6308fc4b2f46b88739cc4bd58b35a09f16fc071b2dd75f017d7f8b3690fa9bac

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260831-a1tfvaeb65
SHA256 6308fc4b2f46b88739cc4bd58b35a09f16fc071b2dd75f017d7f8b3690fa9bac
MD5 f59094638cfd393cb78de57db72ccec9
SHA1 63cf27dbc0638229552bdcbe465ab2571615e1e3
SHA512 0bc5a124d75839488e5440c8c1dacb221bfb561fae58e3149e5270ffb6c2516b6e97d004e84ce5f99cb67f08fd57644f13abdaf9cb1f5fc5d58da614d03d6b9b
SSDEEP 12288:JgPrGxzQ9TA1ubv6IQ3mF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZvv:JgzGxmsdmf1GDvnYhSyyz1txyTZuy
TLSH
T1C755121236D084F3C5B30A3099B5EAB0593EFE301FB50AAB63D41B6B5D746D28D3466B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4900	elevation_service.exe
2108	elevation_service.exe
5776	maintenanceservice.exe
2768	OSE.EXE
720	PerceptionSimulationService.exe
5796	perfhost.exe
4608	ReFsDedupSvc.exe
5348	SensorDataService.exe
4644	ssh-agent.exe
2764	AgentService.exe
5292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b9969d4238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071ef1375e138dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033e3eb78e138dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4699d76e138dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f08bc8b7e138dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078b286b7e138dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005107d776e138dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020b3f376e138dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4608	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2764	AgentService.exe
Token: 33	5292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5292	SearchIndexer.exe
Token: SeDebugPrivilege	2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2560	2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 5400	5292	SearchIndexer.exe	100
PID 5292 wrote to memory of 1948	5292	SearchIndexer.exe	101
PID 5292 wrote to memory of 5008	5292	SearchIndexer.exe	102
PID 5292 wrote to memory of 3116	5292	SearchIndexer.exe	103
PID 5292 wrote to memory of 2796	5292	SearchIndexer.exe	105
PID 5292 wrote to memory of 1828	5292	SearchIndexer.exe	106
PID 5292 wrote to memory of 3936	5292	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_f59094638cfd393cb78de57db72ccec9_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f310ac0a88685ccd4dc23808299e857edf712401750b2ab2f70bc379e25f139
MD5 15e9ebe68e379082b59f730d82c1bc48
SHA1 d27edfd7bc8173392c7287909dffc46fafd34672
SHA512 44904500bb7bc48e4ceaf4735a396c09c72b8459f9266f8abe4c92c3a59edfd3898e33cf661a98bfcf1a5671b1cd6640ec0d5a8643858affd78615f9fd38055d
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1mf1GLnKSyyz1tgTF:l3q6HjBxf1MKsT
TLSH
T112D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a282f2828c0a426be9535c3e2a7a4b9f2986a60cbd5e9d9103fb5fe19fcf01f0
MD5 06ea4d1f29fab91cc916023cab094264
SHA1 8deb72821df84465669438002b1f2a066693f0f1
SHA512 55841d14e4861b798035724c43bbbd26ae1cc0e13f7f2e1c7a0f31cd372ae86bc0ff545a2c38e4335537ea673dd53297460ff208a3b7b0b6ad4a09e8ff996007
SSDEEP 12288:L1XLsswWkxy2lRq2czAjF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZvv:xXYfDtczAmmf1GDvnYhSyyz1txyTZuy
TLSH
T19265F12967E408F9DD678238CCA2C511EA33B85543B0E79B03E49A661F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9fa775f1e04cf810baf0137daa6bd5ae1238384de8c61d744a06926f9b4355e0
MD5 f69704e3b5994ec8c1d9400047506d96
SHA1 c107c66c0794bbe2445b6dae3f766a4dc8690a90
SHA512 b2650ab7282665e0add855be20cbd2d7d521f8416fa921948cead62faaff9b7432797be3bf6dd147553f40b1415b20fa32366d5b3f24a69781d38b59e35d4134
SSDEEP 24576:p0Le5ji0hmxirMNmf1GDvnYhSyyz1txyTZuy:pPji0AcQmf1GLnKSyyz1tgTF
TLSH
T16D85AE16F6748775D073C0B9C5D2A68AED32308617308ACB4286D77C7E67BE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 03b3f4375cfaeb1665f6e73753014108d3e2a91b85e3a68b1ee14e37a0c828d1
MD5 a7e3e704a03231082d3a3c31911f73cf
SHA1 2c69445cc038abde1ab46a8a1c8d4977614db43d
SHA512 b116471bd10f26799eb80a70da91f271637f838a783bb502bfd9a155ce87087596e569eb812802ec6028bc4f96d61c897ef428e31d721f58b2d82c53d0ff1a56
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuzmf1GDvnYhSyyz1txyTZuy:k/ezSC6vUzPvxHjycmf1GLnKSyyz1tgx
TLSH
T10F755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4959d138f0bcd3cdf2370b88da2c770fd67b63ffe07aff73e3e9cc6ac9dae346
