ef8e454d34f4459b157cb5bd4183acf120678dc9c7389c6cdfaae2d0eaa1ec4e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260916-tyb9bsshlf
SHA256 ef8e454d34f4459b157cb5bd4183acf120678dc9c7389c6cdfaae2d0eaa1ec4e
MD5 d9f045ee05ddc65a57a8ae7c574276ad
SHA1 e6cd328c4c6c8bfd1b40b78c63bac38e35c6f04b
SHA512 6c550e24951f8d17107ad639fbda2d30e855f2c98acd261f15efc18f02328a021861e546c950ceeca14d9fdcbd34aaae0cef02d90de73de47bd0c1130db20053
SSDEEP 24576:n5GtIv+w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5GCv+wLNiXicJFFRGNzj3
TLSH
T14165015132C080B3E9B7043449B49970696DFE345F7549EBA3842B2E9E74BD28E38777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4448	elevation_service.exe
2576	elevation_service.exe
5620	maintenanceservice.exe
3540	OSE.EXE
2572	PerceptionSimulationService.exe
5708	perfhost.exe
4708	ReFsDedupSvc.exe
4792	SensorDataService.exe
4248	ssh-agent.exe
3640	AgentService.exe
2528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62870aeb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009330b752f845dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000232ea952f845dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c9378553f845dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1264853f845dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033541294f845dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccc67c52f845dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3640	AgentService.exe
Token: 33	2528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2528	SearchIndexer.exe
Token: SeDebugPrivilege	5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5132	2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4448	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2076	2528	SearchIndexer.exe	99
PID 2528 wrote to memory of 5224	2528	SearchIndexer.exe	100
PID 2528 wrote to memory of 1924	2528	SearchIndexer.exe	101
PID 2528 wrote to memory of 4260	2528	SearchIndexer.exe	102
PID 2528 wrote to memory of 2636	2528	SearchIndexer.exe	104
PID 2528 wrote to memory of 5368	2528	SearchIndexer.exe	105
PID 2528 wrote to memory of 4372	2528	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_d9f045ee05ddc65a57a8ae7c574276ad_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4792

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1680 2500 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1672 1608 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1672 1608 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1680 2500 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 64ae7b7d2e193556c215199a98a524c86e40a742d00133134e7f25cf17e033cd
MD5 de375c22380b1de21be0a55b8c47a62d
SHA1 7c14fd161f467c8a495a123813f94ede3f8c72ae
SHA512 317856361d43ed73eb9441e58f52f40cf5d06c5924320e502699059665e2d874f458b99c14a3174fbf19cbeb3e71ff50aefa88223e088c4e1e88f0b1484fb484
SSDEEP 49152:Zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9LNiXicJFFRGNzj3:v3q6mjBe7wRGpj3
TLSH
T1EFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 65d1c4ead897ecb725b10024f61354114f9c06eb459535876460ebc91ed6837c
MD5 6c693c2b2bc21d3748039326a487b384
SHA1 d75946dc74c47b2eb5bb2c7138a7029c8dbc9ef8
SHA512 119baa426aa814df9ba774b9b8c315e5a06cb1f764fe58d8e71d35d086846242427620d734ce5eeb4226bb2686a32ce16ca9710c4989029ba0b0b66e0b3b952b
SSDEEP 24576:8XYfDtczA6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7tcLLNiXicJFFRGNzj3
TLSH
T14575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fb7b31f9000a84281ec68abe85ea5ef6563ed621e7a37cb94d79ad105bc92b3a
MD5 f5d6173dbf00fcf841942eaecefdac5d
SHA1 40724498053a61628d61bdeb6cd0996fa1963004
SHA512 713d12af232ea525a0989f822967a3a09ea0329b6bdc7cb4cd71f4742edae1620e59bdb48e6352cb30a394bc137fb5884fef290d5960939f0a0c6b9d8be1b571
SSDEEP 24576:f0Le5ji0hmxhrMl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPji0AzMLNiXicJFFRGNzj3
TLSH
T199859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ef499ae1059424f83cde286964deaa9b4bed0e2bf32127df2a7cfce1de340020
MD5 ca40ed493f46ca266fd5af48156e5cd6
SHA1 1fa7af18aa329d4b97fb20436fd92750e59370ef
