42d18d4bccab16b8146dd0a4aae44cee565fd1a9d53043492967a4d06c68d429

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample261009-zagrssvx2j
SHA256 42d18d4bccab16b8146dd0a4aae44cee565fd1a9d53043492967a4d06c68d429
MD5 15bf673245b0273c4284f2c15aacc9ba
SHA1 7ec75a9b9c4c03b526b55e0a8a95727f8afcdcee
SHA512 3ec1486985101a310471fc5baf85967e8f63e6bea1b0c3d55c9307702c1f56d85894d0a07335d1455cad2afbdd49a897b7a7275fe94288995984a90b130767a3
SSDEEP 24576:65GtI/40sy49ZoAVMEM9GyqIEx6d5WeSn9:GGC/40sy4PZSEkzExsWeS
TLSH
T16165011232C1C4B3E9B7063009B5E670A97DFE700F754AEF6394672A5D702D29A39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4980	elevation_service.exe
4404	elevation_service.exe
3604	maintenanceservice.exe
1656	OSE.EXE
4364	PerceptionSimulationService.exe
5160	perfhost.exe
2620	ReFsDedupSvc.exe
124	SensorDataService.exe
4944	ssh-agent.exe
4304	AgentService.exe
2508	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dcaba9a5f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec00701a2d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000033ab91b2d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000637fd1192d58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf836192d58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4304	AgentService.exe
Token: 33	2508	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2508	SearchIndexer.exe
Token: SeBackupPrivilege	2620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2620	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4452	2508	SearchIndexer.exe	100
PID 2508 wrote to memory of 4948	2508	SearchIndexer.exe	101
PID 2508 wrote to memory of 2292	2508	SearchIndexer.exe	102
PID 2508 wrote to memory of 4792	2508	SearchIndexer.exe	103
PID 2508 wrote to memory of 2824	2508	SearchIndexer.exe	105
PID 2508 wrote to memory of 6064	2508	SearchIndexer.exe	106
PID 2508 wrote to memory of 1960	2508	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f2aa1c6bfad4cbc7c7ac6d6b985a5b14777c08a9e6ee5a4107c340c21382f249
MD5 7638999c88f1d49a1f47be1935522ec4
SHA1 91ea99ff1edd2c4d6445a289344e01e5f92666a4
SHA512 3f5b7323707d71bbc4756cd9cd642e49831303da2fb8076973d33fadebae11a838aed286f7769484fe24f3a051649819cf40a3ddd97d675508e72fe8574c9ff3
SSDEEP 49152:Eb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn1sy4PZSEkzExsWeS:+3q60jBRy4P9yEx3e
TLSH
T180D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8e61b364b9d35559b3d0de76cfe8ba4cc1399e3f21e9a75dab8722742dfe5033
MD5 32d8c02632d0300b3d13086769675df8
SHA1 dae96f6dedc8fa32a5f3917448eb8a8315c7a7b4
SHA512 71fb3e63f3691eb6e2977908cc892bf2ee0365f9d9fbd22a9ef99a373d3d423b14c385fef47d987a58a29b7aecab741d703131e77412d2b82288a7c78e0704be
SSDEEP 24576:bXYfDtczASsy49ZoAVMEM9GyqIEx6d5WeSn9:+tcTsy4PZSEkzExsWeS
TLSH
T11965F12963E408FAED6B8279C8A2C111E67278954760E7DF03A4DA351F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 640eff8841659b54ca5849f3d80a0190c18b946d5854ba6c3cb242f72f2b977f
MD5 dc13a35acb57346afdeb369c98fbaaa6
SHA1 5adb669c595694ec1312b4e3b855e3ac2004bc43
SHA512 bfe9bc0e7f78e65ddc131a6cc7033b1e80ea2a3f7621b8d18ff4298c9e11edc0bf40a05cc73f46ef79965f42ac9b487e3147654b7911a01c32836d84a1e8d55d
SSDEEP 24576:s0Le5ji0hmxTrMNsy49ZoAVMEM9GyqIEx6d5WeSn9:sPji0AFksy4PZSEkzExsWeS
TLSH
T13185AE16F6788335D073C0B9C5D2A68EE971308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe996684e3327c33c4b1fcb08aeff6385321fb1dfca3ebf7a94ec42896faadf6
MD5 4ba6c5ce865ded0b5e80f3e78ef4dc6f
SHA1 5c95388d3788ad647c14b6ff106d9871af94948e
SHA512 27f4f0d71305fbc36f4c1e65c85105f52784a95a92a60a6262f16c73df66897e0e595a3e64786e02c1e00340f29dbb8fbc705f24702dd1207d6a72e9b36a496f
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWr6q8wyuDsy49ZoAVMEM9GyqIEx6d5WeSn9:3/ezSC6vUzPviHjyosy4PZSEkzExsWeS
TLSH
T11E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0096e83da51ec1070f1a3a10e133d3af59ad538cbb8edda906a330490e5e2765
MD5 7af3480140b8534c43e7cfcda02367bf
SHA1 a3e05a20f8db71ff633ebeb757781c2cea5f4071
SHA512 3edb7a6ff4aad3b1e82150f8edeb76b147f02224af0922b477e16fcac7e20db2d585b77d92414199fc947e7280f4890bd37e5cefd2e38302fd2d61580e3a1e52
SSDEEP 24576:4VbqPb88hv/l+busy49ZoAVMEM9GyqIEx6d5WeSn9:4VO88hXl+6sy4PZSEkzExsWeS
TLSH
T162559E66F6748331D073C0BAC5D2A69AEE3234424B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b7ad39711d0739752d70e66cd05ec4e0ccb34ee25b30ea1949c0f6894fb305d1
MD5 ec8378b295dad6a729f2c2c7b1cbcacd
SHA1 0e7bf6fb47350fadc3c10753e0845b3e50dd5d67
