98d3163c46a5fdc47ac8a31d82c5556a7e2a0203baab1d5bbf3cac5b57716d67

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260804-sa6mlagr21
SHA256 98d3163c46a5fdc47ac8a31d82c5556a7e2a0203baab1d5bbf3cac5b57716d67
MD5 9384415a14d4fa609cbec211c660aeda
SHA1 d8ff38123fbe2b865eda3ad33000612446a1711c
SHA512 c055e325213080c8ceeae6f96e73d3ed49a786b118dec0b214241871ccd2832e862f4e7846fc431f2b44e5ad7a233a39a0785e2d07abd3891ab8a2dbd06f5d69
SSDEEP 24576:aVGGTWBZIVukHvWx6T0zViHj+ZtW0I3ti8Zh:WGyWBZIfVTBHYMZ
TLSH
T1A365022232C0C4B7E9A3153059B0DA71693EFE705FB0498B6388676E5D707E2493AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5984	elevation_service.exe
4840	elevation_service.exe
4688	maintenanceservice.exe
4800	OSE.EXE
3748	PerceptionSimulationService.exe
3220	perfhost.exe
4184	ReFsDedupSvc.exe
4740	SensorDataService.exe
580	ssh-agent.exe
4928	AgentService.exe
4112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\35ea5901e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffa202742124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029ace8722124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000ea5f1732124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080595db72124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9a360742124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000556546752124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe
5984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4184	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4928	AgentService.exe
Token: 33	4112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeDebugPrivilege	440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	440	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 944	4112	SearchIndexer.exe	101
PID 4112 wrote to memory of 5608	4112	SearchIndexer.exe	102
PID 4112 wrote to memory of 2996	4112	SearchIndexer.exe	103
PID 4112 wrote to memory of 2876	4112	SearchIndexer.exe	104
PID 4112 wrote to memory of 4700	4112	SearchIndexer.exe	106
PID 4112 wrote to memory of 3888	4112	SearchIndexer.exe	107
PID 4112 wrote to memory of 4544	4112	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4740

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2644 2668 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2644 2668 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 637f86651ea10c41ca7eec0c448a046743853e61979e6f298b549d0d5c0fb3d9
MD5 6fed78b76f23bad1bc5c990d2a41abac
SHA1 1118f6938cfd0cce885b8839e9e2d26d9855f6d1
SHA512 d946a88956b789530259c3c5d8db9a623e344f4c40340356f0bd29d73282420e91c92a3f254f4810d8e1ae5cb2e8929637ab6c2d36756fe14131b98388037584
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLfVTBHYMZ:r3q6mjB6Vmi
TLSH
T1F0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 86def8652feb4c3f92bc9c1d07be3fd0940c2705eece206a99aeeb7e55902a6c
MD5 f8a1d118113465423a456a101f523919
SHA1 de75d656c98949dabd1639408b47288f70d423a0
SHA512 a1487f189041441d707d755a8e22d5c9946642ed6c128b8193fef4ad76bc2fa2bf585abdc9d21247fc9be1113d98bac7d8b6977e667b00f1ad10eadc77306de9
SSDEEP 24576:0XYfDtczAmVukHvWx6T0zViHj+ZtW0I3ti8Zh:ztcFfVTBHYMZ
TLSH
T1FD75F12963D408F9EDA7417CCCB28511EA73BC9183A0E78B03A495695F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0dcf3bc02de0e58a07bd54626bcd27cacea0b024df9ca8e8118dfb7c1c94c918
MD5 64a7dfd59e84eb15327240f9ec749f8d
SHA1 a7792b5877ce9b172bd29a342f63443f15f47f4b
SHA512 3b3089962137a4a61622610a40071a75645afe8555fab6404c3b78d8af854869e68fd16e321a4003994b6da6d23ab9bfea77633a94155f1c15f0080d8ff058bb
SSDEEP 24576:z0Le5ji0hmxNrMTVukHvWx6T0zViHj+ZtW0I3ti8Zh:zPji0AH8fVTBHYMZ
TLSH
T15D959E16F6748335D073C0B9C5D2A69AED72308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9bbf823b099137574c465ba38c888b6119b52b3de3ee3e2840b07bb74389d965
MD5 502e27df0f2f34a61174972b4ce52567
SHA1 4a9dae4d66d0d4f5725cffb754e826f0086a8cc5
SHA512 4592cd981ee666c40d9d0a10265a55894d0ed80ed19e900f91dc44b4de52b0c045067cbc8839fa42b6f0c61ac9fccbfa4be7a366ebb6c84ce677f0ffa95b3715
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWj6q8wyuVVukHvWx6T0zViHj+ZtW0I3ti8Zh:v/ezSC6vUzPv+HjywfVTBHYMZ
TLSH
T140755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d2e819713b99f696bd68e0803ae5dbcf444628064c99af114b4131426b9d846
MD5 8720d654754f66e0e6a9b9834ff6aa3f
SHA1 033620e37c15c55643205cd9eadd2f32a864e4d7
SHA512 a8107413708885d2462e6dc1ef29a13215b025bbf613d210747504c1a73fd0e5838b36725a716c03de36e99769e5cb5732df427db18e6a3eeed0d1a3bd12ddc6
