21ed17e993192601a830452b7b42fd23ef2f0c2316b441ded581c8e89729d91f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample261030-jbhgqaav21
SHA256 21ed17e993192601a830452b7b42fd23ef2f0c2316b441ded581c8e89729d91f
MD5 2f3e3c3c48c4432616a6e958b4eed11d
SHA1 66a9582cc28448f190276b385bebbb63779f75b6
SHA512 e77fc8c7d8688f0f35046a06a961ae6908b9e7a1a8f06796a5c8c119d85157cbbd211527f219c8250f8d6ab0886e882284ad36ed3b8b17fde34bac6e529ca55b
SSDEEP 24576:a5GtI/4joHjto1GFxlXutIs1WZX5ARLN:mGC/4sT/M+w
TLSH
T13575022175D180F3E573153019B2AA71A97EFA301F6419EF63805B2E4E742E19E39BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4928	elevation_service.exe
4724	elevation_service.exe
2520	maintenanceservice.exe
956	OSE.EXE
4720	PerceptionSimulationService.exe
1748	perfhost.exe
5740	ReFsDedupSvc.exe
4404	SensorDataService.exe
2720	ssh-agent.exe
3656	AgentService.exe
1496	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a18989dc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000edd679784068dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004b58db54068dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8fb4e7a4068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060da5f774068dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000209074774068dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001aa250794068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	3656	AgentService.exe
Token: 33	1496	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1496	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1496	SearchIndexer.exe
Token: SeBackupPrivilege	5740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5740	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5904	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2796	1496	SearchIndexer.exe	100
PID 1496 wrote to memory of 1328	1496	SearchIndexer.exe	101
PID 1496 wrote to memory of 4468	1496	SearchIndexer.exe	102
PID 1496 wrote to memory of 5492	1496	SearchIndexer.exe	103
PID 1496 wrote to memory of 3948	1496	SearchIndexer.exe	105
PID 1496 wrote to memory of 4644	1496	SearchIndexer.exe	106
PID 1496 wrote to memory of 2940	1496	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2b3a65ec64c3b3a13faf949c6437e8544d29dba25c9d62935beecaa844e0ce44
MD5 985e21e80f4b2864f8f90ee664ddf3b6
SHA1 c05ad7447419b25010910d132adc61a6dbd63b7a
SHA512 ab175f8c7a2cfe6d5089cdf7c51bba302f92a54e9457f66648ed66a2745aa0f09563807544714fc55473078318c77dd2ccf46b54bb4a3522395e0319aebde272
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMT/M+w:S3q6HjBRw
TLSH
T1DCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ce3053ef1e571da955500aebebec2564f59b06ace2574024aab620a322df9973
MD5 5395b9da07cf0c04a83a381e83a78316
SHA1 ec39afccdb401dcb850b75668e1eb63033b06f4a
SHA512 82803fe8f2f8b669cc3f9426cd9ef3a9bc80cecc03c494e61d411ded3628e5798def5c39aaf5dd268f724180a455fef9babe5fc387173a897ccc023eaa32fbd9
SSDEEP 24576:hXYfDtczAIoHjto1GFxlXutIs1WZX5AR:ktcmT/M+w
TLSH
T1DB85F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5fdaa97aeaa117b769d0f0bb1c3ba169c2304e2eb1cdfc2cd200f25ac6b0e64b
MD5 ed879b16744b599f0f123d8769fb5356
SHA1 1d9c5e39e58b910976065ae13e7a48b4be51e4c9
SHA512 11ebf010dd11675abd7d761827273ed32d3b960061a0db0ef9a9b173c4e42dd8f0f93fa6f7c5936e93011ea4e8aa3ed5a0b41fbcb305474453df083c9a5c0ce7
SSDEEP 24576:50Le5ji0hmxIrMboHjto1GFxlXutIs1WZX5AR:5Pji0AGXT/M+w
TLSH
T1B9959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3c12043f9f2abbc4a5d975cc01e6dae462cf6e53ab94f5f401965e30a9da59f7
MD5 da86e5a93e00aea6eecce245f7c068c9
SHA1 4244df464885fd28baa7ec155c51b1048d67f7f1
SHA512 762c2e7054a43f27aefd81151d5f2b90cc5f8d88d55329ad87612d36e64fb48dca115ca686ed62f529b30db55e456c84c0d5176f03446d1820c986e8820d7913
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuloHjto1GFxlXutIs1WZX5AR:P/ezSC6vUzPvxHjyzT/M+w
TLSH
T1B1756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089DB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ea27b2f2b70dd01fb0f2f41c305836c53ba76e763807097b4969efe274ad59ce
MD5 7953f32cb8e51bbc7c02b6c11d2e15b9
SHA1 ccfe239c554c543df693e9b220db1591977a6f79
