fc5098305bea0cc0a819f7dd7d63b560b3e944a3db49d862bb18c3012a9286b3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260908-2tpb4ayfjg
SHA256 fc5098305bea0cc0a819f7dd7d63b560b3e944a3db49d862bb18c3012a9286b3
MD5 76c56cf840c333282097e4725bc6b84f
SHA1 090d987b5bed12ddae549ef4e94dfff8a5f73f21
SHA512 d342eefcdd332a23e441eb665220e45542723332f03829b71a2e82e1e31702ceedc72f621e28b47616a4f9381b589a43d9785e009ffe2c603664415c29ad44ac
SSDEEP 12288:o93G6vHzOASubviBNDYa3A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxQ:oVGGTWBZQyxknw4FYnshx8OfVe247
TLSH
T1C975122472C1C0B3E96315310AB0A6716A3EFE305F7585DFA398272EADB05D1993DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3440	elevation_service.exe
1404	elevation_service.exe
4732	maintenanceservice.exe
1336	OSE.EXE
1056	PerceptionSimulationService.exe
6012	perfhost.exe
3740	ReFsDedupSvc.exe
5184	SensorDataService.exe
5332	ssh-agent.exe
4444	AgentService.exe
2952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25f3299209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aad17cae43fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b29dbbc7e43fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e3af0ae53fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000469410c8e43fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a354c0be53fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000942ee3c7e43fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fa38d0ae53fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd1b6ec7e43fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db12aec7e43fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4444	AgentService.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2868	2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3440	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5016	2952	SearchIndexer.exe	99
PID 2952 wrote to memory of 1508	2952	SearchIndexer.exe	100
PID 2952 wrote to memory of 5764	2952	SearchIndexer.exe	101
PID 2952 wrote to memory of 4768	2952	SearchIndexer.exe	102
PID 2952 wrote to memory of 4524	2952	SearchIndexer.exe	106
PID 2952 wrote to memory of 4620	2952	SearchIndexer.exe	107
PID 2952 wrote to memory of 3376	2952	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_76c56cf840c333282097e4725bc6b84f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4732

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6012

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2700 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2700 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e8c2218a4d73d5eab65751268491009998c0740bcb97614b24c6c63d96829991
MD5 d98c2a0713eec2cefda27d42d58a1839
SHA1 f63dcc4d24f3518b8bfa678d5675dc866ab319b0
SHA512 a718dab0bcf4092287c4319aff53c825182a1a4bb97750b6a40ced3d34db444eebc4d440a164c911352019b5f850088e60bf3f92ee525a3ade9dbcdcc738bd91
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnox4x8EVep:53q6HjBLix8EVy
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 40911b482cb0acfa7edbb27790c2e8dee1d5c2147c3a2cfb7e624bcbcffd42c7
MD5 7a5885a50bfcc75262e9612bdbd8ead3
SHA1 49fdd23de6562a88f89c150ff8afd0934c7d9fb5
SHA512 7153fad41b39fb7a6319c2fabdfebbefd1589136c903998105d8e8595fbe3d8ef34f9474d88cc8c0a898aaa02d27c2643d1b3b5cdd7e45070e69b0fe149b4231
SSDEEP 12288:21XLsswWkxy2lRq2czA8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:0XYfDtczA8yxknw4FYnshx8OfVe247
TLSH
T1AE75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 a9069e1195c2a666844dcc48eb859b2e6eb8878d5620da0a29b687eb0a5d5c93
MD5 d9f2bbe40f177dc2314cb0851876ee66
SHA1 aea382c2195708d79683d1eca0966047979007e1
SHA512 f84dc9e8d2d8a4dea6fef9025e1ae5b029fd95f705218a947657d01f79cac244bee7bafd5309d0c9eb1e54b91a6b6a0028f287de3074f3fab37bbae421a00740
SSDEEP 24576:r0Le5ji0hmx1rMlyxknw4FYnshx8OfVe247:rPji0A7lx4x8EVep
TLSH
T12B95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9597b19484db19f1e1ea6bf80bfea133980e98098821a4353d05add6c8019978
MD5 ed33af8c04b789e4266aa28e534f7847
SHA1 b9d2e7e7163f295892ff46e6e00d555da4ec221e