MD5 a0cbe595d2bec40d3db6d3deed5d0a61
SHA1 de35a45f2ef018fdb6b460dadc0137b35717edce
SHA512 854ad1524a568e956b750ba25a7b3c193decddc8cd6d8fc705fd719979701fe39c0f1da556f09e4a261cd2e1f99c695308f28e250928d3af87c5bf26b31bc501
SSDEEP 24576:OVbqPb88hv/l+6Kmf1GDvnYhSyyz1txyTZuy:OVO88hXl+Jmf1GLnKSyyz1tgTF
TLSH
T1AF559E66F5B48331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d49b567a8e67a80dc2e7eb6c396890f502a07cb1515478e15f55a282bda9ce52
MD5 2aed2121e3b26b736b9e1198e2b6cb0f
SHA1 87f342cd60240ca66e2ec83758b66aabb724ea19
SHA512 57d748158a89e355564c1e70eaeaa884c808d6b062fa5cba9558312e667b648bc0ecf311edf44a535e52ae4b2e675d7058340a972555927e66f155230ff145b8
SSDEEP 12288:SRSF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:SRxmf1GDvnYhSyyz1txyTZuy
TLSH
T11045230B4BED18F6C6AA4630FD9BE5D15E2EDE9811F5072383E1FAA3587E9E5CC41048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 daaf23c56270b3c28cfef2f566ddb4aacc048242551a6157d5a5a000d478a6f2
MD5 8170a8540080f55d3c752df4509f1b2c
SHA1 385ec7f0181202944f81081c51daf7ed0ec82db1
SHA512 c17ef8cdb151a504314284b639b3f387f1e21baa39f52e82051923bfeea9c657f5ca8b9b64c662298c73dcc4784fc07059523e246edcda9b9492bb356c81a8af
SSDEEP 12288:geBNUbTVO86U3F8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:gJIUimf1GDvnYhSyyz1txyTZuy
TLSH
T1F265CF3BAE28FCE2C27A8D785A91C640D77278704B6293CBD175C20EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fe9e7609e48f96149c54871bf31ea1e94eb610727be9e016e083d98b5b34e757
MD5 eca4b1e918d771ab661ee7c914109ad8
SHA1 b4afd1a5a693ba7cd977a0788d8680cfebaf4204
SHA512 debdd0ff9cef81b35d92c25982fd71df01b99d5d25efb258daade7f47007c31697a1a01b07cb5c8b05e79b92ed99cf8ab37e0af7d2c8723b3750dc4ba642d275
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:zQvGAdlCEL8c/yRNw5Cqf1MKsT
TLSH
T1B2266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b9ce0d664eb0f9afdc068be9d9638f61ff44d8603434788701b2f2029ac551e6
MD5 0f9bd28841ce0bb6da26a8e06fcaa655
SHA1 4ea0f99105414a57f9d45e8fe70510b1192b39f9
SHA512 4fd8896ba4ef8be2010d6c376814593ec560f1efc5dc5cff535d825bfbe8cda64cc552385327be006cc98b52525e839ed7883ddc44b0b0bb5d5fadabba66b7a8
SSDEEP 12288:wAwSfxL/2Dc34DLLmt0LDQewsAjhF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJYj:FdewsAjgmf1GDvnYhSyyz1txyTZuy
TLSH
T19975E031FE74D436C2BF0DB11B26D716583DB9204BA11AC3E3E88E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 07495f5039c478ae4fe35dad1dbfa05a9c4a7aa9a876620ef11951275b8c70c6
MD5 da74dacdbf7c91ad6ab63c12bf39e2a3
SHA1 97a37f8344dd44f2a2061a4d210aa653ce421f05
SHA512 3630b12f91216ba98d19e9fa0db930d215f6462450a99ece92a4b1a99509a4fa87f38d8f8370bfbf8ecf8aa8ae874d004c18c3339de3e7dbbd0d464c5d32d7b2
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGR:JUEtQevvqc2W1cpV2EI32GR
TLSH
T104474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 db4b1239ce2bec87c037a64b2546a01a205d087d2b5cda98ba41b53cab7d644a
MD5 f935e05dfb9e3e93d8de339fbeacfee5
SHA1 9312fae47b9ff215d35c9a198cac36166e19975a
SHA512 97bb8a24495a6d267c0f3907dbc3bb10fb6572b93de90fcc226d0a36c04be843aabbff9936d33095996a9aa7684d21022c798a5592fc71d44d43b149b3d6c198
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zAmf1GLnKSyyz1tgTF:9oquVjnm+f1MKsT
TLSH
T1B0D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1039c2c8077622a1f70961bc9c07c546dcb7ba06da6cbf0d8c5a9cb877b032a0
MD5 b428a494887b37f299a77f86df6858e1
SHA1 2f37f14051a0612a39f64ed2ebbb273548ea2e78
SHA512 10596cfefe1b3069eed80ff2ee03312a4d1732dea73bcb0a66c73383e6f5f906894fc0325a14c6496acc967e3b91cb779b623774b9a819e9b6b2dbc78e1afaa0
SSDEEP 24576:BAhGLJIFoiwtA5l7S53Pmf1GDvnYhSyyz1txyTZuy:BAMyFoiq5/mf1GLnKSyyz1tgTF
TLSH
T179359D81EBF955D4F5B3AA7899B69170EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ef316aa173034a6939b942790b370d32f162b638ccb572d94c84c635abecdc8a
MD5 d18f5a236e3e4ac5d9de1c13bd518aee
SHA1 889eebbdc4faa6476d668d9912da0e812291ecbe
SHA512 3319a1f15faf77965a17fbe16e56f4dc2b0601ad300b79bace51dfd925575cf4785609c536895a1d481b793a7e0cbd70b3e1ec6d654299fb9dee765295d165ed
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CIF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yx:OwuoOW8mf1GDvnYhSyyz1txyTZuy
TLSH
T1BE65F14A77E80CF9E9A78238C597D532EBB2B8152671C71F03A0C65B5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 896584319b8bf23d79bc06b125d9fcc219afd9fbc9c93c57d24986c64495b63c
