4617455e03226cdb6abac7b97576d9dc86d6c3199a5367a3b54145e4b24b064e

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260930-dfswcssapb
SHA256 4617455e03226cdb6abac7b97576d9dc86d6c3199a5367a3b54145e4b24b064e
MD5 39aa7a8ac665e65d9d7cf0c9483e827f
SHA1 5cc81f89d1b87a3bb7e8e9eaec66e631fa306210
SHA512 6034d550fae72a110ff81134dd94cb444c13bfbbab84efd8b0b9b2161a556c5a85b0d4aa41b8916db78875b45f5441730bcd88edcaaf70f81f2657216bd4dbf7
SSDEEP 24576:XVGGTWBZNsqjnhMgeiCl7G0nehbGZpbD:lGyWBZxDmg27RnWGj
TLSH
T11855012172C080B7D973193046B4EA71683EFE315F6049DB73952B6E9EB06D18E38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3308	elevation_service.exe
2860	elevation_service.exe
2900	maintenanceservice.exe
3460	OSE.EXE
1096	PerceptionSimulationService.exe
1376	perfhost.exe
5176	ReFsDedupSvc.exe
244	SensorDataService.exe
1296	ssh-agent.exe
4572	AgentService.exe
4964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\97e8bdc8227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000885fe1788750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d6588778750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000260a0f798750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	5176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5176	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4572	AgentService.exe
Token: 33	4964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4964	SearchIndexer.exe
Token: SeDebugPrivilege	1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1600	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3308	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 5980	4964	SearchIndexer.exe	100
PID 4964 wrote to memory of 2504	4964	SearchIndexer.exe	101
PID 4964 wrote to memory of 2884	4964	SearchIndexer.exe	102
PID 4964 wrote to memory of 4504	4964	SearchIndexer.exe	103
PID 4964 wrote to memory of 6096	4964	SearchIndexer.exe	107
PID 4964 wrote to memory of 3836	4964	SearchIndexer.exe	108
PID 4964 wrote to memory of 4456	4964	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5176

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1296

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3044 3040 824 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3028 3024 824 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3044 3040 824 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3028 3024 824 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 17689273c3abe68fac074217828d6586a20ace2a141a6950d6e926673b07f146
MD5 e7ce86174fc878704a6f8972998ebff5
SHA1 dbeb7e263e701ead70aa2fdb93584ebe36dc1e5d
SHA512 82e0db273b653a6ad93ce5d20775b8d85d943380e4f6305acb5bea2348e40fd0a3eb49ffa40ab1cfbdf8cea06e116a52bb6becfa928e4913f40def5699fdd21d
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnpDmg27RnWGj:h3q6HjBWD527BWG
TLSH
T1C0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cc2c838811f6bad8fa4cab4f31b75c19cef405b948273b617c52b9ca38b46833
MD5 f3619a9f3f093d0eb8192161ee253b88
SHA1 63e8dce74a411c610bc63b2f4830549066909a38
SHA512 29c42f63a366eb0d175200032d5988e7aadcf924a2d0f1033f9bda37371636d9085e5de07a89094db30f6cb021a39b59f3456c77222e462d66f72421c2cbd2de
SSDEEP 24576:QXYfDtczA2sqjnhMgeiCl7G0nehbGZpbD:ntc7Dmg27RnWGj
TLSH
T13A650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 41b87e6feaada567e3b47faf8e49087d7d16de65f4ebbd94b220330888910e73
MD5 71f7988bb45932fdd156273a9026190f
SHA1 b66d259531694021d905b7f847108db4d6a80008
SHA512 8b918ae7406f3f13d43f2efc94c72a831a15064ff40e701f13155e0e3abc590f198ec14aa82cc421ac51c22c79d5544fc605f82928bf14374c0ea918eaf49913
SSDEEP 24576:q0Le5ji0hmxirMNsqjnhMgeiCl7G0nehbGZpbD:qPji0AcADmg27RnWGj
TLSH
T15A859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f57b4733ae343f01048906bead7c7984ff8a79e817c66ae0c73eaebb9660ce1c
MD5 a980b0c0a15ee1b9b11b191decab5bee
SHA1 42b2da24112ee33ca154ac8f6af4d6a6d6c1bc60