SHA512 8950b3df53ad666a3d91e7809f4c1eb7d8b8b12ddee65f84da0812fb9841cd6fc0f34c089b01d120b1325e9443f6a27d0f73d70b2df939ec191961ff067d4c62
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyuPyxknw4FYnshx8OfVe247:o/ezSC6vUzPvxHjyBx4x8EVep
TLSH
T1D8756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 789fee652774e0379f049d20722fb1f147b56f2f20e6fb5db2d9cf818ebb9e00
MD5 77045f33eb9ecda89051bca146f7a18a
SHA1 cb9de7511610ffebad54b1bea8074806648ba5f3
SHA512 f98ebc301cbf8b133f363c27cdf29d12ae9df921bdbb27b76f0f7c167ed4da9f075aba45483db337245cadfefc0a2f3ec62c0010d642e23e8c60092746c6e3ab
SSDEEP 24576:+VbqPb88hv/l+64yxknw4FYnshx8OfVe247:+VO88hXl+cx4x8EVep
TLSH
T117559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 507081aa7f62f1cd5957a62a7fdb77f40ddc81607af2f1978621c18e53f7fc9b
MD5 df7afb4392ff58bf0fda4c5092a0bc48
SHA1 8b58da3d4f7affc596dec63aafaa99aeca9c4bba
SHA512 09a55a839378459b06e436798c60479ef52e4c51c1204bc52b5a8b3e18cd71ec318e60bd24bbfb6b760148b9d74d7087ea3706c9e3f8af501fc7512078c4aca8
SSDEEP 12288:qNx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qNxyxknw4FYnshx8OfVe247
TLSH
T19F65237CA7DDA4E1FA5E14331B7572622616F9A4DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 52067f14d20f523723f60868eec24aa42c345aa20c4e3271577e76263f7e2f19
MD5 e1a48b8b409036e2f24bafb62e6b911f
SHA1 75e0586b302b0fd4d441177951c0b148b4fec396
SHA512 e65c4a5b815d3ed7546ec44a6be4fa68d6108528f6090ffef52546a324d742ed905e55da27be142faa0beaa0b64e05d7adbc0d67825102303c6626c9a4e39c12
SSDEEP 12288:ZeBNUbTVO86UA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZJIUAyxknw4FYnshx8OfVe247
TLSH
T11C75CF7BEE28FCD2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a986f49f15e10989eea482542a443ef4f1a2e8af2238f71f6d3fb7b46a8b1401
MD5 ba00ed09a90b733c0ee204c1625250fc
SHA1 7fc2af391138f6e7f06a7377695a486dd3bd4c52
SHA512 0a6b62c0901cd1656bda2a99bac8c74fe6313d5ddcf1339ebf638ec9ec34dde27ea187166d9a084a63d3a6a8568a0e87363a3e55c522ab44bd5b082b9fe0a356
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:UQvGAdlCEL8c/yRNw5CKix8EVy
TLSH
T10C267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e5ec091325403cf2df2310c25e3c00b869bac7812de116969aa3d5a3571017c8
MD5 82ebf5021945872713880fc0ae3823b1
SHA1 85af479c466a75de5edda20e061c97dda356e9a9
SHA512 8f962ff22803dec2b53765e7574daceb8aabc8a046295bdaaf87c0a3ddf1215c732bea9ba745a38ef2d030e409e4b9929ecbf9f8e1ffd29bed0b53e1c8cc10b3
SSDEEP 12288:2AwSfxL/2Dc3LDLLmt0LDQewsAja+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:L6ewsAjayxknw4FYnshx8OfVe247
TLSH
T10885E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6569fb5b6b7e42de67739621a988ab5b8252540242f07cb9f32274adb304a171
MD5 9d47625695447166b55a8ebf0089fe5d
SHA1 e52fa441184a807d5bc325170c83653c014ef621
SHA512 b82007fbbac08abde775681040557efaf1244f19d7ae90b676b76614de52e006210ef100afb8794541ac12355d722e1484442fdf0144f34776428d72ffb72001
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:YUEtQevvqc2W1cpV2EI32
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 870fb90cc8d5a9b8f71c31d8e28dc1b6e6b0d52ff86189a2a5eabf059a973bf7
MD5 30ca106c4058df39faaecc60678f2670
SHA1 9caec580fd3cb2c38f5340f0b8e2884f51d0a567
SHA512 4775cd3ae97ca5165adaa3d2cc54ea7028baec679d32d449b5a78228d9aa0084d3060ccd4e1ba4f61efd42e69e26eae68c421b9fcff7be697dad121dc4151008
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zVx4x8EVep:FoqtVjnm2ix8EVy
TLSH
T102D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f45128b15115068907d8a7ad49baf26b865f9968b8df2d2a7ada27eff8868a5a
MD5 2854a4277d845e112b44f65757259932
SHA1 5c9ed876a15dc0d5f5e03f080d4b2682e4aaf96e
SHA512 faf2c532d3cd2bd8de0463d28f25d81720f11017a5854ac3bb826c935dc0924e4d00f1ed408454cd69dacf6f13cd091ab742606c028fecd3ad90d56198b4d5a0
SSDEEP 24576:9AhGLJIFoiwtA5l7S53Tyxknw4FYnshx8OfVe247:9AMyFoiq5Gx4x8EVep
TLSH
T11B35AD80E7F955D4F5B3AA7899B69171EA76BCA65E30C20F2260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c50fbc59c8bccc391922f7b60a7a2cda997125e65888d6d10033c053582ff156
MD5 e5a87b7dde71823b84b1afdef0ab35ca