SHA512 2387f3a7e3013eda291730d9b198855de484d4728121bf9e77fb7f653a5e8e863d0d94ddb61f500724fb5c8ddfe81d82ba729cae05460bb0800aa2e91f1a9a5a
SSDEEP 24576:2VbqPb88hv/l+6UoHjto1GFxlXutIs1WZX5AR:2VO88hXl+gT/M+w
TLSH
T1ED559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f9368db251cbf474d78cb3c8882dee2a041063dc1a5a546126a3e45eb8174359
MD5 9eec48e1e6783850ea6ddd03c3d936a3
SHA1 80487b5ada0e98e3699bf9a38fb2c5eac5ae7520
SHA512 eb75a74f254f88f1151b3e59259aa2bfee15dccadef26c761a107b2668569eef7b28224c7a3bdf05a835423904e14802adde236cf2186f05f4626ac5ba5bedea
SSDEEP 12288:rHhhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYKN:rHnoHjto1GFxlXutIs1WZX5ARLN
TLSH
T1C965236399F250D7F77A11B02DD77A61ECB7BB06084824BB8B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d8b0870ba2add329adae04b7490bb41574c6be0f98bad81229a9680c3ffff6e9
MD5 56d5976c9d7c546c98e82c5beb9db9c4
SHA1 8d3556fce29f3de1012ddf70bca3d73e8abfadff
SHA512 75f5f51c630b17f6e8d247659261a6c7d6c0ffcd4925d1cb22f54d348a7202713f3d78c30609112103b07d36e2320f6b5c601e7eec71c5172dccf1fa94d1f35c
SSDEEP 12288:+eBNUbTVO86UmhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:+JIUMoHjto1GFxlXutIs1WZX5AR
TLSH
T12085CF3BEE38FCD2C27A4DB85A928640E77274314F51A3CBD165C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03edc10bb233054c24d0a562de7a40b9480f4b21ff3f117f2f0da46f7b2bcff2
MD5 585cd344691c59e5313903f72841af0d
SHA1 44216164ead2425da566d4680333a1ee03c93546
SHA512 2c664c21a13482f2c170326da6c1090e3c9ae12009b082a5442f99c37f71427c4b28bda8be93813219c1328ac5ec74d3f71854c1e5665d876dd9adf36a50201b
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:fQvGAdlCEL8c/yRNw5CAw
TLSH
T14E266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b7c4fa9d2855cff0b791f803fe6a9c28aa6ec8b7158d93085aeb64654ee6d66a
MD5 3b2c80e0939f9180c3e255067aed69bd
SHA1 dfa3677d05dd741bda4da50c48a49eccdeb56af7
SHA512 8413c08886cb3c8d90cc0c2d9cb273db1796f9794c7176d0cd54b45a5b73fc293b29f10fca0b1916efbc0e452a997be9cded731f1e5516a3cae2966a9f809f17
SSDEEP 24576:N7ewsAjmoHjto1GFxlXutIs1WZX5ARIN:FljnT/M+w
TLSH
T13585E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 76fca8a79cf5f8a5dd2d5997fbfa273cd5f3a34d9de2d059fcd67966101ff8ef
MD5 aadabb6e3d2cc8670225b249a505a20a
SHA1 77804bc5398068b2cec72b51adc1d44602bebdab
SHA512 23bb79c60a90f758b3689d600d53e8b1e3f0021dc2dafa8bc4c495adce3a13a16790317e1a486f836a3af3c4ed05e2a20af4aeb1b10efe114cde1fc53da495a4
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8:sUEtQevvqc2W1cpV2EI32
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67b96638448d84872bdbfb5219dd242e88d79fb7d2cd863abaf89f31660186ba
MD5 27b5ec58b378f1b5bb2b67ce292fca5a
SHA1 170fbccda11ed5ba5ae378c3810f78d9dd923b2c
SHA512 1d421e00513f28e0a9f2e739b8740b7b991f3adb59ca0d21366f2639548f1329cae19e7ec74b1f1053304006cf7311b6d21850b8dce542d5966ff281fb00e40d
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zHT/M+w:xoqtVjnm0w
TLSH
T1F0D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 375caed24c5491369df05683765b4b369275ac953045beb41aae51872e9b6837
MD5 5a6530fd116cb27f64147a4aac518cd7
SHA1 a5220dd4177b7cbcc706ac334e249262d4a3052f
SHA512 c3cb264b326e649a9f550d9dbadc8b91f8401411f590c0e2e1155e6408c386913e3fb93348713f7eebc3257f6544f71fd4478bf888ac2210e1c344a72b5bfe35
SSDEEP 24576:JAhGLJIFoiwtA5l7S535oHjto1GFxlXutIs1WZX5AR:JAMyFoiq5CT/M+w
TLSH
T12B35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0cf10aed1d1a9058103993349c61ea44943502b8bc46ce1230ed82ecd9e29fa9
MD5 a5a132cff180f68715be4c5ab8408ea9
SHA1 4727d54cae2d1b35c09c7937752567e00b63325f
SHA512 1d2a0f05bb2bdf85c278eed8d5753c5cff11e638586069dccc336a2bfadbeea47efe2695f84945bdd71771f380f8d4f01adb8649f2d8dde8dc65ec4ca27214fe
SSDEEP 12288:wmw5HEjsChNDBFgl0WDm+C7hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:twuiOWaoHjto1GFxlXutIs1WZX5AR
TLSH
T13885F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1fc7f70c3751780eb40f89b290751b9e8855f55119ca37cf9a1da1deb6ab9290
MD5 5b8f206f8c8410666a438a54e8affe02
SHA1 ca0c44d8786352a4989bfb3efe3f8e50d7e05cad
SHA512 9a9a1216c1a122de847fe425961d48ef3c988720f85b69adeacbead26ac11e20a6c63d2980388df6b143f7069d0a540940cef9d64935560d3c8dbcf92b458709