MD5 dba067ada03523c443b12759ba24b458
SHA1 61bfa16d4a5eedd6f98cccf6f9d4810efa1f2aae
SHA512 e443cd60af84fb45b299aea529c581a966553d1b95620ec3d6962946c7ddae4a9e858481574d3b760bf795ec9d88d7f2ee720ccd2ee72c35861dac346ea2fc32
SSDEEP 12288:mBZ1IyRF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:wZuFmf1GDvnYhSyyz1txyTZuy
TLSH
T10E55124B27E824FAC1A78234DDE79681DB36B46523B603CF13A186A71F77AD24D35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a6b8824e556c6b108605c318af95f7f27ab672455115aeead4b2c757e1c87e84
MD5 dcf8a456414589b14788a5267b253dc6
SHA1 938300dc275cd0d47f390f7722610c4b1e3c67e2
SHA512 cd8b8b2777da3b9370d5d2aa27c06816451457d9a37d01e26fe45638c009f55db4ac2fab1b6bbae3f818eddfe5029c802dab744833e0936882d61a214cd4db97
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:vQRQyi36YOcPQLvw2gAf+PN3Nf1MKsT
TLSH
T1FD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f800be3ac21d097d9f0262340c0aa82ec8ec3266081bd57a0d8266fe111c6c12
MD5 0c4a2b6e9d9d24740d90613bb16187f9
SHA1 7281169e786e691b3b6c246cf56e4095dd9bf4ef
SHA512 4354c81706e11d729b78f8e557d4413b6c7cf3a5763f08e02904f071af1414aa0928d293f1ec3967ab5de178c9756d7ee09948cd0365fa81adeb0c35956c7931
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:5QRQyi36YOcPQLvw2gAf+PN3Nf1MKsT
TLSH
T1C5666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c984ba75a56b6c4902dbeec7b96e2ffe696b7d82a870475df1834060bc2d52de
MD5 cd39353323adc256b93a6fcf66f9ad40
SHA1 e80e9854c99076332bb8a9fb36343166c171b833
SHA512 b803470747ff680fe945f5ba51e588cd67ce9733a7855a217cd1c45e6b1cbb5a6185520f39c4dad01b384869680f40dc28530741aa4e32bf82b0504a6ce07244
SSDEEP 49152:B68Qg55nhheWu7PNU3/Qmf1GLnKSyyz1tgTF:/thWRc/Xf1MKsT
TLSH
T1F7B55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 51f5b6f129890e5ebc70a582a6530e4db6aa6ed1d190e98bd6ddcf2e01dade4f
MD5 1b034d2a028a096479e1780a9713621f
SHA1 ae09f84abd0c6501317706b73c69b7cfa082ea49
SHA512 90f7aff7653a44ae2ba1d05a57b6c895f311d5b4abc0321f4ff1f7fd1088ae934f9759accb5cbae4661129576e3adc98cfda730463d791d6dd3f213b09e032d7
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:ky5112gYy5azzVvL69nLKnhZAf1MKsT
TLSH
T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b1527fd44f6932bcd957716930ce1618fa90fd7607fed0328c3c332d85f513b5
MD5 ce17baeda6ead7d2e76e301b5073cecc
SHA1 e80761d1776fb9c0e40887752d7b1a51330d2451
SHA512 3e4c596bdb2894ea5cae02da2cc69b1a9a443a071c71fdeadfbe359f5b9380fafcf4c9f0329fb711db8a2611ba8e1812c42290e834ba7d15d1380a8035f17a00
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWmf1GLnKSyyz1tgTF:2u6JmVxd2dVf1MKsT
TLSH
T129D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ab19e13f890944b7152f4ed7053684a23891b93d0fe8e9009c830e8b7aef7f9
MD5 330b8bdcd80978b104a1ec77b46ad261
SHA1 ed75f118ac357d2665defd0532ea4e55e879cecd
SHA512 0f16889d134a97ece38bf47d957508a25a4ba16b074d75191a479b11a2be643012d23a2c2ed45af19497eb7421da88eb0601593f31f37da24c9323e7fcf508e8
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xCmf1GLnKSyyz1tgTF:2mifPbR+f1MKsT
TLSH
T1B9B5AE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a114d1474f665587a2f97ff838b16abd7500adc92bbd253c225f1b975151ea32
MD5 be79bbab072dfd1cc9dd722a07f7c579
SHA1 b4c122330185b677c8a5dbae5f59085998e4ae4f
SHA512 93d8f42ccf48cbb03b3be9d8fcabad36b50c005381e0b4d063b90f6c5732d24eace93ae10c09ca7e0dc08deb0311127ac38ac466fc3a46a8efd8b9b0e9d739f8
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqFmf1GLnKSyyz1tgTF:n5dKTi61cf1MKsT
TLSH
T149C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 260a6c0e78ddbab7c29d13f5ca8cec33c86bcd2bcb6e7d14d11c0793db34fdd5
MD5 ad94e04c9cf6c687da41609e7b093e43
SHA1 d945d4c4b857f26a8df26cf8cbea4ada776ea9fd
SHA512 889de4ea3f77cb2295d9644461b13c8866e3c596b359d4abc08211830157bb6667cd8f8ba3144e6bc3249e326d6f7126d51a00b3f7f15df1f8295f3fc667d152
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wmmf1GLnKSyyz1tgTF:PX2iyphCf1MKsT
TLSH
T1FB95BE13F2D900E8D06ED174C7568632EA62BC150B35AAEF0A90B7561E7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9d2ba33d9aad4f8e8a2122c14a70d88b964c063ba718b59e55472bdf2b82059a
MD5 57ec22e98ff4d390c6d3fa60affc3f5a
SHA1 280c55411a3ac54c14947590690f777f6b4dec46
SHA512 3158c94a9cad8e218a193129967ffcc1a496c4ac4db2e9db8a45df7ab7e6e09585933e7854ff3b105a94d98c519e5bc5697836783214adffd819a6b1ef8ab4b6
SSDEEP 12288:+qF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:+Jmf1GDvnYhSyyz1txyTZuy