SHA512 e6a5b2b601bd443c9e32fb87cc9c6fe992b23bbebbeddf65ab4bd4f6b93df218143c4fccd1b498c0e79e073bba262ccd5c3d81cd8ffd1c4c51d1a3aa6b27b97e
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyu3sqjnhMgeiCl7G0nehbGZpbD:A/ezSC6vUzPvxHjy0Dmg27RnWGj
TLSH
T1DE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c01bea817e8ce1755d3408da7e9e9448484a8833ab69ac96ad67ecc8c4813bd0
MD5 14f10b76fbd0c5076b67775e3a1c8cf5
SHA1 15458ead4d61149046c4e6401e1a30a590a6735c
SHA512 96142baa2f0235c2c39a176a43b2c04940284f7c328ad6ec63e7e5087215acc8474a3c64e766ceb2ea0e09bdd92cfe2238a80d390b38f63adc4997fbd753c848
SSDEEP 24576:LVbqPb88hv/l+6isqjnhMgeiCl7G0nehbGZpbD:LVO88hXl+1Dmg27RnWGj
TLSH
T1B7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 190e23d1373fdc52cf4c18e5d90480ef297727e3a027ca3d41676f68cd7240e5
MD5 96cc53728cd79a87f461431da5af3a87
SHA1 776a030d0d63b2041d50927ec95a2a3588bc665a
SHA512 6dd96a315d649dfdeac5e4f8aaff3016f61753a114fcedfaba102221f19c9832a89c24ab3da8d04bfe4fb563020d7470cb24dde57f58257e53f5215996684039
SSDEEP 12288:9RpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9RpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BF864C50CAEB7608B5C3E9F11EAC137E56982008436A637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 08b6ed456c454b450900c2428a853e38c31225586127ff1d7be9571b0dfd5aec
MD5 37ac1ef6d22cdbbfc085791cb8ed120f
SHA1 7e17cdcce81a88c600dbd73ac4182a6f02cf8d6f
SHA512 e604241808ab94bc2f9b8838989e6263c16335c985fcdee224e7f8ac0121eb428e8b3769633e7a41cbf6669a9dc1a87f3532cc2d7776c226ecb87ec9f42bc87f
SSDEEP 12288:KeBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:KJIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 da337732911e0de6a22664e64322b5f0e1ad85475d27d404eea3cf908fbaa54c
MD5 6cd7778e2499f15672888f743e4614e6
SHA1 3c3e6e12021d7feb18d9e63dd401a03a024b290b
SHA512 a09a439ec5233df81ec3d43ed4637f6010b013da0bedd6b172d46e287f64d2e8fcc9991ddd0216d682070ec9638ed7b0baf4fde3f1f7f48e01ad5b30cd94469f
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:cQvGAdlCEL8c/yRNw5CbD527BWG
TLSH
T1C8266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3a5f2e47aa4d9f0ea6a6d2e7e02a6dc6f9e850f4f1aa84b46862ae6ba2c88392
MD5 22b54617e91cbb2af96ae46cf1dd5333
SHA1 860fc3fccd8214fe1e6a13f9aa5ef3940687f484
SHA512 b5cf3217e07c53627809df8a3d8b2c6ee58c45a3c09c5d3da66ee08215491e68b62c90b893d372cf3c4b7c10c3edebda0ee5ff16907139eb10750116f1f7beef
SSDEEP 12288:7AwSfxL/2Dc34DLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:kdewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f05c646cb45f71c00eb4933407e53365519e5ddb0af1e6d4909a7dff147a2871
MD5 56c08442b6560022878f7e58024ddd7a
SHA1 2ac85c392c9f56335603ce140666fcaf40896a06
SHA512 4b13eef7575e556fe0aeba7cc213b9340b312650cd4c0c5710cbba7e2deb2fe1eabae67b22fcab875d82325126223482026fc814b9116cfe5bb7e77ec3bb33eb
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoVQBWG:dUEtQevvqc2W1cpV2EI32vB
TLSH
T103474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b1f46a4777ff86485ff88cd878c332f0a95451b775ccab2eed4975c934cacbdf
MD5 98d086485d967f33d34e56f2c2321fa9
SHA1 338264e5a534f4d4b285a15247ddcd1874ec42e4
SHA512 5b64e4134f0a0ad935a09d77f8a7178cb069b1f206e69d03665f40d46380dc278c47933c84388fc9e0512591e0cc382fc51a94364902f1144a35d8be9162cd0a
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zwDmg27RnWGj:coqtVjnmfD527BWG
TLSH
T143D58D1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c2ae96af7cfc212fb45c2ef2b1fdcbfa66d64dd6a3e52a32b4a165c407314882
MD5 fd09c0b5805b2cee45bee2c3c27e6c60
SHA1 40703bc1f3badc7c353db9f0893222f8caaa891f
SHA512 551468b8787454086066ca383fb36b5632409353b0ec87914adba2fa231de2348e814f0be158c8c096f5e8021c6678528929b6ae18f160a4934cbbfb491a07be
SSDEEP 24576:NAhGLJIFoiwtA5l7S53LsqjnhMgeiCl7G0nehbGZpbD:NAMyFoiq5vDmg27RnWGj
TLSH
T187359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 16d7a2ea9c12b44efe13a2a4883d82e1ffd951322d263bdd0c5ded8757d7c72b