SSDEEP 24576:xVbqPb88hv/l+BSVukHvWx6T0zViHj+ZtW0I3ti8Zh:xVO88hXl+cfVTBHYMZ
TLSH
T176559F66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ae3eb9c63c6ecee1b5f7f5b9dceb8c43f6150e2758f45e6e1c247599ef2247b3
MD5 56b3e81bc0c4d2f8140b86761c6c3040
SHA1 126b77b8ba1ef6e3c457d7fd3c62154b825133b5
SHA512 2cbe260caf28aaf905b5e6feb189ff76204301290865eaa916111af9956de4be4f710b343c024ea0b4b09e83c051949491dce4808171929080d222205edd5a3e
SSDEEP 12288:DzPvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:Dz/VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T17A55232F068884E9FBE70174A872AB916477FDF1E1E045068908F6DC447A77A85BF837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 9796b0cc8ca953650f7456e6632a94af5c60a4726cd1157d551b70840ce013d2
MD5 8b1a5ebddd65b031d1d85fe5053ee5e4
SHA1 49a74773ccaa6e1d06c85b3b3909d69eaea752b5
SHA512 e9555680fc7c60a2dc548a1aea2e790245adecc748089fed03825fdf15ab8463e7bb10b312d8d8362aad2e7b1ef7fc543fd1fb40bc8ee5f192d09b65da7c58bf
SSDEEP 24576:YJIUaVukHvWx6T0zViHj+ZtW0I3ti8Zh:YJIUafVTBHYMZ
TLSH
T1DA75CF3BAE28FCE2C27A4DB85A91C740D77278704B6193CBD164C24EDE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 770c68087f2c43c21e8e9f81f1286d3fec71056e41c11101c4061705a3ca359b
MD5 53697432a80decfedeb2dd029d3b81a0
SHA1 0fd4e4177b1b4e0fe6392a2f086c404e20ed5b8c
SHA512 1a7ed850ff90f5c7fa03e06e0d1c71d51714a806c32b59ef99e3548a6e505df447496e57b2d93fbb04871034f8698f576df5e325733f1a94f5b0bf4cf7c4e0d1
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THq:GQvGAdlCEL8c/WRNw5CNVmi
TLSH
T1B7267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a848a3255e373ae27984b89c8a3c3997ac6c3ba92875fd453bb75d302203aece
MD5 efcb11d71fd8318815958eccd36a93c7
SHA1 c9f689c815236ac1ab83f184630c7c888cccf817
SHA512 a8d386a5008d1b616e751e9212b3f6ef784bdb7a645bd5fceb0a416ef0dc291f70123ff2475012661395cd82db0f4dcf6a962c3023d23ceeebb69dedcdb0d895
SSDEEP 24576:0TewsAjMVukHvWx6T0zViHj+ZtW0I3ti8Zh:yljMfVTBHYMZ
TLSH
T1B975E031FA74D036C7BB0DB21B36D716143DB9604BA11AC3E3A89E9D59342D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b39b86e9292229f6c90a8a0bc70c0634f3e894886815b4697a551fd17dd573e7
MD5 c7bda6b666e8072849386f5fb0b6a188
SHA1 5eaf6cdb1664daf1c55300a6d1f4636bac05b60e
SHA512 761e6d9734f7731442a48510af78e4b435001123b84932158612bf0265498d2f576a1e066a51ecae1984d89967fa4396b04e2c159f2bc681e91870dafa209d00
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8:FUEtQevvqc2W1cpV20I32
TLSH
T1CD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d90b69bd90d2e09e869efd4eb8d56b1b909993fabc5a31583f5f40d403f0cab
MD5 c95898b2264d3ee0ee348f331209c10d
SHA1 013fe2e05523c921457e0b46d699e0050e80402b
SHA512 d2865e1762ff4fb937a1776cf460bfa0a9c5a3f43ba09af24064b640b26cfc4fdbd07525c5fb6d74dd41a88778126ff2a057eb2bfbc980a1e782ed0603e8068d
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zsfVTBHYMZ:hoquVjnmZVmi
TLSH
T11DD58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 03feedbe1258883ba6f4783558849dbfd212b00ba143537b2dac895ca656ae51
MD5 268acde778c35d11bce8bc226f9f1463
SHA1 1cf3a025f037914ca05128b4bd32c95dd254b343
SHA512 59e798f7d1c6229720821dcee3b619aaa7d780c266f908f8fce5c6beb8c6925af6e9e731161854a82c4e1ee35408a74664563e5018689fa5a18abfa110520069
SSDEEP 24576:gAhGL6IFoiwtA5l7S53pVukHvWx6T0zViHj+ZtW0I3ti8Zh:gAM5Foiq5ZfVTBHYMZ
TLSH
T1E7359C81E7F945D4F5F3AAB899B69570EA76BCA65E30C20F2150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 91685bff3395a8580ab6379d527a960d6d1bd2afecc9f5ad586c910d7bf93b71
MD5 31c79c177166ef9f5496b04182b26133
SHA1 86740a1ef1993f5c90077b8c3f14b8c153efc1b6
SHA512 2279e974482dfbf647a283c450035a6ef593878b5b28dea0ba0d496b856c7ed97642d9e5ced6c0f875c1c74e03b13f289489892a6662a2baaa3df630eeb00d8a
SSDEEP 24576:cwuNOWQVukHvWx6T0zViHj+ZtW0I3ti8Zh:cwGO9fVTBHYMZ
TLSH
T11A75F10A26A80CF9E9A74238C5A7D536F7B3BC522661C70F4760C65B5F373616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b5b04a10df2281451aa509ca7f72204dadae88463dc3681bc9d27dab8bc05649
MD5 df004aaa9502dd189d03803bb7917ad2
SHA1 fe7ff1768a40726aef3935a4e197e4058ca55911
SHA512 8f612ce15160e098e2e54a984ab21cf652fa327c3e6091d65e07c83006bed20e48b0857e16ae95ae5cd7a370682d576bbd04e4ced62e64082da501a18523370f
SSDEEP 12288:ldZ1IyCvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:bZubVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1CD65121E22D860F9E5E30278D8F15A45D773B8A263B143CF0614A2A95E77BD60D3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 98a887ecb93c04257afc20d8513f1d71b0d8cdaa72b7174a7c12cda9c8e105de
