40839c21fc79e55926b75b5eff9b770a59b4030c140b70a8b7352114df7b0638

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample261020-18va8add94
SHA256 40839c21fc79e55926b75b5eff9b770a59b4030c140b70a8b7352114df7b0638
MD5 422817aad94e53f1e945c159cda33cb4
SHA1 88b4eb7b5f41d51cbd7e145588c360c34d6728b0
SHA512 5fb4863c3742dfcd10397ccb365d4989d858046ebf0f27b86e624377446bb78424db0efd807a660d974b6e0a68f49117b5839e4016eb79d5927d06c56c04f5dd
SSDEEP 24576:D5GtI/4I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dGC/4ILNiXicJFFRGNzj3
TLSH
T12265025132C080B3E9B7043449B49970A96DFE345F7549EBB3842B2E9E747D28E38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4112	elevation_service.exe
5304	elevation_service.exe
3480	maintenanceservice.exe
5344	OSE.EXE
4976	PerceptionSimulationService.exe
2388	perfhost.exe
248	ReFsDedupSvc.exe
4888	SensorDataService.exe
2184	ssh-agent.exe
2112	AgentService.exe
5552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9acf0ee87465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0dc6666e160dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5444325e160dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	248	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2112	AgentService.exe
Token: 33	5552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5552	SearchIndexer.exe
Token: SeDebugPrivilege	4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4704	2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4112	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 4220	5552	SearchIndexer.exe	100
PID 5552 wrote to memory of 2712	5552	SearchIndexer.exe	101
PID 5552 wrote to memory of 5872	5552	SearchIndexer.exe	102
PID 5552 wrote to memory of 5016	5552	SearchIndexer.exe	103
PID 5552 wrote to memory of 1320	5552	SearchIndexer.exe	105
PID 5552 wrote to memory of 3640	5552	SearchIndexer.exe	106
PID 5552 wrote to memory of 4396	5552	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_422817aad94e53f1e945c159cda33cb4_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eabb3223274195e6b9b9946795a8e695cccb140c2322f078700da3b3256390ef
MD5 2d0b6912ff2c86fababa541a925ce72b
SHA1 90b749fa0f2dbe8e49913888e281a6114e200bec
SHA512 a594f026dc7d63612337143eecca4d1516c1daa03cf3480b30b0a8addebf9f98e4bd4229834c4bdd863b315ef05819b3e6f3d76508009ed233a168c733829a32
SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:l3q6mjBb7wRGpj3
TLSH
T1D6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 28e4827b0a30a21e1a7d34dcdf501e8efc175db6ab274206c8057e898da756a3
MD5 7cb53b7895ebd0eff3260e98edeaf880
SHA1 ff443aefe95c3f9d09f67c9c78c9bc06946a03be
SHA512 e1744af848129af8d04670da0e17530f5693c25303f71be4d0234551205d1bdd68797e424a4a40ebeb3233467438b6462ca9e2cb03ce276381963444c8733158
SSDEEP 24576:8XYfDtczAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7tcyLNiXicJFFRGNzj3
TLSH
T14075012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ec820e9f55d2fae450f26da1dd0a51c3a539c0bc415d282ff7b2e17a1ba33656
MD5 09f81f242e0f667c5e40f48cb5d8d581
SHA1 cd121a2fdf25b5bd01516885cc95212759833421
SHA512 05696264499301055a5bb05b152f1e138f02ce43b3a9b8e6aeb2b83b62e32b46be6b9f47883cd1a008a7fc6ee8b8d2511e35a52bda13bb04a1e6f731cb38dc14
SSDEEP 24576:S0Le5ji0hmxhrMY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SPji0AzFLNiXicJFFRGNzj3
TLSH
T1CD859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c8b00f4d2adbbffae347489f8fc9764d10039e42c36ffc07573515e39b20601a
MD5 06f2667acf0b09b02eeee646f99a3d7d
SHA1 3df8e9c55e6ce7d695eed127b807981f18d583e3
SHA512 1699722080068a8827c4f8ec0d2d743768c3bc027e9bbf4bf2260a5870c0ea1c462cafc728044a9d564682aa10510b8b591dcc39323fc3ba57c68d561ec8d0b1
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d/ezSC6vUzPv+HjyRLNiXicJFFRGNzj3
TLSH
T16B756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d617f1abe56d7383140832fc3ebd9439f0cada7aaebd000af90e3ba5924cd5d
MD5 6a1977f3949aec67a43dc17d54428b68