SHA512 902357e2aa838b1e9ce8ceef3eb55dbea7105fed09cc5abe8d10a38745ab402f48fb1b9604dfb66303b855b8f00e25c0545d04963a198ca27932fe8fa30a6687
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWj6q8wyu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K/ezSC6vUzPv+HjyoLNiXicJFFRGNzj3
TLSH
T14B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5113af585b600e82076a7a34e2c804bf3d11dfa15a10cbd1f811b39edf9a0ffc
MD5 5d7e3e2cc4e0baf2ba1b955ce75a239d
SHA1 8f0c18c578be79d7bce9382aa702bbabb51bf559
SHA512 aa7184c215905fb68f7560c4fcd0446cdf7e0a68bdab43d01fb5c5d618e8222b6897bb70876e8ae818d66478e229124a69ee05ccccc261cd02962cda4f41ffcd
SSDEEP 24576:6VbqPb88hv/l+BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6VO88hXl+sLNiXicJFFRGNzj3
TLSH
T130559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1cad615f302cf58e35418c67d7d57cd33909f56eaf57732f60b17ce10adce454
MD5 d50f4bfd2dfe9559fb52a2f2b6518979
SHA1 0a4bafa26892c7eb11d6bc6b63c15fda49c078e6
SHA512 dd0b2d1e8a02c5a71220ada916efa3d48bda050d444af9c116f615339c510f85f58f88d47ad38f148011f73646db27f1aa0c4210a647f15df2d715bcfe9d7478
SSDEEP 24576:bG5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
TLSH
T1D15523D3468864B1FBFD0039867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 181f1883671434f2b1982fe15c19e6bff5ceefbab3a7ea476f451cf17b7c11cd
MD5 92f19dcbe7ff59a0c63787b9525cb726
SHA1 2545541a714997afb174a1d4c9b1eb4e1de611d0
SHA512 b3857637070772834cda7bbd74734edbd8b9d636c7eae3463195810e98ec6a7e4f4e5d259d8d7a8e4cbe213a7ed687605a6f3eb64452612a5017c15891f1d712
SSDEEP 24576:xJIU2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJIU2LNiXicJFFRGNzj3
TLSH
T1F475CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e8bd62065b79b3d4cb8b08efc6951fbfaffed2b1515523b3034e32c595ae6807
MD5 2b600f9923244a6e1abea2e308bd9479
SHA1 f92ef1dccabf60cb995b34ac176bc20f090cb997
SHA512 9815b4d160bcff5ed4ac85bbf48a5e3c6a0fd2a7a2f1ede92fd8b3ce4d9d772a310944072d0a12cce9efc330a3f96f64356a1f0715bd44f84053d03a66cdb9e4
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:FQvGAdlCEL8c/WRNw5Cr7wRGpj3
TLSH
T1E8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f51824398f902b68923a6bfcd064175745a43cda01211530d2fe8b94f25278de
MD5 5e0f47f0943d494fef7cacae6ff6db91
SHA1 1b32067b601c66c14dab70f678b6c5ceeb8d03b1
SHA512 be3d678749b940191b156f48fae900184821469dba5d2261f9d1a92cf6d0bfca34d3a201a722dc6ddfad5667ad69152c2948dcce6125aaf79c801b6471732af1
SSDEEP 24576:ffewsAj8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nlj8LNiXicJFFRGNzj3
TLSH
T18A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5da23663b5d1d4f7a44460c73597c6b2e6253b62d2ae81771d0995b5d469abec
MD5 b3d0391811045c1a69fd8b99cad3f948
SHA1 3e67941a46ade12fdd1a7fc133096cb88fcf9957
SHA512 9263c9fb3750c12f2bf3cc0fecd35bf8b0027a77fa6640441b6eedc40a86a404b6480a324301d96c17a87fa7f3028b264d39f036e8df2be0937613742465c90d
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgF9:xUEtQevvqc2W1cpV20I32E9
TLSH
T1CB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fe9d53f50a0f3e10555870b40f6e7644b64483afbebe61a9d6ed63c09fb92d53
MD5 c5a5c4dd8cf8acd2b331fd7c02fd78bd
SHA1 d1e2cb9d2dfb2a550923a1b8ed6e5b671b65d266
SHA512 2b4726a011ef8c78ccdd6725bffad710bac4b16b38b4856ca00e6a2750c4a4da6701eb4aefaadf47607dec3090716d11b870f3edf1e108197c9f7ac9ddd9c825
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zcLNiXicJFFRGNzj3:voq2VjnmH7wRGpj3
TLSH
T1D4D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0bc60f6dd8e60e0af51a2fc64d9cefc729a00abafc1ed6e941713634f04e35a
MD5 e00cd8fd23179d7bd62f6e242becc3c1
SHA1 4302f8fa5455b728e2284dadb8a8bdaef95b3af1
SHA512 6042d2f7453b2bfb880a5df17259a2d7af8e8b4117d2bcae1c28844c1492d9f80e0f65a47837a5a7fdb96e6f52cefc211bdba1698d6376205dfdd544931dff4e
SSDEEP 24576:uAhGL6IFoiwtA5l7S53n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uAM5Foiq53LNiXicJFFRGNzj3
TLSH
T16B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a9020ba68fd999914fb4153c7fbc68119a35bdbb554413add72499c00d2ce15e
MD5 20a5ec01c19951dcd90f956435b4b14a
SHA1 bc2798c3a65a8019e3857df682ae3246ab018215
SHA512 62dde2827061d68460456bbd20a5244d82377eb93777437c54d91770f903781c297227c0c554f0fd2a98436d8841cd069e94c6402d73e8050399e0bb05f9ac50
