4a68fdf472a65ecd23167171191b54057369fa21c0dc5f4a1918b38aae8121d2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample261102-s2ps6ads7n
SHA256 4a68fdf472a65ecd23167171191b54057369fa21c0dc5f4a1918b38aae8121d2
MD5 89717c83786946c96392b00e24907f19
SHA1 de222ced31d8a606a7f3ec20d0b5ac754d3a778f
SHA512 c05c79bf76adccde63af1eeda843bda9864d5628f76629ff6a3f935e4786a80c5f6b1f7894dacf2ad72dba5bb8abe44574bdc817761e98b8e8ae73f957def084
SSDEEP 12288:WK9PGxTszBAGubvoXmH3AVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOqo:L5GtI/4wQCBq/McxvN2T/u1mWXMHM9
TLSH
T1AA75121575C0C0B3E6630A3009B49A715A3EFE346FA489EF7394177A5E706E28D38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3396	elevation_service.exe
4148	elevation_service.exe
4868	maintenanceservice.exe
3284	OSE.EXE
3932	PerceptionSimulationService.exe
4380	perfhost.exe
5736	ReFsDedupSvc.exe
1880	SensorDataService.exe
5840	ssh-agent.exe
5652	AgentService.exe
4528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3b12370c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007537cd20e06add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed5fd320e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000db19d20e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077593520e06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066e83d5fe06add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9e2415fe06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000954d2f5fe06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046cc9620e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fe94a5fe06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5652	AgentService.exe
Token: 33	4528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeDebugPrivilege	3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3888	2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3396	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3824	4528	SearchIndexer.exe	100
PID 4528 wrote to memory of 4408	4528	SearchIndexer.exe	101
PID 4528 wrote to memory of 3924	4528	SearchIndexer.exe	102
PID 4528 wrote to memory of 4592	4528	SearchIndexer.exe	103
PID 4528 wrote to memory of 5644	4528	SearchIndexer.exe	105
PID 4528 wrote to memory of 1784	4528	SearchIndexer.exe	106
PID 4528 wrote to memory of 4212	4528	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_89717c83786946c96392b00e24907f19_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4148

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 728 724 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2432 2468 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 728 724 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2432 2468 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 184fe09e4a2b6e2f7f303a6e0882be7e198d4d30d2301c17433ada8854ba7de3
MD5 2df7163e248afd43168121430b0f6049
SHA1 99decc230368ea387fc9eb39cb6af786cc87a1cd
SHA512 2ab1b4d8fb5592e5d9b61c41bd5cc4c32c8d8337cc54490d70c437dbaaa4b7ded45317e4b9e172d2c1beb8095992055f1e951c74e854333947c9b077ac586e0a