SHA1 9c820f40c924202e1992466e5cf8ebddf203dea3
SHA512 7fb2753eeb05bb8c96a488f69dfd32e6af329a9120c7570a537cc9e363cbd10b3e0aec4e0ea8985b06bc35633ef746d476805af307b986ea51f77668d163cdf5
SSDEEP 24576:QVbqPb88hv/l+Br/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVO88hXl+lLNiXicJFFRGNzj3
TLSH
T1E5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0efb943f45139101fa936dc302552b68f54db59f4ff93ce45db76684bbc20f04
MD5 f4daac2619fe5df3bf5f2e12b0025777
SHA1 b671923618434ebdbcc4701a10de1ccb4d898a09
SHA512 68240a526290f38d03ac6663e9c76f22d56b9d8674f76784b5f6906ae5581130feb51cba9bbff9d6f63850b35f36d29b05caa162148ee42376fd8b3b1c7bbd56
SSDEEP 24576:mGs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uLNiXicJFFRGNzj3
TLSH
T1525523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 47eb7a7da62a6de114dc9e26b1f034136cca710fb3bebbe1188d2a3547d89d0e
MD5 140667f9ff24564cf1828453f3db6261
SHA1 066452b44320ff8c02db95f4705d5d21b4094843
SHA512 6f1bbd8cf174041b312130a8eacd308f82e3633a1fee178a442fe3bfa7cdde0f02490d519a0cecb08e7d20a331d7d1157f82a43264702cf363324253401a4ff4
SSDEEP 24576:9JIUD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9JIUDLNiXicJFFRGNzj3
TLSH
T12A75CF7BAE28FCE2C27E4C7957918600E76278304F6293CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 21bf4b55b7040ca3ce6f51fcfad3cf1675f88e4019996a6d7f31c1dd8c4a891d
MD5 37329a449bc64a20960d6a680bfb9dc8
SHA1 7b6890a7dec3c9fd255f0d3802bf632492aeb547
SHA512 f2330b121752de39a0ab361606f489764183f5d480687af2660f45f8a8ad6c3a04c438c832520be8ffd79a7faa6edd77b7ec6d32f3a996f376ff20548290e24f
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THX:8QvGAdlCEL8c/WRNw5CS7wRGpj3
TLSH
T15A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1065ce55cdc04f0de2712cafa4871fd6a3a3b0363c4effd0dcf98d4ceec24d0a
MD5 0ab9c5ec5b3a12e82d51c8bfae192781
SHA1 c835c2a33e717f52836dcb53aa9dd97e855e379d
SHA512 81ad1879bfd5b652dd96561f768e1283f3ee3546b67c4bb0b43db2204c4bb1349f8686675abb38b5a79054a766af2fd154728b5a6877136a137081c5eb962b33
SSDEEP 24576:9fewsAjV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BljVLNiXicJFFRGNzj3
TLSH
T1C875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7b93a080706f327f63e2bac0ae54b886c54121fa3d069558f7bc30c79406bf89
MD5 bc2a4fdc05377972c14f514c21e5011e
SHA1 9fd8e05904a5a555d59889f742215c5f8ead7b0d
SHA512 a8ec3a128c748c6313040d8fc3cb2dc718156bbb6e08fe417a64c541d16a338e7c79f62f70a4c241979771754715abf30febea214c79b6822abb0f4b15d021be
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHhF9:JUEtQevvqc2W1cpV20I3239
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f8686dadf410392d0412ff811633400bd0927110a397ccbd84df3e4980b3a50
MD5 2a7e5f94ee0977a4311506357ef56b4f
SHA1 743c35bb622fad755e431e8d78b4f4cad33784fd
SHA512 e966295925c55851bb00385b0de81b45a573cb51dc69be18d5f7ad7fd03b7f8b10a4ece4fe330574d9c1e09049b7f4d486bf29a06282aff0f5c3019bd48d1262
SSDEEP 49152:pCbRquA/m2yL5zLfFiV+XenmE3/z1LNiXicJFFRGNzj3:moq2Vjnme7wRGpj3
TLSH
T104D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 79e2abd8953453eecae160397896162894ada50df0198fc78568b7918b26c855
MD5 822670d7a8bf57f0ddf6820ff57c21ad
SHA1 12f2eb54c996fb0e22e93afe6dd7d5b457752b13
SHA512 43e85be8f6b8ce9a54638ca65571b7de6a4cd38b4201829fed34ea84a3a21aee85fcb1092e0548fc1d0cad75ded77217e015b24e9823eb3834f4392c507d08e8
SSDEEP 24576:1AhGL6IFoiwtA5l7S53+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1AM5Foiq5uLNiXicJFFRGNzj3
TLSH
T14B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 778f4e352a8fa55fd36530bbc6644eac840d3201bafaa47c581a461efb2e8dac
MD5 50f5e370615b990c2842cc279b667a95
SHA1 744f734f363a34b955ec4dd29177a601bc483d38
SHA512 2c5fa2f69eb96920c94eef8c7ef7a2730eba31adbf8c236dcec76361515511406d683842cfda25aaac369d9765ef1f44588b7deb3cfc68d541afdd26415f39bb
SSDEEP 24576:bwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bwSO6LNiXicJFFRGNzj3
TLSH