MD5 fa0d46572212f781f7fbbad0458286d3
SHA1 c44acd553bbd087216180c9724b6a9dffb27e4cf
SHA512 1cea365c87c9835fcaef7c735a4a0591c0f37176c3b970d43924fe09f26d21da8bd3fa7ad79149bbc178282a79af13c614e41f9e33e83dd56e1292f1e09bf34e
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UW:fQRQyi36YOcPDLvw2gAf+PN3OVmi
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ef626d6d8c1c5e7da85709932903aeda782b9d434be52e9d376e259b1f4a98eb
MD5 e49ba1413d6e94e3e9dc0a92324552cb
SHA1 8b331a8397040d22c7b71ea7503e733261a1268a
SHA512 31e2fb061f157f590cb38d8dd09205e00496188d409bedb44b14158eabc7c10d5f56f6c74fa1bf8b237e6885ee4a7588a238b580c258855e67e7f7948132fb73
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UW:/QRQyi36YOcPDLvw2gAf+PN3OVmi
TLSH
T18C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c843a78d0dc2a8d66f7ec82e0fa178560bb51583bebe5cca1d037f5a8112cf90
MD5 aa63c423d3014a65ec7238c11f06487a
SHA1 ca5b0a686c1f0a19b05c37203fae2dae165fc30b
SHA512 ae8933edc9c8349068ce48ac003e237c6139fc2565525585997435fd4b17c8cb9daa9559abf1d3e78e4506c5b35551e2bb4d5335ed867b406d2fa563307b2d83
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0LVukHvWx6T0zVif:P68Qg55nhkeWu7PNU3/8fVTBHYMZ
TLSH
T146B54933B2F600A9C44DE1769F46972196D27C71CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c625e054b09f5fd1793fb7e2c719abc588043665764abc6bb732a1fbef99448
MD5 249145f054c54ca16886fa3f94ba2ad8
SHA1 88133d219126e03934e24fc41e2112f1dc56ea23
SHA512 47341a5fe1285ae638ba72b5fb0f9375c89ccd9819834c11f5749c45fbcb90b7e1fe5b1c37a7bff1c5567e7491e8ddf1205b2aacb90436d9d5ed78fe6d5d17b2
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99E:dy5112gYy5azzVvU69nLKnhZnVmi
TLSH
T1D5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 991ad132b3b421a50781bc5e31c015bb032f1bc9c5926e9bb3652bb50732c74b
MD5 7b8f1b7df1dd1da9cdae78f93bfa9bf7
SHA1 91ed573573bb352f9cc51ba54c6bb915083182bd
SHA512 7066c8b435b578f2581697cc4829d72daeef80a2d41c69fc4d1510509de727c03d3fec68081cd3caf4fbdc61f7547f8d33504bf47f84b5c4be6169039728a2df
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWfVTBHYMZ:6u6JmIxd2dmVmi
TLSH
T18AD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d9f1dd2b929af950aecef4f4fd564a93c179e581f4d861c132627cf0d398f4a6
MD5 2d16a863de3ea4726e544cf60d1e0ad9
SHA1 0e996b388063966a3683d8609ec8b07ef005c5a3
SHA512 9628665e631b9e3923131724f007c599df48174cafb5215dc1944f32d1c281247b1f6daeae744834367bac5e87cb9833a5caa3e06b5299f3de679baaa1b94bd2
SSDEEP 49152:d1hpsNoJpF1A67U44CwH7R4x6fVTBHYMZ:dmifPqRZVmi
TLSH
T14CB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f9db1166341fa13fed1ca6da51ebf653ad098070f8ae573c41960c10b5fd02ea
MD5 bf49179789d1c4cbd81404ff7752eeb3
SHA1 a00ba6c767f9345c6c32eb5d49c332dc96ab7a66
SHA512 53538d992f8001314557cd601547476e67617e33f04fbbff39774530e702af9e4a81fa908f15e1176155a885e50d080120ad957bb7181065524bb4e009520d17
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqbfVTBHYMZ:H5dKqi61rVmi
TLSH
T1BDC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50663c577b3e13a5a602957b76ff2821969218aaf6f2e23f8e1b0755804a4e75
MD5 60155a94f99a022d1c097f754e5a76bd
SHA1 d8253a45480560e1dbd8beec913b05579bef9a39
SHA512 85dd9d5e676a118dac357f7d010518912a4bf103114ba74ebcd4f3172045d356261fbeecf1d3da40f45348416879e571533d179d7dcb3737b43ea76b73996445
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wmfVTBHYMZ:xX2iWph1Vmi
TLSH
T18C95BE13F2D900E8D05ED178C7568632E972BC160B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 7d7867f2682194295140cba2893e2524c69af75dfe1a94c3451a201e82dac245
MD5 cb6048ee30ded1c18c18f43ca60904af
SHA1 70db574f7bc5370efd810fee23831f44d6ba86fd
SHA512 e64ecafc08f544ca2f0e53b4e6d50fe58ea9b981225931be500015948db4eb98e0eaf9f4761d0dea63329e051e5b9184b0c8af7b9a5a4470dc0d4e61ec39b4b9
SSDEEP 12288:ynvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:yHVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T19455232F05C984EEFAD201B4D872AB95647BBDF2F1E041069A0CF1984476B7A057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 31f664105ed5fb74e80abefff8181187b271417d5cd2655f9dad53d34734328d
MD5 ee75bfbd891e4d8b8ab6fffd1a050826
SHA1 ad35ca541d7b916f93e576993fa3a757de494a38
SHA512 e8c2a30d355b1c91f8f2dff0553e8e95756264a8a8190baf83953a5b50f3a6dc2e112339f6068a44d664c588e5ff57fe4cb20782d2228220e3b76fa01fbee5a5