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4CM/XxvYT/u1XMHM9:13q6HjBQM/XxN1cHM9
TLSH
T1BDD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 64854a76c1f86776c37295f6cd6488098a2cb03fbc3394060faf774ad5344111
MD5 b148600b3823a2d283c1156227bf84a5
SHA1 ef00dc7fcedb7e84ac19313ebeea7ffcd4859872
SHA512 6227d9cf972e037d2eaf6431c9b004f831d9d1b3288cc83f176f384244181e25c94d15e3a8f52ac12600e7bc087b079c3af8743f39e0ec89f89645c1a6c4f074
SSDEEP 24576:7XYfDtczA0QCBq/McxvN2T/u1mWXMHM9:etciCM/XxvYT/u1XMHM9
TLSH
T12485012CB7D409F9ED678239CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 101a75a451eed490ae7af16566fdbaf1b247ecc0bcaf7b62a7a1aaad982cf7b6
MD5 14231b9dd076227ab5b65937b0d7c4f0
SHA1 ea32e448be3106f9081f864227d461d36d4aa942
SHA512 d8e4ea188edec454ba3e4108a1b682e920cb42fc4d5c6cf5f402787e11c9d7599079b5cf5e6cb98710cd403ab8c5f97c446f152427f7be7360e68853bce5a839
SSDEEP 24576:40Le5ji0hmxYrMnQCBq/McxvN2T/u1mWXMHM9:4Pji0A2nCM/XxvYT/u1XMHM9
TLSH
T1FF959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16c774e5d80f2f05f1398b35ed033ed988e7c82762f7e5b71e0a23398155377d
MD5 868df59fbb5446128ab33e49c2de695d
SHA1 21c446442306d519a89f404e79fd9b16682291c3
SHA512 b2eca85adb0ede4a3de17ef74a3fa6ba5ba0a2358f6e14cf17c61762cdfbcaf8093041ca6fdf7de3faec5162c41f453d3182f97ce38be3a0126fe38a40eb12ae
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyudQCBq/McxvN2T/u1mWXMHM9:K/ezSC6vUzPvxHjyzCM/XxvYT/u1XMHK
TLSH
T1AC756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d97a756914973b93f2105eba2ba5365a7f076ba1f92fb9e6ede945c7c4ad9176
MD5 16b4b11ee10ddfc4056d5da1f43c3f18
SHA1 779a881946bc9568bcb53f66425fa0619ec6273a
SHA512 048a9f8d26d64ff4c5b7212e63851751bb6ac739b375e9eea380d64bf8457ffd632691272cb98c77ad3e7df6a286babe312b782b28af331eef26e396db3e5126
SSDEEP 24576:mVbqPb88hv/l+6AQCBq/McxvN2T/u1mWXMHM9:mVO88hXl+MCM/XxvYT/u1XMHM9
TLSH
T124559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 16ea13f65f915d8b94e20085c64b5687f0a11c86d644da26faaee8aeb8ea9172
MD5 61698ddb382d5ea0d18463ad9298b4e4
SHA1 dee8cf457d449b55828117937843cf0fc0583065
SHA512 4781f851addc06611bf1a6961d9886a0833ee87efe9f0d615dca88033ac6e416e075e3099975c0ab9894eb50f026985a8336cd8a042134aeacc0ff30299bbeb5
SSDEEP 12288:1HzVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:1HzQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C365231E9CCCD6D6E7478BB248AD5A7B0E66BF78FCC484B1A5103AF81770CB2D429905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7948e1fb559188df4f40414b7043584594980e06c66da9e09c75bbb8b197adae
MD5 4da0d9ab95c6e2d2ab648013406bf15e
SHA1 664b1cd1827dd086d7a2ebfc96a307a7577f8a60
SHA512 eed96ad156dd83ff90f47e39c6d5abb6be05a4168c5fe9d0836a43e9874fbc06fd5cbcecb161d571dae740ec8f17e6b8a5c5e8b426e660ee2ba3e3b420fabb33
SSDEEP 12288:JeBNUbTVO86UIVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:JJIUIQCBq/McxvN2T/u1mWXMHM9
TLSH
T10D85CF3BEE68FCE2C27A8DB95A918740D77278304F6193CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 68f68b98e4e5382909b033fecfd6aaa951b270af573badc24faf573549317deb