T1DA65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a0d126da8ff8e2f7f3a8161a9d38c28c1882dd044108b4b3c686c03e1d4e7c02
MD5 b3df5c882b0fac60ab388d6a4480b7f2
SHA1 9da4a1976aa7009cfb003580a45aa3546e2677ab
SHA512 2dd4884eb075a0994fad52bb5bf4961e507a49a8c4e84a26b5aecaaf677cf92a1a38f39d5aeccba204796cbbed6787ca592aed91ba23b1fe222a7d9480aa71c5
SSDEEP 24576:eZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T13D55129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4bdca7be9d9a5487b9d219ce47b422686b9cc14e9482ce0913cc6f42eecae16
MD5 b66643cbef1e5dc2afa68073b4f9c305
SHA1 72d38b55f82eca5d31d891d6eec38d3cbda4cd8a
SHA512 d3bad1c1193abb9009e58383ede4852d08a3add14097e47e210a88200e6afaa62185b56cd56c98e4d565e043c58f9084f09a22fe59d101abf19f0ba2759b70aa
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:vQyiKanX+PNTF9
TLSH
T160667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5778e10d1c39b4cc764682000997f593480a9315c01b31fe5354b227b2982ee1
MD5 ed31878af065e7bd19010ab396d9eb17
SHA1 40cff6bfb252261e22baacc43b4eff2fd863f2ba
SHA512 a41fe8a83915aaf1e9d30bffe134c5a768dfca39c1128f2ddd1cab37b2be4f6509c4298525960dfee2bfaba21498328f77ae578f342835e6975494177a483361
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:tQyiKanX+PNTF9
TLSH
T15E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 61807aaa2eff17e5fc66f32b4af69a7cf183b9651446d4356d0d373e73020214
MD5 1b3bc2382458123a384620d8b837d8d1
SHA1 c57e482dc4ab5c207aba04ae314b00550c455130
SHA512 50aee43501d4eeb8d61b109c00e97a95832fa52ec84bbc1c04af71b3170cc3f798f6f1c00a34f74b30db531b0a3c07b488b0d24cbc3b5eb3f7986452855aa811
SSDEEP 49152:H68Qg55nhkeWu7PNU3/FLNiXicJFFRGNzj3:xthTRc/F7wRGpj3
TLSH
T14AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 68dc00a88f740c10ba4f8871f5937ed29a0410c14141fae6a148a959a7ca5ca1
MD5 0af1f9b10d254d9f66cfcdc402bee70a
SHA1 b001942db857d33c1d4f0b538acb18f1a1a5880d
SHA512 2feb9fedb32518e3e0aa0f689bbf5cc566dbbc72ce13dcb149f7dbc39f1e16ae5b7d5a6d335fe4ff69e3ab8e8e0f10a54c62c8348033eea873c088515ff6ec96
SSDEEP 98304:2y5112gYy5azzVvU69nLKnhZs7wRGpj3:nLIHRWhKF9
TLSH
T194167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 55a6cf59eee30743e208786f0ab826fe1f07ed9837ecef2623688da3fbaefc12
MD5 55cdb8cc615406fdd06a6c22e0935b18
SHA1 7529b8135577401afadd9979ca30ca9d8709f136
SHA512 233e976bf438e398c4b9de74053549fc71ea360623270b1fbec5e3e2be356f405f9a225e50f3bddbec2f7615b29752759956aa3ba6fb558808304e14d2b806a7
SSDEEP 49152:wB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3LNiXicJFFRGNzj3:qu6JmIxd2d37wRGpj3
TLSH
T1F5D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2b9e65973d70e6d7384ebcb82824e46cff00b218799c54e1aa4019054bccd65d
MD5 c2dfd4722cbaf92075c23aa45583c3d1
SHA1 7b5d48b8e8ef5d9bf31df6d0b8ae91ff0330ece3
SHA512 65d94bc8591d842f3ac90b57cbe7847364549bcaeefedc6c784b197f0f56c812177cb569a18f591ebe77e75b8c678f3144899895f85d37c703ae4a495eb6377f
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xjLNiXicJFFRGNzj3:gmifPqRe7wRGpj3
TLSH
T169B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 641e84441e825e699e9134dbcfff3ad1000f28a6436e72ab9829f2d124547bb5
MD5 41acce39594d579d72d8ec50af947d42
SHA1 4a8b399a58c64940240030907651b75cbdb560c8
SHA512 c970d2f36f59ed685e9f93c6c3fccf75554b2263e8d0b613e6e8cf8ff5999fb3e266b046057c39dac20038a43a9202361717f82e1761d7bc8275dfc3060d3ebb
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:15dKqi61Q7wRGpj3
TLSH
T1D0C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be2894c8880838880423859179244f0964731f4ce79962eec9a62a73223ffdb2
MD5 6443e478381c9689c1a767e575ac19f3
SHA1 1d62cfd4a3db88c200568b665d6d2c6b90f704e3
SHA512 a774aee34508ea5847641f30d779097baae62db580be9833519d8570981acaf149e3d1f335aaf76ab1964a41c8e596d347b6c553f45061c0b262d7287fc7059e
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:eX2iWpha7wRGpj3
TLSH
T16195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 52606785098c3c76f26389dbae6b13528b040483014bfd88a468cc51ed71a35e