SHA1 3cc1f67f34e8131faeceddaae32551614aba99b9
SHA512 e93773798927f2104442e5b490098741fe7a288eafd3e64e1695a30b76eb2ed3f4405e00c0bc7d1624e495a8a4aa42f7cf929c7a8655f1571ac2d8c540af8d6f
SSDEEP 12288:5mw5HEjsChN4BFgl0WDm+Cv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:UwuVOWuyxknw4FYnshx8OfVe247
TLSH
T12C75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 de5fb2203e3b4262d4a9eced2b8a9d1f18e5007f68e2109bb6cac7b8f2c1dd70
MD5 1860a575fc00f72a7ef67caac17ec8e3
SHA1 85c50bcd3ceef61fc01c1a41d3ae828da5563900
SHA512 e40a6e6fe79fb41bc6403b19ecf6f3338496993a372aa19f4e8a18df5c8d6eb94473fa172d1f2609827174a5cd32131e5772f3ebaf5d4e1a635ef518594628f5
SSDEEP 12288:aFZ1Iyq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wZuNyxknw4FYnshx8OfVe247
TLSH
T16E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 781fa6ba1ef83e2a2f8e46fd20a7a577910cdc980cdbb10332717b370cb35dc8
MD5 de82541f3a6a24eeadff0a6be46dd561
SHA1 218b7576358d3897e194d738f7a6507d5e2b39f3
SHA512 bde92de6519b0d715089fbcf1ef6407ab4c8ba6afa3eee705e188c4e6916e85279d281b351ae45623470c2c8cbdd3d4a6d0b3db8c9a64b345871fd8eee941cbe
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:lQRQyi36YOcPQLvw2gAf+PN3/ix8EVy
TLSH
T177667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55e84bff5c6b709ec259b3a57c180e01539badb0ca21d8c34bbd571d627d29cd
MD5 10495004ba9e523d3d6dc5f9d704aab5
SHA1 40d0299f1b6341cb1a09ba9b96eacd4f20eaed70
SHA512 ff71387abe1e532448a93a5bb240b098761df90a1eaec494abcf6c1b4c3cce8e3514a6899fd224c517e1a168048d834ec296b6735638fc8dbc22cfaf4d81b320
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:JQRQyi36YOcPQLvw2gAf+PN3/ix8EVy
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2071d5cf78c9a3149e30e9f0adf838fb9f4212c5290c44649d6bf8d2e2c4e671
MD5 6e3c8470991a2172ab783ee4f0c4bbe0
SHA1 9ad947c39fcf25a746c001160b4065f74bacbfb8
SHA512 4241bf29824fa3a65cba1d923eb3aa6eca9a5bce14eba4bd67df5a51535fedd6470dc91a8e322c8cc6994a9726bc83d08a18311e7b8ffd92f6722047b0f85d34
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09yxknw4FYnshx8Z:S68Qg55nhheWu7PNU3/lx4x8EVep
TLSH
T190B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5d16d8f562ed98cd9c8c9593968828ddbb38185cb30a0e33d00be8d358e41890
MD5 67b716e641e6bf79cb35469388e7575b
SHA1 186c190b1b2554278e13582785fc405767ea3d0c
SHA512 4bc5d899c1cb152873cccac8143fb67d4e40cee9500469ecefcf3bc67f7756fea72e7cac0f4ac114199f8ed8b81a23977216b14ffe1a7b186dce3523f174fe9c
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:Cy5112gYy5azzVvL69nLKnhZ0ix8EVy
TLSH
T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fef0d43a6b89b703e81eb27f844f72b014642b61bdaa49020e438a4e00426c49
MD5 954276c06703b8f5624a666c6314ca41
SHA1 9151bfd1a450cd7961adae626d43cadbf6465be3
SHA512 fedb204ed4cf95c0ffbbbd950d9d77fd2d5f4dbb02fb3d11e723d66b0d52dd7c66dfc5ca0038257be65db16637b96692b09a4d8bd51f2ba4d5a19507426e5a1e
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHx4x8EVep:Au6JmVxd2dHix8EVy
TLSH
T1FFD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 28d229fd4be5c029b584a7d260a72460f09ae94558057cf2d512ac4eb6a4afc9
MD5 9aa7aef90fdfe27f41ed556a78c497eb
SHA1 7c44c1cec3def1ad728ae4608c2f94bdfe72c5e0
SHA512 4fe171b8421201768088c399734d06b9618c568a91f85f2c4f4ed746afea4ff15469a45fca745961be665ce3037b670e7142d604e8ab2ef885da67555c39c6bf
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xjx4x8EVep:jmifPbR2ix8EVy
TLSH
T1C9B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 058675e82613cd6773322fce4d4e3036d1ae98b1d699a1eba0a4f3ee9d0aff86
MD5 0182fcf41852302a54417f70f3baa5b7
SHA1 682df6f44228589f9f7abf1c99c2b310df86c25e
SHA512 186cf2c814c47503259399501e19f32759519265937f63ea3317746a3b375915203d8b252d9e53324b057a6c3e78fa91d10b48963485348b8bd466b16368e66b
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHq4x4x8EVep:i5dKTi614ix8EVy
TLSH
T1F0C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 71e1c819048b8217b325c666e0b2677501aabefddfeb0f7569b1455c5442929c
MD5 665a49c3b105400ccdbc06ef0cd2175c
SHA1 5b0228209b60098f40676cdd341583db07a42f03
