3aa52b61701b8cc56be10b0eb359e5eecf6842650b97ba82448b6c81c7e82124

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260809-pn76sseq6w
SHA256 3aa52b61701b8cc56be10b0eb359e5eecf6842650b97ba82448b6c81c7e82124
MD5 9cdb64c6b9945b7a8692777314fc80cf
SHA1 c19ad978bf2346bd91c90a409fe9291afa664f1c
SHA512 18b63237c652512da0cd3c8998c3f0333e1564ee59cae20f19c4ca925aebca2d756aade9620ad694323bec007410e1e01d9c9909ded679687b9c5bb045ad3a78
SSDEEP 24576:55GtI/4EX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vGC/4EXvYMLprznyDSga9
TLSH
T1DB75021072D084B3EA73153049F09A61697EFE700F248AEF63D1176E5EB86E29C39327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4852	elevation_service.exe
928	elevation_service.exe
3356	maintenanceservice.exe
1464	OSE.EXE
3416	PerceptionSimulationService.exe
5972	perfhost.exe
3472	ReFsDedupSvc.exe
620	SensorDataService.exe
1172	ssh-agent.exe
1248	AgentService.exe
2308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\817ad705e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1d88dcdfa27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009fbff4cdfa27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da5839d0fa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001385320ffb27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000830098ccfa27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4852	elevation_service.exe
4852	elevation_service.exe
4852	elevation_service.exe
4852	elevation_service.exe
4852	elevation_service.exe
4852	elevation_service.exe
4852	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1248	AgentService.exe
Token: 33	2308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2308	SearchIndexer.exe
Token: SeDebugPrivilege	6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6080	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4852	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 5276	2308	SearchIndexer.exe	99
PID 2308 wrote to memory of 4708	2308	SearchIndexer.exe	100
PID 2308 wrote to memory of 2376	2308	SearchIndexer.exe	101
PID 2308 wrote to memory of 3172	2308	SearchIndexer.exe	102
PID 2308 wrote to memory of 2812	2308	SearchIndexer.exe	104
PID 2308 wrote to memory of 4712	2308	SearchIndexer.exe	105
PID 2308 wrote to memory of 5916	2308	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5972

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fc4093fd8ce99475507b3af611bf0b8b84d760ecd4e07bda7a18853bee4877c3
MD5 09cb0bf625699e56f06dfc54980a1a5b
SHA1 28ed51dc69c08386b4914efb8720caad5ab6b684
SHA512 c6e35f51ed8eb225fab607309f524b3a31e4fb567ae83050e0392d3e48fa84fbaed9ba3bef964e5e4b3a432270b2ae63f40c706c7218e1f3807495946d5fa335
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLXvYMLprznyDSga9:S3q6HjB+XvYCp3nyG
TLSH
T178D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b67865596dde6612654dc1e6295e3e04f6c072e3bcc7902e72c982442a766ba0
MD5 7a8973df1a41df347a707ef0acd9b115
SHA1 ca64d5906a4ff5d47b78a4705b34abcee917bc7a
SHA512 30672bbb85bc5f6e47b026547ed3399060d7130a37953863ca6ee22eb2ae6c0b4850984aee5fe9d94328e4b530bec99affd881b161194b26b579447e9fbab0f7
SSDEEP 24576:aXYfDtczA6X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:BtcFXvYMLprznyDSga9
TLSH
T1BF850128B3E408F9ED27813DCCA28405EA7378954764E79B03E0996A1F377D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 465c152ec1e3b50bf7932d74e63a1e0f913a40c49e7f495b8a6b61aaf8b2059f
MD5 56993a57bbd4dc156c63385747747193
SHA1 4835c5252c856bb98daeae705697aadd1b8cdadb
SHA512 7d799306dfa2d226d8a900c9f117574aa36a6a215d08e6203ecef58a2604c389ae953be3596a2479bcad3b8305057a519bb3448cfb7ee865a29b96587c17cc07
SSDEEP 24576:u0Le5ji0hmxirMjX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:uPji0AcIXvYMLprznyDSga9
TLSH
T118959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 611fae2b4211cecf46a490d4cb2161bd087d459d0426d6390e305cb5f192e181
MD5 ed065f4e3cb629f67f5fac08cafa83b3
SHA1 4df7cd1b6f66f721e1d10809422ec4a0ad168c80
SHA512 7ed31525d112922386e6752720cb0efd4d936a426104cf4da50ea1e54b68ba119ab9ef5564d6d50630864c5c17d7842ee2ab3ca68ed98db24f516a9fddbdcab2
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyu1X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:4/ezSC6vUzPvxHjy0XvYMLprznyDSga9
TLSH
T149756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8b4d1a69ef0aecada4fd0883c35f695a104faa832ab003d6fb548f47792513c7
MD5 50d1549bcf6911aed761d4a21e003cc6
SHA1 478cd2245e17fee7e3497220ea3bca8c20316eb0