SSDEEP 12288:a2vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:aIVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1C255232F058984EEFAD201B4D872AB95643BFDF2F1E041069A0CF1984476B7A056FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 03936c10109e92f73b3e860a36b092b4e21576c55693330b9946212e1619e60f
MD5 62a0b79349dd4038021f596f1aee5f1f
SHA1 86f8c28643f60926af842ab8258ce43d8bd4c0b5
SHA512 968f3866a03d3966f2af51153270a14d5e185eb04b7dd1a0cf8d1992232e48560c941f058c3a3d581b99f7e199a93bb463ea5148bdfae694cf615b2d74354e48
SSDEEP 12288:tYvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:tCVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T10E55232F058984EEF6D201B4D872AB95647BBDF2F1E041069A0CF1984476B7E05BFC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d1ea75eae3b7f3d8dde2bfec57e419004e05832dae467254f5b3a926824a4d66
MD5 5c00ed338e4fa10c58d1e87b60096f58
SHA1 0d23d55b3bea29a118453202a491789555d74a2e
SHA512 aedadf4e1d02e28bdb489a1ca2c932c12280eb89526c8ee55e97170fdf3d77bd94a93aed48ef6991615119a27fe06896691541724be28cd4c9e660c9749bec3c
SSDEEP 12288:LVBvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:LVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T11355232B069D40E9E9E34274C872AA51E577FCF1F3F1420F8A08B5990C727A9097BD76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 bfb0f13f401086302a1463de8cc9cc6d860662fb28a62a5498fda3032ae2c3a3
MD5 b3690dac590947682c692b2a59cc6171
SHA1 8f106afb4a55d4005c655b67a666cf6c468ccae6
SHA512 c575d3f86a6f95e7f7bc54e2df139d7cccd423a9c689c24015c7720e8823504a3e0c3d3ebc933b7ac2d03743a0d15856ba84eb87e0e15eb7ef300d981cfa82b9
SSDEEP 12288:ZJvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:ZhVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T15E55232F058984EEF6D201B4D872AB95647BBDF2F1E041069A0CF1984876B7E057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 80266ac9636aea3635fa9e569ba9edbd44c7f4513cab36bde93fd270c26da9f2
MD5 39d31bc88c758aa09c2de7d23dd9302f
SHA1 e1d5ff76d1dbc2ce2cb7bbf25084dafe3c87a751
SHA512 72e84284c641a07cf4870ba8e48aedcfaad986466d0053694a9417870753b4b9e9225dd95d418aad18eb9cb0e6b787be3f730580b05846c95ca74be886dbd7b7
SSDEEP 12288:TKvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:T0VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1F055232F058984EEFAD201B4D872AB95643BFDF2F1E041069A0CF1994476B7A057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 7f59a1881d6248f285a8305438246d047ca40d81b4121e9f4f9ed7aa42dbffed
MD5 d57b793d5b8ada6f152592226d9c84a6
SHA1 702967ca1faa535c956251008ea476752abd9c1f
SHA512 a5501eda1f45c957bd2abfa673c86e8c50c58db39e111f9baf1c734ebb547a32a3606bb090b3d35aad33da0d90c650d22d92de50e9c950b38876ae7fb277da78
SSDEEP 12288:eevsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:eAVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1AB55233F058984EEFAD201B4D972AB95543BBDF2F1E041069A0CF1988476B7A017FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 814888ed337728c0ced42d8aefec35f7cacd82210c06d8a2a3c03003577db1f5
MD5 b23b88c5c17dcb49d35ac92f69c5d9a6
SHA1 1c5cd7dfcfeabbd3e0d4ca248085c1b38e332fd5
SHA512 5439f8600ba2b036d9d01a9bebccbc4e4917258fba33bf85269413c30f54b0cdca6485a3d5dc9b2e18f097e1d05209be0bcfe15a72b1f2bbc029e5a46a82a201
SSDEEP 24576:GZM7zFVSOoVukHvWx6T0zViHj+ZtW0I3ti8Zh:GZM7zfEfVTBHYMZ
TLSH
T1CB75F269739008F8ECA7413DC9619906D6B3BC6657B0C60F07A8366A5F733A10D3EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a664a72f222852c953707e283155bec827288b92ee8f4c83f37e1ad70f9fad15
MD5 ac7de54999939007271bdc78949901d2
SHA1 abf998a29c96383b80236da8c854ccda136faa98
SHA512 c2a061fc1af3dad0d3d81074e89a9bac002f377f5b600ba4a013c921db1e89a39cb9f4ffc7366a5c3c432fda6769bd67e3bda6a480470a4ccdafdaa74ee594fb
SSDEEP 12288:sDvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:srVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T17255232F058984EDFAD201B4D872AB95547BFDF2F1E041069A0CF198487AB7E056FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 30cf19cbfc20c1835dca729e755c948a060974070f8664254ce800dd82fc753c
MD5 dd72cf2722447427aad41aa718d15ce3
SHA1 b7749dfe087aa2bdfecd93a6815003c7f40b8688
SHA512 9b70d8e8de7e39a9eb872ef2f8958147ade546dd71690a194e7bf065c8914c1aa4d11f208b29e59cfa372dab771849bc1d22734dbdafa9524989b40815aebfce