SSDEEP 24576:dwuROWI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwSOjLNiXicJFFRGNzj3
TLSH
T1FC65F18632941CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1dd992f29948d1d4a6422bf2c071bef4a9ec705360d9d5ffb3a1a539549dc538
MD5 2494a4b4da3ad3b56cd72038060d957e
SHA1 445bc1bbccd57afb90d29f9ee8baa82b6954724e
SHA512 4157059af64d228068f62978fdb96e14a23d4048f01570fc045c1450e6dfe66bf9b5a09635a509eae4b96f7d29ac8d301c505193ca4065684fbd81802c7c12ed
SSDEEP 24576:MZut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vLNiXicJFFRGNzj3
TLSH
T1FB55129622C420F5E6BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2421ad39214c825531cce3af8a9f97f7afc8e45b9f06703b3f40c73ec24517b7
MD5 f41009a73dd247106e634ec70b40126f
SHA1 322d473c0e4680a5c42ae26578cab86add951e22
SHA512 bcb67ca31d85e1dbcb97c962e1b3640cd2b75cdbc4af2eb08056fe4309e0fe574e963baca77bc98f3e2e9cf260c23ff262609e8ccbbf97cf5d9d4f8c5caa7b5a
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3C7wRGpj3:vQyiKanX+PNWF9
TLSH
T1D8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0371d1adb992c0327d7995606bf49a0719c11e0681355a9af1cdb188a85cb99b
MD5 a1254a36941ca7d324819d4ad949fa82
SHA1 2e5d1462b0555a77ce98c6c6cad9fc22c4493db9
SHA512 ab2fe8f7f8958c4ef02525d18a23b437dedf39c0ed1355d4fd2c55c9ec78f6ec2c43dbecb22a64e51f6c3c497eb8db43f10d2513daa4ad20cfee061728916d02
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3C7wRGpj3:FQyiKanX+PNWF9
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d6cc74b00f2914f6d2aa69bbe8438453f8c8ab2b42d696293fc5291fb24e3b90
MD5 d45c1d4718e493f46d5854e72f7484f8
SHA1 303c5c9027d36783d663e10ee43da84c20f2e727
SHA512 c137fb527c56e4c17c8830744c074ce2284d0d97c32b4840b99ef446e76229d21a1f95f1adf76081d1328b2a1a6e1212654058a63552ec167099e445f57d3b6e
SSDEEP 49152:p68Qg55nhkeWu7PNU3/MLNiXicJFFRGNzj3:3thTRc/M7wRGpj3
TLSH
T1D0B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 12539041b38b437d375070483b67f0ecc1d8bc31abe79444a85434a2f8115875
MD5 8810d4e1804c8eeaaea870fffc5a64f1
SHA1 37322837d56c62434cd6eae3c0b943e83b4872df
SHA512 0823bf1b916d75f12ef45e1623be2f2ceb6cf9b553f208b1b6d11810e3a927f7f0d61e1c0b54bc78e59db26649d822b75fa5392f31293d673675c31e9f4594f9
SSDEEP 98304:/y5112gYy5azzVvU69nLKnhZ57wRGpj3:yLIHRWhDF9
TLSH
T166167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 25f01a63ec8edc532b0d0089abea6f75e68350afcbae0ddc3504fde03baba251
MD5 246793ba42a8030659f0a2c4a068bf3e
SHA1 a248576944bbe253df1b50ee2efc7f61581bbab7
SHA512 f20d58e79b7331f03b3c3a96aa0a894aa45d9888cf3ac7217e896cff988076566aab538700614fb582003a8ddebcd74fd0929c580b9a3a93656882ec3adea619
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glKLNiXicJFFRGNzj3:uu6JmIxd2dK7wRGpj3
TLSH
T134D59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2ff81c196cdf8bd0d9ae776fe59dfac1ac09ee807bf48aaa6742b06c428b7a1
MD5 f63238665925220bf908c916de9376b1
SHA1 63f6733031aabfd348315d8a2682f2470e4de229
SHA512 2606f51d49324a5669c26396575057fa3bc37bb571075c99dfe52967054ea4cfb01b9f1ef522c87e88daf3a35a6d209f68629184f7083d1d7d9a017f8e27b322
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xWLNiXicJFFRGNzj3:DmifPqRH7wRGpj3
TLSH
T1B1B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b1da98fa784f521479c0a5dd94c5810dc3e97543f499273845256687821057e
MD5 1e278cb070edeb875293db2a5b92389a
SHA1 89c43663a1820cdacb583f19d9ac3abbcc092da8
SHA512 d3c46eda654a60fc0e1e95aff2c5bb8037d34ed980c035ab0259c9652b26650c0f16fbb809c95d1f0bb95fef9f49977e4e0b02d42a65892c2b2626bf4f5cf624
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqtLNiXicJFFRGNzj3:G5dKqi61t7wRGpj3
TLSH
T160C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cb96845920a97acadb5517e21d9ea4fab3aeb631eb4278669e264a02fa75e770
MD5 5bedaf160af21465d21eeb0ceda9a01b
SHA1 968453bfd30d3b4710cdff8e28fc34a85a1fc523
SHA512 5f632309269eb4dd35eb464a14edcd3395fb955aaa1125fa4d0f75c7f66ab720aef0ae4f10892fe3d5e9fa32abf2f29d10bf593f041b341d90babc2804c8cbf2
SSDEEP 49152:LhtSn8EApI0figjgiDn0AP5w6LNiXicJFFRGNzj3:KX2iWphD7wRGpj3
TLSH
