SEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3558955B1E6FC003986354428F5881E2DEB5659E3E2483D1EA23CFEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 110f34e08946f773436ce3100e44822c721137b680b93a2336b9b44269733dbe
MD5 9664eac5767520b1f058675adf42d30b
SHA1 98be7c882c4bec768d9028b2f04fe30e5da6cc0e
SHA512 30a69bdef6e7e18417c1d99f730a581cdc65d836736a453f15f34fc789bd9ab3cf06dd5447c7515d74781cf3c63aae058f019dc20b623f6f73805933346655e7
SSDEEP 12288:pZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3558955B1E6FC003A86764428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7bb70412e0aca325e22d0aeda760169235408be02eb586250cc6b4cb655ee96a
MD5 60db59255866cb93f69ee6b3528ba28d
SHA1 50f881f733870f1d6d3d22cac194d762c2528abe
SHA512 6655e11161eb706049aa1452d70781113a333940344a95ff656d87f114dc53fcbf906611930d2970982715ca391c1d327ec6ad8fddaaeb5533342ec5864dcbae
SSDEEP 12288:58iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D2558955B1EABC003A86754428F5881E2DEB5659E3E2083D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a42f0124020614d92dad2f03c38a04e9e27f48c6fbacd5d9775ca9c62d45da0e
MD5 bff3b0f59201401add7fcb1d35ff14f1
SHA1 8472b669d897677fc620d7dab8acb93a02b37c1f
SHA512 a033208d5ca61c923465babaa533420ff8968082bad6640c695d68efde7952044aec3c3e38cdd28a2140a6758edb05084eb40a5c09800e09f0c899d1ea6496b8
SSDEEP 12288:lSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5b1fe1adf9f03c315e83007625e4b3caafadfda22ccec6c83f903505fd06aee9
MD5 70b74f63d296d776c557aa1903ef746c
SHA1 50c78c8ddeb4e0dd2132ecd0286e8d17727a3d63
SHA512 c2aecee87172ed5ff70b5bf034c0f80fed73b5720ac36040ccc2e36b6924822f2aff3351739d41cb68419f6cbdd28b0faa6466bfd258b53d12f43518a7b38dab
SSDEEP 24576:/fwvzk9RX6wkyAIS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aMnYISLNiXicJFFRGNzj3
TLSH
T13685DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0525874dac360cc9b510f3e0eb3f9ebc089162a12b99d0d1db56208362b6cba3
MD5 d693c773655560e97ff86a2e0296f01b
SHA1 6f6885afc880887ff69afcc45e23313fb392547f
SHA512 7d9f2f3b2ceb375e23e5cd3d52824efe343a61e92d0afe5f2a2a35304bd53f905066c3a50961b2a5a3fad82704cb973ac5c56952765490071b11de08efac2370
SSDEEP 49152:kYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JLNiXicJFFRGN:bySzPx7wRGpj3
TLSH
T1CD066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 362d63d06a67ccdac445624b2e981dbc837e9bbf8dda7d9719cfeda3c47f02e5
MD5 c5820dac1ca744b7336c1c939442a811
SHA1 ebec0cab89f76c32e829865b1dc28e8b6182123b
SHA512 b73aed40397fccb43b05243b24ac567b0f7006adbf7830336fa830d88e057b3762f02f1116885527b810d62bb85acac538205994c283003c002d6576509e34d4
SSDEEP 24576:P47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P47JUQjqirIhCnDHUPfF/5LNiXicJFFS
TLSH
T1A765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 93eb586f9d4914ffb72633b21cdf306e8c714ee9bddb62ca9c6e15b9d0e28fcd
MD5 9b704e91384d7c917dbc5248ed81bed9
SHA1 04da997a1b89ab9403509e6f0de3071aa368c5ef
SHA512 9dc632b2d31f45045fccd84500448875b50528e1c28de3e5c2ce506fcd5eff26fa91f6e90b5b97293153be928fe446a038c5acab1c58852232cf671fd5aef7b0
SSDEEP 12288:4psf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10365F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 ddebbd65f43aa33db3e31cda6a99d4dceb97a3723d6eee5e720a90da0a2ebcda
MD5 6e7c5bdff3e7367d274f66480cf34a07
SHA1 0dc37d66ecf43a0a2732ef57440ff75a6a177a0c
SHA512 967aed3729f4fb7c3c6575a36480ccfc44bf5b3590ece4e6cac5fcece8d79bb87ed179fe70f1ae94e894bcc95a4524e42ae4287dc7891ea80a60cd432cd71fee
SSDEEP 24576:ahqDUPB7WrR9RHynz+OrsMmnONXEIt/p+SBMRktQuBjKZBe:TDU9WrRHHynz+OrsMmnONX//p+IaktxT
TLSH
T19B552740762BC78FC6A940325E36D6CCA7707D01FE456F1773C8873F8476669BAA6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 eea67f261d5f639630c363c559d4c8ac6475ca0e0971a2671df23d38b56dc5ae
MD5 d25ef70816339a9a47ad9e5fbd8c5a80