SHA512 62d93538ee6b5fdc1731e8e5963864619392d54ade84ce6da43111f1b66844e1200067676ae1872ae23bec9d343b56703af5d3d2fe3df5c9b60f3a49a2622bde
SSDEEP 12288:HtpsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI1:Htpsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1E1452307031D98ABEBBFC372099BE358E0B0BED48865519F4336FB755C78718E24A661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 34093ec35d3385e86c0ff7eacac7a290bdfa8a559f16dd882a5a0373d40a65db
MD5 da515056bc42163f7ade248547d0822d
SHA1 2369009595dc05a6357b89259f39e59cdbd8a47a
SHA512 caed88d87bfab87794665659a28f83b09c0b532c13ea0f8e3b81db9b72c1986ccf05f7deb654d531f9a8d6e766fbe918c6fb04ab540e83a917faf84d12733ea7
SSDEEP 12288:UeBNUbTVO86UmsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIg:UJIUmsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1D065BF3BAE28FCD2C27E89B95A91C200D77278704B61A3CBD165C30EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b4b23798f9f0f2d58a40a7db245cfede96fdc951a569c90864980d8a1bdcd21f
MD5 c6f6f38c37e39edd17e7a79cd8458be8
SHA1 62642eee2ba3b1592f2aa66e5c04afd80a04ef54
SHA512 bf9682b7d5a776fa384f7c1cab598fbcab86107f4ced45c894c83a017b3264b99621c2aa85b05c8d3461c75d634d811386b3d0b8cd1db64374edeb64f30938c8
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THj:WQvGAdlCEL8c/RRNw5CIy4P9yEx3e
TLSH
T1A4266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8deae2e4717edc238f0c6a0c0bf31e58eed8307f291032bf91c52d75ac8ab758
MD5 50aea7633720ecc808398226dd592be4
SHA1 9b2a7637dfccc91cb819f969de72a94fc57b9ae9
SHA512 d670508f1b4e22e7c94bcac805d788027c745069eb868a6548ecd04f512136fae0c6593d5bd942303fbe3489f07593a1eb4e543822c66103a567b98b9f1f2ad7
SSDEEP 24576:W8ewsAjUsy49ZoAVMEM9GyqIEx6d5WeSn9:3ljUsy4PZSEkzExsWeS
TLSH
T17075E031FB78E436C7BF0DB21B26C316547C7A604B611AC3E3A89E9D59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6f6052e8c253e4f8efae70bc0fee14ddabb3fe3933ca5dc7cf2d980455ca4cb
MD5 564da2b811693084d16bedbf0de8c210
SHA1 baab1fe4dcf414688c7a12cea06ab44dafef980a
SHA512 413ffd926e56035cfce13b8a96746557f7859bef4a417145646b93c395a90aac566de6cc27f1b82f5c99c6844db5a5096a6ad3a5928496a11bdd3411e55cbccf
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHbXx:JUEtQevvqc2W1cpV2RI32
TLSH
T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 65200efab0ac55ecdcb8e6dd399a28941ff77ecd99362661b1779a9d83256733
MD5 a36981f0adef3fe6a5808a1f6c17f7f9
SHA1 8caf43033fb187324ea19a9d9bd70de81414d168
SHA512 ca2ea58ee0bb0246a1c8243d8dc7d76097644a34492935dbd1e09f06e99c5f9d17f3db6957646ca31bdf36858d23f7082988725fd57545e4b0b2ea464cf00a60
SSDEEP 49152:yCbRquA/m2yL5zifFiV+XenmE3/z0sy4PZSEkzExsWeS:XoqHVjnmcy4P9yEx3e
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fa17e6f64dc3f020818054348afc82d769afacfed7cf2b9d3f89aee41f4ffb0e
MD5 66e1a82f22bcb56c475c803537e7f36e
SHA1 efcdfcdf6783af933785ceb1680a4ae48fb1c27d
SHA512 590e3a47520abe0c5cae3bc0661c7d2496f854e8c884392fa8079ae1250e7bdd22cc4831c855b0008e7b5b8b492752f015d5768829d7fc2f1a1516188cbf3ab0
SSDEEP 24576:TAhGL2IFoiwtA5l7S53Xsy49ZoAVMEM9GyqIEx6d5WeSn9:TAM1Foiq5nsy4PZSEkzExsWeS
TLSH
T11C359D81E7F955D4F5B3AA7859B69170EA76BCA65E31C20F2260D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ca08e08ed3875e2461642648bb79905896d95e8f72f338b40503bea4a58ae11c
MD5 0383b196051f49c65cf20101f1d63ca0
SHA1 b3119dba8a194f3acc8508155f7fd071775851d7
SHA512 e093af5c2c3248943c158fcb8d18301c5914b8071bb5a0154da166ead27c7630edcc3327bea7bd782a777a081bdc42ffc5f5149ca8bfc4c1e82de163a28c0fc9
SSDEEP 24576:awuxOWIsy49ZoAVMEM9GyqIEx6d5WeSn9:awOO7sy4PZSEkzExsWeS
TLSH
T1B665F14623A91CFAE9A782398597C135F7F2B8512A25D71F0360C75B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1f590120a0231e7dc60dd2d93c16791b8db2aba1b9f801c161a0f59ad0c6a7db
MD5 b8b63d19ad6eab9455113166f31cf7a5
SHA1 7edf47048957dbf8b2329b0789d08a2bd490a3e0
SHA512 0492440c0c388fa5dc620aa70675bfbfb14b0b0926193aa3d536b1501c08e6136d1a36efe7a0f9abc66894954d1f1326882a055d35555560ca3264f39ba120a2
SSDEEP 12288:llZ1IyEsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIs:3Zulsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1B655124A239C60FAE2BB837989E69304E3B17496473543CF032597692F72BC55E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe44cde8520ce97c32e21be3bef5bc3cf81414a1490e6815a42826b63a3dcb73
MD5 6acb9065bef9ec45d30dec697a704395
SHA1 5fc5e5f0258f22e2dbac8d90617b158eab355fc8
SHA512 cf8fc5f114273d14290eb01e0b319caca5b127349b46cec13bd3c0c6abc54b29d423a99db9be73244b8a467972cf167dc43c9e985ebe7759d6c6bda1e07521b0
SSDEEP 98304:5QRQyi36YOcPhLvw2gAf+PN3ty4P9yEx3e:wQyiKahX+PNxXx