MD5 a1426c2356071f41e593476689abdb5b
SHA1 37b9bd791b1956c3fc8367ab59ba306b7274a9f7
SHA512 f70a2c79d0711b04d047aeff6f7da7cfc126c13aee097a575cc5de1c7444ed74f0444d1140913e819e51ea45a9dc2ef8008e32d699c13e44c4f28d713b787fdc
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:hQvGAdlCEL8c/yRNw5C9M/XxN1cHM9
TLSH
T1C8267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 527260909515e4460ff2b8134dadc4ae35bacb979477d11228ecac344b170f28
MD5 370420ec65fdc67b83de232bc6d3ff9e
SHA1 a8f8eb480d2a73519f5187423ee711e366bf47f7
SHA512 ab34c2b356edb9d403af7c5fc971dc41b79aac8c735c0f5d5ac94326062cab262962df28694059839218a1a51e4329d03c110b990ae050daf8547305ed218d3a
SSDEEP 12288:kAwSfxL/2Dc3SDLLmt0LDQewsAjmVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:57ewsAjmQCBq/McxvN2T/u1mWXMHM9
TLSH
T14785E031FEB4E436C77B0DB21B26C716182DBA204FA119C3E3A85E9D5A305D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8987229c27eb937937b718a1c4764f70c4ae6909033ab8f732e302b03805f87
MD5 f4831edc441490f131ccd666c8a84443
SHA1 9007c5584cae7843a1ecec6f8db8f51edce08f2d
SHA512 10d2bb08d41c6aa90b35f329472cadaa3494040bd38db5c94c5f1b0daaa83cc4ca25df36c86dee6f7679cfe3502c998f03fa8cd44e3975be16b176addcd0a300
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhfyHK:fUEtQevvqc2W1cpV2EI32RyHK
TLSH
T11A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ba44abb198e692de4ee8be1697b6634ea96d3067f2f8b81dd326323b4c66ce1
MD5 3cb667aefe6cc054a14d11b15f7a3a7a
SHA1 31458fb74a9cf3208d3c600c9f005e4f10832019
SHA512 d8432aec9c7500f17c8faf1ddef226c35d13c3d2543ab4f362f2722551324c7daff49e3bf4f0ac56a0db14badacb9164f96fadd43336ab96fcee1af213615141
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zXCM/XxvYT/u1XMHM9:boq2VjnmRM/XxN1cHM9
TLSH
T194D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 427ab83df477a1a5f23a734cc5aab92fec3a919a42579f3c688ae1c209dbc391
MD5 ec44c7a8195584535c595527ce7a56d2
SHA1 d4f0aee8afe7c48909853a047f9b554aa8a1b949
SHA512 6c84d44ce16147820633d663581b801544ea7c80970ef988cfb9b7c03e46cb3c889595777befbe0e6a4ffefa3b9b7d4faa51a04504e8a5f385e65f30a57fda00
SSDEEP 24576:MAhGLJIFoiwtA5l7S53xQCBq/McxvN2T/u1mWXMHM9:MAMyFoiq5+CM/XxvYT/u1XMHM9
TLSH
T10D359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2d5cc229cfbddef9754de6ba1ba6fdef938b6f48482fff4510b0311ef0095e55
MD5 7b5908588aaa5c6dddaabfc814f2ae7d
SHA1 f6dcbf575165733944b4e5c61328b70868fe0764
SHA512 5b2b9882de789f3f95cede647f796501bfa541da13eab02715a719db9a53c2c28ddde0bf5b8e5da5ae94e340f0462299316786581d2a5cd9502c1acf1762d5e4
SSDEEP 12288:2mw5HEjsChNzBFgl0WDm+C9VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:vwuSOWKQCBq/McxvN2T/u1mWXMHM9
TLSH
T14E85F14A76E81CF9EA6782398557C136E7F2BC113A60C71F1760C66B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0ee5e63f9bdaa438bc53e782678c57e85226521cbbef29964a08fdeed3e00415
MD5 24ed360df690b1ff3e86baef5235d9c1
SHA1 f149b3ba8d23b0636ca77fc96f8df32e3462d3c8