T18995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ab131a6e21c1de5019b5db44f974838915dd6298d2214c336c4871089cc4ee7c
MD5 aa8fdb8ba2ac6d09ce946cdf18b4923a
SHA1 004032616b58854a866867972dea869f365f1bc6
SHA512 1e2e6eea536be8fa714c15e7027246fca9e48d6c55d4017314b82294e78d6e90ea0024a12f7f7827f717a6b6ca7e5bb10b804dd8393d0f2deafbbff55f594ce6
SSDEEP 12288:a9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ah/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D3558955B1E6FC0039C6794428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 78130945250be239b26eaa1c02640b7980f8844b0f9b211ab8a592ca3cc9cf2b
MD5 0e480d1778ae9ef498e02d1ddce60024
SHA1 5f704beadd3f65bb3ccda224b261a31490b7a61c
SHA512 3a60760feb01fd86da85085886b156fcd583ca906945cb8ac47d442ddd3dfc4685a03f2a8265c17445056f679c0ec2622efe1475a7d3dd081b4b992f537a2feb
SSDEEP 12288:m2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D3548955B1EABC003986795428F5881E2DEB5619E3E3483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 08bcfdf7709916aad9dd9f7b0749ccd10d8dfacf7af3c3fbfbdfc5e20ddfea15
MD5 a22e5bdae7f6a1218051369fcb322a98
SHA1 e3639604692f5520f489bf5de02cae295378dfb9
SHA512 c92931c4168e08ee9f21858ca56bb961bee98f78b65c27454267fe61db38366ec28dc8cd92fc007ab3dabd4bce7f215f8f4461913cdd16003ce7d8331042b740
SSDEEP 12288:S0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Se/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1955523D2558955B1E6FC0039C67A4428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5269e0a1b10d561f892a7d72ad7220b0b55baed7bb164168999f4d2b73420d36
MD5 f2d66d9db4b8830ec79b3ca164c1a86c
SHA1 a749a3f99d219abbd0944b2270b0921b90ee9f4d
SHA512 a434f7df831f2d5416d5814bc5c274f3b6869cdf5a41bc7e871c2f6852ef12757f766a2b3ee7d4009fa195e116444eace897c87c349be521d102601d236f24e0
SSDEEP 12288:QVziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D552392168901F1EAFD8039CA764424F2A47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a35c7840dc05db61eb07fa926024060d458e9e27e1dff6da1a88b91f3cebdf6d
MD5 3503e2ca4ef575a8697c4f8c5e906625
SHA1 4798f9f686cdade4ebfa595b8e4662bb7a63d026
SHA512 07bac723c1c9ae34fbcf0c4c2545a61eb7a262c3669d01ed189ee87ad611fc432be22ff2d6179bc32ddb4d4f3a520eaff79369fdfd7ef034c3b295032cee336e
SSDEEP 12288:6riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D45523D3558955B1E6FC0039C67A4428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9fd605e312f2706f69172c6f60869c84b90f6c8166a82d90572125dd66e7f115
MD5 8ef89cc48e008e1b69bac15bd89cd1a6
SHA1 944123645f4b0268acea47addb826b021271de30
SHA512 8da48fe1d69e8a82b8b86d04f8deb67bee11f249223d998c68e280d9eacb29b529a5e36af08b47867a0357da21e57a2b0361951abf0206407eb1489f5a99937a
SSDEEP 12288:MiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3558955B1EABC0039C6754428F5882E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ac9e95d82f75b8f84c67417acb1b0c37403452848df8be41752075cb8138cc67
MD5 d39a27a908c1f90ef14f08e24e58f60c
SHA1 78945c8be5a551b8541d231601af21924785f341
SHA512 de2a32d45180ba00e51923f1915d19edb265429c733c19a7d5966fc53d728957ac7d8d73ddd8f912c34a9d6dbda3b9deae846c3ebcabf65100bfd2712652c957
SSDEEP 12288:2uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3548955B1E7BC003986794428F5882E2DEB5649E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3513d78b70b2d1b89ea6e383a26fc180c75663cf31c70e9f54ef3b3a612b527d
MD5 fc5612fcef7327443970cb24e80683e1
SHA1 5f53d0cf5ee7d8b7155cc1574647cb7d6336f30e
SHA512 9165e4b9dabc4c9b48db251a560af3815c01de34344a0ae0cb177681c0028abbf75a63fc121bc09e3ac8c99256778884553e85479abf907eb4e8b7f342cf1798
SSDEEP 24576:XZM3zFVSOg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XZM3zfULNiXicJFFRGNzj3
TLSH
T15D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 608228b3fd76b35e136adf197b25b724dfb6708a68665b026e9b6a90c3b126f3
MD5 afa386eb7cb41e4125c534989075fd72
SHA1 bfbeb2d365b948490a56b68e07598b1c9a13468b
SHA512 61ecc9fdb9de38b4c4c812b5391d9214274cbd66db185a3c46a41605c63cba7e9bc6dee0589efd25ee1907150c287f93ae514dca96d928cb4c39199b5318dc90