SSDEEP 12288:XfvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:XPVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T10655232F05C984EDFAD201B4D972AB95543BFEF2F1E041069A0CF198447AB7A056FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 beb1705ab5dd4ebb4438d8cf15e3641619fb5e76062fe9a3b597bc703dac80a4
MD5 a8be0633c5ba7178a9d36984e5a924be
SHA1 afcb43994dea680b2e80f51ed33da14c57f516f1
SHA512 868bb4a19ff06319126313aa9b31dbcfbb3534721ed5dac8aaac830ceb3514b88b776ab8c5a23c6f98ef7230aa920ee1f8f82390445e2316d540eb4828d940a4
SSDEEP 12288:pyPz5L8CvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:IzycVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1DA65021B22A520FDE1B74238C8B21A02F776BC7257608A5F575452BA1E377A14E3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 ef257a86b1a6137ad01679122345be6aee3ab25e684d929ff33150083f8d1b86
MD5 e9377c8c12d5b2affc965e3e41ea4ca4
SHA1 775fddfd17106097570254225ed934e7077d00c8
SHA512 21347b5d250a898346e26b4ac215d2e321dadfb943b87a929e470ade9751a32b5168796bcd938632e16fca5b0e012e20709cd4b0713a62bb738a22e8915b6834
SSDEEP 12288:RDvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:RrVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T14B55232F058984EDFAD201B4D872AB95547BFDF2F1E041069A0CF198487AB7E056FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 dca2f8e197bb3731f6dd5623face10f995de663feaedfe489f8a80a719485a80
MD5 cacc373600f47b69699e6b274d1335e6
SHA1 9db42c0d67d0b211e809186c1605eafc37e7d479
SHA512 ae42831f8cfca590e2f7e0d2e72d24149622d8290dabc2baac77754cde9f98d3f6a3a4937a8c18186fac607bbdd6794770fd27010427c93220caa997f61ff264
SSDEEP 12288:wDvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:wrVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1AF55232F058984EDFAD201B4D872AB95547BFDF2F1E041069A0CF198487AB7A057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 964cb50b3dfbb54074d0d8f1eff6ba001f7723215e9dc973c048ad9500342fa3
MD5 82e0b4a4df826cd9f629365eb2c13c66
SHA1 fdd00fecb8a8f8f19f1a9fda97c129c0c4231c09
SHA512 cf00901529d0cdf1bfa978a12ef18f0bcc6150877f6f5e02b38eb94194ecc8f23f58fd7322bd3b32aab78d3150c73e559eb6b4acf28c9abbf738ae0809fc1738
SSDEEP 12288:4yPz5L8CvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:ZzycVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1F165021B23A520FDE1A74238C8721A02F776BC7257A08A5F575452BA1E377A14E3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 13bb721972be0770c0b470f726eca0c375fec58e8da4f661c3a2c4610e745a88
MD5 32803d0752b8c83f28ba5bde5dc33bdc
SHA1 5b5e8be6f727deed2822d71cb31c6491ba9404c9
SHA512 e1f3883c093f048eccad240a7686901e1a76e9004faea317895641b35282c72ea12c91bd5d90de9dfe39d54489e66e27b1afb8ce26fac7b3c68328a4e82d1e9d
SSDEEP 24576:mTwaLl3z0zDyVukHvWx6T0zViHj+ZtW0I3ti8Zh:mTXLljVfVTBHYMZ
TLSH
T10475F169739058F8ECA7413EC9619906D5B37C6647B0C60F07A8366A5F333A10C3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 61402c6b889684adef822d1536be9cf45f38c7d692598e1fa00409239bf27326
MD5 668436303085d22514a3c9f9efe4de7c
SHA1 427723dbb3d145cc803f840ea5f48f03de39d44a
SHA512 c92f993eb8c48ec41a32f967ef2a37a8d51a0d9a88a004d0a7d09af1beea23b9dfce1869c483f3cf2c1ef38dd4846eca98efd6b32b08a012b8669dbf2fe29168
SSDEEP 24576:L3Sd9CHKy7GZOVukHvWx6T0zViHj+ZtW0I3ti8Zh:rSd9CHKyaEfVTBHYMZ
TLSH
T14E85CF50B3E410E8F0B78A35CD725511DA767CAA5B71CA8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 7ce1053ac6cac52d02a09566036836d0b08996541ad51c925484029be10bfe4d
MD5 35bc0aec0b6c97160b26204cba877fc1
SHA1 439b09a324aeef9d5403c0c2d61751348d95bd1b
SHA512 de94051e562477625940564c0b98b87f91e094edfc72ab8eb8879815b929a53b7ed20f70120c37a9be4cbaf4fc20c04244d04cdfd4bfd77c64541f228b33a9da
SSDEEP 12288:84vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:8iVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T10955232F058984EDFAD201B4D872AB95647BBDF2F1E041069A0CF1984876B7E057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 355e9c96cc295ad14606cbf37cdb200abe384fe4628c35f2a0567409f5e756c8
MD5 efb55f85ae109269fc6125c4caa3451a
SHA1 e8aa96661d032b88596ef8289452c89260bf042f
SHA512 a9d162308f33f0a6b2b172a7606d10e54005541ca97705d8daa94f40277e03b5529bb4625d2d7b520b1a0a37e6b11cae4c239c8910d9162e3a731ebfc7920836
SSDEEP 12288:4ivsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:48VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1B955233F058984EDF6D601B4D872AB91647BBDF2F1E041069A0CF198447AB7A057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 89a8cb4b149b3c3e95e840df259682a0fe7f94d383f3d0c151a363603c7b1276
MD5 c52f29d03c07040b70027cb4eafc9756