SHA512 d770ddddff0aeb494c83ed6eecef33359a529016c275d50806c93666af49b7893b9563adde7d9d472c10d3e97d598a974170657e094051b510b91e3c303a9a0d
SSDEEP 12288:8jZ1Iy2VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:IZuPQCBq/McxvN2T/u1mWXMHM9
TLSH
T17E75125E36D861F9E2938379C8E54616DB7278757BB483CF122002B92F32DD25D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ccc155a177d1207a4d510b1c3b6f587ded123e40679c1d98fba23820d2af9e1e
MD5 8db603ea02a40a0545e98b35585e0af5
SHA1 d96d766a6be79574f034a0e9f562fe1a1b64c531
SHA512 44687ccba79099cadd3c05bd9bb034c653048deeb801bfcaf52a814b7a911cda51cbd18393331823c17457e20647aef50db1772e674af0d6f47fb1050c2982fd
SSDEEP 98304:PQRQyi36YOcPQLvw2gAf+PN3cM/XxN1cHM9:+QyiKayX+PNzfyHK
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 43dbe9a92f49dc0b2056c1047299ca53065b63e377c55e700c7b9ae526fdff14
MD5 d2dda808ab683968c71fc153d3a9c617
SHA1 751131a9d9d2ee0dc7d3c8e1a3129a4b87cd6e4b
SHA512 d46ee077a6dcf11720800702cca6f9b8ec44bf2bb75358a2af7022bd6c81752d575452fa7521224e1bed233981ed427caaee8d0471a56620bf198095e50f5c1f
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN3cM/XxN1cHM9:tQyiKayX+PNzfyHK
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 af7d3c5821ffdb34047d7bb43ff683f9e6f9bb5b25e136a7c6d480859de9f25c
MD5 3001a287e11149392b6b0ccc403f6bf2
SHA1 3435a22af35bf768f1ef78f6a8e33349a7ad9c91
SHA512 4fad7fbaa7dd40270ccdb98009e9afd1754e42f48125380fa55e923204ada56174e67f88a8f88db872f2c537ed3c7a119c40238a103bf50bbfc06dfee845654a
SSDEEP 49152:N68Qg55nhheWu7PNU3/nCM/XxvYT/u1XMHM9:LthWRc/CM/XxN1cHM9
TLSH
T13EB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ec5efede4c8b513288e7703cca15ebab25c57b46fe562e2e9830166b7db56914
MD5 b1fc8ac2f601ee11f8c67af2dff6b374
SHA1 837326c104f613335cdd13899ca3856ae9e4e400
SHA512 684191e0d7e4c5f6b135e9631b5d165ee35d8e7c0d7b7d8b5d9a0bb4d12a16270840f5b404d771a49a71f14bc301fb3004ece1812841c532f2d61d7bf45d620b
SSDEEP 98304:Wy5112gYy5azzVvL69nLKnhZXM/XxN1cHM9:HLIHmWhefyHK
TLSH
T1C7168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 28f85be6f32b3baacb2c24e26fd18d0b9b74b07b874cad438909efa7bc52af4f
MD5 703e41cdeac113517029b6e750e86d4d
SHA1 a5ee15a44e62b401890342a43f33b145d1c6a929
SHA512 d358ec204b2160ce9e0e96785447e7de9d6321c6e99582d92fd5abc78da4f753f96d5ccbb4b6a630f87a2ef16a103d7a5c1873d4d90e98b0bb0c6e1dc593be0b
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxCM/XxvYT/u1XMHM9:Yu6JmVxd2dEM/XxN1cHM9
TLSH
T18AD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7f6dfb78e16825fd1a59ab71cafa4abbb9297ab9f5795502021098c39989080f
MD5 04d208ed8a7fc1c6ceb914f2f4bf5ce1
SHA1 9887ce1ecbb790e275d8f597ab25447784bf1cc0
SHA512 b4518361ff7f9e4c59edc7d430572ed5a03da383b18109bca1ddfa0b0c7955e92de45292b6b3fcb386b276c2ccd92f29ae1d7a38e51e700d62ba1a25555418a7
SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4xNCM/XxvYT/u1XMHM9:GmifPbRRM/XxN1cHM9
TLSH
T111B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 efb74ce7f76077888d64c24b47ec9df12b6d71ad3e1fc336b9c827e166dd2e0b
MD5 f73f0fba03df44b0d08c0b71a41f2f2b
SHA1 6177332895ed5defb363a4b4c4098cbea6c348f6