SHA512 9617c8de9a07bd36b57eaeae62f5e749d1d9d2db5f7cb2c13575ca1c41a89a388343472105085b897b1bc359064c40193ba3455cfc0c0cad692773bc1943e785
SSDEEP 24576:XVbqPb88hv/l+6uX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:XVO88hXl+fXvYMLprznyDSga9
TLSH
T135559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b0f46e90a5421ae8ada8d3073e99d227258360a28c9a59d238ec7bc13cf0184d
MD5 011961823c569a56496705802f03e6e0
SHA1 fc1339d7f000b35526a1875dbf1905d51099ebce
SHA512 c3752ac33c34d3d9e3c1b1f0f2e58badf42d0193e270f70ceabcae7c5c6ef5e398b883dd8a8e4ce30e6314118ae6846c5988e5143db2bb6b7cec4d7751d9ff71
SSDEEP 24576:PRHX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:5XvYMLprznyDSga9
TLSH
T1CA652314A63C68F7FF2A54364CF5480DA86F2EC444099E2743D2BADF94FED78E486116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 fa1e21ad9ca4a2a5922f668fa76f4e281783bcb92d733ecacb3e81fde146c17b
MD5 7198bc5c6af027d65e62ccc75974c67c
SHA1 bced15f8b91a3551041a5850f86757579654c8cc
SHA512 e9386a00e623c4f31d07a1c6461758a44d810187def778392fb69553aeb3eaadf4b0d17539daf29cdc32fbedd7e33bebc4f0295d595346da08fd9d440297e02b
SSDEEP 24576:1JIUmX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:1JIUmXvYMLprznyDSga9
TLSH
T13B85CF3BEE38FCE2C67E4C795A918600E77278704F12A3CBD165820EDE275E45D7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9456a5798a5f31e2893100cab6a1bf27a2deb6ea23eadd4645b0ec73a7b81405
MD5 7efc945e019ef084c5592219046a87d6
SHA1 7c953163b44334e30c56b5c5a1c1c01f7d10bf91
SHA512 a0094ffd5abddd57a0b6650e9b2846ceaba71497ad7ba4a29b595a84fe6b6437ca0b5ae8ff9161173f383d96d033ff6fbf4eb5822de25cd183a4dc99c20ad83a
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:XQvGAdlCEL8c/yRNw5ClXvYCp3nyG
TLSH
T14B267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0e77fdeccd9620bd40090610fcc936a829f540226c54a41fbebc4a269063b4d9
MD5 977e063d3721a78d81fd630f698b71f5
SHA1 d37263c9c5f0263feca1f86df46ce645291234bd
SHA512 35e0416a2c5618e2ff2ba0f2c3bf5c096d0cf3771695338e0ce66cf417edddbd094dba629cca134fe1b7faac9292732948c8226fe96fa990fe69e072187e8d75
SSDEEP 24576:SdewsAj4X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Slj4XvYMLprznyDSga9
TLSH
T1B685E030FE74E436C77B0CB21B76C70A586D7A604B511AC3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e64cf1d2d48745ccac3eb842fb49172701c4686060cd2af8f1a7663f7deb1a18
MD5 1bf950a2c60cc43562c3998f26033d80
SHA1 1e682c43179b3ac0669906ab63caebaeb4ebece1
SHA512 9fe5610fef6d4a0e0ad87cf299ea8fd8479c2c9ed4f009dd3d7de4118fe076e6b64f78e80c805825e422d45dca3ea781897da3887db3958b81ba414b6214281a
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgTp3n:lUEtQevvqc2W1cpV2EI32oh
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5cc1561643e55a1342191ec6fb31fece20bd2a6bf8e0f525298d01319ec9a76
MD5 54fede99c356dde9b2e9561b2fb11681
SHA1 35e70197e215fd9a1c0aa27dfa275353d7df1802
SHA512 560f58ea325d66ead395a51895cc6169ab8a2e845cce9ba6fe23d71085589f6097588a804add8f61df9e779f155ee5f5314adfb3c3828a2250c439dbe861c66f
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/zYXvYMLprznyDSga9:koq2VjnmxXvYCp3nyG
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 577ac6d319e256cff5ceed9ff469e1e8c8b599831f371369723187400271e95c
MD5 dd9922349a2c683eed2cdc7353ba869c
SHA1 3dad34255b011dec02c39b34701c59a8f6bfc367
SHA512 506036092753eebd9c683803de9c7b1e410a3f56fef9ecf2a4761f4eab2508ba0b07d3af61d6c1db4d538d4e381f0ce0a0c96a1f969e0306ddfb01a0c6c573d3
SSDEEP 24576:RAhGLJIFoiwtA5l7S53RX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RAMyFoiq5hXvYMLprznyDSga9
TLSH
T112359D80E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5247d9e116e5aba4c81ac987d14ab4bc145e1b08ab1b6ae1b0b7f56c7e473fd5
MD5 72ab37139c5a7e086ec2be0520307ad8
SHA1 d69eef5be0319a143bf0fb1053e4a03396d17bb9
SHA512 3a8c896507b893b8581f5ee07fa9b2f12d9fcca7ba85e41a7c26703f7743a8e96766288fa2c6d879945104b8fb3a39fc1758c0cbb5032b1e28fd1023862bd6fd
SSDEEP 24576:JwuoOWUX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:JwDOtXvYMLprznyDSga9
TLSH
T1CF85F10576A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 178fb271a0735a202947df5b8822844dfc9ff6e89837328144f9f1581d7a1f00
MD5 b89cedd96141654f6856f5a720e38110
SHA1 9dee674fc239cac068372dcc1cb864911b6b3040
SHA512 ff45d758a8f515de297e18af272b4dee38198655b6f8fb9e4c922c166f1a70a8a941ecf3bbf0c38607c9eba39f8a9cbe79bec0e88164c253b4dbf84e9c915819
SSDEEP 24576:/Zu7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:QXvYMLprznyDSga9
TLSH