TLSH
T13A45230B5BEE08F7C1A58770ED9BE5C09E2DDA9C62F6032393E5A563587FAE64C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ed676cbe801c0ce3abc15f65afc66d9475a5f19e4e001eb74916b67b436523d8
MD5 e89e890f60c6dfcef6f32a8d06a1a3e7
SHA1 7bea8c521e8a2154e6b81c652459398ac675ccaa
SHA512 72c855adb300c4fb10f5d5a28bae5d87950d88f96007c7787f3cf6df269ce141e97d79631be35f88b4772bef825d537c7768b353c75f51608cb0daa7bfbbf23e
SSDEEP 12288:C9F8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:Ckmf1GDvnYhSyyz1txyTZuy
TLSH
T12645230B5EED0CF7C1658670ED9BE5C09E2DDAAC62F2032393E5E963587EAE64C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 52e56ee2946e7f782d0902155b3bb15a258aac6be42345569733b4730e58756c
MD5 aace85614efb3ef67ccde235fbfff391
SHA1 2fbe4390a5447522def3416560dfa2d334fe1a41
SHA512 1caed235e5f5a2706748676cd312b0f56876cf3498565d8a2e9fb56aa2ebcd5b42e58a6c819324d2389dd307a87777cf906b04cd822239e1b7d625c05bd8a7de
SSDEEP 12288:/vF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:/6mf1GDvnYhSyyz1txyTZuy
TLSH
T16145230B5EED0CE7C1A58770ED9BE6C09E2DDA9C62F6032393E5A963587FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 734d790084a0b908cb50a7d705450da531b155b4e3664c8633b00efdcb3d0588
MD5 c76f497a50b325777a4cbd41fa68a076
SHA1 0edc4ff89db3afb4a37225c56a47070857c39313
SHA512 ae17d58d03f69af889cf707975c8ea781f7a7e518cc088163762b5ecf0a915127167f5bc7c3127c9c3afe905168ffc5687b0326018b9d0e3d388b7910adbb277
SSDEEP 12288:mV8F8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:Ymf1GDvnYhSyyz1txyTZuy
TLSH
T10345230B1BFD08E6C4A6C770DDA7E1D0DB3AFDA863B2032B939159530D7A7E58C21558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4567b4d54384413ce45382f465702d81a8a55437cd2bc8095264c5fd8faaecff
MD5 9d7ef8a5b0738109f39270af8b421a8a
SHA1 1c1deb54ba6d5cce2590ba5d5539e6e4c7b44ac2
SHA512 14bd69ff936283185e4d1ef5e759c8efb02559dff473b015e29cd1004312bf0eccbb606af15d89c5c87ab2eb767f36c7a3bad4e2a0e79789761542cc096c496c
SSDEEP 12288:GkF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:GXmf1GDvnYhSyyz1txyTZuy
TLSH
T1B945230B5EED08E7C1A58770ED9BE6C09E2DDAAC62F6032393E5A563187FAE54D4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 703de9e67bf35c5740f4740af7d0b74b9e9b294569eaf68ccc57183e39d0a2af
MD5 b7af4f1023050e47b6d68369d771e4cb
SHA1 b7cfbfc7b33e8544f18a898b231a7e16178d9125
SHA512 b79d7cd9cc2cb042457aa5af804a0f2f5cdcccdfc87d76a5186f64580b1f80cdbd5968ddd02f9ba7606e2bbb97e0a28b2a56efeceda0d18d5334bc929fa76715
SSDEEP 12288:yZF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:yYmf1GDvnYhSyyz1txyTZuy
TLSH
T1DD45230B5EED08F7C1658770ED9BE5C09E2DDAAC62F2032393E5E963587EAE64D4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d3f4658801609455f07cb279569ff1139b07c1b8f67d71153d4ac61e2b883420
MD5 736a185d6e959544327dbb0ddf20ce3c
SHA1 f431f2fd1b15e0731dc6e206fff068b45a40e0ec
SHA512 ef750122da86c63589c766e05604ed57ed6f7518b6432777db6ae2adb495fcf026ca7d9e989d5ab50be6340ab265f9e7785f5a72e270f711a38d6d74f4a739b4
SSDEEP 12288:ZFF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:Zsmf1GDvnYhSyyz1txyTZuy
TLSH
T12845230B5EED0CE7C1658670ED9BE5D08E2DEAAC62F6032393E5E963187FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 10cba18c6548de7ff0a444c562224b920becbd083513c7ac797aec8abbcbfa92
MD5 67413adb4bc5a27afbb19c06cce3cb92
SHA1 bffcbb53d355680d1a83e1e013dc258d362bf03c
SHA512 bccb71ae703ff35a1a51c09c3f0caf2288f56f4c000dbfdfc6b7419d31f8ae407bf407215da0813764fd4f61dfff67869dde28acffee5344c341f3ca2ced5bf0
SSDEEP 12288:iiZwb6zzFEoS2cPvydF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:FZMSzFVSOEmf1GDvnYhSyyz1txyTZuy
TLSH
T18D65F199B3A018F9DCA78239CD569946D6B2BC5907B0C71F03E436675F333A10C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 675b391a68bc88cd89a92af793dc5eca79589b068551e0e51a1fa2ae8bc4ba98
MD5 e48315ad9555b4e99398aafab67ad5d1
SHA1 f9fc148dc3ce6d985e2519c9a1330a8228f42463
SHA512 2853da75bf4dedf4d99453b64a3bfdb3becd2633ba5450a2c120d15c5a9e0edb72ec582820e9a8b448fe6d9bcd341c3260a652097fd3bbacfe32f5ffc57b3577
SSDEEP 12288:puF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:pVmf1GDvnYhSyyz1txyTZuy
TLSH
T1CB45230B5BED0CE7C1658670ED9BE5C09E2DDA9C62F2032393E5E963587FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 91d4be37644dc8006e1413b0b1cc228756b5fd6b64c894d2f8ca75fa610c16f2