SHA512 7bfdb6037a5bd050112ce2b1936c110bdc41270b0f13814d34ffad779724c72f73c766dd3c783caeacede7c732a256574683c026ab873ad8819d81b29fe6395d
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqICM/XxvYT/u1XMHM9:v5dKTi61jM/XxN1cHM9
TLSH
T13BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b26c6b4669ff86907bb0d5d6db6f38b4f1386569a6d14564a6acf2806de64c3c
MD5 f97b503141db08add42ea068d1fea3c3
SHA1 b6d54bbf000db54ae83973ac88fe449cd20fac59
SHA512 0f5546d83b0b2fa330a19ef143d28b26a52438c2209e1cecdc64ec444e1c78d1ee2cffeacc5e72f75769c7f2b4cca869eae7e7fd7d02be51fcd82c5293f5204f
SSDEEP 49152:shtSn8EApI0figngiDn0AP5wBCM/XxvYT/u1XMHM9:NX2iyph1M/XxN1cHM9
TLSH
T16D95BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2c163060c9908c3c36df1f1f34f33081c1dafb4e7c898267628eeab6c971640b
MD5 4129c2eb3fb16a15c8e47f1d1ae0508f
SHA1 48d0913baf97bce963219209f901861c8536756e
SHA512 49293ba957084eb5bc4a311dbe6af12df88db9b4d2cf633501914b212bc58bd249529bafedbc2275f093118af0e2f686f9f233a91057bc5adecbfebbff7e72db
SSDEEP 12288:37VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:37QCBq/McxvN2T/u1mWXMHM9
TLSH
T11165231EACCD9BD6E703CBB2886D16BA4E6A7F7CFDC480B6761421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5b5578331ca9165f339f73a0d4d2c81148a85d41d2761efb8ab8285faeaba398
MD5 ae86a3816b961b355d8e32a48f30d995
SHA1 e5763ae6b606bb1c20597d128b6e293636470526
SHA512 2afa0f71ffc233621422e70754bf0b589d276087a60944f274e5e64ca041b1242041c486ea5bb8261e1ee73fe7965df00b92bd11cb0765e56f11ef713ad88328
SSDEEP 12288:DCVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:DCQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E265231EACCD8BD6E703CBB2885D16BA4E297F7CFDD480B6B61425B12770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 408ca328e2685c216e7bec86d425b9abe045a1bac15f07b5abb54bf2dfe6cb01
MD5 eb6239e654bc7631318502764150e969
SHA1 35728f002288503257a99fba221d018e4f75bb37
SHA512 1ce07c181171713532714c1c0bb8d88e4a1ca469b9aee2b2803c9057b262f3d6ff7377607af0400d140da7c1fe7679c46c3e90d6d054fcbda7965cd24ecc24e1
SSDEEP 12288:9wVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:9wQCBq/McxvN2T/u1mWXMHM9
TLSH
T1B165231EACCDDAD6E703CBB2885D16BA4E697F7CFDC480B6B61421B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5389eb953f5f37af79aaebad234924c0fcf84200ee774ed3a337dd5aaa01100b
MD5 7d1115148849f8526a05196b7fd38265
SHA1 acda352290d7951993924188dfa21bbf02fa6d50
SHA512 ec9a17678e06d96b15941f359d912305609d920121acf1b7fae1d1ac39d92ba7dc6b7504aaac4f5945a3eaeb22854ecd69dd0c6360e12cfb2d6fa44cbe764ff3
SSDEEP 12288:WVRVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:eQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E165231E6DDD82D5E703C7B2C86942769E75BE78FFA082EF660015B51F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c087047bbe4c43a376c091c0c9a199317c9abaaa95ebe03272bc21fd41f9d1dc
MD5 365eab6f6d67663f90f6dd50c8be786f
SHA1 4f653479ff502ebd8e64432a689dc2cec4d6c40b
SHA512 4f5a85c0d0917b9de0db4595f3bafe6c51f26ce365cda7cc3cbc733e2a4a4686035b9531a20b64f0f0abb5f66b2dd54f0ed9b64a172537effe7fbedf708649e3