T17E75121932B830FAE667513DCCF14509E7767492173683CF026146AA5FBBEE56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5833836faf7e09552bc33c1ad18c1d0c1e607843060a212f693ef1da411bce2d
MD5 a8f11e428a5c1aaa48fe12397f1b958c
SHA1 1664e8dc078c19f023f56cdf984e0c4fee03d82e
SHA512 505af02c9285b017762eef238c64fdf19327f3261962fecef2ac03694a865bd672133bc94d8b7d4936917077587c1c479bf2b9c4d4876d886bdd03245b193511
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3SXvYCp3nyG:rQyiKayX+PNiTp3n
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 23ab6bf5d5d5763aacbf4486e8a49ebdd83c02ca86745cbea0e5f8b69fcf7437
MD5 1bddf54e69e00845cd27c5df9b3d78a8
SHA1 91607bbbbf97185ab30366f287d4c61a788514f0
SHA512 978558b1e033ea218af30a771636a5104aa0bfba14ffb5d5a8a80502d31457cc37f4f534ad032ebc7edf7548c01a01364561e277f7facb3a1d6dd411f1c921b7
SSDEEP 98304:/QRQyi36YOcPQLvw2gAf+PN3SXvYCp3nyG:OQyiKayX+PNiTp3n
TLSH
T191667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dec31d08afd970a6022eaf3e3dba83f05b1320e61111a01c44db093904316e9e
MD5 62337b0787d9ff883d93a61716f95738
SHA1 9f46991d3e1fc9b28fe38554f390b9e56d6b7ffe
SHA512 c715c5083c4d98098b493d336db46beb9a060a8816e6bc54a2334399b4f9d282917f1b7e4c85c08622c5a75503c7b7a17de89d6773124b210d795bd34d9734a2
SSDEEP 49152:E68Qg55nhheWu7PNU3/IXvYMLprznyDSga9:uthWRc/IXvYCp3nyG
TLSH
T1A2B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d0dbab25b56aee162541e65bfdabe0b7b8ba452023d867c6ccf4c8ff30819301
MD5 a16bdbb1beb4e9f792c267fe7c1e0b04
SHA1 992fa91e71af6ad2a8c0a7656485df4bbdfeaadb
SHA512 eac03335507e2f9714e60d18eee1d27012da1665ceeab985f7c32289962011364724400253494b36d657aa05e67f7e15f03ed15a051125a5247ec17fc542a156
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZHXvYCp3nyG:dLIHmWh5Tp3n
TLSH
T1C8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffa7688c26c3553964aeb0a79ad28c6d2136e396ddc8d989511f8fb6bc24665b
MD5 c6045fe1551014311d69d11d8182dd77
SHA1 27af60b15982bbf8e3036f35a0983a4176430c94
SHA512 5975be5a3e7bab66b1173794478aae0ce6ef730a178667c1683e3dad18b327ea898f60b21f3ce07b03824da5e21759cd3267fd2d076132984391057feabb634d
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKXvYMLprznyDSga9:Qu6JmVxd2dKXvYCp3nyG
TLSH
T14CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7cb8b1eec2d075570755aa9fab6bc8295eca42f365ef8181c5a6417ae21c2546
MD5 473957e77aadb56bd5e9dceff1012f89
SHA1 dbb2354e6e872bba8bcb32bfb2a9d87b9bf8dc91
SHA512 c4547e3a190dadcb2ee0d61e4c1368d41bf4f4f875c81814973b0b76564739a80ebdcd3e1ff8d49e096afbca08c32750f4d78184091e1c0a4a7f439827c935c3
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xGXvYMLprznyDSga9:amifPbRxXvYCp3nyG
TLSH
T197B5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c56ee300998c2acfef59dd9f6fe7562244890c54b5b230ddf8741061ef70efcb
MD5 ffb431e3d0c078de745b3bc787cdc209
SHA1 259f5416833fedfcf5f5a572f333f459affa1c9f
SHA512 acd9a231dba0b33a08fd8adb34fe16e2ea8e1dffe3990b82896206ed4abed322975b498a5ee3588daca2c31b0678ebba9f57adedae4e717b73373b8ec85074a2
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHq7XvYMLprznyDSga9:45dKTi617XvYCp3nyG
TLSH
T1D5C5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96b2f819bc06b2badf12e726a8e4b73a42d6c59b40271607118a19336521c69f
MD5 4c987cfbae072f91bc9fcd466202b65c
SHA1 b429fa1269347884ef376c8b13de12aaee89f862
SHA512 316cdb881d27fe5530716d00699a8cc9ac8045d33b1774b75f13dcea7509b1f812057db8e0d446e50c208987c49a857a7abd2d75c1f12eec0baa616b6677f28b
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5w6XvYMLprznyDSga9:1X2iyphNXvYCp3nyG
TLSH
T10095BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 efedf334f628907c02ffc2b497cefc4cae26a21dde8d0939544ae2be731832cb
MD5 8a7b7cd492153e74502070d3eb910c4c
SHA1 9de083b12a17f57d34f208526164c1750bb02f2e
SHA512 4b04c5fdb2a5c7c8e84dd93d3ccb4df152b9e68f81f030abe16531a166f9422b815f4eb5e3ac6813d86544c5918361990e5fee659147b9877819d3714ecbe90e
SSDEEP 12288:cfLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:cfX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T12D652304B43D69FBFF1650368CF0040DE86F3ACA840A9A2B5393A59FA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 e8477dcd3834db7ce3eeba983bfe857e603a9f3fdc7e288b699f9b1ebaca42dd
MD5 5f78a50744ab0d63686a79335f085e7f
SHA1 d4ce9aa0b16dbf38f5ff1bd3c20c4514385bfbdb
SHA512 3555647ef1956f67e609282f35474d970621cef08939abcbc163c33524d1bfa604b4783811d108591c9118c8e88de0475c3b5bf1872f657c66f5c61a50e881c0