MD5 cd56c0bfd1b8157b81a37c86bd866e93
SHA1 5abd26c836b81b0aad3687e5b65a79f5617c4fc7
SHA512 126e59bd8b942142f107597bf7c2b9d0255945ea8fb12fc270ffa9376ee7c81b1f87a4ccdbc8ffaa9e8bfe9437a67581204b25f8e2f2523a8f25ad9cfa41622a
SSDEEP 12288:VCF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:VBmf1GDvnYhSyyz1txyTZuy
TLSH
T13245230B5AED0CF7C1658670ED9BE5C09E2DDBAC62F2032393E5E963587EAE64C4105C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5789e03573e1fb56f745a6b496abf789fe31e1fb0484923f0ed6494d11aa46a4
MD5 c9c46108be9106e09420aae870d5cc15
SHA1 07fcd20071a2d7d2fbf17d2b4ae5f6e6da024f31
SHA512 5254e4e657437607293a2fe6a2f31dc39cbc80047de48f5bee9dd4d2781a2103d5ca9912efeba1dcc9b682347d29e84a52555f422594e72e80a5397791c38a80
SSDEEP 12288:QyPz5L8RF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:hzywmf1GDvnYhSyyz1txyTZuy
TLSH
T1FF55010B67E520F9C1768234C8A35A41FB36B83517714B6F53A047772E376E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4d1dc0b23f2caf3e52220f722d405448fe02d037668a69cb3e22c6d24f48eca9
MD5 00a6ad841ea0259efbeaaf75d212e005
SHA1 71cdbdc2953a8678176a629c89ca1894f435171b
SHA512 b90bb8110625d884fecc497e2a1066acac36529d71a6ed8e99dc2bc0d0f4ef5532529d3d4d4fe163aa3cbc55e528041b9932ffc77fe68c2bd878f593948726e1
SSDEEP 12288:3uF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:3Vmf1GDvnYhSyyz1txyTZuy
TLSH
T1A645230B5AED0CE7C1A58670ED9BE5C09E2DDA9C62F2032393E5E963587FAE64C4504C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c870873d4a9bd9ef23b64fda44c8805ea0b735ff265e5382e94eb5259ea2e9f9
MD5 057b6fd7fa5c6f93924b052f9ea952d1
SHA1 7822ad42dfe169935e821ce36dacfd3c4d2595f0
SHA512 33009ac14a6b77beaaf41fdb0d387ffad9f85b44a0ff4538cad82e765c530e0d7f5330e5afa5035f79c1250aba01e9a222301517a850a1a280fe3139d8a7c04a
SSDEEP 12288:juF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:jVmf1GDvnYhSyyz1txyTZuy
TLSH
T1D145230B5AED0CF7C1A58670ED9BE5C09E2DDAAC61F6032393E5E963587FAE64C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5894dda2492fe180b051193dc6593226cba0a7cb0cac4dd9ee7783042e6a824e
MD5 06d86446da3aae599848244a0bebd13c
SHA1 c00a7454a85f8a0f34be2fa7300586206183170f
SHA512 5b4d9e5b574e073d2d744d0abdb085ee99e12974672f2f0944e4c6d539aaa11322ca5b489dc6ab0d72401dab990d54ebfb77a23d0a5d0d6af039d63c88fd9aac
SSDEEP 12288:MyPz5L8RF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:Vzywmf1GDvnYhSyyz1txyTZuy
TLSH
T10355010B67E520F9C1768234C8A35A41FB36B83617714B6F53A047772E376E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 730642d955b31131b3e6e2f8e6afc6e0e71e037bbfef79145fe3abc093fac6c3
MD5 e1a98c76f7dad29d6c91737f08160162
SHA1 ee796da7d0a4c9cce636191cf5b1327dc7364212
SHA512 ac95d91c456020d0f08cd1770026e2c01f54bf2033fabf8092da24bdfecff123e02b9a6f035426d0568cefd062aa73a7d948752bed6c706d443d04259bbc81bf
SSDEEP 24576:aTHaLl3z0zDqmf1GDvnYhSyyz1txyTZuy:aT6Lljzmf1GLnKSyyz1tgTF
TLSH
T10565F195B3A018F9DC67823ACD568946D6B2BC5A07B0C71F03E436675F373A10C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b7f3c064e680f79ad499f17d128456ed53ea78dd887775acd3d6caa05e4ebaf7
MD5 8fb36739e161fbccfd1cd2f2f7b7a450
SHA1 d4892e2152718fd0e73c2fdbfa5f11be8b8a7d9f
SHA512 e1fc4c0b68a74c869f3035a941046e0c8edf0c7521ed5d3a809b20a1a9a13bc08f2a58379c57f8cd86b3e60bbdbebe15c7de1071d49e8a31805de20071f564a2
SSDEEP 24576:w37d9CHKy7GZ+mf1GDvnYhSyyz1txyTZuy:67d9CHKyaomf1GLnKSyyz1tgTF
TLSH
T1C475CF90F3E814E8F0B78A35C9769511DA767C991B71CA8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ff327e32bac848ae79218bcd0c48ab99f97c688d0d0382b81c81cc53b228ccbc
MD5 82fc41d25e0bccd877bfc22b3a52a5d2
SHA1 5afeb5e8423e6627bfb6ae40fadf09fcc13f873c
SHA512 294a9c168dc335e043ce8d93671f4dfb2e872c076e10c6c75c5db1b73f4f3f7bfbeff51feaf69d02e5a1725de58675dd4f44c8fc6cbf3a17ef37285700ef3412
SSDEEP 12288:RPF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:Ramf1GDvnYhSyyz1txyTZuy
TLSH
T14A45230B5EEE08E7C1558770ED9BE6C09E2DDAAC62F6032393E5A563587FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 eba539d27f68a273d416643968258c4710de5a59450d93f0a5ead9a6c77f1f5c
MD5 a43590c2e174c96b9ecd8027ef87208b
SHA1 221dca5f1cffd5a858935a1817eef81b7e3969b4
SHA512 d5b968dddf34718acb3932e7f2b62183f11eced54f05753764ec90a6e9356ffda25e4eaa877ebe2911fdc8d96af0b24430edb8630892655e5a58ee9f3967c89c
SSDEEP 12288:mxF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:mQmf1GDvnYhSyyz1txyTZuy
TLSH