SSDEEP 12288:ERiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ed/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3558955B1EAFC003986794428F5881E2DEB5619E3E2483D1EA23CFEBCF3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0c7ba943bf70e0aa2920d9585b1b22bb442c7b8684b418bc81d36999498d138d
MD5 9667dc536c74e09d44417a1941b25a21
SHA1 902ddc88146a90478e40b000116a93088161f3dc
SHA512 e7012b89420a26f6031d490e64a51cebced5242b53d3c52058a7498e8b2f09d76da036e8a912075e575c048dd111914317b301b25706d450b47f5351debb99a0
SSDEEP 12288:2liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EABC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 63109dce52a3c3b9cdff862bdb5d798addd9c9122a442f78dc79a623925acda2
MD5 ce623971cc92b83a5e97f97732a6e8e9
SHA1 cd34a1f6d60e1c1fae86cd0d27795121c687ed07
SHA512 a4afecc6b8ba6d2efcd2032c2e5c8eec229af2f5d99ebfe92650dfec4e2272ce99f4a47b7cf3b39ea5235b0c38a894a989acc08add173b48204f673abb65e435
SSDEEP 24576:Rzys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RDLNiXicJFFRGNzj3
TLSH
T18D650247629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6dd09735753c882c02813e295f2eb40c25dd631994cfee8432c1b180dd5f148a
MD5 d0a6618a9d11503ffb8b460257fb3516
SHA1 a0e9092659d6445f90c58d9489f6df2f668dd2c6
SHA512 21beed3b722cdd09b3497114751b3ace7004b02d8276e5667f8b52e00a0d5df922d738cedfb4e4a01f2ea8151b8550b88a19f04be6ce66527d150578ced6eb4c
SSDEEP 12288:VRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1215523D3548955B1EAFC003986794428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fbe075631b2abaf78e9ac50402baf788e1dd7ce49f4d1cfbaed38e9304e09d1c
MD5 882b7bc0faf37a8e1d443e2a0d7156e8
SHA1 94bcccb67891594d89f95bfdfc437272541fd271
SHA512 9b9b73b82527058b2214a387bd68327dd2ac173befdaac98fffb184ac7959fa9299708d7a4c8899951da49dd34957d88298d83cafef29725c398af1db667fe92
SSDEEP 12288:FRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1EAFC003986794428F5881E2DEB5659E3E2483D1EA23CFEBCF3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7ded5468254a87b20b308ca018150937ebddcb1ca7ff079b4ec1dce62161b77b
MD5 ab4c506b49a46a2c1b8835943cb6b46a
SHA1 9e2b2f2855448e6d33952fcb04fb883c079aa331
SHA512 41e649c9591789e22ff787cdb70654cf4325ed4b306a18665f086763f16cc8921b12591cdefb6d82471afc426e5495440c70147a645be0b3145044ac83ccde28
SSDEEP 24576:wzys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wDLNiXicJFFRGNzj3
TLSH
T1E9650247629530F9E17A4139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3e3b595a58b329c19d273ea3d8a68b71bcb63c8697febfecd09e1648e559dae1
MD5 32f9a06def08332a4fac60d474a38db2
SHA1 2e2c0fa59abbf16a6e30d9abb8496abc7b6806a3
SHA512 932bbb0b2e10074bac46388b2656c1a46b5e49843ba8b03b9ee122f960f11c2073632f248a2b9283e8639d5b33548a6296750b5e32bd9b58a60df3f36d893c2b
SSDEEP 24576:lT8aLl3z0zDu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lT7Llj7LNiXicJFFRGNzj3
TLSH
T1E57502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e58b635f609303186b1b35da943b703d07d571d525b31a2d87f9bfd6fdce041c
MD5 6a581dce50d7ecd9e4580e4e56555e11
SHA1 44c5bb2d27bff18eca2bb2f696fa542cfe4ae28d
SHA512 05d3b7a124c1410e47906042d93e9c7ea3a3b67cd9b2323ba9a1ef9a42eaf7a11dd84e28ccdcaa6a08c29a609b375c72f02975574b54e3301a9d40c23eff9905
SSDEEP 24576:13rd9CHKy7GZi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vrd9CHKyaULNiXicJFFRGNzj3
TLSH
T19585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 aa69d0c932f289c84003923854d44feaaedb678eb6f7027fa4c1ed19f475725e
MD5 2c61239c6f97f7c6c74efa8ff50b1581
SHA1 13f136577f1aac0e6fd03182dd6515dfb7dce9f2
SHA512 3fa83fca88fa6ef3783a1447dfe18ae8a67ff347228f53efb8250cf9274f38c1fb521a47156a79486b00dd0abd06061246a0cf77838965e74304ba5b943f9cb4
SSDEEP 12288:AUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D3548955B1E6FC0039C67A4428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c7866e5df4c730c495c473930f1c97a8e03b06ffdf8f3bfe9e54ded557ce984b
MD5 0af578c8285a18dc977eb48706b09fc4
SHA1 4e766784be5572d1fa8881a2484fd4299c2dd0f2
SHA512 9a862d822ae048ff26e56df627bfb89ed2a08019e7396326152b2518eed04cf4f525288e5b40d8ec0c01c84f2793758d41db874e607f4102faa593b7d41cae55
SSDEEP 12288:AKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C5523D2558955B1F6BC003A867A4428F5881E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 48ce03ae9a3becbc064ba1d0497bb72e742beae4b161b7c9e83c6138d4f3c401