SSDEEP 12288:ocLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:ocX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T14B652314B43D69FBFF1650368CF0440CE86E3ACA440A9A2B53D3A59FA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d331fbc91758dce9840968467985759be78a7cbd4c8969b5c2f262e82451cd06
MD5 01f1355915a5b430a89eb5a3a26e2e01
SHA1 14bf8ab323ae360f8897803405d8eb3c8806177d
SHA512 a282dde3f5269e7f9647e284cdade966a69853bf62c8bb6d18ceb5b94efbe78e99d67e18fd0428dcf8becd7651a7def62cc3aa5e7591bffb2ba0bac516eb566e
SSDEEP 12288:Y+LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:Y+X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T173652314B43D69FBFF1654368CF0040CE86F3ACA440A9A2B53D3A59EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 74dcbc58874b583fcd7d81128a733eb86492aac607f0c5d23278c364eb89a0fb
MD5 55f82409418a4435e20848babf7f4e02
SHA1 f5a8c77b737408e6b3fa77b615f2a5b3ad20ac8a
SHA512 96a40b2aa301a82db4a2b9298a7cdd8d6812b9b60c3dce2f906ebbf01f704c0423e46d2c18a5bf845544d663fe7a48ea8a3aee266f9f836ae69f91746ba40b48
SSDEEP 12288:AVxLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:WX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C4652204763D15F7FE26903ACCF14409E4BE7DC586269BAF4382499E5EFEBB87805224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 1486f9a7ff6b535fe809392b55f0b4baf1d2319816464207f36f9b10bb71b64f
MD5 fb0780d1f7d510e5c46ead407410e8ac
SHA1 b76efe0044fd438e07b78079b44c5a8371f77f60
SHA512 d27489657118a78391c0730fc573477dd407aaf9ccc59aafc4170cc96cb2eb16951655cec6d5a6ea8dbed1f3b1a6f7b1e8c99b38b33c87c35e117c69d7bef3ed
SSDEEP 12288:gZLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:gZX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T129652304B43D69FBFF1A54368CF0040CE86F3ACA440A9A2B53D3A59EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e5e358dc5055160d353378269f3a0766464533aea65b62a5738f1fd15f7c08fe
MD5 72ffeface359a8394a1d0f82d5a8a763
SHA1 cd073aa265c5a168dc6fae50acaaea39e2d2c001
SHA512 e3cdd2280c54f58a622a7ac1629f83c0fb59a58294dacefb8af2f08d71bc4e119508262a4a029a39b5860f1f7d423cafae12361df800bd0c7b5446e2aab63c68
SSDEEP 12288:cQLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:cQX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T10D652314B43D69FBFF1A50368CF0440CE86E3ACA440A9A2B53D3A59EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3d94fe4ed03f911d57ed32f09c99630aa25155639d228ff0014971e9087f8bab
MD5 e3cafd7189d90d7bdfbd9ea77b783d15
SHA1 183d9014a5b7e9b7eafe70bb6e483d4b414d9359
SHA512 87a474078c6bd1ce9adf6e3dca11067380100d597c533be0cf8e3c27a3cc1fe35d192954146063002f5aaf16d7a856141d46878354ab9352d361492689c19d02
SSDEEP 12288:dkLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:dkX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C0652314B53D59FBFF1650368CF0440CE86F3ACA840A9A2B6393959EA6FFE397446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a2e5985a60832abe6254fc48ac13e19d3e6bcea9e865f9f496850dcdbb352fc6
MD5 aa348f515bb1cf96775d9c19b3b828e8
SHA1 cfe7450e1c4a2f97be1738dce63139fdd8b479cf
SHA512 dd4edbf228e7c5ae244709decdbe3c1078b38b4b27137c142d1025d859379ab4119464547b88c0fcb60afaf7ea6479ecec8ecf31774d1467e106f255ba3edfb6
SSDEEP 24576:cZMSzFVSO8X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:cZMSzfAXvYMLprznyDSga9
TLSH
T186850154B3601CF9ED67813ECC65880AD6B27C5A0B60CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f745c7301f7ec0743661b8e66524a696fc5878bf8502f8bb8302ca21216e5be7
MD5 07283d72a224f1b65000238e0c28c580
SHA1 48b5a629e7221d7635a87dba625aa9d3c192115d
SHA512 ea5ebc845d959fc7fbe55f7c855f7d1aa550d51785d9e5a875bf8c3b0263c0c59ec0932f12a81f00af1d94743319cb53209676ab8f6df33df59f4bc610122dbb
SSDEEP 12288:6rLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:6rX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T174652314B43D69FBFF1650368CF0440CE86F3ACA440AAA2B53D3959EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 2f1eafc54fbdb4dca6441c7306f1962a3acffd8b88b67f00aa1cbe17149bc099
MD5 3d255ee4ba3a3781eacb570b6b673938
SHA1 8d074b7e5c815c1fbd26628ddd16bddc5d0269f4
SHA512 4aceba53834ef71f905f6d27e7dd444ebf946cbace8549c17b3e210a508cbc1efc07746866c289b33607fbad94ca87736547c6fa35b3421616b4e3f75434a94b
SSDEEP 12288:33LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:33X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1E5652314B53D69FBFF1650368CF0440CE86E3BCA440AAA2B5393959FA6FFE397446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4ee8ad9e0074eef49f62c285540e4179b5980056a8fbdc228ba1955473b94efc