T12445230B5FED08F7C1698670ED9BE6C09E2DDA9C61F6032393E5A963187FAE64C4105C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cea9c2af137ebcc66dfced835c100ba26f90880f5a900a21fdaed13f908f686f
MD5 04f5eb3eff2aa0e46958e0fa0a141366
SHA1 60e2338d427746b1b9a53813b75fe0c9efad5bef
SHA512 67cea67c790a0cc35bb2c1f6e061e8202400a8110076b34296a68921eed76b00e6ee982d45a539ec3c45e870a382b5d4dff574f5b5d94701988b7b97b754075b
SSDEEP 12288:7QF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:7bmf1GDvnYhSyyz1txyTZuy
TLSH
T1E845230B5AED0CF7C1A58670ED9BE6D09E2DEA9C61F2032393E5A9635C7FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 33c46fd969dedbda5d9db1d6ca1f5f91f45ef07644bb940c93b02d61f311ba74
MD5 cc6e3e9175e9ce709819dccfc5099468
SHA1 4c105a848af2de4733c87d24fd589eae906ef683
SHA512 5fae0a5a48f6df6e117fa566a9395d9515811dca62aa1872e4c184a5b2edf38481351ed2581f4278e25c02767371da6078e3a0e5ea01b8e467ff949331e8a7ac
SSDEEP 12288:MuF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:MVmf1GDvnYhSyyz1txyTZuy
TLSH
T1CA45230B5AED0CE7C1A58670ED9BE6C09E2DDA9C61F2032393E5E9635C7FAE64C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 416ef897fd6a539f7200f8431536b2a89969d0b2f1fdb1f2efe1eafbd4c368a9
MD5 ebdca86a7b58dfb394d76e32c536a750
SHA1 ec67e8b87c4c5238618e559da7f22e8cf7880113
SHA512 580cf9d6a5e3d74299aaf50a296ddd79b5e9f4d2876674893de7279dddcc8427674a32ed3015e96abaf087561421abe591d137f517700b586fba99a87c0101f5
SSDEEP 12288:oPF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:oamf1GDvnYhSyyz1txyTZuy
TLSH
T13745230B5EED0CE7C1A58670ED9BE6C09E2DDAAC62F6032393E5A563587FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d64bec8ac154e16a39512ce7947824d7f0fdddb47f75787da3c0093f879332cf
MD5 efa14d2a2da0d90f817aa9525600ad59
SHA1 441dfc93eaaeeff610769918e2aeadb0811fb996
SHA512 b90522b828da7c75e7933ef6974d69581c19e1bd2bc79abbb8a14286b69857579a1ee5640d35f9a932497a5895f252820a973edec961618a379cfdf951946d98
SSDEEP 12288:5WF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:59mf1GDvnYhSyyz1txyTZuy
TLSH
T1FF45230B5EED08E7C1658670ED9BE6D08E2DDAAC61F6032393E5A963587FAE64C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 58c3e893e83ecc17ab93744c0b36bc80a347130424e1adbdc4e48cc3333b4177
MD5 c07a8ef9da03029370577f537112a02f
SHA1 a606893335a5fd15b9140877e020b2815e91f1ae
SHA512 87c70c464904de7bfc5d2f840a4d8ecac818d861f7c747fa805946a8ae784eef81ad80bde297d06e6eb4fdabd43dd82d56b104421a67be7d050b62b82379a51c
SSDEEP 12288:JkF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:JXmf1GDvnYhSyyz1txyTZuy
TLSH
T14545230B5EED08E7C1A58670ED9BE6C09E2DDAAC62F6032393E5E5635C7FAE54C4104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 de6cb18152d06d3eb25228d57c5a4fe8d23b665997ec20afdbf40ad13d28a8f9
MD5 2ddbf50fd02c1e7ac1329956a0c896fb
SHA1 278cd0d1176d4525cc2f11b6d7d7482e136b6dd1
SHA512 2b5986a31421eaa2cb341231bb96aeb7c11017895726c27f49a77006b7341f06dd5c14235eb5c90436565ba1ff52efbe4fa059020bdd8df3b2f39dffaa5de0b5
SSDEEP 24576:Hfwvok9RX6wkyAIRmf1GDvnYhSyyz1txyTZuy:BMnYIRmf1GLnKSyyz1tgTF
TLSH
T1C685CF29EBDC04E5E1B7923C99B7464AF6B178681B31C2CF029A53AE0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f0d91ea5ce3141f088899ae0593d058ec88c2f7320dcc5109b1be4358bba89e4
MD5 0b7ef4f66ec17cfc4eac2c2a315f0846
SHA1 2121bf19e02a9e01147399973166b7763d194760
SHA512 77f0db940c7d1f3bb1358e5fbef89c38e888388bebd160904b92b2020b482e51feeca69dda53e75fc9cbb01a8744a0a30d7844527512f502ca55b95019b37b3b
SSDEEP 49152:kYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Gmf1GLnKSyyzk:qySzPtf1MKsT
TLSH
T19D066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d1dfaca565585cb0592c226d1b334af64efde5c868cdfff048df3b306df36ea6
MD5 df7cecd7839c6a339cf211f96711e934
SHA1 f68104e83f7d6675bde759965fee9c6ef50ff777
SHA512 879e8e1383f1e5411cedc75da28883085e2e64fb8baa84af19791c57e74b7911d39d9775ee6023507a89ddfb1a8cb547e525187fb3ee80c78f21d43ca793f9fe
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUmf1GDvnYhSyyz1txyTZuy:447JUQj1irIhCnDHUPfF/Wmf1GLnKSy3
TLSH
T1B365AE1EA3EC01E5E1BAD27885158A5AEA71742D1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ada2c5cee29772981c2255b792f6ae7ad7ec642596cb12206db6bd2083988005
MD5 6337a25ba07f56f7eb97a1d08cfc1494
SHA1 b39c9734caeab275be268b49fea558972dc6c485
SHA512 d484060fc82855e8fd80db77553ecc8b15f65eaec2fe7e9dcefd81bdc0039a628a17d50c23b15cafc0eccf3b339d9fdce3b8304bcd5df2b73680c5b5055be7b9