SHA1 e3def7eb4ce42c96ecc6a6c5fbf485d301bed320
SHA512 cbac9147c279c2870bca5dd3431846b2486559d4bbe4f0b51bb7322490e3fe1d4ed3b96e6cb9ef500beee2ed3f98d2ba3d8009edb06d2d07750889ca4e9b7484
SSDEEP 12288:otvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:otVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T13D55232F058984ADFAD201B4D972AB95547BBDF2F1E041079A0CF198487AB7E017FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 e33741a7709a32374a54c5f691f3b0fc0596c99fee4c977527ea39c10e84dbf6
MD5 71a4427df13971d149a8872fe4f5087e
SHA1 37397e5f8fbd6c6260fbef49d4452696c7afb7bf
SHA512 63bc36974f83bbe229dc74240d89c83e4f1d16161691ffc3b9d101bd846ee5af1d8dd343dbabd65f3f244bf08020d2687f0500bd3dd5d27dc955522beb664140
SSDEEP 12288:wDvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:wrVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1F755232F058984ADFAD201B4D872AB95547BFDF2F1E041069A0CF198487AB7E016FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 78ce83dd6ffbced1c80a97cb911a69c53351e098e8f3b1cec441c3db91c19329
MD5 cee0a4279bcd8331870e117ae75206d4
SHA1 a1feea759f0fa2ef0bef37b6c9a4d8e5ef9a149b
SHA512 eaaf22bae7ea1fde1dd29103f2ec4330abaad003e8306f292af83bdb95743ddcec774c77c20d3d9414af0fc871aa642ec0e1b5b61d44dd4b20fb162da49b190e
SSDEEP 12288:x4vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:xiVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18955232F058984EEF6D201B4D872AB95647BBDF2F1E041069A0CF1984876B7E057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 3646d666a38e00f9d3d7bd3003b84b97e10a5f2b96813087f06c572968358934
MD5 f44fa067dddcfc361c72da0247c0ae99
SHA1 70beff551ce6ea701deb1333fffba81da5943c1d
SHA512 76bf8fb347e676984cfb6d35f02da0c3455bf9e57d1f0f8c59f4e831b4c8c241b4a762ff2836d37cbee6d0196f8d489963d80b1e498e1f8b7c7e0f929df5157e
SSDEEP 12288:nrvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:nDVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18655232F058984EDFAD201B4D972AB91547BFDF2F1E141069A0CF198487AB7E016FC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 82988bceb44fc2441a510e0ce0a6c9b3267945acbcab5ec1cf4916809631c63b
MD5 02c640c0904013b2762af9d34d7e4d4b
SHA1 4b8e747f25d00aa1c600c3ad64f7eb92b67c9e77
SHA512 f045c2652216e9ec8995d030127caa1f2ccb41ae80dda50650aebf038cd39e487b514f28aa50d20e967487bbe13958d11345422ab66eb99460b633cd710cdd14
SSDEEP 12288:eJvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:ehVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T16555232F058984EDFAD201B4D872AB95647BBDF2F1E041069A0CF1984876B7E057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 588a55af8b45254b4468cecc850a164072738a66e08eaa4be262cf901e6b957f
MD5 164f31c84646bb8feb81dfb46b4a8982
SHA1 e10cb5c21598a0320516cf7867d1947f983f8d4e
SHA512 433d93ee0b346a51e4e001c37e8e98b9f2fe365199893e0c0c176c3dbd2a291d8bef92309b86c9e08dd57951cc450c156a8bc5b3cfd1c1e431258c2963e82443
SSDEEP 24576:Ifwvfk9RX6wkyAIfVukHvWx6T0zViHj+ZtW0I3ti8Zh:nMnYIffVTBHYMZ
TLSH
T16285D029EBDC44E5E1B7923C89B3460AF6B278691B71C2CF025953AD0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8d62650b5c2f2c67b8e0c3f7586b76f8a57224da21bfe5fabcc27487d3d8fac2
MD5 c4260531ede03157dc6b9063b1c8a9a9
SHA1 89b949689df458439b059052dcc1f6f6ca0b9db2
SHA512 c75e9c567be538e4a8399ee11af561f89057b3cdde9cf288769ac184cc709c3a8828c987cfa5ae00123042790e0f78b3119acf441b1e4d562608f2329eb28de9
SSDEEP 49152:pYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GfVTBHYMZ:gySzPuVmi
TLSH
T182066C56A1A801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4feb14b8424fbb9f0649cda039d6bd24957b1dda2d61571082452d1e9a3e9b13
MD5 93999c526d19b649cf0711b99cf48be0
SHA1 2913277c836262c3506c50aad34defe145b414f5
SHA512 fe641010bdc95cbd06adcc58d98c17089455e4010b35c9cd8bebc617486495c6b295791cc141cd8456702493817ec358a4e9a3d5cc6132ac416ddd367488a661
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY4VukHvWx6T0zViHj+ZtW0I3ti8Zh:R47JUQjqirIhCnDHUPfF/WfVTBHYMZ
TLSH
T16665AE1EA3EC01E5E1BA927885154A5AEA71782E5B31CACF1270837D6F23ED44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 47da8cf5caef87b04216c34c54815abaecf755080c87499d05c3155cd4290fda
MD5 12e6de261d5ed898995f684c78431064
SHA1 e1c4574289fe7065d2a195a49f5f1343b797f97c
SHA512 7ac630631511c74cb8caafb427f0e5cfb2f3a626c67c80e7933676c5c829024b54d9680cc903091aedbc91d349e52fcd1edf5101ca2c30442b68611b880875cf