TLSH
T174667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e9df70b0d107700a92626936d45bbd830ee420d64d64701cbf9611fde7765d72
MD5 60770c6e2bd98aaa34d2bd53f404506e
SHA1 427331a2ea68605f1d3c7749f59f459589ff2519
SHA512 c2dbee634d299916254b520e14a1173e8b0a92963cddae6aad38185013455ddad251552ce9de3fbd71b2a3c4094abba33f405964ca3e28b518f4123d648bbf1b
SSDEEP 98304:fQRQyi36YOcPhLvw2gAf+PN3ty4P9yEx3e:uQyiKahX+PNxXx
TLSH
T151667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fdde0c04ae09d9cb20744eb5e4253d7f88e7bf6cbcaa983674467bd997dded3f
MD5 052c7e7e7b28fc4ceaf1182d46e459c4
SHA1 d42fdafcef2e275c44f02754de9b07ffb3901730
SHA512 9908ee7847432068cceb5da8b9809869eec38475da9aebcd8c58bb7ad7ba45cb01e262b57b6b26c084aec158ded49bc6d95033f30ff0c24e64a4b8b9a9477a3d
SSDEEP 49152:m68Qg55nhceWu7PNU3/ksy4PZSEkzExsWeS:EthLRc/Ly4P9yEx3e
TLSH
T144B54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB861172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6697f944eff8f3302076bb3ddffd9c73cbe77e11051821f95d5136ef9756804f
MD5 34624a463ddb1adabb1dde419c28094a
SHA1 8165935e38c933a9d35fed9a4294dc55db8c2e7b
SHA512 73fef377ce43b430f65ddfa9c02c9ca8aea7825c15161d59c35d29dd07826b8e3edcc39b4f127e77b4bbe342ec1ff6dca3469861da1c8687e3f3e175237fffd0
SSDEEP 98304:wy5112gYy5azzVva69nLKnhZay4P9yEx3e:JLIHjWhGXx
TLSH
T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1c7d4603835dc167603ed7a7c973284623dce0afc191cb9c2847bc95a6e150ea
MD5 4267eb49a8635a4a57591d87aef319de
SHA1 2635c9d7a97232d7c4d90e665ecd23fa870e11fc
SHA512 4395231b3a021171e353ecb3505627d20b7f38e8a1a99562c6758d740c52f74d59199445006639a4d0d1a49ada60cef8846fe3f2de79b4fd514027b04316bfcd
SSDEEP 49152:bB+taZ3usBWOBr4tEG20bqx0z+n217aau1glisy4PZSEkzExsWeS:Nu6JmUxd2dly4P9yEx3e
TLSH
T1B8D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 90008228923c82b4b88c52560d289908546109ad64056ce80776924fdb5fa667
MD5 e84982f9dcbf929628cfad08cbd00cf6
SHA1 e2b2cc0c5e555eb483e78fde6e820f5598cbcce5
SHA512 d9d94d9ceb26681f9d7e87194bcdb54d73bb8d8046e0a6ccafae6bc35c1d8c547acb02918da0e3407d04d6ed3c251715ab1b5af29c7fe36001416def810046e0
SSDEEP 49152:C1hpsNoJpF1A6BU44CwH7R4xGsy4PZSEkzExsWeS:CmifPkRcy4P9yEx3e
TLSH
T12AB5AE13F29900E8D06ED17887569232EA72BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6c75b065a1c90eca419d62601c5f5a8cb7eccbb18963243de4baf65ea7294dc
MD5 3d61ff391adec0d502ba10cbddc3a4da
SHA1 5995b04106d63e5113b54a723ea36ff5f6acfc23
SHA512 d982018e3561d27b6d31ca88c74430821c44d688f03288361702f6d80cc05ad6511ed2c4ad1313157e2e95888d6b6abf7c46551857af7169d15dc96a19ba316d
SSDEEP 49152:mSuZQIY0Be2KNRVtOnks6NMHqlsy4PZSEkzExsWeS:o5dKvi61my4P9yEx3e
TLSH
T19CC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8c30651cd13057f996a757c4fc60f9d427622257ce70dfbb027488eff6ed2889
MD5 3ac62621e7c32240922dd513c207b2d8
SHA1 8f1165b99ffd546bb9ae709a76b28dd458fce14b
SHA512 b8a45ee5ca4eccfa0b9406c16e3770677889b59c74c2b9b8428ea564ec6b4841199ec7adcc586ab627f6efbe61c0d357262b39770d02c64726183fcb209952f8
SSDEEP 49152:OhtSn8EApI0figXgiDn0AP5wSsy4PZSEkzExsWeS:PX2iyphwy4P9yEx3e
TLSH
T18695BE13F2D900E8D06ED178C7468632E972BC160B39A6EF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1130b55378c4b93b68bcd5bc58bad6fc70ee286dc595ac0d1a94cae79cab7fc6
MD5 fa558d3cd933503fba700454664374b3
SHA1 5a44318db5f0bc2eed71f535f8ae99012311f45f
SHA512 a5066b821b61e5fd80c45cb03d4f09a3bbd8e677f2a7d9ddf745c19d6bee065a059cc134446d82ef4c6ebee85b80f127dbfea11b3359afd8844c5dfb382f261a
SSDEEP 12288:mBsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIf:mBsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1D2452307035E98AFE67FC3B2059BE348E0B07ADA846611DF532AF7316DB4718624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1d221a6f2feced4dbb68abeb9cb4f2e7337d44252c31373a43e3205a33264445
MD5 286861a80f346d5a49453dd699d5cc4a
SHA1 f41b03a2f06a3865da4e6006014f14e48b0482c5
SHA512 860654038a0b28efa533232ee6f8d28de0f33dcf4add71363b9b266725370d446729ff630ee5f87e34efb563f7b6ba0f5face9b5125633e54e2e5e8a9a4524ff
SSDEEP 12288:TwsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIq:Twsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T178452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB471C624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c75db2d8bcd7e6eba56837958605baf6fc1e5d1515dce6ddd223982034b51d46
MD5 e642a9c6b9ecc8f9e6ad673a0261ced5
SHA1 920e6d0ef956a609ddcf95b018357c4485f0d29f