MD5 c78c5af0fb2c1662c7f6ca595d43a1ba
SHA1 c779199dec46a19f114fdf88f3d19a9b62729864
SHA512 1288cf6ce795b2f6c967bf925b5bda7687db130a61824b2e6098deba2e7b0ceb2a7574ff18fce1d8a3121f10409def704b5f729b0bd2dc02f57836b534d919b8
SSDEEP 24576:NzyoX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:NNXvYMLprznyDSga9
TLSH
T158750207737530F9E6379139CCA10905F776787607249BAF13A047BB2E7B6A46D2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2b9d5697233da3bedfca53164c06e4028b244c182cf508663444625f8c6de060
MD5 9bef4ec08fc92e97cbadf08ddb668727
SHA1 62732e8d9d432033919ebea60588987906ab04d6
SHA512 abcc3a42b6266c5bac2070903a9355e20601481043283d14747ba13bdcb932a7ccacbe8be8ecc18dd5e070e18a5b45a89c5de442b72e2e7c3f430535961e9aa5
SSDEEP 12288:qrLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:qrX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1B4652314B43D69FBFF1650368CF0440CE86F3ACA440AAA6B53D3A59EA5FFE397446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0375741a931838ca3b4194925c3515bdb0d29f6e67bc2ec1d5c972db05ab8895
MD5 701b5145bf7a063a72c01fdd16852280
SHA1 851253459d475536f294ab7cdf4e0eba57310e37
SHA512 760d0949364fa9b54cc6e4d64b3b17bc7f20d77fa66c73c151b794b96e6143c46c5139a91cc4b70665a641e14b3984ded60f7effabf80123b49d98f219bac027
SSDEEP 12288:LrLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:LrX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T106652314B43D69FBFF1650368CF0440CE86F3ACA440AAA2B53D3959EA9FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f27135b5915f6148d361204c14c2f3f0de6fb31a0d82636fda7d0c70de85cbb7
MD5 a70e0643643c124558d2867f464d8d99
SHA1 4a6a449d77912818c7cee075ad064aecd7a0b19e
SHA512 4a3dcc700ef07d9286dfd3b059f49ded6046756772546e74a1b11a8a4a4ee11fb17a62062c047a20777055304b7953221377e37aee3d1a411216d4a1405cbb61
SSDEEP 24576:RzyoX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RNXvYMLprznyDSga9
TLSH
T15D750207737530F9E6379139CCA10905F776787607249BAF13A047BB2E7B6A4AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 14ceb81896657ef04b2368e580bb66a5fd251f82d631ef961bfaf83aca760869
MD5 5aa83a62c968c175120890c5229d43d4
SHA1 ffd9947214a131593101d358523533a67c4120c4
SHA512 0d8705b4bf8f37143b2603efebf6113cb5dd4176594f1228dfa5667d3ba6d07518cddeb71bdeecc349244b4b6dc71d65cb382ae07844e0e11676cdcf5a8595c9
SSDEEP 24576:ZTHaLl3z0zDOX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ZT6Llj1XvYMLprznyDSga9
TLSH
T1D6850164B3601CF9ED27813ECC65890AD6B27C5A0760CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ac9413e0e07311e1a44a532173b7b3f465f692087dc448a079b9be9fec326c48
MD5 8c3131183bc78914d8af700326d36068
SHA1 8e150255ce8cac55a8f32f81a96bc610b54b4560
SHA512 78306ba9495e05a44d69d044b3b23a3b6a0d883e27f045c7fb4f44bee3b61cb349432d941a10720316397829782c5b2f646ab27baedfbbd30c931584f9b6b7d1
SSDEEP 24576:t37d9CHKy7GZyX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:N7d9CHKyaAXvYMLprznyDSga9
TLSH
T15A95CF90F3E814E9F1779A358C764501DAB67C9A1B21DE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 024a95e677fd942a54818f9043fb0baa8c4cd8e324eb3102a75ec246bd8c63b5
MD5 eb91c825a77787a2504214fee7ea8824
SHA1 eff236a3bb7eb56878399a620daed026d2dba558
SHA512 3988c07f2108ace5481c7c34d091c8aa76d1c2ec1f742fb96bba48c2b2f14e745ff385d56165101ca6a8a05d270a2653d969e215f45915e64d0a763749e9c308
SSDEEP 12288:DeLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:DeX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T155652314B43D69FBFF1A50368CF0040DE86F3ACA440A9A2B53D3A59EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 9ada7494e4320a430d02305b33f61a12096510d447d373eb995972e2bb5c0e5a
MD5 24221b81c32432553f76dc4e42afcd84
SHA1 5fc29466663e4d2040fbfafffcfbd90418a35ccd
SHA512 614586464934978d29ddfc30236bf82dfa50b107b57c79bef2c144ef369bfc66316e093d517a092aac87f0b41ebaa16511e77686173e2379d112e200bb3ee573
SSDEEP 12288:DILD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:DIX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T135652314B53D69FBFF1A50768CF0440CE85E3ACA840A9A2B53D3959FA6FFD397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 352740a752ede60dd9e87cdd15faad4dcedba513bcb7da0d72a4a10d28ef3aa4
MD5 469e991d22f38d705de28a7e2c23b54a
SHA1 17c49aafca89fb59983c741107c34e04c4f2c2df
SHA512 e40670d1d4b9e0fee7a29de41b5bcb8740bbae9e505cfb8f07529c2960d46b303d5b8f6c2577baa457d7ee2eeced52e13ff7f888c7137f60643b9c4d6e4937fc