MD5 5a64e177224b3fcce3f4881fa008f9a4
SHA1 d6f7ad01315cd47904cddc7394ef2fcc87e0d008
SHA512 db062855fa5682c020f8c4564af6f7e6d9cf09a44376c8992ccf2d4136c4f08f4edec38ee11e9bc55d7da55e944fb8ebd694852af9bfffd68f4e9e4a3ba80261
SSDEEP 12288:miiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1525523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3183D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4b937702e711c94ff8ef934ba308dc3dccd83915adf465ff29b5c701a12018bc
MD5 66c7e4a6c792d49238ad0191dbae67c1
SHA1 04b140909b81b4c27796f180199766acf81b8dc6
SHA512 6bb3bffd47fd653f53786ee7ae7275f7b9c558970d517ba49a25358036db091e803b8c659b97bf76997630bb3e071dd74e2128b910197d665a1a180b3dd1da6a
SSDEEP 24576:M5/TwSfVcYG3K/cJHlnFR+IGNe8j3Izm:ELNiXicJFFRGNzj3t
TLSH
T1415523D3558945B1FABC003986754428F5882E2DEB5618E3E3583D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c58a1ac3a59f9964b4fec3e0598e3ebd457daa917b4b84099f71372b2ec00746
MD5 372d58e5bed78d204790a5b765c4b03d
SHA1 efa7d27d6b9360e957aff332756922659c06ed9f
SHA512 ede9e493798755e402c026df1ead8b50907e3d94494b5c31d3fb29db0addd0f1c48b7310da769ce842ea347d8be6a2dca56b61a4eb6d25a0fe63ac8e24e951e4
SSDEEP 24576:Mb/TwSfVcYG3K/cJHlnFR+IGNe8j3Izm:eLNiXicJFFRGNzj3t
TLSH
T11D5523D3558955B1FAFC003986764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4af19e28035fda5ce5e4cd538896c7851ef668695c4eecf5082b6b7d0d21f40f
MD5 91777f2824f8b6781042c384814b9831
SHA1 4ff48719c19c1ef8f544bbd3665b16a35aae5aa8
SHA512 9cca922efd11853d536fe3206c4442aec25457e1dacda1369c026ac2c76c68aadf3bafd8c7f2d091bced1bd7f8845aa9e30e9e2b3fb1383e759cc7343b1b81b3
SSDEEP 12288:ZV0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153552393168900F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dbfadd85ec0e01db75d612024e6a8b53d4f419a69cc876786d186aa2e49a3202
MD5 d822fa89d7bbe9c8271d39b9b3614455
SHA1 b359f8c5e3efbecd5ce700fc9314aa3fe26ce7fa
SHA512 4a54a305f762f7e41f096ddf37520f770c6919d65e497e1a6a79f4f1cfcf74a378b13dda143cc17ca7b1f14e4c58683ea2e54f6f0a44972b08d2c46d13f71313
SSDEEP 12288:88iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ea3e707909f9de15df012cd799f427b3def8d7bf7bdeb13489c10ee536075d71
MD5 72bd730052e4d2b16056617d3bdf9e7b
SHA1 c32cc6fb339b8ba533dc204ca031c606934daa78
SHA512 a367b00897998b068c49c9c12596f759462150f20c57dd37edc7fe6503d3b190619066fb5a506e336c77516f6a1f1d9edf739044e784c6407d1d82d0c11cc541
SSDEEP 12288:/BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3558955B1FABC003986754428F5882E2DEB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 239f30033de4b11acde53d115459c23ca070a57f06a3b47b56f0229f287b771c
MD5 2c4805c0a21421f941f5a61c8c649561
SHA1 da5a838edbef2bbc3d18ddde6a1f4e0aa369fde6
SHA512 d40c81e03a3d2bcec2d3e14fd053934e76776f796213f55fa0ee725602ebcbdf91b0cbd0efbbecfb0c3003cf68824fa89d03cf757f0262107aa33293f5c98b62
SSDEEP 12288:69iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3548945B1FABC003986754428F5882E2DEB5659E3E3183D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 dd7b8f4e5486c162f76247b8768e2a2945aa34a630384716e917197983e47987
MD5 1e4905328ce1342c654d9b57fbe1112e
SHA1 547eef7611c41ceb4f3f745d7796264e8b70130e
SHA512 712a8f0af1cac283e211202f7c9e37ade9e68c11ffc5c410ec41b435389b0fbda51c6724d8ccb57b749a82391b1042c6f28f02b0c578654ada1df62597c81254
SSDEEP 24576:2ZM3zFVSOZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM3zf9LNiXicJFFRGNzj3
TLSH
T1AF750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 47451f7b4797ccaacd8d027e9eff402b8c890e5a61a39607b24315d9f6372f6e
MD5 56a74ac1a118da4a053350e02975ce6b
SHA1 740b0d33aa804e91af30bd46c08c9c53deebaa92
SHA512 d128f8ad7a9a1ef904d1db2988d31cbaa107205f94c334bac2c44068037c3c45d1488245e896d16a5ea5487751cd73b67678da856e791bbac1279cf807c05fbb
SSDEEP 24576:Ug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz6:DLNiXicJFFRGNzj3H
TLSH