SHA512 e63428d4afbef5b2007b423302c5bc5941bda17ea9c6064fa3e61a7eef2c2472448b38dd4377c93c683a7cb64c2030df4603607f06df26053c3da977ea94adf1
SSDEEP 12288:k+syU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI5:k+sy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1F1452307031E989BE67FC372055BE348E0B07ADA846611DF532AF7356DB471C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 93e88ab3a49bfbed25ce0fc06f3800d763a62094eecb4c6faff95c0018df8b1d
MD5 d867ec3d3dc1676e7858260408f7f1bd
SHA1 16783be37c9dd9a7bf841b34837a55eb092ba1ca
SHA512 1dc57cbf88f77290623bcdf90a458106b42f684935b2b85608a2d6787230842cc0a0eb4c0e7957e813d59aee007f26ad540739e02b5a4b176f82dc882ea78ba8
SSDEEP 12288:SV3syU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIl:osy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T12B552307136E44EBE9BFC37149A6D318E1F0BDD5863253EF4321BB251DB0758A269BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f1a903ff630bfd29b2dfbf7e73f71372c65fe9f26101c986ae1c6e1fca67b992
MD5 d1f4b65d560c9cf032420fa8a9df2210
SHA1 da6ea00b99babcbf2733a3a27fee46036c17e263
SHA512 73bb36db2d6991dbc8f949f25c78d0c0b90d2a646bafcbc2570bdcdf33f4cd2e181a10041a7b20ac8a17704356f30b067edc70fc7ed6a3be95028a1a0bbcc8b5
SSDEEP 12288:OfsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIq:Ofsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1FA452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB471C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6f5cb6162f31afd76a119056586cad358282d4c4f1c24ef6b0fe16a40f642178
MD5 80c48ff9bf792068c365746db050a393
SHA1 16c25d97f36fd5dc8e402d19eb4bafd6c8125d09
SHA512 abae4b978288e909779c3115ffc2f5c59c57b5de26d855cf4c835d5abf4ced5a37ff9612b4b36d83403954ab81b0931dbcdcfb19c20ac41b0c63ef99249ec8ef
SSDEEP 12288:RssyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIf:Rssy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1C5452307035E88AFE67FC372059BE348E0B07ADA846611DF532AF7356DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 61a85cc8e618a8412fe5b3d40c305c160cf23806386f168f4f441ca0d58493c1
MD5 a7c1819c072906727b84b653c0bbf541
SHA1 d813f8822f98f60a647ff8df3af24a635931acc3
SHA512 cb4aaf16479d40bcf2501fbe123402fcae8cac7603cd39f859ef9107c532b116b540a310d95502fe28d0b4a765c37049468fac82d268c7c66c131d5b9cea3f07
SSDEEP 12288:NYsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XII:NYsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T157452307031E886BE67FC3B2055BE358E0B07ADA886511DF532AF7357DB8718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c9aae0f5fd8ee78c90b2d49aa0f4cf20ce1f9e5daca41f2e64c26375e650f80b
MD5 8252712b3aadcab9317610e27ac37185
SHA1 f1b2459f552fe5ea3d846b29beaff0391d3c2fd2
SHA512 ffba1cc25526ee24a79c6a59e285fedfdb1581a14ce962bf036fd330c7661991c003854743fc864bdd3f9cf38f2c0782f57afd0c6f3319f1963cb41891d4ad71
SSDEEP 24576:5ZMCzFVSOQsy49ZoAVMEM9GyqIEx6d5WeSn9:5ZMCzfcsy4PZSEkzExsWeS
TLSH
T10E650195B3941CF9ECB7823E89568605D2B27C5A0A70C65F03B437275F733A01D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2afdfa88c315eef760e1dbb977d32293eca987ae55d4bcd07a467692a3857b0b
MD5 b46997d0fe6406c46b9c854dc5554d7b
SHA1 201017b7fc16a1ad1fabb1ed7459ea86968b5a4c
SHA512 a295e68dd0d422d784c7e2b7eef125ee5c1cd999be3e9986d2eb1439ca1f5cc19a542f8042a6eead1eb76c2aec6a752755e7a6495b011a6e77c8569b59c6ca7b
SSDEEP 12288:KVsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIz:KVsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1F3452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB471C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d97500c624c0eaae322a24a7a56a21da5ff76f354ce9f120ea77e269e3267532
MD5 9a30c3516de83955ddaf83659122328e
SHA1 e9802282f76d58b9e4ac8def1c5a54afd0360dd1
SHA512 6ed6a42f8b11188f537406aeee097ce5b195f156fae72b7b0fb62448e778fce22eeb591aab9b925b1d32cb9da575bc45323992c5a79f5205471a72c27988067a
SSDEEP 12288:DZsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIS:DZsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1CF452307031E88ABE67FC372059BE348E0B07ADA846611DF532AF7356DB471C624D5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 25c10a8a97143b692527eba1545c48c4a582c179eb22a1faaf87d2793f90df7b
MD5 03877eadefb4492075bdcfe92f25d9e0
SHA1 36d697a35a7eb7fb16e932b8661776a9b1118ab5
SHA512 445c0dc64c10cdf9529db027fe4a71048ae82306592b77ef42aee7c62f54582449e4753de4dabac2882d6d2e913da5d9cc361dad43591ed7ad1f29353d3b0b24