SSDEEP 12288:h9LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:h9X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T14D652314B43D69FBFF1650368CF0440CE86E3ACA440AAA2B53D3959EA9FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 48a8f85dd41a046ca859d53c0f155148f0272b178c490a74763ade2e65ccd09b
MD5 8e195940ce0f1dba215f4203127a1919
SHA1 6a496997de0de889966745591700825ffe3a4ed6
SHA512 89fc9744a1604585f84c5299b63b20bc9c5ae21655bab85f05645972d5a49f29c6d01c14e2f3b24ef93fd6d9ce2eb74322e63b9056f61bbbf29e18a0501e714c
SSDEEP 12288:mrLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:mrX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T14B652314B43D69FBFF1650368CF0440CE86F3ACA440AAA2B53D3959EA9FFE397446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9003b5e711e8b901b65c9b0371798b92690f952653c392138b9d6ffa71c00ca8
MD5 761f3d455391556a54bc4cea3dd4344f
SHA1 f8332c0c4d2b48af7eb586ed92259df26323834a
SHA512 a9f6d49dc62aa5e716a7233d8b4ddbfe9fb0fc3358acdc847dc078d627c1ceabf4380c8b68249654b46cc01ecd6d72ee5ae6b0951aea384322bccc32049966a3
SSDEEP 12288:9eLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:9eX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T19B652314B43D69FBFF1650368CF0040DE86F3ACA440A9A2B53D3A59EA9FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f1b8eeffcc59582475c06c12abf93252525767acd4475966e73e9f9eadebcf13
MD5 aba69fca2c5fbe0485bb5299c596590a
SHA1 2138a30ea58f95fcde2b6597043560f486c1fb88
SHA512 bac7c3c8b8176771d50b94798bcee3545940ee5d9549f60d3cc4456291c9be0332d0bb9713ab85242d5974c158ee1320a15d6766b625bb252e4ab46551a5764e
SSDEEP 12288:szLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:szX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1CE652314B43D59FBFF1650768CF0040DE8AE3ACA440A9A2B53D3959FAAFFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 effd517f69b21cdb00a5f937f216b17b758b69c7f1d1513179407581a458a11e
MD5 d429e60ed467f6a847581e4de2644243
SHA1 27645c1765a8dc6024261ac3cccf5f0aa43dfb8e
SHA512 74ef89cbd293b5e94822dc6e1278d3e2efe84e06c6bf21000a89be1fa20c3994d852b48b520e2f7fe344277d917d0cf0c18b55a4d94e57b0acde27442c183ce1
SSDEEP 12288:zZLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:zZX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T16E652314B43D69FBFF1650368CF0040DE86F3ACA440A9A2B53D3A59EA9FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 6c5ac5b610bf7ab7a562fc4d4232d471f8c56f70eb16f01cf3cb936b549d4d40
MD5 9771a4791f43b57674b185cae6abdb67
SHA1 153636a47511558bb31b1d87ea930ec038063bd5
SHA512 a2d3ae2d590155271a8a5bf233436515d1f58c3ea81d4e74aecc46630411245296eca2c6e74276a475672fe1d781741d3ac945f4facf6ccd8c22703504d054b2
SSDEEP 24576:hfwvok9RX6wkyAInX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:HMnYInXvYMLprznyDSga9
TLSH
T17B95CF29EBDC44E5E177913C89B3460AF6B178591B31C6CF029A53AE0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ad4f72de4c4b0d50ae7d76724f07c7eb8234edb319dec364d2b9e42fbb517151
MD5 07fcebd561801ecad9e8d944d541cb6d
SHA1 2e22a852bf32e0ac3e6c4f9e6ec9107febb789da
SHA512 ab8fcc1a20f386d191bcc2a45bd99a8f6833e64029dc566d6b1dfb80ab51514e76991b40f89004b71f16cb800ead5e333b30b7ff21a7be7abc5ffb870dc14873
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aXvYMLprznyDK:gySzPyXvYCp3nyG
TLSH
T148067C56A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6db9f6ec59efafbd1d84a30ee0fba40adfa378eece14cc85a1092cc102c67ae4
MD5 fe9f3b2df7461fccdcf0517d2f8d97a3
SHA1 06589608bc3d19e1343fa4999d4e86b3bdb556e2
SHA512 1587129d7e379fe5ca0a3d187f0d154fa18686266d32d5ad613bcfebb60e86002eb8ce379b460e2593bb365ab16140071f6b5674ecd55b59a2f39ef6a94b91b4
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Z47JUQj1irIhCnDHUPfF/KXvYMLprznj
TLSH
T1D665AE1DA3EC01E5E1BA923885154A1AEA71742E1F31CACF12B0837D6F67ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c3af8e9094c63593607b1c337d35ea1bcece4e259d3e6ef1361951fa0fea52aa
MD5 d1b64d5230a8cc4c2cd676787e39934a
SHA1 527983fc27bac0f7c369ed916b2793ac02a020db
SHA512 b1e7aac9fd7425d0aedcd0ca8e412737d43b31f0cd2ad23286fde60ca56586fa4d0588caae168013a910133f801abcca5be3214ee9cbb4ead2a8bbb70f9fed45
SSDEEP 12288:PNsf7LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:s7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T19175F109E26812E9D52E6139CB914A05F7373C6583E1D3CB53D0F57E1F7AAA46CEA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 acc645c0378ecba1a96b40600366fb169deab43294696780fcad7d9a96f4dfac
MD5 1e387112afbc1b9f4c3b71463cd2297e