MD5 541940470f1f962c8bedd9b6d1aeef1f
SHA1 42639a3c90a3f3cfd12c0b480b25fe6a21e1dce0
SHA512 0f4a95b97242cad51604e0e95b6c5d59accf4bd0a019a7754eb537406500b93efbb9e1985081506e9e4f55af728604e705ee8ba4aa1980a3e719c63b03d155d6
SSDEEP 12288:bHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3548955B1E6FC0039C6794428F5882E2DEB5659E3E2483D1EA23CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7c93ed422cd63a57da5c23005c70d25d23ec8b15e2e2f8e337c2f781e9b97df2
MD5 fe467504d8cef1db1a64a72acca2decb
SHA1 8e26de0ac88106025a05b17e16d1239df1adcd50
SHA512 8836523466646c30e8de4e3f0ab6ac1b197a1cf16cfc8dc8b0124304e1da6d7232656676f9e4b9bee44b5db6683dae99d9f2cff213e8fe1d276a6a32889c0cf1
SSDEEP 12288:8RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3548955B1EBFC003986794428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fd373840cebf7a227e7166af9fbcc5e8efba60033fc3eb3a7a2a8c00f2d285a4
MD5 81040406438b00334982f8354b01a7fe
SHA1 5643ebefb4e246880ec46f04ebb0aea4854f3079
SHA512 8c90095809c36c825396ffdc0d10ca9946691f692504500252b96d32a9dac8b3323a0931651867443911db80186776b179ee9a740483e08ddff7c7e5f6389018
SSDEEP 12288:eUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 895abacef48e2da718616e2502a9de1bf670b2581ec79e7e7946e2c71b3af715
MD5 808f209943eb16c8e3273deecc339ecc
SHA1 f7da4aabb567259982349850702a7d6417ef969f
SHA512 3bc0d24e8745914ac3e155f18cfab4708c2c2faf7e622681e90aed59fad069fe9a00796306f15b802aade8d1cf8e4ee00e67eb983e720ab1b3262a85dd35fcc8
SSDEEP 12288:wpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D2548955B1E6BC003AC6794428F5881E2DEB5659E3E3483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4a3e77c199debc21c31d7eb493e04571164ec161e38872cf9526c499b70b8c87
MD5 62966096dda3ca690a59fcbd52614000
SHA1 95a96e75cd3d5b6b445a08d82a0dd6acc5ca61c3
SHA512 a86a507737ced51e6bdc0a8acc266d2cb283058fa154b1013c26af86b7e7750ab8ab0803ffae930a467711e5dabf2292441869bc3da96ad327059cc453af56f9
SSDEEP 12288:qriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D2548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e73e1019e7bce67996e6ce3fc30ec755e53d25efa115f95d85ac2919dd8e1d2f
MD5 c83474ccb6a3317349ebbe1c46d6528f
SHA1 5514ed3293adc626759b069956693c3062965b87
SHA512 1803ae5f87dbe768b0d2f90e18bd3f7aeea369a7ce81fb9ca70c88dda11301541852fb326aa54ccf402c7f2f05c6750d85cceae73b09a3d443fc9c50cbf35abc
SSDEEP 24576:Qfwvzk9RX6wkyAIZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DMnYIZLNiXicJFFRGNzj3
TLSH
T19385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dd54786eae7f2dc0be578dafd2b394b0845147f098f0593c3ebe79452e9627e9
MD5 60416a8c3e5a5280c51b27f8cd9b9d67
SHA1 854c71baf245620f6c388a60aef32c19eddc8526
SHA512 3719815241fa078c4a7e7a2c4b28d17cf0a3973735a81efbc752d1580b753691fb3b441c84e4f2751cc396989a1fdd76462272f4c5c738701d917348bd7f1c9e
SSDEEP 49152:hYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aLNiXicJFFRGN:4ySzPi7wRGpj3
TLSH
T1E8066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6eed3b3876d7900b4f7370e35d9f569a68b79526b16b8593e76987c62a76fa2
MD5 a82d68929437cfefd1d5a8e0026612d1
SHA1 8c2a5c8eb0c6f6b778cd60d483d8251abf3ec59b
SHA512 411aa0db216cbf01afb63d17b689cec2fbf0a64a4a5893477e61c3d26a66634e06064145eb9fbbed7ee59e5a69a12ae1f279a0a1f5d9c5dd1c220aadf51a6f19
SSDEEP 24576:L47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L47JUQjqirIhCnDHUPfF/KLNiXicJFFS
TLSH
T11165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 de113ad783e62c83eced9232e6dd8d57993599110d16923e126edc49ac433b4d
MD5 daeb9e979e010622311d2b7baa3bb2bb
SHA1 618dfa4f42468ed86f0ca401e59145ba644d3b45
SHA512 ed999e1e205e2516af5136286bddd2ded2da43ef6aaa9eb4edbc2f3f97ff5051435ea24039bb712688f9002e47d571af95d145ed3ef95b6254e033d69103919f
SSDEEP 12288:qpsfBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11965F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1617139543d3f6b64038b278f895513b910d0f3998e3170a08eb0800050c063b
MD5 e180ce3b1227073188a88367586bcb65
SHA1 ec3303210ca7f468f099768a21ce28314dc7e7d1