MD5 33c8a8538f8be68c515c128baf9bde35
SHA1 21253695a43625d74ccdb19e484fa944ad743e26
SHA512 7b223206c32284e4d68e7ba976de4832b2cbbe17dba737fdc403acb1c73e06473c37d503d4cfe86bcc446ece5416ebd0cc9b7d87a3a291c70262afaa02258827
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:4wuoOWosqjnhMgeiCl7G0nehbGZpbD
TLSH
T13265F14A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 86b00db39aac6ae15535cdd57de4d8d269d06055d11cda0b089559e687b61759
MD5 10bb3eead9a28ef0776c8414275c736d
SHA1 e27a306497528a50417f3eca47a046ccb4577d02
SHA512 34360633961ff23eb7f480ac492e5d07435a33e098a99e3324d35bdee71aa9813b4f40904b0ae8d8a3e2d50c6d263bfc5d1e79a4f6b022b4c124b0e77c769d23
SSDEEP 12288:ABZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+ZuFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1575512AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4c1d4bf51d301cf01ff312b6929bdeb6c07e4c127b4771d8d714034ae0afbfa
MD5 b280b83c73b161988973001c2220a00a
SHA1 a0816a7db5a08b5ec7bc7b9a073136b0eabb2282
SHA512 81f0fff46e9ba7323d1aec3bf03a7ef7254fa2dc0012a8d48b5c3a0262fdd0302994d4b9a2d9be26d5f8aed9d0ffdbb7b66f17416fd3f4356a99f2085f18aed8
SSDEEP 98304:8QRQyi36YOcPQLvw2gAf+PN3iD527BWG:jQyiKayX+PNSVQBWG
TLSH
T1CA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 adbac933e6fc6f42b5ad72da152dc64272665bd14b0a7dd2b65e9cbedc4e2152
MD5 17c72048da0dcc4ecde4bf5425e5d5c9
SHA1 56695530a6a6e48a6e48fe0d0e667e62217350ae
SHA512 a189af8cb08b778e86392a2721f1dd225960b7a0abce56452a6a7b9c2b4c29f9e9753dac132c08cf62657ed3d8ccc04a0f458b19d99f5f563606eb1d974266ac
SSDEEP 98304:SQRQyi36YOcPQLvw2gAf+PN3iD527BWG:JQyiKayX+PNSVQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 43023f6f4093631ccb6ba7fe364a4746ccb5caa82db1345c3497fd949aa84895
MD5 b819592151b05560a2494fb8c53ebc79
SHA1 ccfe0b1cf5c01dd596eddefdc1ceb75ef857d19d
SHA512 b858075ef4c085d81eaa717d93e236a83f1810cdf248227975ad1e9a5ed4073e04c542210eac89d042b8451324f084b84f1e7e4a5a96fd2d13b0db26f8be118d
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01sqjnhMgeiCl7Ge:S68Qg55nhheWu7PNU3/ADmg27RnWGj
TLSH
T108B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 401c4832658fbea3f187d895215e0ec9d46643457a1f2c161e473001e61fb4cb
MD5 9181d366d113b04a3cc46bd83cbd4dcb
SHA1 07f0f35b8ad6c82b781cc76add7948acbf7a6c46
SHA512 e0a2a0761d3e5bc5590ac6130be00e037611441a92495c0ac2f36638e65ae2108de031270888afa8d9a00bd5c5ee424dbb7878c7b9781816e99eab9c47c44a00
SSDEEP 98304:Qy5112gYy5azzVvL69nLKnhZtD527BWG:pLIHmWhXVQBWG
TLSH
T174167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dc8985eed13b659342e145682af07864fc049caac96d48afa7cf4d9428d1e016
MD5 476f79f8d7bc46f161dea08d37954bad
SHA1 017016e125b8781f0f522c7dd754fea011fc9cf8
SHA512 f943133dc025cd70bac35341f8ff982dc55606c68027115e0fc3a9aa5272571bae4c7f498643ca10a529b97280c7074c55a86ac8842c0558934d3d9418f75dfd
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqDmg27RnWGj:Tu6JmVxd2dqD527BWG
TLSH
T14DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8d93139e4cebf79302bc0ae08e0207d1f2200c02f9bd45701aa90f3cd63d540
MD5 f0a2fc513a5a01733d1ba7573efb334b
SHA1 06e0436ad559e1e9213faefc6112bd77a4e7ed6e
SHA512 26fb17c0e5b661f3df050d9af981966e8d86c162066d7cf5832d50338cc58be1eaa1acd611f5e0af1b583cdad999628114838894b06086ac65b567d969e92d72
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xODmg27RnWGj:bmifPbRfD527BWG
TLSH
T115B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3a2ecfa495be5f285c7aa11efa93dbf69359e2ec4565465918962dab58206932
MD5 84be3e36d9c47ff5b58def0c151e76cf
SHA1 08a1a352af68ab98ceb51ab899fad986c80c949e
SHA512 e308812a0e4cdb5d8c5fdbea33b71ee51dac30bf06fa4cdc00bb9f25eae2011271aa70344aa99882073b24d72e548f91c4771ef6859c8c28e48b2dfa7cdc1f95
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq5Dmg27RnWGj:Q5dKTi615D527BWG
TLSH
T155C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be4e9ad7edb56fa92b9bc3526d4b5e82e8926274cb265ca46fd7ed785f157673