T1275523D3558955B1FAFC003986754428F5882E2DEB5618E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 08a714828455c868c6ddca3cdc9821953e54f3eabcbe586dbd6889d82cb5fca2
MD5 c433fbe967a39920edffc6e8bf189e0a
SHA1 20210ce49cabd4887c2ca25373a67df088fdc425
SHA512 8ba0a85efe77f53e48aa42018e6e1e2c263cc20bfd74a6808e77378f056bd58bd336fb21c210a40285d5fbb187b40cb369e2a4940cceba71ac8c815500805fbe
SSDEEP 24576:x8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz6:OLNiXicJFFRGNzj3H
TLSH
T1CB5523D3548955B1FABC003986754428F5882E2DEB5619E3E3183D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c92c0359f9fd1eb8262eb456ae7a16bb52dab8e2e581e710d1c9d54cf628dfe7
MD5 03abdd0fca7ad35a9d911ab08d071d00
SHA1 b39b0d3da89daa1ca3a4627df4f139ec92e283dc
SHA512 76241d402a1773775eedf881a48799236683508a938b0eade93a82e30db5e295d7749db5298d2be31c3f9e3533c3b0b49e7410bbeb7fd215c54f51653a2fffcc
SSDEEP 24576:izyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iaLNiXicJFFRGNzj3
TLSH
T1A6650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d92c50846bb12b49e282a2a552de90b48962a1be8d1a397e744efe11fbf782f3
MD5 8434ca746e848d906ba97472648df4e3
SHA1 e3ba204daaf5b3241b0b4056c0497187ec970fd7
SHA512 0652b4c46bebdeb38dd4caaf4a378b22a11ef76e00fe10aa41c09a1def4904a4bdf38fe60bfb62972a84a046ceb700f3c3d226e41fe9c49a632f7f27d0c261c8
SSDEEP 12288:uWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3558955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d570be403c4020451c04a8322445eaa36056ff8e9681197009182bf28b3ab3e1
MD5 c624e143ffe39408ce4abaf8337bcfa4
SHA1 c2d7bde2f7f00b0405816b13f142d03d2725237c
SHA512 86bae9653caa53532a1213a704f1b3c2d9f12e6994dd22d39b93156e59d65fb72ed928e6fd9e343166040b246c0d2fb3ebccf27e99e7625c34c665314ebedaf6
SSDEEP 12288:uWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3558955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8d92ad1af66db005d420f9e02fd29856966102a74e244598819804ae627a8ac0
MD5 b6008de40bcb3b1fa3257e6179887b68
SHA1 82e0ce78193a9425617e7f7c2d40c316bf1f168a
SHA512 fd4f1d387c7d72de75e8d50f21381d37482a599041394372b186a6dc4e93463ae5efd9b4190afacd03d6e131df5bdcf48c7d8af71c901e21f2fedbe6922ca0a3
SSDEEP 24576:Azyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AaLNiXicJFFRGNzj3
TLSH
T1EA650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dc6ff2222cc56081ca01e56d7f98ba3a86e766a850b12699e39c51669a2b869b
MD5 9b89a708ec0179bb693d16412cc78a50
SHA1 7f245e70ebb279b401a16205297d0f3f1d3a82d4
SHA512 4072d712fd38a848c62bcfbc191bb30eb04086147bf451704388c08599563fc72462e5c1a0cff7a81f67a9b8cfcb51ad68e9afd353fa2ecfd408cdbb187ba901
SSDEEP 24576:6T8aLl3z0zDL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6T7LljCLNiXicJFFRGNzj3
TLSH
T1897502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 48f213adb25bba26f2b5384bee88dd78d08b092d70789f99fdd7c3da3352b118
MD5 7692af10904da8991e1e1d5df3fdee0e
SHA1 0347955a3f4ecd068137e493d2624e3e0b823ed1
SHA512 e3d8d6b79bccd02803b9885a8348b8c307806d98eac76887e10cb7081aa9a2f8a27e1ed17cf12f2db15b882c463808442a16bd47a7fc88c104b3b5daaa24cb25
SSDEEP 24576:93rd9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:drd9CHKya9LNiXicJFFRGNzj3
TLSH
T15885CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b32e6a73d283e67f467d62632470bb49ecf2c51af7ef8dcde48bcb4b53fb91c1
MD5 62c648895e667eceb39e3f766b03718f
SHA1 7ad74350f9ef48fef87fb40b9d8e1c76ee44a4d6
SHA512 f2d82ca3abd04177f865fe5940617285ca696721bc10d2aff238c4aac7f00eb965570eb4e25c44ee978f7fb5ff078f432e8a08c8ab8fdb15a180390a8a3b115d
SSDEEP 12288:jPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 849bdf958a50b18c54e66f6f0adc6e2cd49643943a80fe94fb33054c5df7ef9c
MD5 d0bfa95bb43b5cec4821f0bf4f5b3f3a
SHA1 18cc9c0b1a2cc0c66a3b995c37e0fad1f62b1e81
SHA512 eadecc2fb65c1758dc123ed5e541d0fed30210661bde3dfd8b8ab3ff7fceed0dde78ac764688bcd0c5e7ece410953688108d40d1bcef1f9f80a86e08ae5a3e78
SSDEEP 12288:1ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5a1570c765951ac6ba9e658d1f5d43f7a26448789d228a3cd42dc31459867a88