SHA512 32b2820a2eaaff79709560f7e991c71f8ac1534e148a94915969f045c2529c69f3dbf08b0636c793f61fa06e9669dd871ff37a99cbba70f88d7492bf7509db68
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5wXx4x8EVep:gX2iyphCix8EVy
TLSH
T17595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9679012ddf061ab34be80ced93537d6f80b3674f77c8a312027d3070a06de294
MD5 755c76da86dfb8f7a651fabb15a88692
SHA1 deae98b38c41cdeb1ce07c0192a1a7af7fca44c4
SHA512 dc0562cf399e076aaaca5a8c2862c7bbf6d8d0fd6986cd38f67670bc61ad5ec50be16165272e6bb8acf7cf89409942f0b76d6ccb7cbacbfa48210e1eef017339
SSDEEP 12288:qZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qZyxknw4FYnshx8OfVe247
TLSH
T1F765237CBBDEA5E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 77f9b30b05bacd89a05d23bd0a2a54c24f6b0b02bf4f94a0a75c670e0e71d1e5
MD5 39ebcaeb827973d0db00547776ace391
SHA1 852837c740e0a575131d19a4f9d433c8e34b0e18
SHA512 07ab023b61a0dd3bb2e8d9eb7911b10ba6dc4c219441c7d486495cab8812ab24e0372236b0e4318f1b22f720ca060b124d4bff40626da49f760240ddf48f3f56
SSDEEP 12288:cG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cGyxknw4FYnshx8OfVe247
TLSH
T10365237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8f7604aacb6975945e701fe4b832b50e0a07548fc5bf5e22eb24ded8442a19e7
MD5 0011f835d04f85dfef4ad3f0e79dfbfa
SHA1 e2dece49dc68d30b5cb5df85b32edd8da401e88c
SHA512 16947e843674e2413ffde4c86e569682b45266b84fbe24573947a25b46abe5d99c3aadcdd6ff454b42c594b0340fa3d6020b4cecfbd9f0b4f31ead4f4e8e0257
SSDEEP 12288:go+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:goyxknw4FYnshx8OfVe247
TLSH
T1F065237CBBDEA5D2E54D10734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 3e32b4fd9a49d34913a6d4fcce6f338fd52047f35bc846cdd436f4aedbeeb7c2
MD5 15fd6502305dbd3ec00a0e461a5394d6
SHA1 53b2f7987ba658757c0f71f1a0e54cdfad3c4b97
SHA512 4fbf70ad2259e7e549ce546aa7279339a9793829dadeaf823f302471100bc03e131ef120186fe5878c5a80f9400dcadd75f04c00e500d8ef4f571e095679e538
SSDEEP 12288:qVz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2yxknw4FYnshx8OfVe247
TLSH
T11F65236C77EE50D1E85A51738A716222B265B8E5EB31C35FCB24710EE9B0C90A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 687807a049dce7682d30c6dcc998afa859c5f64ff0778f3d0f7507a804c40775
MD5 226d57629e94f51b2f91982f550c709d
SHA1 9f1443159e020aa1189e8f7ee1ac46dfefeb3016
SHA512 3edb0c73abd05d4ae98a0ccbb44660708034f8fa310f3792e38dc2d1c2e7f4cdf0cf76f3db4fdefa308e9188dd7a49c6b797108627a698dc43304e5b6bbf67e6
SSDEEP 12288:EL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ELyxknw4FYnshx8OfVe247
TLSH
T14165237CBBDE95E2E50D10734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b35aeb416ec4138201efe53b4071af8a0a2d11a16b5b82a804ff4750395cea19
MD5 747402d367ced9787770dcba697f8e63
SHA1 c8839a0d35231f4420a1ab41a9c6ea4b672b70ac
SHA512 091b4324c0acb54ba0356c60fa18030163dee0c56b0a272e7beb3342fd78d3611d74ded42f545c9853795c90a50209ba8cb81265620a5d809678c5f1a0cebfe7
SSDEEP 12288:ii+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iiyxknw4FYnshx8OfVe247
TLSH
T1F86523BCBBDE95E2E50D10734B7172666609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4fc774fa0ce977dd84af7593cd69b14bb305f5129e6a41cd7ffca235e097f344
MD5 9a6aac831864ce1586e8bca069578c0a
SHA1 be00bd1986870245abd9f82cd74a7a4d9f3ed24e
SHA512 729d45300c4383456afa162b380c345006d5e7398d4bf1462e17de41e6ebea49316a838ed9c2dd217f2665344186956f2e4c2b3f5c6abbbc18a19283554c1ddc
SSDEEP 12288:ee+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eeyxknw4FYnshx8OfVe247
TLSH
T14465237CBBDE95E2E50D10734B7172626609B5A5EB75821BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d480d1d77b24abedd1dd815ad5303cab22be9b99927d6734fc271eed9f094dfd
MD5 829d672d98b369bd5cf9f3ac33a50c7c
SHA1 b6d90c38b173f6ddfa05652eb8f00283bb850253
SHA512 4807497f16ca231e5329445347d4af1fe940642fb6514e0384efb3d4ffd55d9cbfda2a16757b2e6da15b52d7bee49787c8388fcc601004862f10de3efa9e010b
SSDEEP 12288:niZwbZzzFEoS2cPvym+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iZMdzFVSOmyxknw4FYnshx8OfVe247
TLSH