SSDEEP 12288:vJVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:vJQCBq/McxvN2T/u1mWXMHM9
TLSH
T10465231EACCDCAD6E703CBB2885D16BA4E697F7CFDC480B6B61421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3d91782a039e9fe802db92d3ec369000ec537195ac426f6cedb9042e0280db06
MD5 d99f84732ca2e3bfa5d48bf51119d556
SHA1 cc09b1b02b855cd504408e5f185c90abfa6cfbe4
SHA512 f6a88792a109d97bf8e9b12121ac2f4da6b64277249b17e9f1fd3ad287f079f0d8afe4edc0898ab9fa239449c1b0ce87950822f096d502ef49b1314d2bd60eae
SSDEEP 12288:huVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:huQCBq/McxvN2T/u1mWXMHM9
TLSH
T15165231EACCD8BD6E703CBB2886D16BA4E297F7CFED480B6761425712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8410bb9b38848a085d87716f9d0ba320d6001dc68c233bb65ab55e992962a684
MD5 63d4fedb8e05e4cc1483a2308b3cad8f
SHA1 c1f2b131a8b2e19c8a1072064434a6a74cbd8352
SHA512 e761d716ecd8bf78fd7ffe0af7516cc573dfc2ad6c4ab5fd1e5078742c6a55ef1ce1474c6a69833c5519bd0046cd7d1a63fd0715fc5e2683b72d9095cb6d2e83
SSDEEP 12288:N6VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:N6QCBq/McxvN2T/u1mWXMHM9
TLSH
T17665232EACCD8BD6E703C7B2895C16BA4E297F7CFDD480B6B61425B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 54e0160388a2662e58e121c9890d9bf25096989be88657eb5337c7b26326d42d
MD5 72c7d99a0d5b555241c1269ea381409f
SHA1 c2534015bd0f27480e2726e035bbd9532c85ba48
SHA512 b2f1b5a6152d8d74e7089ef70e2cc7c0fefdcdc748f210c3b2383b51995f27425284718ca1fbe0b93507a5c13efcea44aeeb3cdd39ff66e950894acb7de26dc8
SSDEEP 24576:2ZMEzFVSOiQCBq/McxvN2T/u1mWXMHM9:2ZMEzf/CM/XxvYT/u1XMHM9
TLSH
T10E850299B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 19ef8345cb95b61fc9e5512981e2fa4e94208a9539d6e6721e4842708bef198a
MD5 a3c704ab5c807e61278a054b10b4e75e
SHA1 3a9a74e1be881713d0794f35baca8b5aa01dd0e0
SHA512 ec69ea724abfa4bbfdcbba6fbca408ff581b61d553fc769335c9fe0e90f2dbe8d89408a5cf1048ad5373f5d5802bf6aa5d96f467862657c72be1860053a27fb5
SSDEEP 12288:wfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:wfQCBq/McxvN2T/u1mWXMHM9
TLSH
T15165231EACCD9ADAE703CBB2885D16BA4E297F7CFDC480F6B61425742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f84a0b51fab13af96d236cdd781e982d4fc41f6beafac3f726402ffae97cfc8c
MD5 d1b845ebd1a411aafdbf4a3fbb51262e
SHA1 9a0775905836de313eb700a72879faecb0f0b572
SHA512 2d2266f4ca470aa423e40cc184c7c8f532a0d74db0dcc102b9d893d2d1fae6fe82afb520d0cd6e8e1c0a8d1fecfd0f0ceee9d82a83e313ac33a9cfff53451997
SSDEEP 12288:6DVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:6DQCBq/McxvN2T/u1mWXMHM9
TLSH
T19465231EACCD8BD6E703CBB2895D16BA4E297F7CFDC480B6B61425B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 48e80e19b0e39e9321b295191238eb27c836ecc3f0ed70407ea403a9133397d6
MD5 5b0deec8b473e91da82f655dfd455e9f
SHA1 02d25ab3b855de6c0215a5b7695d944fc437abe0
SHA512 49fe895a8ba465f95deaf71312b4c43c693448de1bf221f1725a8a3e49c526ecb118b65f2dc1f3cb181aaac17f70068213feb4354642327e63808d2e6371b1a0