MD5 652023529d37c928ea7c406069998993
SHA1 94b01617c1eb25a89c50a701470ee678839cb484
SHA512 49590d96c14ccf36750ad557eb8cfd68e4391b860c42d178da4cb7032dc38b563b9f53eed150f0511b6d8166f080907291929a9544b4a9fa20943b7c1ba8cee9
SSDEEP 49152:0htSn8EApI0figngiDn0AP5w6Dmg27RnWGj:VX2iyphTD527BWG
TLSH
T1B495BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 31ecddcdb924410f4e8f8607bd4dec9fb15eaac580e541811deb0012c8e5bc2f
MD5 4ed5d87b3618aaa50cff0250929ec09c
SHA1 9b1e572fa8938c2681bfa9f4650d835bf7297599
SHA512 0cb58652b2bb079136aaf3f5ea864c9b163173ad3be7e64dd8f5fffe4f05636d9367a0169e1e4dcecc2664966d877d4219c3e30acc7ddf850f5f0a30fb9fdf1b
SSDEEP 12288:VhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE964C51CAE52644B5C3E9F10DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ede9141db207561f6bdf0edb5a9c35d57a03903d1f9eeca70556d7d77243a3a4
MD5 3b4a10f88b6c4f614aaac992370b486f
SHA1 7d4519658f103e6fb61c4d307f0411af7a5e963c
SHA512 d968b312e6033a8fcddbfd8c1b2cb07201fd2a82bc53e29b7dab3eb65b4cd004973e0444f03cb993f66ccd4dc96b53face21ff8929bab015cfc21438e52c348d
SSDEEP 12288:HwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE964C41CBE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c9ba13da8b09c94d7ae80dbf487e3b2974c67211d23a4a8044468a78b1a8cf65
MD5 43fe7ea7d0de8d0a0c7b69d21fa4d511
SHA1 5f717963c1b82ae7ff9d7a1eb61bc4c263f7a4a6
SHA512 4f0133b662b6724dbba7feb4d0601a797d5c8bf3f984a150c0807263502f1956bcd471ced70ffa87c8ffff6c78eeca0aa78f6e4a8b0bccaecf9fd2c2884fa533
SSDEEP 12288:pSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE964C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f9f03b604c12634d6e8f60ea56663e55ab4bc75fe244112538c981e141305a4f
MD5 95906846afdc8211fdc60bf8e2a5d0d6
SHA1 e01a15fec128fb5c10109c6415548c8eeffbab97
SHA512 9d5e64907ac28f7ed132a2cae59a8f204138461458e6263f78b4068f278d0a3821b51ae0b635f1a1ab498a7c3d7d5f3145d520be6ea90ee76a891fd5575cfc06
SSDEEP 12288:fVrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:psqjnhMgeiCl7G0nehbGZpbD
TLSH
T17645236F575C40CAD83285B4C2F5E11DE8237D56EB30059B6B522CEEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e69cdb9164fe0218da2a535dbeb9cc494aec6856d68fe55f4e6e6e5bf7ae2f66
MD5 1c61ac1ea1c3c255fc5fdd879d90c1f5
SHA1 c53273f4ce1b350db07330e2ca7253b409451701
SHA512 4f495f99220d2ae66e864019e7521f8b5a1a296f2414b21f78ca5f5df02f9602d5ed45b9732a9a4a8827a8e8e1fc68da6cfaf83c8828e0db6e6a88f717b10fda
SSDEEP 12288:DzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6afa353712d6829b7b59ae39d96afa4d20d008e140013db4cb7ba0f4fb0ca990
MD5 e2ef403fa1cd95cd6d64958f37922529
SHA1 94c1c87b9a8c5381962584334a602397eaa2b973
SHA512 93063c0e461f8ac5f7ed027bd2858ff7861a01358ddd8742c6576f0fe56731132d963f7d8f2dcef25c7c9e40ddcba8e7886f4f7244516fe6c44321a9cb4f5e4f
SSDEEP 12288:AMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE964C41CBE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 752988cf168f858b3d6011f34c0952c57415fd61f02f11bb854bab41196976e9
MD5 528327f6a10d1e86070e8d34a01e613f
SHA1 c8b5bc6eaa0f4f818d3e5081bb2fa58e4d417a19
SHA512 3244fb5d60a0892efb8adf52569d174516e674ed121bfbd2680cdfd476652535f7c54e306f43ee0289fc7c9dbd578aa3736948a0f1cbe9e7f780bb64aa50328f
SSDEEP 12288:MYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE964C41CAE52644B5C3E9F15DAC073E5BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 23f88b7feb38494225decd7f6ed0c77af5de76b4cff702b7aedb8140258fd25f
MD5 70f4ea15278624d31aaf014ed290a1a9
SHA1 96498b42e1f2f290a9b5770bd69e1103b03d9f0e
SHA512 747aa7716e2535f721b2d931ff886f74a3ef3cca552837a9e4d637737bbac8c5a5afaad3d591dbf15e70642d9dc5c4240c62d60aa1df579c872de223ed65711f
SSDEEP 24576:6ZMSzFVSOQsqjnhMgeiCl7G0nehbGZpbD:6ZMSzfIDmg27RnWGj
TLSH
T1E86501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 13a9541f50480fce7362279a4b311d6d74cc0ac096e07482dd90a7361992563c
MD5 c393186dd8509d98c849dca05a5fc30f