SSDEEP 12288:HyPz5L8EsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIg:qzyEsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T17E55020763A930FAD17B833588A25705F3B1B87647208AAF136457762E777909E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 468e4c0c20d7b5659e9753bce941f7abbf966593699af918c80b5716301b68d0
MD5 e86cb6cfe3baa470be854c34d07f33e1
SHA1 9a143602556a5e3b1fd164d1094db3c42a73361f
SHA512 c55fc4de241f4ab4dc69f3ba9a74f67a5d206d5b2b5d75737bc1c8426e563908e22e9a9b2b1151ea43fb25d0fc6095e8ae88070d43afa3ebc025d11e15c60840
SSDEEP 12288:EVsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIb:EVsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T198452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB871C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 15b72d7dc286bd235ff460a55ae401c47abb7a39703ebd98f97d8e36c9a31d7b
MD5 d2cca660c60ba2007e859c114794db5e
SHA1 7423eacb16a1bf81d14981e3adc047e678eb74dc
SHA512 985517b3cbd13819e81f133c16145bfea4885806da3ceb3c9850d0d1718f5cc6785ac35855f3a1e60887374e8fd6e1a7e66366db72f9322b86b19ca9adee7dcb
SSDEEP 12288:EVsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI+:EVsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T112452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB471C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4a290660a54212cb8375436c6c50b0160cc5b2cafcb1fbce20721d6ac20cb153
MD5 29e91e6797d151757e279fe485ad23c1
SHA1 140419394dbe38a5e425cd6cec086a3fa9e990cd
SHA512 03d3f54b8b3256a794c2a0ba4d0b00cedb4aa35c0945130e393a52a89ed36fd3fcab037692e18f22c1527bdca1508c0aaceede4774984d2419920f5860b18eeb
SSDEEP 12288:/yPz5L8EsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIN:yzyEsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T11B55020763A930FAD17B833588A25705F3B1B87647208AAF136457762E777909E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bab1a2d754c30b668deabc3be9898b346d646b7ad653d7c7468a965d5ae80c14
MD5 6de692dbe086866a561919379da60b47
SHA1 774e87c9a14ec8b720fa1467447a2e6a7a9072e3
SHA512 1368d8497193cb954b79246ac487af6c3b887753c888073a8756f70641c730a141b3dc77f4b6acec2b6a65fba66c7ff0ae9196bf08d0b6f5d6bd6cbab7cfe2fe
SSDEEP 24576:3T7aLl3z0zDOsy49ZoAVMEM9GyqIEx6d5WeSn9:3T2LljDsy4PZSEkzExsWeS
TLSH
T1DE650195B35418F9EC6B823ECD568606D2B27C5A0B70C65F03B837665F333A01D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 af55c78570563875d05ef40eeb019cac0b6a0dff76908b5c9d570333b7a1c5a5
MD5 ec2fb8c8b9bdaf709649d43b4877735f
SHA1 d1b074b59fcfab352417c75d69e02482a680c977
SHA512 3476abc64a9843d225cd113bff5183356e3f16616983080ae438cebbd761d745db67fbec607f695b892d9b585578b5224e2b01139f5db4f2b74d55909315f853
SSDEEP 24576:i3vd9CHKy7GZKsy49ZoAVMEM9GyqIEx6d5WeSn9:Evd9CHKyacsy4PZSEkzExsWeS
TLSH
T18285CF90F3E814E9F0B7CA3589769511DAB67C991B31CA8F03A4661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4fdb2415ee02d4f31ca75c4c7227a3f369e57a5e84aaf3475571c2508f3086cb
MD5 993528cea488d78bcb4f791185841280
SHA1 55d389b8a3267ea2519dcbebedaf4670e99179d8
SHA512 0003f4a6e499c27f6d98af60d26230c184258b5685aaa8b6331cf834b2bee854d8ad2fc5a9f17750781a42ecd7aec57a481e43c92aa8d131e6d6aa94cfea6a62
SSDEEP 12288:hesyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIX:hesy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T155452307031E989FE67FC3B2055BE348E0B07ADA886611DF532AF7356DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a900ff8d20548a75149f51fc3642c70f71c4dd93477d6e6ef0e7a29464bc8345
MD5 7b51dc1601112db4e8dd18be87409219
SHA1 388b9caf1bba1aed870d5af549ba70e67b66bd37
SHA512 43e663f52279b5e0f43df1640eb9f8bea2e6242cf93037632522ed7177c0e0adea287c897c27419e9a1ee79b4642e8537f8d10481730c20e28c00b9bc9adf749
SSDEEP 12288:nksyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI1:nksy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T130452307031E98AFE67FC3B2059BD348E0B07AD9846612DF532AF7356DB8718624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 aa923f06a674d07002e0ca7e0e2fbd3764402d48416058358dd2a69e6cf6d8d4
MD5 33a312f26dd92f3df258bc44164e1230
SHA1 5392d55857b30913ce7e2faa0670824a50ca28ca
SHA512 de5716f36999101fc79f9a350255a867b6bc15af9d91e8252b1c994808eea006f773de532309a23e7aedb32d4643437bce08babc45d87318683f4a9dc828d891
SSDEEP 12288:iLsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIQ:iLsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T193452307031E88ABE67FC372059BE348E4B07ADA846611DF532AF7356DB871C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 044724617bb535d45ae13dbc8af8d43d4290b6509ed72fb472ce470d9a355d32
MD5 2a6687c3d7fbf995314bb9f891b23d26
SHA1 c71bd3acfcc79ff7bb060bc2a27ac2115b24e900