T1EE7502A8B39018F4EC67413EC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2e6672c0015df50d860c2b125f53a7ad9e1334766e2a14aaf2adf07ca1ca564e
MD5 61f3b0b3a32d04187293eaddee7dea8c
SHA1 c870341cd4d565d593382b1807f58970083f1293
SHA512 cf40d107c0afa381a5cd92c746f3d8df3c7aec44f47042f0edda9d2c3f4a1a219b6141f9b5242dfd31cdb27f8e99b4a4dcd91c250752481d851e629f491f6bbb
SSDEEP 12288:Yd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ydyxknw4FYnshx8OfVe247
TLSH
T1E965237CBBDEA4E2E50D10734B7163666609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 edbf80c91eb295a8769f7e68d291b66ecadd420fc5fbde7248bd7b1ea369304e
MD5 4b476a4c748c9c5ab2600429616a4600
SHA1 034ad06aace09ad00de899da95a876f6303d1c5b
SHA512 e8350ffead5a2571242da2f7cbfd39b982eca9a8959b866195e9b690e3709f10738b80a50f5fbae64fc7d5b7bf636db67380e2387b045e5e51931e20ca717aa9
SSDEEP 12288:SB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SByxknw4FYnshx8OfVe247
TLSH
T1A065237CBBDE95E2E50D10734B7172666609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5b49f40954daa5f91c71ac6124deb5581b32f482b1da912fc9fd99a1a1b853a6
MD5 d93544429616bed9ffce2f6871140a52
SHA1 0617c690a2662e270fb2bb27c8cde321677b716e
SHA512 85328e02c82b65dc4964b5608d322b05325338be5b7c81b6145920931fa6ed2fb47abd3d9755b67169a7ef2c22ec15009b5316c4d99ca2daf84dcd026b31b929
SSDEEP 12288:qyPz5L8q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3zyqyxknw4FYnshx8OfVe247
TLSH
T11375125B73E530F5D12A4236C9621612F372B872473086AF47A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c46cbe0bdeca3bd8668b86150d22309c7b4b4e0f5cd955d60864093bd1ec7f06
MD5 6782cbe502ea83d3cdd2993fcfd0823c
SHA1 588208eae3d650bf75a00f89b4260c5c21efb4f4
SHA512 1eb3b1b0971a5a4441685bae5554bb2177c3bda4a3bf6cf295505cc5fb2a05146a704df9fc0108e1fcd0849af6a77471f72af56378934e119e30e9bcde03d1e8
SSDEEP 12288:Zd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zdyxknw4FYnshx8OfVe247
TLSH
T18B65237CBBDEA5E2E50D10734B7163666609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ec39171f6d6c944f8d609b0fd4a9bc3b24c1f36c48a7e2023e41e0cce6a893a6
MD5 bef0b5992376c2d0fe2d725272f70f66
SHA1 35eef299e162760effac23cd340713d2b3d96b8c
SHA512 fb0106eff83a68efa8ac4c2a0a7545b109a597459bebff5b6ed11c4d43a64fda24165c523857c405a3266993b7a52e3fe480ce8349f119cfe61c565c048fb172
SSDEEP 12288:fd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fdyxknw4FYnshx8OfVe247
TLSH
T17465237CBBDEA4E2E50D10734B7173626509B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2c4f356c4f8c00e7e44581128e9c1804992b8c1b58ea410c7ad6b44f073dd95d
MD5 ee1549ca2538023cafe83af0181376c1
SHA1 83ce680d119699125afa92b09418982bb5532a0c
SHA512 d30d6f0c0278c9c043df844595af36e8dbf5be212c3d455a5a0dcc65c4be89870e905141da8e1e0a1ed0e470bcaa5f33dc743adc345f0c6f0b37135cdc8599ab
SSDEEP 12288:yyPz5L8q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vzyqyxknw4FYnshx8OfVe247
TLSH
T17F75125B73E530F5D12A4236C9621612F372B8724B3086AF47A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 f39551e969c83f476e76e109d0700e23d4215b770853a657757b7f158d39a3fd
MD5 44d12b52d261003713f91eeb985e00dd
SHA1 ac498f6e5c554124379510892d980f0deb5f8292
SHA512 4ea97cde0f76bbf95b1db7f32b09c86c91fc0adb7e4dc831c3d2a260f3debcaf91a8e9afc4dcda2f9cf46f9d030ca8d63c766ea34c2d9c57299f5d5886b87f50
SSDEEP 24576:8TGaLl3z0zDYyxknw4FYnshx8OfVe247:8TFLlj6x4x8EVep
TLSH
T1487502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 572051eba9389f7d5ec818b6905efdebe3b6b53bd30102120bcfeaf61963118a
MD5 8031266225395338b4f3f4b9ae4a41a6
SHA1 8bbaf93b4133dedab736b86808f2ceb01f78d48c
SHA512 bd58a1b32a3086e53828c06e8e91222677242ebfd440199c102bae04449cf8ea4e34e200d7870b43e0a9026198743b42987914a1f247cbd323e0ba1e1c2752bb
SSDEEP 24576:n3Xd9CHKy7GZEyxknw4FYnshx8OfVe247:3Xd9CHKyatx4x8EVep
TLSH
T11095DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 05bd29354829b5e118fe2d81c81fd02fa156e4463f1b2039c2cab7bce290b3c3
MD5 8766d6f69dfbaf2ae60f38447484f69f
SHA1 a4bdff41ae7e2bef8da900dbf5a4b228baf3a9b0
SHA512 c4e707da270513fcc016b79d35081cb9492928e292a17007ce66fd7d2b80a1239d259389a71dd3acafa8c3b0b7c28f3506e5e2e294cd6b2b5ea0b96ca61d7af9