SHA1 2cad562299bbe47a49422452a2d33fd9250807ee
SHA512 44dd6ab491774d97aa515e50416c52df9977e9dfc7ebc3092f961a3cec9424c93097d1e85507618f64248622aa8ace801efa074608ff53bd61a8cecc8db2d225
SSDEEP 12288:2VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 27b05f99a6409e5b03262978c5a8bcb4073490413dba89fb08a8742a68c61d6e
MD5 896551fec179a24d931ce12b5a55d47b
SHA1 fa4deb47bcd6a98842213705ca3ed8f68d268bc9
SHA512 9e3d1ca8809e6e2be108a6533a15942f590502373b9b63b08d74b5cc5fbceebd101cb3c6e8b0dc69ca7f53d4fdc2458004177d00ed97db4d4564514d9b9d63f2
SSDEEP 12288:G5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BF964C41CAE52644B5C3E9F14DAC073E5BE9200493BA5B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4bc180aa235ed761607e5d1234e8fd532e128ccbc5def20bd6e76c547bb10f91
MD5 3ea51773a65c3a02824e280dbfb0cf06
SHA1 ed0cad1f370d495a4789bb276db8f6e5b8d57b43
SHA512 a9a4dad1a41609c23e49f7d05ee60cc6859ddc415383a71e00a03aa2eb67d5b67b13ec4bebb9372212be68c34eeb86f7ea7528271483ae3a0ee06266d580bfbf
SSDEEP 12288:YyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cf3910c0ed5bb39fea022b2acb9cbc459e64cac6feb56d3514503b7e88623621
MD5 6d5b68bd9f1a4f6831508bb7b6cc265b
SHA1 19fbf046bcaefb2f945c1db4fce3b8ba17c5ecbb
SHA512 1433ef86e92a68a3f0a787f86678fe522b7ef7cfb3fd4143827e5d79a2154a6b727705e2f88956896bd4958f91c277da0afb766570d24b0cc49ec74fb864ca8f
SSDEEP 12288:+VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BF964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c7ef8cdfe82a7f651105adb298ca6035596648c9abf6117cd891b0c3055007d2
MD5 412f7e0a8cb91a6ea6139a7178fb7965
SHA1 0ba048c892014cd4de8304795e4ab95f32d4d6fa
SHA512 077014dba299566e41c437dc32e57e2159370ec231737a1ee4010da500a21150409e874f7a25ff6219c43c507c66d30b148ad54f81c33a240ea88740fbaf13dc
SSDEEP 12288:CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BE964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f048268baf3414cb4027f7ae11488e97783fa97c5bf141312e5c0438555e7fdd
MD5 f4dc86d3ea5d6fb08181020cc0e09d73
SHA1 22ea1fbc02fd0ace26563fca14ddf36a5fd7a5e4
SHA512 889ddd0883df4c9cff052861f9192699d0c8a713c30c44110d548737c06898e9566d7c5955cf793fe9f1ddf43041d002d2a710fb0fc3080e766f38056c7b346d
SSDEEP 12288:HyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 89f18f63e0b5d63aae5cd40a13d699ac9cb4b5366e5d8a42db26817e6be046a0
MD5 a07cf642bb2e959ee19891c87a74dd09
SHA1 cb86cae2543c45be932ced8130f43a5f8b7bd5e3
SHA512 0295cf8a900dd7b364be2f007047582ab0a04150349043074288b9dcb6b9457fa075f8f954f3ba5d8cd9d82f6ca00d4f9affd809537590e6bca1ee2ec4f914b8
SSDEEP 24576:FTHaLl3z0zDCsqjnhMgeiCl7G0nehbGZpbD:FT6LljLDmg27RnWGj
TLSH
T1FC6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f2cad21b773b956158a35b9e2de8d6e018d846b491ee6653a21349df9efb655e
MD5 101427b6b718a0f0b8efd14605d11b0a
SHA1 ceae694d8535c3a8d7f1bc75665c4b6c9d17de30
SHA512 038b8de58bf92df2fa5198a4e8fba171e2f0b661ada2ea307cf3e9ab06c7a57c4a8fa0781aa466e7d2574525493d1016250cf032228d5581f8cd541e16ea6671
SSDEEP 24576:q37d9CHKy7GZusqjnhMgeiCl7G0nehbGZpbD:M7d9CHKyaIDmg27RnWGj
TLSH
T1C275CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8dfb26b1815581387ee89288ad1a9ccfa15cab78f3385d709a621f90e42281d9
MD5 e7bdff1f7c3d90e323730b5101bda742
SHA1 5b540e7f3148d1f2c356b1a2c10bc6a3e7fe3ed6
SHA512 2f34f5988d01ff75adf1535c4b3a074516d327664f275234bbf2baf1412a76a4c55037e2786faeb9575373d24d60b94c5669eeb4579743a9cda20fcfaa7c5308
SSDEEP 12288:MyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE954C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 82b7fb930960325c351e32d429adc35f980a1a905d97ba73a8a6953b65aea956
MD5 ff62d3fa6eab4e2d4947609d10e53847
SHA1 c8cc13cb42aecc265eef116d63648942b7657cec
SHA512 934b660f87543547ddf875f998c8b8bf24691b41b5f7810fa0891612c426d53e8c8130dc4d90848bc097d6fd41f9f08f49aaba731256a06a072b26edbf4eea27