SSDEEP 12288:fyPz5L82VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:Szy2QCBq/McxvN2T/u1mWXMHM9
TLSH
T18A75121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c0d26bd1f66f8d40a8ac11f62c42f3428f09f2df5deee89246c04a95b6ff715e
MD5 6b56c385d193f1cb07bedb9c160b9ef2
SHA1 ad8d4df9e035a89d3ad8cbef7651dbeb1a173928
SHA512 c1cc1520f56c89d01bf2bed14d88725aba33bacd691bf79623216db3a849d0ed40691d71ec23779e8467323b8a7a774075d1716cf66f6dd76dfc092413898d30
SSDEEP 12288:LfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LfQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F465231EACCD9AD6E703CBB2885D16BA4E297F7CFDC480F6B61425B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 c216cc0ca86a0b19ca8620fbbdfe1eb083cb68aacba3511a11de16cd9aafaac7
MD5 7f0436635b9bc05fc0c20084d5b4012e
SHA1 73ed41c24a16ab967c0639caec9fa3647625e6fd
SHA512 734242a9f0000533f6525b666d4ed68351564e64ee3e556440a9592feaf2914756bb12c8c705644df629ab1ed7ff2d9e7c2dc52a51d5259e9d8c534aa6652124
SSDEEP 12288:EfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:EfQCBq/McxvN2T/u1mWXMHM9
TLSH
T17F65231EACCD9AD6E703CBB2485D16BA4E297F7CFDC480F6B61425742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f5ba11f878d2d5ab81841c5889aab134b56b61e0a1fa832c077691d412b54930
MD5 119171c0d95a47c3b2760546f83f2178
SHA1 49d23a8c470b391089927ce47763efa896a529e0
SHA512 b9ce0c81246d797a78d935105f5cbad11bae25da3262246394edce9a42e87c9c96b84a07b562df3459a11fe0a0af707aa73f8e15c1b5838498a09cffc8b880b1
SSDEEP 12288:byPz5L82VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:Wzy2QCBq/McxvN2T/u1mWXMHM9
TLSH
T15475121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b467133b8e33959f29922e9322f06f1f4c03eeee574fcdd53ca4672081225471
MD5 2d6417f7fe1bd49ed4d019ba9cd6a90e
SHA1 00bc93f5802a7526d8a728caf836ebb543d1275c
SHA512 adc1ca311e28fb512a62e55614307d42d3acdc6e124b2a5e08aaf02879d5b8518423998f5ae69dcca15f83e595630a153b7e0120e996b3e1cd3880b6804bb6ff
SSDEEP 24576:eTdaLl3z0zDgQCBq/McxvN2T/u1mWXMHM9:eTwLljyCM/XxvYT/u1XMHM9
TLSH
T1EA8502A9B39018F8ED67823ECC554916D6B27C2A4BB0C65F13A436661F333A11C3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 82f7b97f8a2c2eace10296c2889029e9afce2cc4fc07ee1474321aa70488d6ee
MD5 3d21ea2c009c8282eef88a67d9e47e4d
SHA1 75556cf6f029408a6f8c48fcd00af1b64ba6cc26
SHA512 d8948a5760ff535fb9b8182d98668b547a3573c7ea5221c222db1d442f041db264b13c8c7ae7e33a3559293f496b18d6ccd97726f8b463a9ad1de7962cc4107d
SSDEEP 24576:T35d9CHKy7GZ8QCBq/McxvN2T/u1mWXMHM9:z5d9CHKya/CM/XxvYT/u1XMHM9
TLSH
T16A95CF94F3E810E8F1B7CA358D764512DA767C695B70CA8F03A4265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 458cb4ab621f413af92a4fae13f7d73037a950d93cdb0c648f7ef6ef8c6f9a0f
MD5 1ca56975ab5b36b5a5ff234a2ebb2b4e
SHA1 a40183bdcf5f40e9c9ce25f7a8490b34f736f5a2
SHA512 30afde732323d3c2b1881f0742e04f5ec9034ca865e9be5de1ef612d3865f956269ff808f3933171377c4bac344a9153117af9f9d338d80ebb415c087ebd81bf
SSDEEP 12288:RQVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:RQQCBq/McxvN2T/u1mWXMHM9
TLSH