SSDEEP 12288:tTZ1IykhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ZZuzoHjto1GFxlXutIs1WZX5AR
TLSH
T16E75125636F020FAE2A752789DE35A55EBB3B013173503DF06608A2A0F375D06E397B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b3433369c456e05ea525bc10cce879e817842418854f0a7496b88fa54b08288f
MD5 7a55cdfb1de015931fdf2b922c9320b9
SHA1 26d7caa5f4e339a75755c7e4f9d8e30cbec80770
SHA512 fd2679d7a391bfe8e9489803df1816d667ddeb2eff192dc70dd25660ca2cbbd35dafc7e31bba0d6dfb5bcd279126a6d4cba6aab5adcdbd5c003a628ee82352b0
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:RQRQyi36YOcPQLvw2gAf+PN3tw
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ea0ccb98f6f6b04082d831fb65af64c2b8655405092f9bdc47f192ef0c395909
MD5 f9e625ffcd8bdb11e20938a0efb19b88
SHA1 bc0395c915f87df9819e58dcfc89d94faa0b2fec
SHA512 a878929b2c104e5a18a1ad609704e7a55d8aac577d745d4684c073a732bc7e5d82bd0dacddbed3b736d95db1d00e06519fc4e0e5510294cbe1325e10d56ef5e4
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:kQRQyi36YOcPQLvw2gAf+PN3tw
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 75eed4ca0c36b7904e7aca69aff8b121a2b13ae6e0b0195fa751c38fdcacccae
MD5 807b9724d373b8cc2bcc5f4af1061ace
SHA1 3987516b7c8f6e9c232606d1bd3d8d4dd3579b81
SHA512 1e6d867dcbec305929b013b21dad120df7ed92329fa6d25b24a2e478cd6e5156f9de4a8a1077648a1a25b2a08a7a17b4f29d2f0cc417e27daf38dc9483c8bc55
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DoHjto1GFxlXutx:U68Qg55nhheWu7PNU3/XT/M+w
TLSH
T1AAB54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dddf9d07295f8899e9840d0a93dbf61e47360565da26804e61c3e64cdd86d3c2
MD5 11dfb509c6726752a958eb7a9bc62ade
SHA1 c17bffe74ffd9e248e49386a569ebb72f8e2fce9
SHA512 5b48c4a6f69566053131c951110d905b13ab4e37b584e9efbb546283c490640c74867c94cfb9bbc732115e71dfd8e5e3237cd32f01fd7ff8613a2bc89edbfe54
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:Zy5112gYy5azzVvL69nLKnhZiw
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7f0f79e595bec1a44bb205ccfdfc47ac5f316e7d031cc2c4a5e8cd74385786c5
MD5 18a8f3e980abf235e2879c3294e15a35
SHA1 82d53b34edb47569a17f54dabddb4208a34c2240
SHA512 15293a666715ca4aecf8c060cdb71432a8e21f955dffaafe3295e571794d41a2855e84f121d005cde42381700ea78adb917571796fdc0d4a907c7cee2e785749
SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZT/M+w:+u6JmVxd2dVw
TLSH
T17CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6922df2591c75ca6b7e772084166c859585af8f59517f6f0ff86d21777ae8dd8
MD5 3057315f3d5855b8c2c62e3c952e1662
SHA1 ae867d21e8bf147e3dee99a1e0f91abdc0c7e448
SHA512 24a7890f7cce88b7ecf73a726a8ffb9973a429aa9fb613d259a8e7e7b4374a66b80bc167154363f2e1fefd0418901a4d3be4f802a58c54b67f1915638c429202
SSDEEP 24576:xhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3coHjto1GFxlXutx:D1hpsNoJpF1A6UU44CwH7R4xlT/M+w
TLSH
T183B5AE13F2D900E8D06DD17887569632EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 649895ff4a61734db7b9ae9780e383cf253dd67e87463f703f6582b511e139e4
MD5 76da829a41aa5219be3e746a75be2ed8
SHA1 44381f34a4b61dcfc40b446308b75c3a52e40fbe
SHA512 fd52295e0d81896ded08975ace15225686d510f318ec4150afb88cbb8733056097196ddc04da42c3cd3f53446c82066436ed7318e2b80edbda5ee5b62ee5e76f
SSDEEP 24576:g4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqzoHjto1z:gSuZQIY0Be2KRRVtOnks6NMHqcT/M+w
TLSH
T174C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9a8071f0584ccbbd2b0f615c7e334db40146ba502cbf3c0d5ce5372e3a633e52
MD5 4eb4dd0c0f49a1f7d2fb14ea1cd5c2e2
SHA1 18e5ba0860d19e4b1791916d6bd148418ecf6eb0
SHA512 3482180c0e577172c24240bfd7fa7f5f3b9fa806f25fbaad5a5b5b871885d176c8183606a750ce09a0e56f3bd283459d9ce7cb03b1be7d4e409a9bdacf577b3e
SSDEEP 24576:jhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLcoHjto1GFxlXutIs1Wg:jhtSn8EApI0figngiDn0AP5wpT/M+w
TLSH
T17B95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2ae388e4da379d6c682f8b110844b85491c9a6d3f98af85b8dc2b809ef23c15b
MD5 304a8b5f10e47d268a4f5ad4e850d605
SHA1 806634208c2b3650d7c46e01e06074af3a953384
SHA512 e1221e220638263ddd8b045fc270a961fe99e624cd7ee6c315538eb5aca4c542d0dda5b704b2d6687279b42063bff73ea1d54d2045a833106aa0349c9e3d7f56