SSDEEP 12288:5kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BE965C41CAE52644F5C3E9F10DAC073E5BE9200493BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f6a9eb59084c12a36d3dccdc42b97d21baaffa2751a78f066343fcfce9395f16
MD5 a670e0d443325a1d6133d5691936397e
SHA1 629844216d4fb1e9c75b121672dc7dfcbf82a44f
SHA512 b65d2b61d76dcee7124cce2b0c75cf325211c3959efe3666bdcb2b73544cb8a2fac45305884fc053bf2bc224293a153a48a2b78884ac4323c6f0b34f74046f16
SSDEEP 12288:o/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BE965C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b1f078e38b8c939b25258666914c0af3bed0a26c846020a94ca55763c94ac660
MD5 81f6b712596cc760b3024d38ec7b715b
SHA1 57f5fe15fe4260b8a499077c4636a3b5404aa91c
SHA512 f2b90ab2ed7b34c2ff9e9da47d5702597fe442f1cb7800f1d332694c1955f7fb83bdf2b57005a790a106b1b60a45cafa5b8cb17e08c098dabcaa7c630adc9093
SSDEEP 12288:SVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BF964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 948aee2953710b49fb84657b2c7d81ae3637c5e2402ae6deb49bd41c47df505c
MD5 056b622cd5b0b2677c1036fa3c328a9b
SHA1 9deaa6ff614d05c02fb99d46d4269a046b7bc8b3
SHA512 5410108feaa85513bbb2f978518a689e13d5f5c6160c8df5dd5df5ef90f683dc58fc1d2688c83f19c9502060e48242e7efb37a6443341145f98a3cf447851248
SSDEEP 12288:oyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BE954C41CBE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a667fef7abb77a90aa87cd9fdcfba8481e11a4f5b4db54ae64c8c57c82767acf
MD5 6265eb7a8405692204b4b3af983db1b8
SHA1 516f3d988fcfdf59ca692e8dea3f16ed767a871a
SHA512 f1880784c332d0b10265f12430c36d84780a967b9ede74a801b33ec4e716a59c5dbe7676203205f98e8bb18db8a6691cf733e4f0eb6eacc5c381b93ea9bf9479
SSDEEP 12288:V9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CAE52644B5C3E9F11DAC073E5BE9200483BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 327b54ce808e239d2231591b6b96337b29409873823b7b6cfae84552c921877e
MD5 92e7d784e6ed5768244abac78d898e1c
SHA1 a3d0847d34ee6bc8bf1df4de961b22c5a5674a7e
SHA512 4ea91da689322ba1647c27efa15b900d972d1a28105c8455bd13acc71ca0cab3bbdf03efe690167d55f8f00544aa30692c393b9c57123872b0a791dfacb6a853
SSDEEP 12288:1zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE954C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 15d4f17573551d0fc911cd15f70bb6bff528563a6b7b1c4cf6fccd93b0d0c445
MD5 a9c20349ef7c169abf3dbb168ca8a197
SHA1 191a1a56e672438954809956eb35b539ecb79bce
SHA512 1b80ba284c36888dfe5443ddc66ccb08a6b927380dd1126a8f246937705285214fb1b71ad28b141975fb8aadcb65388002ef273a1d7c4204d450e89f36700fdb
SSDEEP 24576:dfwvok9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:bMnYINDmg27RnWGj
TLSH
T1A785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 072807a7e5849fc411552a8e083e3b1f1497a2dae752fbc17a7a73f45e34c932
MD5 d496957c36d5f4d214375c5a98abcf09
SHA1 d71aa3cc8e5b20d05a49ebd9f71ecbf6898c5bc1
SHA512 f4179ec03208bc5b257808ccd466ff301fee497224ba0fc474c28434706630d315328e99191e37f72e6992f7acea44e502c732c7106c703e5255bb74098d0102
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aDmg27RnWGj:TySzPCD527BWG
TLSH
T139066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 29d26cb0a4061a40e4e4660b170aeb0a955e7978b7e3107d4e43c28a5239a202
MD5 3add4eac076126aaef1f391d4f22b081
SHA1 daa8988e26158b7acfec1f2016e4a1b1468f1e9e
SHA512 fa5847ffda8b4f49858c4a24fba74bd3e5dc760bb069570080c67b33ee42c39059045e210aead56a528d5118792dca2a3e871a6766e49f3fc86bd58b14e56072
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgsqjnhMgeiCl7G0nehbGZpbD:647JUQj1irIhCnDHUPfF/qDmg27RnWGj
TLSH
T18F65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 06a8593feb8ca7bb28bad9d214c4acba42c5dcda324a68f65a971eade83ac2b5
MD5 6a3608c257f708b48af34352e96d2434
SHA1 d46f0b4b0a0f8c420eac6580a03c8c366a35e6e3
SHA512 4895b03c24eecab7d23798a85c16d9d652ee0b74f5d840cb9b33c10931d622f700c147a73dfdab1d660a48519b3b99b5a116f770be065997063a31903dc3d50c