SHA512 c8c0f3d68326b2e34d1cb47bc150cc1184243bb7255e91b19b47d370b303d86e332ae549f862dce667b73be5ab6fc1ca7cd3db44868e216d7a7a84a3d46a3bfa
SSDEEP 12288:rVsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIb:rVsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1FD452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB871C624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4167eefcae429e43e36d55fc99587277060e90fe50feacb8a50d04730ec9c159
MD5 e0874b7775b70ed786b8d5030f8cd531
SHA1 47572e1d39a5ed483b988ef96f0e99550fbf2c8f
SHA512 29c65f7a50f4d29da17757e3ffa653f11101a23199d3fb0ceafa349257c8b8513d376e3e29966885145c0d8990e1e6c83c5f12fd82d5019d194a426fbd40bc00
SSDEEP 12288:MesyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIE:Mesy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1D6452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7356DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f1d231d834625b18a5c944c14fed4ae090514982ac00e4e449a4b85265e0ddd2
MD5 86aa0891c399f55c6df2521d0dd9447a
SHA1 88f427448c16229a4618984677ee1738c73420d9
SHA512 28f25afbfa0b282d673895a80fa660f808e55c84ec25ba3970a87ba271fe9e03e9e2c1c083443fd1c04dc1caa0728ca99cfab5d26c6d07b8d32cc103939388d6
SSDEEP 12288:IdsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIR:Idsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T144452307031E88AFE67FC3B2058BD354E4B07ADA846612DF532AF7356DB8718624E974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d9918362c625b37b3af210ad4fcfc14729b04a79a500c95174a08cf543f2f595
MD5 f895680b6da4a882f341f05342e64d20
SHA1 dee34c32f5cfc8f3c2a3e8524d18074e7bf35f70
SHA512 ef04a01d822d689ce074d035f265cdf758809001d2b43f281501ebf8baf9ea827320b9b8d984cc7fb72b73050272ee58ff906350120254bf5226a4345d389dbc
SSDEEP 12288:QfsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI/:Qfsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T103452307031E98ABE67FC3B2059BE348E0F07ADA846611DF532AF7356DB4718624E5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7a6b13b19449e69857363068f0d9f39c74208eee33d65a6ec106967bb8db622e
MD5 b81c1e127166d626a9e2812e4ac7095f
SHA1 0f26c6fd626f04d62a7ff9d9a280a5103a5b5fdc
SHA512 1a196e25e461e470aa8c1fe8695c0dc6b9eeb3a4664606d044cdd878bbaae88145ec1e8669245c240493841422d497e3dece646e9d2baae92a5c1114c14416a4
SSDEEP 24576:SfwvPk9RX6wkyAIJsy49ZoAVMEM9GyqIEx6d5WeSn9:ZMnYIJsy4PZSEkzExsWeS
TLSH
T1B385C029EBDC44E6E1B7923C89B7460AF6B178591B31C2CF025A536D0E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e37356295fb5e15e792243313782c5c38b0c5c6bd0a72dd08d352be92484aca6
MD5 ab550d67f658022549c7c55f8c7ba6f7
SHA1 387811bd057fdab59302bd18fe48066fc7bd91f4
SHA512 310e411c565a29acf641d3dd94aa61149d0e63a9cae8eae4e8d411c90eadfe28c6dd2606dd008cc65723a425971a44dde30869e78d9c6fbc4391b149e7097d10
SSDEEP 49152:rYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ysy4PZSEkzEx7:VySzPNy4P9yEx3e
TLSH
T1DB066C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c17b1ecc848fed59d2ddaf42469a5fa8317f14a06e066919b20e101480b46a80
MD5 080f870015602b4d63e35ef96cec5611
SHA1 c04ab3c929e7ec4dc6fbffa9a3e56abb8497c195
SHA512 9538c4211eef36965d57426d7e505f56f84b492a0a06f95528313ddd9051fd9836714d9a6c61d1a3afabb95b7d53de780ef4372948897059904e57714c035df8
SSDEEP 24576:P47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYAsy49ZoAVMEM9GyqIEx6d5WeSn9:P47JUQj4irIhCnDHUPfF/isy4PZSEkz
TLSH
T19965AE1EA3EC01E5E1BA92788515865AEA71742E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5f96e78ab82d5bc849282bb3d533e36b422093b336b15c62d3b897ecdbb8dd6a
MD5 0d54b562b07738a54fd05bd8b805c2f8
SHA1 972da6237cf0fb9beababd613e9fa468080c10a5
SHA512 2ec01a997a0e72bd3a4fbe7bbb1b4bedb03f686a78bd2608af59c717491428b1d9798f8638ac2ca79aded6e86985568b2f2d15ea02e7500f86f9ed6e30ecafee
SSDEEP 12288:DssflsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIz:Hlsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T11555F10AC29801EAC06E9275CB569240F3737C6587E193CB53D0F63E1F766949EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 46d30e6cb42627b95f9d740982b98a422b478fed6cf19ec4a655738b50e8ea41
MD5 fd61ae19ecd92e20a7cb645a841c3299
SHA1 843fb261d473bac14d9e9207d68963cbe5071628
SHA512 d6f0bd2f26641b7056d5471c64d7aed949ae04d0e956440eb1e732ec50cc80df05f3fdd4f996bbf1d9b67c000f815db89175b31107163eddb25b0c31f1f05986
SSDEEP 12288:slQc/QtvjU3fD82/A55H2CO4g2ab2oXU4oBoPCApS4FpT:shotrUP74gPVXU4o+KApS4F
TLSH
T19C3507007626DB4BC5A950321E77C6CCAB70BD06FE059B17B2CA473FC576658BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 e5ab767ed063db85bacc19303c12aae97608827f9f58b10d9aeb3805b0eddd05