MD5 eb7fe3169d85fcb31e4b900e5e1fb360
SHA1 a5b29fcfb4859240f03d6a40b038da2c6d6cbdf7
SHA512 627746e9a01aac0a7f59d1a45512aca31177cfb7984df07150915894ed93fb6c0bbe70d8e42c05f97f3399cc27677c2e4a82339b7fd2eb799aedb8b720a996ca
SSDEEP 12288:0YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1e455695ce0b3d3ff3024687f1a392d1714d92aebaaa885a12923587be6060fe
MD5 695631724eca8be0702f264d77f50789
SHA1 818fe540726c638ac149d0fcde61f227ba1276b3
SHA512 9854d654ef2cd51ddcb185e894ef461823494f7e0ff29f1b0e50060ce0d5883463830f8e3e7325193a621daa7df5a6a64a50d38c4f2acd90bc31f22a089c33f8
SSDEEP 12288:LWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3558955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 52368fbd87227181a8787d3a6efaf5573c65fe0e54001da6e43e5acfbab75dcc
MD5 a4b3fdf77fe7d5f0b2a96dfcbb30fdb3
SHA1 177b42e2c003a07db0cfa214eb6b105bafc64b70
SHA512 68e5dbd9df2e94ba0aa569995b517a5461c2ead8a84f28b5253c6e7a8b8c10e094a42b005e2188968f5f093a62b8166429ed9581d656fb7960c1a72baca5ba45
SSDEEP 12288:QPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9d2962f6e7ac571f2123945113517ad1afa3240433ca992ec69272119f6ddd25
MD5 3a1a4cea133d3c29bde18612add9f7a7
SHA1 b032bfafe2f081bd821d78c3a0ca90686188fc99
SHA512 a23d12999169871e77e7e100d275e6bc2481a2fb07cca10cdfa759667f2a8dd8c050e7633ce44b8a19a4dad61bc060ddcbedc472c7ba76abaceb83053c3d512c
SSDEEP 12288:r+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 43f9c5ed71009b149de87062d0ccd93fdaa192860562bb8074a5f3fb57863f06
MD5 2db64e5add60a3d39241697289ca409a
SHA1 d83694165a47e8fd4de8999a7d88d85990743d8b
SHA512 26d2425cbdbe424e3fa06859eca6e02f7e7df138963c0a3fddce7fc6e29bf7109834fe9f0db8f478775857bd50d4a25d76b6e78ba01c167a5213b67f7004e5e1
SSDEEP 12288:+8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D05523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 511e814f8fe8000eaac56d101d0e20e202feec393fa215997c9eacd71b20249d
MD5 bd3480190ad98157799dc16e5538e64d
SHA1 3b3de8ee37085a1d8888bc04918e1aef9cc3e141
SHA512 96b3b9bf0c8991b136c22312642b9589736d8ee0415fdff351529f0d751134dcc4b1e9a4658fe1fc7529277ad6ebf06dea83957a2987b3ad00fb1c79527c93d8
SSDEEP 24576:6fwvzk9RX6wkyAIM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BMnYIMLNiXicJFFRGNzj3
TLSH
T1BC85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 40bc7e66f9a36442454fa23689c9c0a039e885799189a2ab20db2e7e941b722f
MD5 5e2d05362cc1bdd42c5a84b2d1f1a5a5
SHA1 8975af2b74e14c3307c79b74fd0f736c75d471ec
SHA512 360177562e187e4f2ceb595b783ebf9a740384d2087b530cf6d1498856195e853471caf91b7f6cceb4acda00a218319fef35f442a8cb48e0d0d3d664f2d5693d
SSDEEP 49152:7YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nLNiXicJFFRGN:GySzP/7wRGpj3
TLSH
T177066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 39d77d15eb37157973d9f125f7437fc5f6482cde376b8ec49bb27772c715f499
MD5 495305f374a42bac11b852b6f2773546
SHA1 f9c90df539969580715c47e9e1f76c4676fe69d0
SHA512 75bedac4aa1bb34c541e5acbf7a8e140bdd2916592da20d9b68ae4f9cc050d70dd692fcdcd41e5b2e2114b8a18a7b35ecb9ae3cb5e296af69c2683837e1f9e30
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x47JUQjqirIhCnDHUPfF/3LNiXicJFFS
TLSH
T12E65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1cffcedd758c87032da995a2f86fee89c7f697b8f8af18b540eb6650ba1cfca4
MD5 2ddecffbdc3069b787792a5cc34bb237
SHA1 e25d57dec9d04b68caa123322b4c6b33ee3144dc
SHA512 fce76c000b633c3bef88173d4a16735aadb86fc2927c19320d2bd2c65986fa0c1cfc3b2671537f3ee28dcf112ffcf137d331c57a54c4cc6560d21cd63489ec0c
SSDEEP 12288:4psfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f823a4c671b143862da3032606139b6b0064a009ffbc20bdc0ef4b16b453f6b2
MD5 a248cebe53ae4c9962ac215765a5b5a0
SHA1 813c4276c59e285119a497a212827f897a4a4b3c
SHA512 312fbd4742e5116fdaa4325dd37bd560c028f9e218bbd77a7ac924381d8a4117fab85d0787f1efd0b13242e12b3a1ad4f88386398709f5062e8c501e51240366