SHA1 8216f1c9db241b51906e998aafc8b55ee01d2822
SHA512 4c8272decd707331bcd5ecdd2d6ae6c16e1cbc15c98f635581104c75f2287f5972569007d3ee615011d2d87860ba72b9b2430bdebb286edec3eec431be45e217
SSDEEP 12288:1Si/QN5L8ViNOou9YmVNnrZW9SuLWz2Vio7i4YCyN:1SiI7Qccz9NZW9SC46i4tyN
TLSH
T19E552941A5ABE35FC9FD50370232C6CDAB746C06BB453B0573448A3C9867A7EF5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 72b91b6ef28e5a54df8e0e63df12592baa8094e6fcaac8f15cf5669c4dfa1fe3
MD5 5704792166e7e565f03dfe099eaf84bb
SHA1 59d5ea166225a1ee8b474a891e4f76eaa9ce15f4
SHA512 9c9308477b50012bba9f0649698f66b6d15edbc58de23ce43a53b63595bfb388590d373b59767604294171fcbeb1e1e43c93dc1e7fe7bf4f26d14b4770a31b21
SSDEEP 12288:EF7siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T162552393568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 47eafb666f951b87ca2c894f414dec7ad294f422f19fcb04ad46c623bc094f40
MD5 1c1288b516219138cfb4f2753cd4f44e
SHA1 ecd9b4524a787dbe7747692e772b442a1f2b23df
SHA512 81fa32bd7e14c85321facb195983a2b1251204a384a8d4c66698aba6859fe44f110a69e34c4415bc11cd861ae30b03f81606287577f4d8b6aa8bc1dc7f4efba3
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Sgb4mBIBhGFjLNiXicJFFRGNzj3
TLSH
T1E165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d9641cc70eeee22ba1b83975686cf99c4ff5de0aeb7df5f7e424457f3d1c428b
MD5 24d2ae4febc110d9ab7f111e2d667e19
SHA1 54be89d9b35518a03883a80460e71ad75bd0a26b
SHA512 ee18f6f14ca9330e420dc73ce7ed6ed0794b4089268bd5b6bba7afb1540fe51de8bc8c02f55851004a2d0cd62f9464dfce8cf2c0cfe779c93fe9a5c01dc6dc92
SSDEEP 24576:vG88u8FpJqH1vzria7/mz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e7ZFPqVya7/QLNiXicJFFRGNzj3
TLSH
T15885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d0e206b37cca4f003f591f64419bd7977b255683771a6ba929039e7e80f30cdb
MD5 3c97ebf62f0e33812867e300828b89d8
SHA1 6cd3fd834339d8ed84d6fa1ebefa6929f7b12129
SHA512 7cf8c3867f7e9136893fe5d39282c859917ecc4d137f748b7a0b21095c42cbbb380c878a7209613fd57a016095a6f36883b9f11c710ed0fba0e203fef8705bac
SSDEEP 24576:iPUr+NQf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJQfLNiXicJFFRGNzj3
TLSH
T10565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f085bc0b87c97933d886df65d5b8cd4235e40f553090546f7117d3967689bad
MD5 78c01b734c63ac1c46166d39d90e0096
SHA1 ddb02370864e199de96f86dfa58087960c0af668
SHA512 911d76ca7301362c25a6663ef6555c808b0b1560abe01251f651e5dcd72ca7f7547fc0c7458eacd47fb0b249d6b4a40404e252ec4b8dbbb1933a895ed8bca5c0
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:QG05lO43bq7wRGpj3
TLSH
T16CD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 35e3a075d2557cdf745435a49be135cdd1be7e5b567cb036a4deafd648a8fe8e
MD5 835a873d02752ac02266edba14b385f5
SHA1 f47c480d0887b3ac53239a4f098e8f54b6574be1
SHA512 9bb5a26da540cd590dffe41cf6eaea8d030595fd60b303d0b8e37346773389ee4e9a673dd109e699c6746c48008ff5ba17bd7c4886ed00b58707c33d88e724d4
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJ/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ha5POZ3lJt2pasx2+mXLNiXicJFFRGNf
TLSH
T1DB65BF5EA2FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 129acba21d0ee37ab9ec831b72917062c858580523e820dfa4f917a93571dede
MD5 6ea16d8061b65271f8708dbfa196cdcc
SHA1 46dd1f193daf1d76742592c4072d52686d84aaf9
SHA512 867a048f980082c75908c70e4248afcd134465d9ea90c31a9f6dff8c4f7dfd82f1e6fb58c2464d2e53d38f1ad01b69e261aeaee7ea3bceb3976479ffb8e7915b
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fk7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mNc/zEOVHFwLNiXicJFFRGNzj3
TLSH
T1C2858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5a38b2932e50b3b3dda5c7b6eba8ae76065be545a14cb7353f2ba780701cf750
MD5 52ca2fdfa8bd5d1d04baaf95c4d98cc1
SHA1 258a684a55dc684a4b19b9d33fbc0225dd664860
SHA512 f7b000bc13cce0880f1ff6a5005d09cdbecc717907e97260011d628963055d16a421df4f11f90a7ec506619b68728b51ca926819d4c4d3fdc8d3a08446fe49ac