MD5 03b6fcce861585c96a922bbda4278ca8
SHA1 2edfeac6c18c28ab59c6e8fc24a63c98b97e85f6
SHA512 665d022cbd92f8914ea239cff2b31313b1326bf83ce2b59256f8eaafc5327c297695b205fc50fb4171d7003f4a6eba8f8bc2b20c352d7d3ba37fe498bb00a8a9
SSDEEP 3:OlH/lhxaH37l083N//bl3yjJ/llS3mCllltGlslslslslslsl636t:KNux083V/BOjlEmCtEEEEEEEU
TLSH
T14D8112F00F540FF2CD32987184559B1C5337D5E2B98097AF1398143A1C0034C9C13B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 89311d14cd9f35a10722d7d646163fec11145ea883a1b2c9ad8f4a397c84ea36
MD5 db59c156f446cb1766d5b5d0d21372f0
SHA1 f05756b716a3a4956c366da530a5fa8a92d52b4c
SHA512 678e6ab1cf0625688d7f5f73fd40b318bc53bbcc31415f6a158fd6968d7f70b5117dfd0d97969b9c5949f1cb03f364452ebcec9af5383582c336a2ca9b257d96
SSDEEP 12288:kyLkvO2J+/el5ENcDnkCF0F4UdM/LH17GR4h1i6XPtBlRiX3J3WKPr1mnO0meuxo:TLPWJnkC8X6jVZK4Z3xKpAwpo
TLSH
T1AA854B0155B7EB4FC5BA80330332DA8DAB78AC07B7457F05A385897988B695EB5F23C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 410ca614f50c3630ed2135e092b854174941db764d897df3842f3b569ce830b1
MD5 129cbdb990d8ffdc39013efe3ea729fe
SHA1 2d7ce80b0404a324fab494572cb658c877c10639
SHA512 e26ed8518e46fcfcee03343d50abcc11c7b4561813a88cc8ef4c26853bed481fb9408c0543e76019c54b563ac98d0693bb4ffc4cd2a9b0d6bb0311595cda437e
SSDEEP 12288:bJ7tsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIo:Ftsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T12E452303035D985BE9BFC3B1049FD324A074BAE48B2041DFA315F7756C74B88AA7AA65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8ac7e4cfd74a538bfeeeab9ff53028a8ae636ecfaad5a0f015b230eeaeb0bfe
MD5 bc6ef35c507c198294ffc9bde454a45a
SHA1 ddf3991a9c0eee3f4373c7ded6919def0ded769a
SHA512 bc93fa5cd8fec9ccb1a10402a78a23aee9d3ffb59d4a1f26a5dd18f0c746c2e9df3bd7245fb5564fee9cb3663026a4d2ad6dae5810f9d36087bc4eb518335e54
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYDsy49ZoAVMEM9GyqIEx6d5WeSn9:mgb4mBIBhGFAsy4PZSEkzExsWeS
TLSH
T17865AF1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2b98d56958463d28e87270e6c7d65974af3f91a4317c3b041f0155a3c9a508cb
MD5 3ef3b93f8f8d9105af5dc2743175b76c
SHA1 2340d0506639d9cd1eac97e77683efbe69d3797c
SHA512 dc46245ee1ac6ddbb3b098bc944381b856f40e81f4c8431a553582e112efb5235afd11fa6d891dd60509f73e417f008777c20ee11382e1e35af9e4d4f9481ff2
SSDEEP 24576:CG88u8FpJqH1ozria7/mQsy49ZoAVMEM9GyqIEx6d5WeSn9:Z7ZFPqVXa7/rsy4PZSEkzExsWeS
TLSH
T1EB85F16663E501F1D47BD1388A868263F6B1B4250364EBDF07A88B511F33BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9b39ab1b4e801ac35867adcf27d2bfa35d4a1fd3ed3859ea90e4f5bd02a64aed
MD5 558e53763e4a30992c192dca66f06eb6
SHA1 475950deb9210ec4eae5c671427456e55a7bbffc
SHA512 a19e3f05680bb739a02ea7eb18be6f53abdaf444737056f6ff214ab0f9178fa6ac8e9d93f0196d1aaaaf54254ce9bbc137d304f9f5fca79590454b520ce632c3
SSDEEP 24576:LPUr+NQcsy49ZoAVMEM9GyqIEx6d5WeSn9:LJQcsy4PZSEkzExsWeS
TLSH
T10A65E11F22AD18E5E67AE17D85868309F771B462071292CF03A1827E5E77ED8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e2fd1f92a018304ea24cb1fc3ff9b3d5885fd2c53decfd8f52be5d0a7a5e3135
MD5 c8028b91ee2cb829219ad95762f0c679
SHA1 61c3776cfab1b7d12db709e504a6cf772da28eec
SHA512 ca1f1b5062df2fc5dfe1da161495c9630fce19d662189c97aa0e0351d62312898344a87499e166a2536e4fe99327b8c0989e705eb844bcb17470ca2cf76e8694
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjssy4PZSEkzExsWeS:uG05lO43bCy4P9yEx3e
TLSH
T121D5CF6A62EC11F9D1BBC17CDAC6860BEBB23415033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1a9f9621d7cfa360adfd399fbe7a14b68042e2f6db143fba34de628614e6e0d9
MD5 11ab47cfa99e9b1f90b6c37f68aa68b1
SHA1 65da60773db21e62328ac7244cdc0ba243a8e3e8
SHA512 75487d63ee4ae5c79d56cc0ffe827f3785380b42e33668c5590c8ab117f94ce8c8ec98fc3225be33f1e68825443f3d385c7d85dc05122553d52f80941db53125
SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnysy49ZoAVMEM9GyqIEx6d5WeSn9:Ha5POZ39Jt2pasx2+mksy4PZSEkzExss
TLSH
T1A965AF5EA3FC00D5D5B9D17DC583861AE5B1346553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3d8ef59ddfa0a4de4e18d6b3406ccbc6818ca66cd5b96086e94e2f0db4b627c9
MD5 690bd513f9a35cbde225a9f4683eb24e
SHA1 cd001020fac66cef31db4b4e9373374ac5a45133
SHA512 956f706050801f59fdc0d8a9ab39c61be2aaa9efc376773ba292a87309535040b896f43785adb654e0961d3d097ffdde24372a4a381e02051e618d1e10dd6caa
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fkosy49ZoAVMEM9GyqIEx6d5WeSn9:oNc/zEOVHFLsy4PZSEkzExsWeS
TLSH