SSDEEP 12288:YZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Y/oHjto1GFxlXutIs1WZX5AR
TLSH
T1BD652363ACF340D7F62551B029C77AA1ECBBB347594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 121db657e843661f248a6f9338494613fe0daf1d747930827249beeff9033f12
MD5 6f74e29b27d7e281abde539b25e47f52
SHA1 5779e1345d64846aad36d63acc76bad64476fd22
SHA512 49e5d3ec8f5ae81e89e7524be03794a7a36d024e854cdbd87bfc5302a9755b79c1a210a56a27085692bf13aaae908c856a3343759b4078445b6788717a976323
SSDEEP 12288:XQhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XioHjto1GFxlXutIs1WZX5AR
TLSH
T124652363ACF340D7E62551B029C76AA5ECBBB307194920BB8B50ED190F3D064BA766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f4c6dc4a6c008b625b4c3979f015d654ec5c0f107ed00e7efc0005e53510ceb5
MD5 5bd8a5384df275452bbcb7d7996cf710
SHA1 8a66f3cb01537ae04ab54728af77928a209b351f
SHA512 65019a373fc04c6d76f9475ad6f3abacd748d37396eda1209f0e23ee43176c001418c588879b3921e5bdd77915f1c15797c8e34232ce5b55b24d50b5162fbebe
SSDEEP 12288:t+hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tkoHjto1GFxlXutIs1WZX5AR
TLSH
T13A652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 7ea7ad5af5cf77da688561d23e3f426e274033fa572e7665aa37c501a102ec68
MD5 41320585aa24ecaf4c1d863dd3324acc
SHA1 e11da012faff2c95f539edf35f56388426a7cee5
SHA512 f99c6a4cd43da4e9a6473c2a8db7d7c8facc56443fad01c4c2120c7b27a3dae69126f8d06799a915677d49ae4ab67d5b37c7507b1a55a984070c499d9f536550
SSDEEP 12288:uV/hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:moHjto1GFxlXutIs1WZX5AR
TLSH
T1726523636DF200C7E53692B09DD36661ECBBB6465B2521FF8B009D190F391A0BE75BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 147c9f535675cf88e2cc9c402465544429f7e6b734c4df1ba29431132c71f951
MD5 33c578d098f8630992f070ae38b7cacd
SHA1 8b9ca121543b8d2f073c499b74a0013a12e3d15e
SHA512 55b242899fdab04462d149a4d1bb6c998705e1955c2cec5a5296b9c67de21a951e65bd3bae12281c2bd292db5807086c86b06e1d899169f8b062c2df6c674297
SSDEEP 12288:ynhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:yhoHjto1GFxlXutIs1WZX5AR
TLSH
T1A5652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9e79783402701b241d8d6121c0ac679633f9071ba6a4f3f3156786590d8f5ad9
MD5 887ca390965ed77f1155125dc25b55f0
SHA1 3954b4ad1c33f602ebb6644f2af140a6b9a6d8ed
SHA512 a9069488938d941c49c0dcb93a1dc6e0877e98971bf7271837528d246a0d3bf615382bb2df53736423c4752c80ec1b638c9547dee7550737d10cd22b35db13ae
SSDEEP 12288:KshKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:K+oHjto1GFxlXutIs1WZX5AR
TLSH
T174652363ACF340D7E62551B02DC76AA5ECBBB307194920BB8B50ED190F3D064BA766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 79355e7ddb43d7775df0ad2bff4e3574df35c532dffa41ae13d4abb6865a3668
MD5 123bd9ad61c7ed01add1cee083240a38
SHA1 2fdb5af3eff2d6f258c0e23ecc04d0b69ae41cdf
SHA512 11563708b78e9aae79f20fdac9de2ed47bd2196def7ad2de34e5c163ad7e32424dd1c7a3127e047dfb1a46b9a4eeb132da86cac3ebfcf38e7f351c54a7f42bcb
SSDEEP 12288:KYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:KqoHjto1GFxlXutIs1WZX5AR
TLSH
T162652363ACF340C7F62551B02AC77AA5ECBBB347594910BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f91ccae5a6db9546e085a3d8224a9f82eff6a70f5193cef5c76d95dcec84ea7a
MD5 7aad42b5905a070668038bef1e277423
SHA1 2cf57b3a9b9135274c52177110e3df74500f4b10
SHA512 d4a8baa2582468f3a4e549a3e86d1eaa2f0160ddba19deda5685a44afb50734e6af4147ba41ec34499f48c46bb7fcc0fe6932610f68ac0b8c43ce2e65732e4f0
SSDEEP 24576:OZM0zFVSOCoHjto1GFxlXutIs1WZX5AR:OZM0zfPT/M+w
TLSH
T1268502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3a02e1a2cfd31700409e155eff45796f46641154a784c5cae782bf06834ec571
MD5 fcf41f20fd9dba1d89967d6a994c9ee7
SHA1 a957f3d7c2747069a9018b926c45cb01716b027e
SHA512 9ced02bc4435a1dc1e181554822c1637bdfeee27256a43d7637f7b230907ba2c286cbde067b69a4a61e5381b8d2665a92f2af56be45c1481eee7f3eeac3d2297
SSDEEP 12288:NNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:NjoHjto1GFxlXutIs1WZX5AR
TLSH
T192652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 07708577ef8070d8001b2ec500a5a5cbe4707e3f315bcfe0d05af5deb1afb9c8
MD5 6b0867df211ff581c1762f8584ec43a0
SHA1 724e8213f9e5d47e93192b7409685ccd109a19ac