SSDEEP 12288:MNsfFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11955015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 911b16d1749c6d12ef943f39927e298c82c79ac18d1d5d3a1a21f802abff4ff8
MD5 202584fb9718c8c9d443cd9d5af64bba
SHA1 625a248bfb29bf17310fe168db769f7b1c3f37fa
SHA512 45dfe4fa1e0ccdc5febdf2b4e204116b8fb30cd343e559dff7bc4d74517740c772e85ed3a2cc85fc913d21297107ebc6fe9c2bd26a4ef3c2d24febbe3312a323
SSDEEP 24576:SCLWaUPK5aiBSt18IH1hCnNaRMW7DnwtiBjWsV:GaUomXH1MNaRMW7DCiBjWsV
TLSH
T1294518407626DB8FC6A940325E36D6CCA7707D12EE056F0373C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 9ad870201ea1bb2ec18414a55e873ee4a5a3c0ce55dd2d0b28698e7e56f0e409
MD5 26b7adeb0088a98d5895d5da1386f40f
SHA1 578c8cf8853aa80716de14328dc3d10d7ccfbb07
SHA512 4a4a73da7262f87a24f70bd392d55d532e2d1b39c637f6f346f6a9ebc33aae0ff613d7ec4e5874473e0c00e0f51f27bace835677a91a5b3125206aec6cbbe3fb
SSDEEP 12288:6+FSCxkHHjDM37Ge2EoYuUfa215lVxf/wtrQ2X6v2eXO2I/Z4XZ8beGOli4Wwf:6+FanXgC1a15lVxqrQ2XS2erGchxf
TLSH
T1CD451740A5B7EB4FC97A9037123686CDAB785C03F7452F0573458838986BA6FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cdebde6299d052f448cb85906871a8cab8c9b2fd89ff5f76b660d77cd8d93505
MD5 5ca7b410bae68aa6f3b0b0e367c85933
SHA1 fdbc69948883ff2aa4e002f77de779ee0a6b6ded
SHA512 4667b3cc49b1c9085fb7510b51cdec519d02c4cc7cf26463be993ed773695a58f630608bf22f04da34ffb216cb6c5ab32db961214a48d5297d1e7b140eb15dfb
SSDEEP 12288:cM7tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17945237B934C518AF93605B482EAE12D680B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 296d340f7fbf10dbe273c09c6cdce3279e753341eb6712f02ddc6917620f3223
MD5 af5b29bb6b4d18aeae03197fd551e309
SHA1 7179be385a88ffba05bf09893a75027f7c2a16bf
SHA512 f813c3979f348a240f4398f767b7a21360bf8c6fea7f2308082690d7afa7efed0cf900dab317b8e8e9ec1971fe7e7598dcd29c1284ddd079af253de760f8bdd2
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bY3sqjnhMgeiCl7G0nehbGZpbD:ggb4mBIBhGFcDmg27RnWGj
TLSH
T176659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 becb1bc879a6aff7ecf6b0e53c8ddc4c26fa999bda7ab6db0157524b5c04ed77
MD5 e2082bfdbdf4e7ad43a739763f3b42ce
SHA1 bae009398dc71ecb29f1a6aa0b4973bb92f0660c
SHA512 643106b4c8b391569fea1bbd4094bd7ef80948f82e975e65f159ad1f1a9164b40c22db2ce1625bb8f62c4288ac0aeafd93aedb3abf95ebb9c55ceb855df54a8a
SSDEEP 24576:XG88u8FpJqH1bzria7/mQsqjnhMgeiCl7G0nehbGZpbD:W7ZFPqVea7/DDmg27RnWGj
TLSH
T12585016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 256ad7c2d43a3924dffa8dfb68efbc98ce15d8ba2c181a34065ca9df36ee8fc3
MD5 3c25a44c92b656f06ff0aa562a7c3b15
SHA1 0559b8354b7327b5f8e5d850d89ac209c11dd2a2
SHA512 e1ebc7a781dcd32577767f61a4a6039adf901722ff07d80df8b3f6980f0cf3859a76d63c0b6b6245e97d8dec7606c9f1ca3dfe4de0a1af2eb2342ede541ba576
SSDEEP 12288:mHvUrBFrEjwaQcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:mPUr+NQcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16365F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8c249db5d5b487bcb1559b0831f377c090d7d7140892df5a8568e5c5d252bb09
MD5 1e63ca5e3d9c61e1bb6c451713d866cf
SHA1 7fd96dc2ba484f2c7227f15982e6ee61b4e2b24a
SHA512 ccd0daa59d84fb05808f386ecfefcc56c5b9c472c5cf955ab51d996039daf67ae17e2774d9b481bb988a438b66e3930c1715d994af6a45205812825083761d07
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:8G05lO43bFD527BWG
TLSH
T116D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ce20f4f16f4a4fec57f8845882bdd3adfa390a90a2b543ce72accf4ebbd47f25
MD5 a9027477241d6bf243b262ebc628973d
SHA1 df63a124631ab6ecb6cc6dcfd9b4da5b14b26509
SHA512 70bb0915359f297bb21af95c1ad26c5b3a7ea743de4b005efcff8ca17ee130adee51a1725acf868d339ea1fdac648a3b671dd70e08322686fef3441598a3edfa
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWsqjnhMgeiCl7G0nehbGZpbD:Aa5POZ3+Jt2pasx2+mADmg27RnWGj
TLSH
T19565BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 556ad9d09d64f13357fefdce4866263caf396f8c6eff05400320c34e55d47d42
MD5 5408ae3b63eef67f1209065da0aa607b