SSDEEP 12288:oI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oIyxknw4FYnshx8OfVe247
TLSH
T1AA65237CBBDEA5D2E50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 db5ebb7f202a3e6f4fe35a18c12ff07287c472164996799c9a9771bd42a37128
MD5 144aac5a5bf26ca9ceca6fc96c138c8a
SHA1 2c83382a3f96dac47b70a2147d9f5fca524ca6be
SHA512 f686984c68eb9b0835b1d84df4b7309b9f1fbf8d96324834d3c03de294751d6ec76f70a2279712e33a4a26663be29bb08f5e07c07ad6b2593d6e4936938c9435
SSDEEP 12288:sK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sKyxknw4FYnshx8OfVe247
TLSH
T19665237CBBDE95E2F50D11734B7163626609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 45735f2cc9ce1effd5c8427770fd4fc691cfd96c7a8f69430b7adb04d416d29f
MD5 2c938398b44617abdd107d881faa339a
SHA1 52d86b15ce4dea8518328d13f42050b75f2997e8
SHA512 98b4a10ee912d1b5f02c50f3c3e8a77a90e97a6d23a3666675c01324890b1225d6cdbb0596e4d31d51978e20d1124c86fa2e14c41aa94e926f577f7bca3658e6
SSDEEP 12288:xH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xHyxknw4FYnshx8OfVe247
TLSH
T1896523BCBBDE95E2E50D10734B7163626509B5A5EBB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ee18e94327166566f48e507b552861764b9834049fa459a04ab1aaa1752be8a0
MD5 73810df99fda33b2fde3de9141458ed2
SHA1 413674c312d85ed05571d135297881ef8e149f9f
SHA512 fcc109344e8c913879d8d4b248e97e26967d98f90bfda7e6567b8752480001350907ee97f00078b53906efbb2248612f72656215a52afcbf519ddc03b8434995
SSDEEP 12288:Zd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zdyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDE95E2E50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 7b49c175d565b430c637f41e7e0bb7e350b48de1a2eed633ca8f08535c4829d9
MD5 310ad1ef8876260e32c89b9d4bea31f6
SHA1 ec5b73eb4f01da2c90104b0b6bec58faecfa9ebb
SHA512 209d871c91c537d8b0eb164bc8cad3fc9db441fd449cecd7b47b3aa6edc8712bd91e2cfbb6d46675928e10cf372b5da9fe34e646e2fde75d223db98112c11612
SSDEEP 12288:4I+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Iyxknw4FYnshx8OfVe247
TLSH
T15465237CBBDEA5D2E50D11734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 eb48f51e15fc7ff27164e17d983d4d7df7ac261f6654f75ca7858db4a2728b91
MD5 537ba95e786f2efe8c22e6d1c4fcf472
SHA1 369ac4c3164bdbc6ff0d935d42bb96f5b087146c
SHA512 668731380c05b88cda9c53a1fae542048509d4b008e5076bb17b932058161bdacc650fdf5397a4014b45c304c7918fb4925b99b385ec67d135557cf643db63ef
SSDEEP 12288:lV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lVyxknw4FYnshx8OfVe247
TLSH
T19265237CBBDE95D2E50D10734B7163626609B5E5EAB2821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 4d81703503ec0fa8ee83853663452bf2f298c28a824455d45a6b4902e2be97b2
MD5 9b87fcc2c78fa8080f846cb258951651
SHA1 5da74c458c6335b9e9ffe13cb04b0ddecec49443
SHA512 b10210c5c4f042b6c84397ed335e1fade809e5266ff8df26cb29da98adbe4fa14185159858adc340104192f7d2d57b0edae8ea8eef2dc55045211cd7a48bbea7
SSDEEP 12288:YL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YLyxknw4FYnshx8OfVe247
TLSH
T16B65237CBBDE95E2E50D10734B7163626609B5A6EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 9426488899aa260f5fb4f247569e70ccfc308f617f1fa2f00a035d7597b59fe0
MD5 c61f044459bdb77f08d7d48ae83a6e73
SHA1 783aac1cfe7a156d31ddff56a40128986e737236
SHA512 a3100f9a517f206a933c77850965b74f3a03f1631baf885ea3c8d4d5be6f4372a6168fb7a24dc4a87a427b6830951446298a77f65389d21b9cf9bdc9ea6c912f
SSDEEP 24576:VfwvJk9RX6wkyAIRyxknw4FYnshx8OfVe247:aMnYIUx4x8EVep
TLSH
T1B095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3659cfb6ccdc9ed93c805c46f8ecd07e77d7b274603e84871477a02b2b5b4600
MD5 a865b40999b2983f5ad352f54ae2744e
SHA1 2fe645b6e67476e3b19902ed50369330a6814ab2
SHA512 efc8a2bb6f9d5b8933ed277d235ee0a20e5306374dd0a5bfa238d1ac366dc15529fa3d939c98940b08242f4570d398e65d3b98a575e073c054f9892c4b3b22dc
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03x4x8EVep:UySzPfix8EVy
TLSH
T173066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 138416d07a5b3a1de3226acc392a6f8f9406d7e7739c7dae6f4bec87587b7fc0
MD5 92c94d7d450638dfd901fd05771c2671