SSDEEP 12288:ktsfzvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:ZbVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T12665F11AC29842E8D0AE1275CB629A41B3337C6193E1D3CB57C0F57E0F766A45DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 936a6631414cb28edf522c90d439f770b289fec8d101a8e81cc4ff8682e6ee20
MD5 4bcf1657b924c34f11543e9b16f687da
SHA1 20a37c341923a08f6b390de3bc2110efe141d7cf
SHA512 147ece57d504611859249548a9d5dd05a2aff91588e3308ddb0c1ec9493538ebe1f529b0c50a2e032c3a9e313ba749b7313a25833c87b8267d3cb07455ae6665
SSDEEP 12288:B/DP++U3fVJ9UN6zDHKELSR01vp7qiSd9J3OHjwY:B/75UPWOdFw/3m8Y
TLSH
T109252810B66AD75FC6AD80321E73C2CCA7707D01EE059B0772C8572FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 394KB
SHA256 90902fb3025481ff755513c7c17f5a558f8c17dcb16d26e74f0f053733d9b9a9
MD5 e1156c84a77b4415c5710daef7e901f6
SHA1 c65dc566e159a8c52803f12ec6417da7e0e76acb
SHA512 d9810fd60bd9f25a3c8f51488cd7d569589fbb3574fe3069803954b9e6d9e86e98e8105e9a02f7504a68c8d53b37c38c566799b6a6128e9ba3971a0c7b52d90c
SSDEEP 3072:4yt2mst2mNhQ4hK/5h7+St2mwt2mfMjFuR:4dZE7+NMxuR
TLSH
T1B4840A007759B32FC4F58177953092DFEB38B812AF1263023BC41D58DCA61AF7AB6A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 118846e706c17828ac309fff01427a1c64386f756fb28a51dc9ded641199e359
MD5 a31ae86ca050fa15b0a970ddce5fc7ea
SHA1 545c3a9ccad4776aa0c8599ff7b87e25fec37af0
SHA512 293b035000eea4f25840fc47f9d2c518a5140c06e3eaf90596c15c9dbddd69757ba72cd56c049e381fccbca2fa151ee591dead029201e9d3342eb71cc0624248
SSDEEP 12288:Vl7bvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:PzVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T12455233B028C88A9F9F611B49472E761642FFDB1E7D08087D908B1D84476BE94D7BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b1df778a4e42b5b482c855f3c0d66e1c69aa9cd7662e51a3d3620cfa25dabc64
MD5 f20a0fe5be9094cb16f5be8bceedde93
SHA1 e39bce88f44308d8597a167c9a2f92eb3087ff52
SHA512 7091f5b2cdf3f357877588769e4cefb36d5b68205ba3a2b385b31374f532135bf38b90760156e511a7e074dd644f0f24344578ca4e61f9e325a4acd5c5b13e58
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYVVukHvWx6T0zViHj+ZtW0I3ti8Zh:+gb4mBIBhGF4fVTBHYMZ
TLSH
T14165AE1E22EC02F5E0F6D2B8DDA64417D6B278161731D2CF1251426D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 20d50067eb3dc901b39c9d5cde8b1c63bafe33cadd1b221a5a4dc7c7032ccf94
MD5 c2a9872a1c10e80df4b8af410e1520c2
SHA1 886f7c4d839a0ece14efa72a058a8115a5f6b513
SHA512 69d2a8fbac3c227754a122dcd397dadc1190d9591d7bd3009c9a892411cb4a5431f1b74dec038237bb9beb9bcf1a49e101de99103fa11d8179dc9c64969ce493
SSDEEP 24576:gG88u8FpJqH1Tzria7/moVukHvWx6T0zViHj+ZtW0I3ti8Zh:z7ZFPqVma7/NfVTBHYMZ
TLSH
T13995F12666E101F5D4B7D13889924663F6B2B8211360EBDF07AC8A551F23BE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0d514e9303d182a350ba1c27135a82e4d7383fd1694eadaa05b709ef68180bae
MD5 72043916eb7d73163055ae2736b31904
SHA1 8c5294c2491ad4c180373c8b7c8e7447b7fe6bd8
SHA512 f6ff01fb63444ea6e9aa8305f33932b204691c003df9f4976329e29c4622023a486b1edff2be88ced198bc51f19dde6621bf30c7f5841ddf821bfdf2d1561bd7
SSDEEP 24576:OPUr+NQEVukHvWx6T0zViHj+ZtW0I3ti8Zh:OJQEfVTBHYMZ
TLSH
T1F375E22F22DC18E5E676A17C85928709F772B8621351D2CF02D0917E4E77EE86D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4fe8496e8db23f611fef79cbc86cbfd984049ee1572a662bb64d3ee40f567275
MD5 f7011f04f9f91c3d2afcfe1b8de63cd6
SHA1 f7b8dfc6b290313dca1632643a357ddc447f67f4
SHA512 ff04afe165b3415bd887a9df1908c0427abf97c4ca91546c36d85eba3931e861fa74fabdc991e04277f9b66504270f5c42d445226dd6cadf477ad5baac284975
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0fVTBHYMZ:9G05lO43bPVmi
TLSH
T100D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1917f294fe6060d45b631718a33899d1371123ba03beeb846f2948565c9966ba
MD5 7a43b5a60d7189f16e61052b05c6cab1
SHA1 8817d322e616a8f799e0b17ca16c08acb758e236
SHA512 9c2194cd0191b9862592bda64a3fbbae3e11da2cdf4dae9bfcec81bdb85e417907a7fa2b4597554cd607b3304d4cf99f0274c497dac73e6e71fafc02c75724d0
SSDEEP 24576:Jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnGVukHvWx6T0zViHj+ZtW0I3ti8Zh:Za5POZ3lJt2pasx2+m8fVTBHYMZ
TLSH
T12B65AF5EA6FC01D5D5B9D17DC583861AF5B2342153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d9f1115a2bb30ed960592b4d9cfad282db3624d96950126020bc63bcd8b4762
MD5 b219281184a82b1592f5d12a594d5f11
SHA1 8d1b47115c263571325875e57d916ad37a09d478
SHA512 0c5f9bb6113cb24bcecd80afccc33d03840757e87b960fc7dd5d8f986930f808cc5b450d8c4b5e25534b75199eb3b1c252f52171fc1bf66a7f0c28b3ab5affd8