SSDEEP 12288:HkEhwXWU3fnP82SndBbjjrLR8nLMJgv8aRMHg88ahfyNJp:HkEqmUP8BzrLR6oWv8aRMHj8ahfop
TLSH
T1314538017666DB4FC66D40322E32C6CCA7707D01EE056F03B2C99B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 81077d81584daceb98165d5213783765d6f833da97ca59106610fafeb896ed0a
MD5 e6ff7627b92082eb11795629e52a2f94
SHA1 cfb3bfec75842600fd1224714086775040568cde
SHA512 e13671c7746b47ca1c3826eba8bd1056769114fc3225e724caad87ad506c498224be01afb5f209df68a79d9aaf4810f3533a6cffe08f00df81157e8da7109e60
SSDEEP 12288:jt1ozPWmSO75GNn073lRKlvuLkO4RNZE0TTQ4VdTaQF06PNl9JzO:jt14PfJ6PNl9JzO
TLSH
T10D55F8819137E78FC1BA6032072A5B4C77A4EC47B6056F27B3C9553AD82AB51A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ba1e8aa4e7a8753a5a66c765a59ec1dc9568f016e510994e355937842f74e8ba
MD5 983f96cc41fadb3e1672ffc0153139be
SHA1 e93bb2e1e40cf43fce4ba59d366fab4b02190e05
SHA512 f297c845955ba9f87e485db4f9b1fd98d88d6100c763414fc25976106d848bf03da0274f0a4065233e7bda84c63a017f501a204fe58682e5c11684966cd0fd17
SSDEEP 12288:MF7OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523A3468C59B1FAFD1039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3fdb95af06b1b2a0c49fedc638773358b69383751e5305fbf06d89d7cc0b29b6
MD5 4a090e6434de550c64a69f8d14eb74d3
SHA1 26b3481971bc1a1ebc6d3ee7c291addc43591624
SHA512 aaed73e4968a0c87eb9be4f07ffb23ae644c6925cc3977cd1fc4afe7d5905b72947cb7260315dcae7858cbc8613a9a5a865d1089ffd3987b13109908048631b5
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vgb4mBIBhGFpLNiXicJFFRGNzj3
TLSH
T1CD65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b6e7be8befdc7fb6970977c28c6ccb6c0ad3df26b358000818264b6aba5f2524
MD5 ddbf988c1160b0a671f0b82abd0d4795
SHA1 bf102a2d46439094c68946c28f9023f79d4d025c
SHA512 e16f2dbfedb09b94c00acd0760cb27962f027b01e5ba2ce2f2fb429b4cbac639b69491bd8ee0c4410d341633f6f60db29ac086dbaf7c4c3b7edfe9a378a7b760
SSDEEP 24576:jG88u8FpJqH1vzria7/mZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S7ZFPqVya7/KLNiXicJFFRGNzj3
TLSH
T16485F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 26acd46e98f9fe84a814bdfb395f0480e2cf8f3a3cab5ac72a2cb1a30c9a64c4
MD5 da12dd874613777177e18d520409d062
SHA1 9383f9d9f19d7b5e4f62d4937f36dacddea94401
SHA512 9948b48a92bae8eaf1e84a915f001691d862b77500065614711017edfa76e953bbf3d680ea3b5d44f951cf47a78252e0bc16955e7d33cfc260cd533e1f3bd125
SSDEEP 24576:YPUr+NQ9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YJQ9LNiXicJFFRGNzj3
TLSH
T13065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e8c79426caf905f33b601f22475722b8ce3260855591a82d2ccbf6c1e664e3b8
MD5 f29109e7e0417e6a5b99b36cf410dec2
SHA1 256d552cdb3a4840fb010467d584b2db2818902c
SHA512 059f631edbdd36399ba06eee3792237fa6addc1bb1d7475d9f2efad05719fa7aa31e5f34aa9b39ce47198154247416e1d5e56ca3f3910497f42892f013737595
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtLNiXicJFFRGNzj3:wG05lO43b07wRGpj3
TLSH
T11BD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4fee8666034ec9eefbf84118d399dcc9727f1f9256384a4681c5761c673e2a3
MD5 d51c8fcaddcfa871deaa85f0fbb63998
SHA1 6badd729a0dd60005fa47444334f1919e4f4a440
SHA512 2706b25bffabc381b435df36e6fd50a427514eefb9ffe20e33dee1b5857552ec009911af597b477ba741b7e3d999c9baeefe7eb985a2f6c95ebd569a4d591875
SSDEEP 24576:sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnn/TwSfVcYG3K/cJHlnFR+IGNe8jg:0a5POZ3lJt2pasx2+mFLNiXicJFFRGNf
TLSH
T1A465BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 730edfb7a9a2163493a5bf8d4c04df84e66eea23f2bfeee26859e319f8914874
MD5 3c835d3b4e9f17b5595e85ae81b9e4a7
SHA1 45302c0326783eb25a8c7433e4fb2cc43377c935
SHA512 d8d8a0fa6e521f8b582173b7b5324dc2bc3cf696ccd6f1ca67a954bfadac14b1a1c05d08aa304cb5a2948dc49d723d435efe4e29dee4f28cd1e2ad0b1c5dd6e0
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rNc/zEOVHFqLNiXicJFFRGNzj3
TLSH
T1EF858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2c7fd397514d2a1caa69443fdc6cae3d438ba9aa4cd52fb74babd0c96b688b8
MD5 81a252583bd08cde4818de522b0bff4e