SHA1 894bb25992c4cce22a1db8753354962fd82e7d07
SHA512 02e82f8fd57b4b0b10d8b2d6fd0a82597dd5ca7f5b796672d4f819e826ceee873e23e4d55d94d67787f30faf2238418de771e570d80372bde4d113a31548bb27
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2yxknw4FYnshx8OfVe247:h47JUQj1irIhCnDHUPfF/Hx4x8EVep
TLSH
T1CC65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3dc6cfa319a2764018673a5499a7192e6379b7bdc918d17129d42eb85e550dbe
MD5 e10d2f85d68c5d55edae294f9dfc6102
SHA1 24976b415d7264adb20b3ca495c6b7595e0b1c13
SHA512 c24d675df50cced70f721167ae89bb05aab9755a484dea05e4e61ef4cd65060f971807f88087fac0411395442268f813e6ae3e8867fe80d1544001069627fd3e
SSDEEP 12288:h+sfN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nNyxknw4FYnshx8OfVe247
TLSH
T17875F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d3aff8eeeb4c208c95ac9660e37f5ce7587bf688ef3264c21e87837d69d8ffd8
MD5 561497d41ee25b40311e0f3856cdeb03
SHA1 3e0064fc9bf7f3db77b198023c8788dec1873023
SHA512 fa1ccdc04739722afdddc5d30d053dec1fced0b33ad836acbb51342f8884afb07b1cc0fab6ce4ca31f9b46765519d9575bda42401c1ceffd04b77839131be0cb
SSDEEP 12288:BMkWU3f6fczZxaX5kCi0jmFDffnhtpV1xlm:BMfUPkX5B5j2zvhXrx
TLSH
T1DE352841766BC75FC6A944326E36D1CCA7707C01EE446F0773C88B3F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 28a5cbdffdf3cc90c6c66d62f3ad16a5b6299b50d6c48ea0aa3844cdd4460299
MD5 87be2202a3661aea2aaeb429a504db3c
SHA1 00550b605bd993ce600f44668cefa6360d8e913f
SHA512 cc39e0c9b5044ee639d3e9fb679b14d62e2963be3c0cfc901dbef77dfe45c47ba754df803aca56e2a6b707c344db5bbdab4de15d03d720af6dea009b0550a30a
SSDEEP 12288:yNxF+Ru+Gq6RssWCscUzWR3cSyE8vryz9oBsY:yNxFksoBsY
TLSH
T1FA75E9816537A38FD1FB5032072A5F4CB774EC06B7496F2673C8453AD82AB25A1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 10d9d5f9f8b3abda12b5019a21f5255deaa0045928de347826b57e1ea7ee9701
MD5 8b145afb2b5d01044be448e46525608b
SHA1 856025cc803626fc305e006815f4244787c1bb3d
SHA512 7428cd6464a44ab97f8a003e5f0f7e55da9769b5e8b7b95455c2ab5bc49c9ea8c81cff2e1d41b7756276066044044e99bdb1e119df212855774bd81c23362ffe
SSDEEP 12288:047F+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xFyxknw4FYnshx8OfVe247
TLSH
T11965237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8f81a7cda53a6a31e0ebadcc84860f383823cd94b2173f325e16e29990686335
MD5 fe41a6f34378da553e1628536f05344c
SHA1 e7603b0afc36771d6ecbbff6311ed6569cc8ba39
SHA512 82ebf4d79a79d59820e5fe1e5d19b7229db540b80546b2784212d513c0d26d056c88093c3cb3c96a4f13a8e78b08793dd736072875e08a980a7418327a9a3253
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYPyxknw4FYnshx8OfVe247:6gb4mBIBhGFpx4x8EVep
TLSH
T1E965AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 edb9a90643e9f12b9ec27ec5324b1ebed27591938459f80187fd22cd69a82b05
MD5 376bd1c2551edb24495ef56d84a940cc
SHA1 abaa8dc221db145141f667d658b66b2b735930dc
SHA512 b72bb1408a1dd6c7acdff0c474b78dac33c6c20432d03ee74f28b4628b120f5e42ed2f2429eaa64734dc5d91de0d22ab0638c8e36f4ddef2fc91e56b7a4927f8
SSDEEP 24576:VG88u8FpJqH1azria7/mmyxknw4FYnshx8OfVe247:Y7ZFPqVla7/yx4x8EVep
TLSH
T1CC95F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2e754626a8292bc43e9cbbad2dfb1f75d9e21710e4adecfe5f786457209311b2
MD5 cf4b9686c7fe4b81de5a3f935db72411
SHA1 ed4189fa80e5674505d41120e2927436ff51b7d4
SHA512 6fac3f9f53c7052fa573a2a834d6f85e6208c20e8a3cb598998587959863070f7d30c9340bfb270afb85c2ec5a8776cc36ae8a1eef329b576eb52ea5e7294654
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdx4x8EVep:5G05lO43bsix8EVy
TLSH
T183D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 237a98f99e0f3b6724a2f87806e64059532847c564f31b448b3059f977601823
MD5 06b045c836a83f0e38a341f722abdd07
SHA1 ed6d844c3c76d390337e1543dff75f5be525d9ae
SHA512 506d8225d790c3dedf4610186a929ba3db8f0780f4a208fe5a9b16c38e2a71b020b6377929b204990bdef001639421c9b57633bdc3928220419dcee4ed75c728
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidncyxknw4FYnshx8OfVe247:Ga5POZ3+Jt2pasx2+mlx4x8EVep
TLSH
T12265AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 13a8b22bd3a40d4798e3eea2da53a151c40da1c2e570885838022e06751afa63