SHA512 0dce1cb3d9606c0e6957023e84e17b48f0c023ca690b85217354910f7e7decd0f9b580befe4dd0093884cddf2ba561cd26d4e920db87b410beebe5a506a25ead
SSDEEP 12288:SxhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:SXoHjto1GFxlXutIs1WZX5AR
TLSH
T112652363ACF340C7F62551B029C76AA5ECBBB307594920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f0fad9c6c239ecb276d1095debce83a832789781ade9fd4c61e396bb1d98c1cf
MD5 b98105fe8cbc76d7973e7780cf47f019
SHA1 749c6b3d35d1cbe0580f673d2418ae10a4d21887
SHA512 da7a7bfcd3745e8c3e4e608748e8da6aeffb01975b269f71b1753b5c9b8e49f4b8b586fe9f77d76e1ab1f778052979aca2d6703a68ee39456bef5047d4d47bdb
SSDEEP 12288:+yPz5L8khKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:jzyWoHjto1GFxlXutIs1WZX5AR
TLSH
T17A75025776F130F9D136927489931A11F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e5297e82f1518440b9697c2c1cb23bc401105156204f264e34e3f3b8c3c8f727
MD5 cfef475110a844dc353f191e8b86fa22
SHA1 a9cc3bfa797c2600d3283124b6925f6b0039d93d
SHA512 09832e409d22462bfbe90d18c4b3b0e63f3a60c5e837e658c26d042a1cde66a8414815cec2b6955f1fbe5cae429aa3d0634214278b2d0e1f831df2837ba7c483
SSDEEP 12288:yNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:yjoHjto1GFxlXutIs1WZX5AR
TLSH
T165652363ACF340C7F62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 27181fe732635c1237f9b759ac5c330b0e9c4bb1f6fe0fd5a12fa642684e718d
MD5 85faea32df5c09c49b96999fb3905d83
SHA1 d68207bca0937e8669645417f1c16f8fbb1f114e
SHA512 988559942fee6a92dcfb165bd42f06907455395d5937d1847540929c181a6ef4caaa080ffaaf3cdc26f9d5dfd92117404d8f74d0a42c22857339fa41134e2e1c
SSDEEP 12288:uNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ujoHjto1GFxlXutIs1WZX5AR
TLSH
T1AA652363ACF340D7F62551B029C76BA5ECBBB347194920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8f556f62c7281de1df967b8a13853a2ac1257b723cf0738e5b87595be571b0a1
MD5 d0ecfc94ddd64467fb1e902d1f9d562f
SHA1 8c9d711bdfbc2985b438f380b46cdc91a898555b
SHA512 4b1ee3a58c934d90a3c370ec097bc5e853dd999a83bb8f36d0d33e092f6df78b72336ab8a52e0b8ad64ea444fed8c1a8913c5ff2c647b22436d96c52b85c7f12
SSDEEP 12288:5yPz5L8khKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:4zyWoHjto1GFxlXutIs1WZX5AR
TLSH
T1B875025776F130F9D136927489931A11F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2476be5a811ff0255acd19985565e24b8a9fc86ebf541e795c26b61855ff90f5
MD5 9307c3aac12982a3edd6f6fae6842429
SHA1 a6eeb6787409352c8ebc65321e527f8f759611ec
SHA512 bc4fb65843fe00bcc76162e9f7ecf8b5fde0ba22e419b876a60ffa5e659949dd68ccac5a5e9c440e0ca181f7aecb85082f11c71c30d9ec24b3a8f954f69eb6cf
SSDEEP 24576:4TNaLl3z0zD0oHjto1GFxlXutIs1WZX5AR:4TALlj2T/M+w
TLSH
T1688502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 71f52f00bd676b9437e4a11b845110cd5524a381a1d329f14c07a0bd5a1e5f97
MD5 9e367bf262a1ee6bdf3b7931d0bd6901
SHA1 76173fbc2757e81234a579afc8f579b836b66708
SHA512 ae4086590903e684fe20f5077aa6ec13dbbfd3c39c2bac24715063b83bc1d9f0b772928d5fcf12b95bb347ed14a50d507d8d3473afc477a88e5d0f8b3d5edf0b
SSDEEP 24576:+3pd9CHKy7GZAoHjto1GFxlXutIs1WZX5AR:Apd9CHKyaPT/M+w
TLSH
T15695DF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 93231231d8e7ff38a5e8d6fa62e2c7182d9bf395041c20659f63ea8839950fbd
MD5 ca96c61e9290cb83be42c946b0a43e30
SHA1 564f31e41be50953f26140a924889fcda39323ab
SHA512 66fde9318bdaf9f4d3706ae8849d0b78c3e38969340a433c148baaf64791b3f41301aef8e4c37a20d1429c3a998d3f048d12143d45eaf0081d1c1bd73de9acb5
SSDEEP 12288:mehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:mEoHjto1GFxlXutIs1WZX5AR
TLSH
T13C652363ACF340C7F62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1ef02ea7a36451d3d99138ad08be094bc898f6eb84f1becdf082a203ae4064d6
MD5 898e77657b69da631ac916453535b978
SHA1 b7fca86f2b57e40255fd6424d882e6d301f90821
SHA512 ba59cde2cdc2e4f17323bf7578de9f13d257c440b22790d621531c919f0e575de8591e4630c7a91d348f73d1f8ed7fb73749ea45769704c5ffb05806f945beb9
SSDEEP 12288:UEhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:U2oHjto1GFxlXutIs1WZX5AR
TLSH
T126652363ACF240D7F62951B029C76BA1ECBBB307594910BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 32efa1e77beaa3ce81ac921935052130f833bd022b034413c1cb5d072d5956f9