SSDEEP 24576:hzkNvNnaFeYhJNtmZBmN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hzMwBtOmNLNiXicJFFRGNzj3
TLSH
T1BF55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 50dae1bb8e5ae73b21eedbea9c5003441a41ce9d9cce057fa1f6adf4f280f1c8
MD5 167484568536019ac6bab9c111224acc
SHA1 c558c93ac595d850c58a1d6e1e424357b0a67128
SHA512 91bfe58a60439bbeb5dce5014d74afa0f46d64100ea7ea5c38ce58c59cdb5b7643fb2ca8c51df404f4953976b81a2f96a78544bb4386081a8275147190e1f425
SSDEEP 24576:hD3FHshBIYQgAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hDVHeBIAAaLNiXicJFFRGNzj3
TLSH
T11175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3192-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3192-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3192-108-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3192-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3192-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3400-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3400-79-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/3400-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3400-84-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/3944-115-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3944-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3944-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3944-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4044-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4044-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4044-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4044-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4044-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4044-328-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4188-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4188-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4188-280-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4188-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4200-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4200-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4200-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4200-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4200-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4348-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4348-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4348-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4484-6-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4484-1-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/4484-77-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/4484-7-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/4756-67-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4756-73-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4756-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4756-295-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4824-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4824-133-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4824-127-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4824-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4824-135-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5692-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5692-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5692-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5692-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5872-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5872-13-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5872-20-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5872-21-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5872-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download