SHA1 623c043b0682724ae47f70f894f3842413fa0df0
SHA512 866eef3095153394fa670a56c5e955a71be8c53c40e38b7e8773e0e40024842e23678f0129165a08435264c94c44c2851272df4754027e16f42a7ca64efd3b0c
SSDEEP 24576:9zkNvNnaFeYhJNtmZBmT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9zMwBtOmTLNiXicJFFRGNzj3
TLSH
T1B855AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 34df88bec0521c78de1f32d7d97c25d1bd86dc41f326bf991534eab9f1bda5ec
MD5 5796c32c50267cf70721bc0e33c6349f
SHA1 f4fdab4be293b4d1bde3cd75a89ee278e6d4185a
SHA512 4b0f50d0af6c897ef22b9efe96a53b45c91b014268cf2b1972ec7b47ea79caffc3dc49be6e854cc2c5e148530c93cc96b59ce75f06fe1ded4251c93601e3b11e
SSDEEP 24576:0D3FHshBIYQgAE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0DVHeBIAAELNiXicJFFRGNzj3
TLSH
T16A75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/248-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/248-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/248-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/248-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2112-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2112-128-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2112-134-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2112-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2112-136-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2184-121-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2184-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2184-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2184-115-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2388-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2388-295-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2388-84-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/2388-79-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3480-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3480-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3480-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3480-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3480-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4112-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4112-13-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4112-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4704-77-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/4704-1-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/4704-0-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/4704-6-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/4704-7-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/4888-102-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4888-108-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4888-314-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4888-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4888-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4888-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4976-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4976-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4976-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4976-280-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5304-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5304-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5304-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5344-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5344-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5344-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5344-247-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5552-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5552-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5552-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5552-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download