MD5 4924bb25ca359b24d3bebedac2b3af16
SHA1 ae21c30521902c462baadde6455e448d31421a7a
SHA512 83176c80718c378910aed3e8d24c9b43ae39e0dcc56224cc99322d0cd465ddd7b8169c52db4d5beadc91e615072213aeb608e038d7688669e0d9514a65bfc28e
SSDEEP 12288:DDhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DtoHjto1GFxlXutIs1WZX5AR
TLSH
T151652363ACF340D7F62551B029C76BA5ECBBB347194920BB8B50ED190F3D0647A766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 1cf42270c1ec2ece7f67f2caaeb6370a63af777a0b5eae20739bbd90195ab9c4
MD5 c7df0f0cd94e1d1cf1f5878d49275a78
SHA1 5ba4fe21dee49d0d611d2c8ca79021adb795c486
SHA512 dae874aaad84f875a8d8f279397489446fe8542c3e86dfbbf921307ffc1292e6043008e2018185f3a63d420b09e9446132eb5da47f8887d2a4934f2fd1a6e952
SSDEEP 12288:3NhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:3joHjto1GFxlXutIs1WZX5AR
TLSH
T174652363ACF340D7F62551B029C76BA5ECBBB347194920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 52af62e68024f5ca1e707886619551125b52affe54bae5c6cbe1c1888164b584
MD5 8f7ac434b4acbb376ed27f45053c2354
SHA1 89c35b45788bfabb2f9a084e6755aa9ededc1338
SHA512 7813a51ee5abc8957ae4f4153d8c6e3413d0d352934c833deb17a918ea125b3715a21d352fc1de4693c7c077a1bb7cd8f33ea5efbcb6f051508bdbfd20233f3e
SSDEEP 12288:PehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:PEoHjto1GFxlXutIs1WZX5AR
TLSH
T1F8652363ACF340D7F62551B029C76AA1ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 30d04113235368ddb0f59bd85d11229b8dbf30cf4c31bf38e2bde24cfca4d8ba
MD5 1af8343365130b36f5ebb73cffdd3d7a
SHA1 ee9428d7c135f9baf35bf2a7db5d5907f7d45988
SHA512 538b54a35446decd4cd22ed7eded4ce47071f5806d0d5a5dd60d1f9599fbd7e5755a80e010d919c1fcf859268e7fa18779448a5932a8a5fd245195e9ab5abedb
SSDEEP 12288:UVhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:UroHjto1GFxlXutIs1WZX5AR
TLSH
T1C9652363ACF340C7E62551B02DC76BA1ECBBB347594910BB8B51EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d427078259978f883cc68bc826c593918448ab3b8f801541db66f27e11f41813
MD5 e4bcde976e97d441fce142bca3fdb69d
SHA1 b3a241e6e62ddadf155713b9e1a7c0907cd80098
SHA512 b5cbbd12d045dc819f35ed28134b6595410b46099da66cdab36256dc7c062288abe67f73901f5a0518c5e4e3614352818c020c5d2bcef5dcbe82e2daaaa3ab59
SSDEEP 12288:inhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ihoHjto1GFxlXutIs1WZX5AR
TLSH
T128652363ACF340D7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 012b79b4b4b13785f7e84f8d2fc83b6c7b25bc44cb3c89aa692b5274699ba8c1
MD5 fbc8adfac58e534a5e1cc89cff067f2c
SHA1 033e7aa37c667e6c7af9a601d957f13372b42267
SHA512 ebd3f372488a4fdea198b4da9c55b965150074339870f5c5bfa43e1dd1ae54dcdbd2fbd4c9a27d689a95c8f42cd43ffdc9e11edcae9029f85017b2e151b2047a
SSDEEP 24576:ffwv+k9RX6wkyAIHoHjto1GFxlXutIs1WZX5AR:vMnYIIT/M+w
TLSH
T10495D029EBD844E5E177913C9DB3460AF6B278591B31C2CF029A536D0E37ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4bd6ba61f24645808ba2fb11e566c06d5eff02eaaa5f9da3436659fa8962a5a5
MD5 aa08241a8d2417fcb94e630105a18f01
SHA1 94fa69bc54ac523540b4a3fc927bc2822de54aa6
SHA512 ea57601892e9e9e32303991052ab0b22b6b20e90712b294a85f74d98148ddf627133be95ab89aa089fdd054de3dca6592dd335ce557ab439a0ff6560f7d417ed
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JT/M+w:zySzPNw
TLSH
T10F066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 70be0d9687615a41f541f6242b73faeeef1a90ea0b8e76c7691bb5c6b0ae1509
MD5 e3ff0dd3cc64df9bf9657b52bd706d62
SHA1 9c646d7062ab3379d3a8232e41a5ff2368f3b331
SHA512 275c238cba1ad1a5a5b7397bfac306bdf263b8a99391eeb96aa1ae933ad88340ce2cfe31ed7a3772a7941045574672502d13cf3d94c836f7fc6c356ce1484c39
SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYyoHjto1GFxlXutIs1WZX5AR:/47JUQj1irIhCnDHUPfF/ZT/M+w
TLSH
T1BB65AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 33a6014484986880843f1fac44f8317d59a5c67257fd96c2621d58204ada57cb
MD5 ad1386665b136cd7c6b2f21b3754b000
SHA1 871143bf38307c61a42ee1cc9895892c000d8ecf
SHA512 d996f0d0f77bf3d1a2e3eb830d78cfbee2d18a368fa260611145991c7c87279171e9df2ced368ab77c1ca1f721af1aa29566895ba37280de64200860eade92b2
SSDEEP 12288:mzsf9hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:xzoHjto1GFxlXutIs1WZX5AR
TLSH