SHA1 eae2d0c8a47b2df2bd369171ccdd1ac60bee8256
SHA512 7ab131e045ab75b0dc119ecf5e200557206615237fa275ccfcef611c409065966aa89e234284647ee1f104e316ac6ffcb92fb54126fcbb18180ce2962b785a4e
SSDEEP 12288:F48SdqU3fDXiAC+KhXlddg+23K+zcEXviCcNi/NLz4raRZdAgR:FHSkUPTiAC+73KicEXqCQi1Lz2aRZd5
TLSH
T114551740762AC69FC6A980321E33D6CCA7707D41FE056F1773C9873F9476668B6E6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a615b07c544f9153ca8227a282310f78895a69b32383997f7116b47b5419265e
MD5 774d72248dbe3730756ab55e97de6760
SHA1 ec6a58ca0fbd3429d7b2f049b90daf6d4db2a83f
SHA512 cdd3f3df26e2d716f70d0516307900b72fc7fb9d4d642fb8af54020ac0a84de7b7b68d930ace6ccea28723f741e5b316833348adc3b2597e51b60b7b02e1f408
SSDEEP 12288:0Rf+SYpIQDfh5RfYREGLE2hPOa6TZuUu1W1MYXEiqAuzbgWXu+BvMEB:0Rf+SOPjTVQEXTRRExzbgWHkEB
TLSH
T153652B41A5B7E35FC9FE90370632868DAB745C06BB453B0573448A3C8867A7EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 095da8e08ace8ef81c69ac324e70a7b5cba57d473504aa4e75431018b60b728d
MD5 3b99ec8d2d6f87c0af381fa43f9dbaeb
SHA1 5a38aefd6a38d12ce4f275257d3bc590fd535eca
SHA512 f25f9d2954cc69459e6aa1260c69c1ae4473ddf1cf1e411fb64fdf3165365b4e6a3fefeb80c23bcaa2114a2e6b10f5973e9d7749c58310bc95667c661242b195
SSDEEP 12288:0F7DLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAjz:IDX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T12E652310B63C6DBBFF3A54354CF54408B81F3AD44B0495E7A38266DEA4FEDE8AC52219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ac1843fab44946201301a5489377f0d72410245a8a12adb9d02a8d564f30651
MD5 6d853a04c4849b17ee7edf3df7f6476a
SHA1 e8431f10b1b48af7720a58438bcd57ce837d25e9
SHA512 8046e46275298c6b4972593163e57522547295638c91a08bb407d21845588fdf155d942bd2c5033009a72e7bf67dc019e0d846b8c1284ec6279d3f7c325d99c4
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bY1X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:mgb4mBIBhGFsXvYMLprznyDSga9
TLSH
T1F265AE1E22EC02F5E1FAD2B8CDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 1247026bab10a84636f54b672b14896bf7a2cb132190fdb052ccf576d49d946d
MD5 b66551d88c06b38c9701f064f272178a
SHA1 4a4518483afd82560e4f6d0a1ea4f900436d825e
SHA512 c98e08dc558ee8bbbd239a71728291344cddd297e8edb9d0bf97084592e39ae7352d97307ea098246a644bc4110ccc2d18033b7d4389fb770f5aee1146e01d27
SSDEEP 24576:UG88u8FpJqH1bzria7/m8X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:n7ZFPqVea7/dXvYMLprznyDSga9
TLSH
T19395012576E501F1E47BD13889824667F6B2B4250324EFDF07A88B561F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 33e8873fd792a53403600337ab31a7bb5dcc07b879b81026b9b57db5518051dd
MD5 d99681fea602c11b8a1f22aca7ee7b1f
SHA1 4204cb3d0e157c95efa432d44b8ea56f0cfa0c12
SHA512 40e3c52374ac9bf07d1e5e510dbc5a5e5895658bbba19d5939f2807ff4adad1ee48cc12d04909af0f2c29901eee1e72198608f5e5b3b1b35e983a9742038a020
SSDEEP 24576:SPUr+NQAX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:SJQAXvYMLprznyDSga9
TLSH
T12F85E12E62AC18E5F676A17D8982460DF77274620712D2DF02E1817E5F67EE8BC3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a76da4b78f6421f3e16cfcf6c81e1c4a3961224fdead176e257f0399e1a2204a
MD5 943b472077ba5dd842abae3f3be702f9
SHA1 ee0ce164b2fc3c2c6dbbfd35081555124de04637
SHA512 f74acdb6cb356039a773ac6128a7cd777f2d0bf23e3f0757f298c285b6b2756a886585e1bffc8aaef2b4116d1357732646720ae815a0fe09a523b4d13ade7df8
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQXvYMLprznyDSga9:LG05lO43bPXvYCp3nyG
TLSH
T176D5CF6A62FC11F9D1BBD17CC9C64A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e42c09154870d1996be7cd0eea04dcf2581a3f69dff2ba9cbfd2f7b5bfe2ae3
MD5 16c95e0a1d2c14a4f483bed176c531c2
SHA1 c29a0b44fbc99c48a81693897418fe566d9b13c4
SHA512 34e3d9ffeff3db42a2b6e9d98a3a9e0c64e149339388fc8a40e5723a30a0ad9b289f2630db2d53b2f5a0a5068a83a2119b878340d611459b0da25283b2a88f7e
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnaX7bHsMQ4/O6yMLprOInyT/Swl8B:ga5POZ3+Jt2pasx2+mIXvYMLprznyDSz
TLSH
T1B065AF5EA6FC01D5E579D17DC583460AF5B1346253329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8fdb64eb7a5b5254f4ba95faf22936c1c5f71b6a5107446de406bffaaddf5d1c
MD5 891f5c69ce4af14c469d8d792cbdbb81
SHA1 3ee569e377c8f17acd221f47dece5c5e20b94190
SHA512 fe34c83ce4282b19bb69293af2b6f8145ee2b1f25b3c191ddb306357831bbce9f1cc1024e32290dc789dbcfb525d2d9c1b6ca04167228611415132912c9c1541
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7Fk0X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:qNc/zEOVHF9XvYMLprznyDSga9
TLSH