MD5 3e269df6578c26a56cf0588e582ba729
SHA1 53085627f1b7b3e4ac06e77f94ad4a36d6b55c4c
SHA512 55520c620b6342cb7ec0eb77e728fff320f44e132610e124de60f5844b1a912de952026762810cf7cd43f601c24e02cf40d1518e52220dfde3398cb092489861
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkOyxknw4FYnshx8OfVe247:TNc/zEOVHFSx4x8EVep
TLSH
T188857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 96c79ec1206919eb6f0c95235d6c8eaae8108cf5ee01ac1f35ee577531149886
MD5 af8cd875356df157b54e885cae38806c
SHA1 13b5bd20daaeb08d8e90e3f744703fa381387232
SHA512 42e9d81de37d3573ec5f01f95392bd9697346ac2f8dd7761474728c965f3a7d2106a58cd6be691f8321df913aeb0a9ad931642f1f306185f8e371a9d3f39c552
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmQyxknw4FYnshx8OfVe247:G8MwBtOmTx4x8EVep
TLSH
T12155AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5aadc4b2784680db4edc51265a97ab42912db771d6b13bac264b931e473a9793
MD5 ab095a4486a63da53ba602341610df34
SHA1 07b0e6f531686718406d866e2dbad632fe8b60a7
SHA512 39bc4030b2596990d19d7f63f717f58d6b7d909b4ee623123b550ba70798ada0d32d8767654a8807e2bd425e9d42803bb6d47733c85a04112780e99072109dbf
SSDEEP 12288:xHvUrBFrEjwaQy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xPUr+NQyyxknw4FYnshx8OfVe247
TLSH
T11975F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 f054247100b3c4dd7c76b0aa98ff35a00778bcb03dd89ea2a84104f24c5885f1
MD5 91a6b2c820722eeb9bf4fd984091958b
SHA1 ad5bd4681857d7989d20f15508c322872809824c
SHA512 944f32d0c84c6d76fe59e847f78c2950ff194c5d571caec12d7d4ab88c1a1a9bed35aba54ad441cad260e512b44f1d6207a057c1a56a1a3d302ddfa0d2b25f74
SSDEEP 24576:DD3FHshBIYQgA5yxknw4FYnshx8OfVe247:DDVHeBIAA8x4x8EVep
TLSH
T1EB85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1056-293-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1056-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1056-64-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1336-258-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1336-53-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1336-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1336-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1404-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-1-0x0000000002330000-0x0000000002396000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/2868-8-0x0000000002330000-0x0000000002396000-memory.dmp

Download

memory/2868-76-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/2952-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3440-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3440-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3440-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3440-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3740-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3740-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3740-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4444-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4444-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4444-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4444-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4732-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5184-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5184-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5184-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5184-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5184-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5184-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5332-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5332-120-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/5332-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/5332-311-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/6012-77-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/6012-83-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/6012-78-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/6012-308-0x0000000000400000-0x0000000000563000-memory.dmp

Download