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkwVukHvWx6T0zViHj+ZtW0I3ti8Zh:zNc/zEOVHFtfVTBHYMZ
TLSH
T10E857B2622E901E4F5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c137a02f47e67b373ccf5712d5e73aecadee26b6437a4bfe3fb60ec3829fe686
MD5 8065f7665e8eb0c374c955a405e7f991
SHA1 7e713fd35bfcda0d2444be49e00a5b0d53bf3c0b
SHA512 e80c265d8be8e742b4c9ec42542d424a1197e7321a5265d3ea293e29db9de3380075b81b839dc96785d73bd6e21313f6ba405734da0ab4f8719a95262f594feb
SSDEEP 24576:kzkNvNnaFeYhJNtmZBmqVukHvWx6T0zViHj+ZtW0I3ti8Zh:kzMwBtOmqfVTBHYMZ
TLSH
T1AF55AF2EA6F846E4D1FEC6B4CD238512E6727861173293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 fe37e47f26a88cc7d6086d6d576baa8bb1abb15b050855848d08c3cf22bb7e9e
MD5 5188e4aff5ad09a80e8f87c449b263f8
SHA1 20c2829fdc2247ea807c1c6c4db7a845f060726e
SHA512 2c3997eba83e131ffaf5e66e357d2a59bb97a74c0d5de9d48be3a4aa6c8784ec2066f469900a9473f3bda6de845e1b6f16dbf066b4a2ff5769d8d6a2ca5d3252
SSDEEP 24576:UD3FHshBIYQgAnVukHvWx6T0zViHj+ZtW0I3ti8Zh:UDVHeBIAAnfVTBHYMZ
TLSH
T17085E13ED69C04E4E57BC1BCDA638A06E67238A9033155CB0694D1B95F6BEE42D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-79-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/440-0-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/440-6-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/440-8-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/440-1-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/580-106-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/580-304-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/580-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/580-112-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3220-76-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/3220-301-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/3748-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3748-64-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3748-66-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3748-290-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/4112-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4112-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4112-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4184-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4184-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4184-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4184-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4184-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4184-327-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4688-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4688-57-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4688-61-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4688-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/4688-38-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4740-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4740-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4740-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4740-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4740-305-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4740-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4800-274-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4800-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4800-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4800-50-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4840-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4840-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4840-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4840-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4840-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4928-118-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4928-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4928-124-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4928-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4928-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5984-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5984-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5984-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5984-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5984-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download