SHA512 ac824471098b782e899959e83aeaf0140cd9b6709e1e0ec2931ba04ebd630b983d90d3828d3dc2f5f0d062a4b6db7840e9798e0b3970be676e8e76d8d98e8dab
SSDEEP 12288:ndzLEiTgDFH33FFyywyX0w+kuWQ+saum:nOiTuH33zyyFX0wxuWQ
TLSH
T1673517117666CB4FC66940321E33C6CCAB707D11EE05AB0772C9877FC576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 75cd4457c09710f9d505921d52b37f613db7c65a2b95c07082f488b41805c67b
MD5 218b726ad629284f96ae5f80720136a2
SHA1 d3fb6b4e86e7d4234b266c178eff048c9bc753aa
SHA512 7d51b63de5793376daf25ab5cdc9a5570ec5ac092904e7810dff1e4a69d01c69b6927c6d3b0fdd405e1f03d5dc2277fae0b9ed87b4c8216350d2ff4569f68264
SSDEEP 24576:fWBis7sHsj94cvbe/JXqH5IYaonL56hZqwXms9y:fWvRwJy
TLSH
T14255E8816137A78FD5BB6032072A5B4CBB64EC06B7055F66B3C5043AD82A756B0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fc927c1df9c9056e64d5aa74291ca0cbed6847ce7bc5efda3de96b2b2c0719ab
MD5 0caf692338668a9ad21ff1543ad888c3
SHA1 cd9562476cdec0dfcafbf0cda697e9bfb5c813b5
SHA512 5c5993840d4e07773bcd15bf588e4a247a50b65e6da0596b0e6eb36e4a6b9168159ba830c7f010e809413ded8af0578661a0d41f52ab5ffa4c654da9887a647d
SSDEEP 12288:CF7ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E552393568959B1FAFD0039857A8434B54C7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 73f433587fd8f4f86581b167a880d19c802f1e156a1a4e4d78d8815053eef9a3
MD5 ed9314b8c497b505d18a57aaef895968
SHA1 e81923a50bdbb7ea038dd73a2b522712e1372255
SHA512 b00406e5d11611ae4d901a91d424bdb4b3db68ef9922e1da73b0965f3ee8955166158dc06d69ec5f300b0f332b0e1b53229dfa7ab847f94be5e031f62974fbcd
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bY7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Igb4mBIBhGFQLNiXicJFFRGNzj3
TLSH
T1BA65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cfc929cf91904ed16f1902fbbc80fc0ee56508ddf6e15defbc87c76d432397a4
MD5 4df0108fc3e21088194f9810f4d28d8a
SHA1 8fbafaf216b02e0ec05f77e72d72eaa96eafac5f
SHA512 bcd9c5d72c1a37f012ca283d90297b68129bf9c74b7b31d634e9569b86003c6a8346cadde0f4d433c96e54bb30a76c90e944099e5998c7cea1ed32ce125f368d
SSDEEP 24576:YG88u8FpJqH1vzria7/mg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b7ZFPqVya7/TLNiXicJFFRGNzj3
TLSH
T17885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c14c797b4c8f6f2d8e33f5e85a15d7eb6fd31898f3d671e917704e94637d8412
MD5 2c40df8d9aa9c142180a2d2121355505
SHA1 ee4d161f4415acd43872ae22078487f5c4df076a
SHA512 e9a5f7367805c5d3c35dfee4b124fd36ca4e515cf23dc1dda3b9dcf98ae3fef86e8fa8720ec9cc8379b218f3d4d0a3d47a5196de5a29f502d32dd20acad465e7
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkLNiXicJFFRGNzj3:RG05lO43bR7wRGpj3
TLSH
T1A4D5C06E62EC11F5D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4b824425807b51315ec8f84e499e76b65bc51202fb23a56fedd529491904eb19
MD5 1a374c704e70f219868e6cb29973ca28
SHA1 02a1a6b36610c311f6230da72054f4847a845436
SHA512 d90ce5be9181e432445a616b9f9956616c6f75477960f2b93b486bc10ac6030e95607178fda56a9e2b4b62895aec364b66b3a37afcc8c340c69aa584ba0534dd
SSDEEP 24576:yfa5POZ3dpyWVM50JicR2hG0lasx2+47eidna/TwSfVcYG3K/cJHlnFR+IGNe8jg:aa5POZ3lJt2pasx2+mMLNiXicJFFRGNf
TLSH
T10B65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9d293fd647c552976dac4610f2fe50d79ff36b404d726930a2f502c0d371066f
MD5 09f8804440d23db09822af638b2b2ba7
SHA1 ef54e2c44bce48b0ac98b5ea4538f6e4645c27ad
SHA512 9186545c0cd2296670635378e978fe4ee53d67f4755bae891c2df3817aa9aa03e3b648926d21d7cdb6ae2df26b065c7b1cf9603ef3ca22bc56d4b4e4e9c138e5
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fko/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CNc/zEOVHFzLNiXicJFFRGNzj3
TLSH
T1BA858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 017631c4f64890b6787079c6427489aed446b75cb49c2f549fb53f3a9752c07c
MD5 41b1cfc5e9e30fd6fa996d3144c6c6fa
SHA1 15d93f103a2739a0ea3e579c39b3c1cdac8f5d90
SHA512 c9cb6c8c4f3405e1376fedec9bf00a1026e720218104acabe551eb0182500b8f024d69e44f31dfec591442a956c5ed39d8720846c1a175f6ae572290a997edfe
SSDEEP 24576:0zkNvNnaFeYhJNtmZBmm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0zMwBtOmmLNiXicJFFRGNzj3
TLSH
T15855AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 50ed25452eba6fd0c0454fa865aa97f157ae0a6b2bc88e97c5212b496660c71d