T17675F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c8844c970d19fb9e2cfb3d968e7259fffbba6772c2d947bf9e64ab26dcca5738
MD5 5323a1ee8ba7cc7bca83770a590b3812
SHA1 7239245fd3c2093e050576b421926427d96baa42
SHA512 bbb03185b11f08a2a027584b39262d16e95c524c2c6bcc5cc8eff0110dc25f882f2a68e49e0bf62595d77605556b0fb01c5bcdd93019f5a525110a6bc7dea4c5
SSDEEP 12288:sfCmU3fcPjdt6/CLQyy0JlRF+l6iSxEalWo23:sfBUPc766LQyHlRFtiSeSWj
TLSH
T1AC3529017666DB4FC66940325E33D1CCAB707D02EE04AB0773C99B3FD576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 11d161779c2d9329e2c59c8a0e4c012842b7f4260ea42ba7f7c1da2850b93dab
MD5 a93cd39d93e10809c4c319624af662cd
SHA1 d0fbe9aa6e2d9479df71ac1747ea989204cf167e
SHA512 b4629ce0f1bd784658c423bad282f1ccd7f0ff9338beca8cd76b05314edca8582fe517140253f457ad18a8e201c9ad74cea0fc6b8ac8fa2c6ce2b5902a69a904
SSDEEP 12288:6uq41+b826IYTFnQjcDTKYTNnQQ2RZ0001Dg7w:6uq41I/6IYTFnQjcDTKYTNnQBk0eg7w
TLSH
T1D3650A406437E78FD5B7603207269B8DA764EC17B3095F2673C9193AD82AB16B1F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4afe60c91713a8e7a1a95c7d70541b0800766ae82a862731e48b954f72074c97
MD5 9e659d344a6b54dde34d731ac115302c
SHA1 3e2d7d7dd673d8ec5ea9260cc5e69c4b0c456f9c
SHA512 1345f932b8e60e41cea80615ca75c29a51d48e465b5b91e5c92a98ea52d93342d49ba05aacdc6893032a4510c5ccd8df5f9f3c839a2dd7ffa778bf3d8b4e1a97
SSDEEP 12288:w+7FhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYMN:X7oHjto1GFxlXutIs1WZX5AR9N
TLSH
T12765236399F254C7F57961B029DBAA31BC7FB3160F4410FB9A40AE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0c6677bac1859cdc966dafdd42bfc9278a00d9b4fd60a7cc4be94970bdef338c
MD5 094c7bace3a6fad729990f1cda75220f
SHA1 609bb82e7dbe70dd43f9fb2426fb9a8c2d820500
SHA512 6b6e29b63ea690f31ac70c7fa6979b144b1d85e3689c2f145be4fac0923eed2be3e640ede16e9e786b2eb9e0bd4519a3ee9581051da2a313bebf330e63fb4c0c
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYloHjto1GFxlXutIs1WZX5AR:9gb4mBIBhGFLT/M+w
TLSH
T117659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a9a9767e310e644a270d298f618ada55054352b835a736e9414cb6e98cfd17b9
MD5 09e66911625466c1a10eeca2ea949fcb
SHA1 18b1612b6139eff422792579ef2acde8987cbc28
SHA512 1b548d9b7124e7c8af9c4fe43f60dce43b8bad9c842649ac378bd99edb7ffab98747a979c63f4eb63cb0860078f194c7d9eb8f4b3a567586326527555c549e30
SSDEEP 24576:MG88u8FpJqH1xzria7/mCoHjto1GFxlXutIs1WZX5AR:v7ZFPqV4a7/eT/M+w
TLSH
T18995F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7ebe82eef4421b7356663ca827834b0d69265f8ea50b3e810ccf3f90b37ee3e6
MD5 05e2aea2f48d56a8d13f28a61fb31634
SHA1 a5281e6ee9907c65b86c6291f5da147dda9bb977
SHA512 881eba7109f82a547257aabb4255bd9fe39b52d544c021669b2165a6c95e235f6827a96000372964045b72e4b84d6ba492e9969a9949d2e826af6d7170726418
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/T/M+w:yG05lO43baw
TLSH
T1C1D5CF6A62EC11F9D1BBC17CD9C74A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9ab9a864a3ef93a3d9685beaf8de8c2efaf6d7ecefee5bff2ac111edc529761f
MD5 69000477fedca954073738e9c9f27c34
SHA1 291f4185725e4b67ba01246a6b1c84f6da791f6d
SHA512 c33e67108bf828f893f1c7a48f2b1ef9840d6fa676702f757df9e843f3070b1a4506a3b85d231e9dfab7a140987221e7f6ac6c27a866ab35419ffa1a57f4a100
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnooHjto1GFxlXutIs1WZX5AR:ha5POZ3+Jt2pasx2+mXT/M+w
TLSH
T1CA65AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bbe4f8917fd15346eded80e0123be0dc4e4e77f1ec53d6fe24d643d2f7ea639a
MD5 c35cebaab697d10cd632dfe837d9f339
SHA1 b02fb311cd71ff76d87c869e4d3223b08b323c0f
SHA512 672fe6e747e616692cfa94b91f247118637499fe0b2784288c8e46caaf8f6ce95de5b93c3795c75254ed4c59534dc92a241c9ee39be189974f644965f8d4dc68
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7Fk6oHjto1GFxlXutIs1WZX5AR:ZNc/zEOVHF+T/M+w
TLSH
T1B3858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 24d811de1c87fa0e5c840cac71f7ebe709a329b4229854b2e7cee5c13e0355ec
MD5 267c0473d8b9025814de28212ffb86d1
SHA1 630b1b4635d36dfe9912264aed8018753ab5a6e3
SHA512 fbc713d561e585c5f5f157ff661559d4800bfe91172722d12692844c59a891407aa0a66e0dd1d6c023ef9dc23a78f9ef1def47d0723a0a773ac4bf83fba860c0
SSDEEP 24576:B8kNvNnaFeYhJNtmZBm8oHjto1GFxlXutIs1WZX5AR:B8MwBtOmVT/M+w