T19A858B1623E901E4F5BBE1BE89779646FAB17865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7ee399332a9063b500cb501488afb68ba7243fd599240c118f89eab9ae88a393
MD5 b5f918d28d3b062a59a2445b541ca63f
SHA1 dc2e7e549a1340ad534ecee648a4164bc398eff7
SHA512 70d87c28a6880727795a1352772ebd90b5c11c3e29deb7fba5080accad8215fe9f132dd226ee1ffe9885199118767733f1025bf35464b27a84b01e1087c09037
SSDEEP 24576:GtkNvNnaFeYhJNtmZBmWsy49ZoAVMEM9GyqIEx6d5WeSn9:GtMwBtOmWsy4PZSEkzExsWeS
TLSH
T11D55AF2EA7B846E4D1FEC6B58D238112E6727461073293CF5390C13E1E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ab788b26cbc04717a24bc898b38c2947ffccd55eec1bd68e35a5eed0c92d04fd
MD5 3b9b0d5041da5e93ea35d11e129a8bad
SHA1 ae458ba55d8164c3df8e0215f0cb897ee37ac139
SHA512 7a6bb4466b3f4f924fb0d7ab00c39eb99692abee1ba54e06b5ab4b6fdfd6de56fe5f137a231c9c40c62431ba35c08e54be50db58078c8cca6b5a86d03709a9f2
SSDEEP 24576:gD3FHshBIYQgAhsy49ZoAVMEM9GyqIEx6d5WeSn9:gDVHeBIAAhsy4PZSEkzExsWeS
TLSH
T18A75E13EE75C04E5E57BC2BC8A538606E67138A9032256DB0294D2B61F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/124-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-314-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/124-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/124-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1656-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1656-217-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1656-54-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1656-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2032-8-0x0000000002410000-0x0000000002477000-memory.dmp

Download

memory/2032-1-0x0000000002410000-0x0000000002477000-memory.dmp

Download

memory/2032-77-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2032-0-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/2508-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2508-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2508-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2508-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2508-317-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/2620-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2620-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2620-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2620-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2620-332-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2620-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-52-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/3604-39-0x0000000001860000-0x00000000018C0000-memory.dmp

Download

memory/3604-38-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/3604-50-0x0000000001860000-0x00000000018C0000-memory.dmp

Download

memory/3604-45-0x0000000001860000-0x00000000018C0000-memory.dmp

Download

memory/3604-46-0x0000000001860000-0x00000000018C0000-memory.dmp

Download

memory/4304-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4304-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4304-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4304-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4304-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4364-73-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4364-253-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4364-67-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4364-65-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4404-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4404-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4404-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4404-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4404-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4944-113-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/4944-313-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/4944-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4980-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4980-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4980-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4980-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4980-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5160-79-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/5160-78-0x0000000000400000-0x000000000053A000-memory.dmp

Download

memory/5160-84-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/5160-281-0x0000000000400000-0x000000000053A000-memory.dmp

Download

memory/6064-408-0x00000206DE110000-0x00000206DE2DA000-memory.dmp

Download