MD5 df1346c02745a39832c76164802310c0
SHA1 4673316f31fff7780fc440ae21bf2575f20166da
SHA512 bc8d06bd874066babe19d044e983fdfaf0b50848f7311ead107ef3c1d1c195b1ea10618d169db6a46da26cf194fb4f01df60ebe8caf5bbfb0a3c753a17eae1f4
SSDEEP 24576:UPUr+NQU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UJQULNiXicJFFRGNzj3
TLSH
T1DC65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 30eddc3caae30bc7cd38a0f3ecafcbfc214a0a9fd24f71ac1934f79b3d4bc5d3
MD5 38190ff30b1e13cf2e1c48ec546f64b0
SHA1 aeb61ae32a87acef6b9a12697060b4b7c243d88e
SHA512 bbd2f6b84e7d2dada7018e6677c5b255734328ea595638593a79d9dcb8a660ad80b056acefb7417f546d48c993fc49110a1126788900b979940004507dab837a
SSDEEP 24576:/D3FHshBIYQgAB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/DVHeBIAABLNiXicJFFRGNzj3
TLSH
T1FA75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2528-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2528-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2528-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2528-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2572-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2572-280-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2572-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2572-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2576-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2576-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2576-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2576-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2576-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3540-248-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3540-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3540-50-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3540-52-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3640-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3640-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3640-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3640-128-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3640-134-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4248-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4248-115-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4248-121-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4248-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4448-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4448-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4448-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4448-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4448-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4708-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4708-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4708-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4708-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4708-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4792-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4792-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4792-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-0-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/5132-77-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/5132-1-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/5132-8-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/5132-6-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/5620-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5620-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5620-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5620-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5620-46-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5620-58-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5708-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5708-295-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5708-79-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5708-84-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download