TLSH
T17855AF6EBAF845E4D1FEC6B49D238512EA727461073252CB5390C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5bff8d62fdebbf1eafe0eda07b704afc085b13f43b1ba6c1701fa04a1bd839fc
MD5 12c135b6501b60d2ebdfbeb2d4956ccf
SHA1 1a83544701e1c01c8b78664bc44a57ad85c777ff
SHA512 4366e0ecf62572e9f3a5866315b6de0755e112890e3aa887f68d3e44282bf63712f48dd99498478d009771c90f68e8de7c0f4b4359c276d69a86ecc04c39cce8
SSDEEP 12288:3HvUrBFrEjwaQ8hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:3PUr+NQuoHjto1GFxlXutIs1WZX5AR
TLSH
T14485E12F66E918E5E676A17C89838719F772B462071292DF02D0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 f24a771a267db19268db8fbf21301b73c2309164bb90270fcd1c782bfe53a277
MD5 a5edfaca46437a23fea06508d118e23e
SHA1 30b46808939b293a822d898d4bc6a802219e3c32
SHA512 efa5f15b775507da6bbb8edc86d042264b7e811fd7be01e1506ba7887d1140e1b69deebfcee77d89aab0d52b20699b52dfe683815c9081c1219909fb70bca7cd
SSDEEP 24576:RD3FHshBIYQgAfoHjto1GFxlXutIs1WZX5AR:RDVHeBIAAAT/M+w
TLSH
T19E95F23EEAA900E4E57BD1BCDA538A06E77234A9032165DB06D0C1791F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/956-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/956-53-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/956-235-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/1496-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1496-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1496-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1496-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1748-79-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/1748-84-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/1748-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1748-281-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2520-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2520-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2520-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2520-44-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2520-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2520-60-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2720-312-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2720-122-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2720-116-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2720-114-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/3656-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3656-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3656-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3656-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4404-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4404-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4404-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4404-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4720-269-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4720-65-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4720-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4724-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4724-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4724-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4724-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4928-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4928-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4928-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4928-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5740-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5740-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5740-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5740-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5740-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5740-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5904-0-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5904-77-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5904-1-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/5904-8-0x0000000002320000-0x0000000002387000-memory.dmp

Download