SSDEEP 12288:nNsf+F8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:kFmf1GDvnYhSyyz1txyTZuy
TLSH
T15655F00AD29800E9C06E9274CB569A80B737BC6593F193CB53D0F57F1F7A6909DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 838b419634b3a8836ea0030d29bbb9e82b6c6fedf79e43d920abd6bf4a11a941
MD5 203bd5271833eecdf825d08e22fe7d21
SHA1 61ac651a95af6115ab2c50ced920c8e569099ada
SHA512 4e3c393f3d99782e8a897565ff3a5c1364bfb23ce6527607fbe3ac2562694f216c6eded30a07104b49ff727b2f1338075fcf47cc852d48138761cdc653e59cf5
SSDEEP 6144:WsBC2na2UugqrERrfKDexHF4py5H+9kv2wAUuP5V0I1uBRQ6QSHMmBloFxhyfvO5:Tjyfmy5H+LjTrqRpQSHMAloPh2a5WE
TLSH
T179351711762BD75FC6A940325E32D2CCAB707D05EE456B0372C89B3FC576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 0a3bc83431e6b0ac0aa13ef7fce79ebd35f09cc9f2fc2320392b4818fdc632bc
MD5 12da28b411a0517d55e3c1bed8a632f0
SHA1 e3deb71ca3574c426783de0fe20ed86cfe5fc328
SHA512 1064a6f4fbd3b5dc42a9df2c59b7c1632a661df89dc6d2f4f2debbca437061c23b032008e5aeab622c4adadf037f15345b968fe23fa656cb2ecadea9b8cb5365
SSDEEP 6144:6RyDgiRVEI1bI1N2kvDPJ+kvj6IaSJyKDexHZNtoNGpyKDexHgMLgOKDCL8bNGEF:6EgiRVo9mI98RMxETyM
TLSH
T1BF75F781A537E38FC1FB5032073AAB4DA778AC1677056F1673C8053AD82A765B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 82fa2bf7cb6f043bdf17dd9a40b6be3aec3decef65ae9242842d0852fe2bca48
MD5 4735d4d0b8180830d4d65f23b4ee2f78
SHA1 dbb7253d15cc27a0929e026d7bca0ce0142ea9ee
SHA512 b270167b08ecbbbe810317eccc3d9fc584246ca6d1516a12f3b9ed8535d55865a9645f5cd61add0e854981e74f79d4922bf69091c97919d03483c52533587665
SSDEEP 12288:a07mF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:btmf1GDvnYhSyyz1txyTZuy
TLSH
T1D54523174BED0CE7C4B98770D89FE5A05E2EFA6C17B10363E391A693587AAD58D7100C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 57b945af45bad39eef27e5749e93e5fa90cb58407e73bc9b097be254e5e5fdd4
MD5 99b2eead0da246299f2fcf431c4aecc5
SHA1 e11053e286fdc748eb7c12d13a42e4e527b5c04b
SHA512 2b0ef8aad0135ba421403135b4d37671a59a8fd3b41dbf5ece576dc7b91e92260c3a8ae68ce95639626a9c5e6f5d9b3b364deec4baaf6510d15c6cacac18ed94
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYzmf1GDvnYhSyyz1txyTZuy:Ugb4mBIBhGFUmf1GLnKSyyz1tgTF
TLSH
T1EF65AE1E22EC01F5E0FAD2B8DDAA4417D6B278160732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 63ef912c1c86e554135b89c1d78c071127e3ddd742d70109bae5bf2992998f72
MD5 fc6c06c7a48b2b4b39e3c2ec5f2f595f
SHA1 750059fa81d8ebc61ee3d16f75d7b80231de99c1
SHA512 40db3addfe44719be0de9bac36e3bd566870097331189333d9dd14f5591bce1693c7705c94c6991ec6b5b69193ff4e7aa35ff466aa82bc397d2d21044608a355
SSDEEP 24576:KG88u8FpJqH1bzria7/mEmf1GDvnYhSyyz1txyTZuy:x7ZFPqVea7/7mf1GLnKSyyz1tgTF
TLSH
T18885F16667E500F1D47BD138898646A3F672B4250374EBDF07A88B521F23AE54F7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 522896d4cd29c6ca4103665e6c05e393d7088879d6022bb6024283866f259bf5
MD5 a81d975af4ff1deb6bddd3a60ab34bc0
SHA1 603efc9ae906ef598f2d2956c1aa55b028e62375
SHA512 13a43ffd6f99742c0d56f6abbfc53db8ae50b7a679245c41d769b92b9f3d319974bf83043def5a8184881559748bf31797cd0c86b88787d37f95a197c58a147c
SSDEEP 12288:7HvUrBFrEjwaQJF8EfS+msn51nBwNccvKPC/pOhSyPaz1lNJY2yk5yTZv2y:7PUr+NQomf1GDvnYhSyyz1txyTZuy
TLSH
T1FF65E11F26ED1CE5E676E17CC9868609E731B462135293DF02E0817F4E67EE8AC39B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf5179125faa0b96a8dd9a5b1076089a5858cbebfdffa8ff541bacd550f917fb
MD5 2ce4aa4ab11dc827db3260bc1e090197
SHA1 522a547c14b361d98a19f1159f37faf731ee07d1
SHA512 0a961f7df08a4c425e276651dce4848668cf9b286f1159d373c9d7855e039cc616392c1de366e171c79c2cb0f0a837dba3d78455dd342d4bd9c471f2223f7902
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYmf1GLnKSyyz1tgTF:TG05lO43bYf1MKsT
TLSH
T137D5CF6E62EC11F9D1BBC17CDAC6860BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a54c86056d86fe4880da86df9232738def58aa12dde9cbb3b4b45831225babb3
MD5 f9b7443a547252e5ce2aeb9659379dbe
SHA1 0464b203e60060d1efcc7855969b4d25742a0b2b
SHA512 3d526498be30815fd01468cef31faaa2feddd3609e2b624d34a8d5e4ca6f68d3aa818b20a765c9ef7669ac2ee01ef65eb3a95ebc3705aed4ef9454e5822d32bb
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnGmf1GDvnYhSyyz1txyTZuy:Sa5POZ3+Jt2pasx2+mQmf1GLnKSyyz1W
TLSH
T18665AF5EA7FC00D5D5B9D17CC583861AE5B1742553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9ac38e39b94ab20a6f4add217a36d605816bdbd218125e8c31c382243106714a