SHA1 0a85e78123a2a2046dabc896d8bc5bea3b4f78e2
SHA512 ae5eb12a508d45fd352302cfa4ef82862103e077b7f9310d24ef580b5c4d5b9734937f838bffb85e23926e0f4d4e05dd69b1b74a099360f947a9e530e2e4ab51
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkIsqjnhMgeiCl7G0nehbGZpbD:YNc/zEOVHFjDmg27RnWGj
TLSH
T14B857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8aa443501f596937d09162c93c5fc74a74b8dd702c174f5c2254c2f2e56b216b
MD5 c62d135922c9173414f5341586cb4cbd
SHA1 948a8427909aea861e284e8d3207697a9c93e830
SHA512 ee0977e8a9824dfccebfc1d1eb14d4c57e486c604ec92b1299c8e76187f18d8c06d51fcc0825226cac02600789263a0a29446baf2c7e4a6f9ad8d39e3d880d11
SSDEEP 24576:t8kNvNnaFeYhJNtmZBmqsqjnhMgeiCl7G0nehbGZpbD:t8MwBtOm+Dmg27RnWGj
TLSH
T17655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e6a616fefdde3094ab61a47ab2bc48f9f78f1e1f5526cfa0457da0d895c0e077
MD5 fc548e93f9deadd8e0ca489ae97c09c3
SHA1 d4f9ee29d4d2246daa81983921e6e9e51d722b4a
SHA512 49e36c55ca03f68387ecd84054b8d86bd64615aa83ba2ef260c8a6ec639c3033d67eb8a9f5a48491efec98c6a75b0e012c9c4c25eebe7e3606d5c1a39b67c1e1
SSDEEP 24576:6D3FHshBIYQgABsqjnhMgeiCl7G0nehbGZpbD:6DVHeBIAAVDmg27RnWGj
TLSH
T1DE75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-315-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/244-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1096-68-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1096-271-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1096-73-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1096-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1296-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1296-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1296-116-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1296-122-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1376-79-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/1376-282-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1376-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1376-84-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/1600-77-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/1600-7-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/1600-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/1600-6-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/1600-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/2860-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2860-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2860-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2860-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2860-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2900-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2900-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2900-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2900-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3460-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3460-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3460-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3460-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4572-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4572-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4572-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4572-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4572-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4964-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4964-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5176-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5176-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5176-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5176-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5176-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5176-328-0x00000000007C0000-0x0000000000820000-memory.dmp

Download