T185857B1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d520585ebb55405d5651355dae6c419cba0ff15d62bb835f8014960092eefeb7
MD5 b42361e0847c8ec0cb6ee0a999c12b5c
SHA1 5a18b3dccc2a8bebe6ca6c81861b675e78554e1d
SHA512 927fe0d73579bb953f6919fd9f5090451ad02b88ee78a4cc850bec4b901d89a98f94a0f6d80c7c62c923a18e4ecdcdb3557e19a86b2c6724656b4ed6f6a41e81
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:M8MwBtOmWXvYMLprznyDSga9
TLSH
T19955AF2EB6B846E4E1BEC675CD238512EA727461073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 571b459ed9079b0fcf71c59004c8a3e427d0b67f470d08154b56b43359aab1d1
MD5 9c56cbe19f401a2b93ec20bd8883cc46
SHA1 f9fb35b78deb358f9324730b34a342b1c5b68c27
SHA512 5a64304ffa4000d3324501c0e25034e0643584c7fd4d41bdc5bdcf8c04ce5b0594612b296ee277eec0d969eae6776076989243a9e96f9ee0009b777bbb829e28
SSDEEP 24576:yD3FHshBIYQgA/X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:yDVHeBIAA/XvYMLprznyDSga9
TLSH
T1DC95E13DE66C04E5E57BD17CCAA38906E77138A9032256DB02D0C1BA5F6BEE47D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/620-298-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/620-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/620-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/620-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/620-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/928-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/928-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/928-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/928-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/928-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1172-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1172-316-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1172-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1172-114-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1248-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1248-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1248-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1248-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1248-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1464-53-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1464-60-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1464-54-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1464-203-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2308-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2308-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2308-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3172-330-0x00007FF9019E0000-0x00007FF901B86000-memory.dmp

Download

memory/3172-329-0x00007FF902360000-0x00007FF902506000-memory.dmp

Download

memory/3356-72-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3356-38-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3356-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3356-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3356-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3356-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3416-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3416-235-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/3416-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3416-64-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/3472-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3472-331-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3472-284-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4852-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4852-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4852-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4852-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4852-20-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5972-269-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/5972-79-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5972-78-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/5972-84-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/6080-0-0x0000000000400000-0x0000000000679000-memory.dmp

Download

memory/6080-77-0x0000000000400000-0x0000000000679000-memory.dmp

Download

memory/6080-7-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/6080-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/6080-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download