MD5 e62d8b80d6269463cc9d116e2b1b1b73
SHA1 d884f1641520f0f4ed120ece816fbd095e371564
SHA512 742ae4e031fae08ee4e12a8b329e24b60884c7d1b459dfa18fca159fdd4377d2d2049985a21aeef0e77792b1addc3036c93ba3eb4d9f6d06f42e9fef5d8ba7d0
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fkcmf1GDvnYhSyyz1txyTZuy:pNc/zEOVHFbmf1GLnKSyyz1tgTF
TLSH
T14D858C1623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4995b07ec1313395829613634fd869ecf1075a2d17569db41cc98d5dee3f9f80
MD5 61380a759d7f7b412b1cfaaaf6c50db3
SHA1 74744cf227a7f9a9a22656651c1427a1a5afe5a0
SHA512 0241b381d6ddfe8b177a8a4f07cefd369248279fe493292d41577b799e952533d756fe59bc09dd756e513cc07596f8ec35b9101f825ba88b3cc5daaa03ea81f1
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmymf1GDvnYhSyyz1txyTZuy:M8MwBtOmymf1GLnKSyyz1tgTF
TLSH
T15155AE2EAAF845E4D1FAC6B4CD238512EA727461173253CB9390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0493a2af609c330542a08364b8b0a52678634ab4207d38234b1abbfb081bc21b
MD5 b6bf5ea63e552eff1e8805d425eb7ad2
SHA1 11b8c28bab2171ed8688c1083e94947a38b93120
SHA512 8364c34a0895ad06fb01626176e9896ad798315ef58109890457f02299bae82983c127d891399642a9bdac5b75701bfe8e70659f5f3826badabcca8961818315
SSDEEP 24576:5D3FHshBIYQgApmf1GDvnYhSyyz1txyTZuy:5DVHeBIAApmf1GLnKSyyz1tgTF
TLSH
T11775E13EE79C04E4D57AC1BCDA638A06E77178A9033256DB02D4C1B61F6BEE46D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-63-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/720-227-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/720-65-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/720-71-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2108-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2108-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2108-105-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2560-74-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/2560-7-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/2560-6-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/2560-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/2560-1-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/2764-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2764-120-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2764-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2768-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2768-53-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2768-59-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2768-188-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4608-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4608-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4608-319-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4608-79-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4608-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4608-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4644-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4644-113-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4644-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4900-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4900-20-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4900-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5292-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5292-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5292-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5292-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5348-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5348-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5348-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5348-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5348-305-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5348-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5776-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5776-48-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/5776-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5776-44-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/5776-38-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/5796-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5796-282-0x0000000000400000-0x00000000005D6000-memory.dmp

Download