T1A265231EACCDDAD6E703CBB2885D16BA4E6A7F7CFDC480B6B61421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 466e5a0f9b035d6f940210bdcd88f00321f68b8aa2ebb0ec272f7382288475b6
MD5 f1502e96cee82eb7e70b95f323d80b20
SHA1 99cf306af38087037b86846d6563591fe47c3c14
SHA512 c2194e20c7d186f7bb774073fb3bf0e3d66d48a151a4010da6afc45f32c411561bf7d84827cf38cdd3cab41362591addbf388e8fe6d149f00b0e220ef7472d68
SSDEEP 12288:iWVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:iWQCBq/McxvN2T/u1mWXMHM9
TLSH
T19E65232EACCD8AE6E707C7B3486D167A4E697F7CFDD480B6B61424702770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 0596e6a1a6e616640c3dbed29421ae4e4e5d147341f72a77165728bf108645e9
MD5 38a434f6b7ce4165203a9cb149b322c4
SHA1 1eadcb01ed6e79b7c3581f958e04e2a28b4cd865
SHA512 0c4abcd818bd9b110f85afc4ca5f8053f5f502232090b5b945a483bac552ec5ce7d75e5236eced733c738b4548dab0da1462065dfdda75515bba5d0280db4c6a
SSDEEP 12288:o1VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:o1QCBq/McxvN2T/u1mWXMHM9
TLSH
T12F65231EACCD8AD6E703CBB3855D16BA4E697F7CFDC480B6B61425742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 15b2cd06a7eaf0f0d76da18e7b72775820d5f176ba6f9dd48e865d7d3e27c9f1
MD5 8f72bcc94f0f5ee8eb85d010b618102c
SHA1 6ef299aac18ec4b99f61eb8041e54912e2f5af8a
SHA512 6bbb2380883cea40df11e77066512f726159ac5ec1e931b36b896d1cc217ffebb00271b79834feac7259d495b9ec97a496ddb737b119507fedafba690c358f0d
SSDEEP 12288:ZfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ZfQCBq/McxvN2T/u1mWXMHM9
TLSH
T1FE65231EACCD8AD6E703CBB3885D16BA4E697F7CFDC480B6B61425742B70CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b2057c99e6f34b63feddcc9934ffbbb3082ffc452eff1aa36bb1bfb6629ef47c
MD5 856faf8c39306dda8232d38f5bd2d661
SHA1 f52e7106f9202f7d03ecc62b09d2b3ceed863932
SHA512 0be45b9d33eca3660b5b24f99d7f6cd74f3c880c44df94a78da2d3b6459741faa5cec0342165a9de7aa44e920300c0fbd025ef268bfa2f69eb0aa4d29efa3e58
SSDEEP 12288:JQVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:JQQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F165231EACCD8AD6E703CBB3885D16BA4E697F7CFDC480B6B61421742B70CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0a0ba350981f341d2589c7a9ab59d0591b4e2512240434053220a3f07ba22708
MD5 e5412d44ebef3c4c981083e5b1f40714
SHA1 2268c5be52c8d092dc10d13451f1fb8df55bc51b
SHA512 a134fcb4f4486b230d657dc82b66f999e42ab04ffc2d952fed5099171f491bdfccb1807699f9222a70dd927c342ff5f1ec2335d457b6610c0b08392a46d6f2d6
SSDEEP 12288:6XVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:6XQCBq/McxvN2T/u1mWXMHM9
TLSH
T1AD65231EACCD8BDAE703CBB2895D167A4E697F7CFDC480B6B61425742770CB25429D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b13a2c012703e06bba2a85fb5b9d018e436d97aa787c738272aa6dda9c556492
MD5 05d1982345d1a17eef79b7b94e8ca8d9
SHA1 6fbb3993c1b5b7f0bc3f8f8bb079dc793c6ed432
SHA512 b0191bc2e154e68d3dcd685b898d2d977723a76b331c84e8397ddb7245d81f9b14196b5fb95a1074ba0db17832ee2c44b1026b98612b55450f55ab8573dedba1
SSDEEP 12288:FJVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:FJQCBq/McxvN2T/u1mWXMHM9
TLSH
T1BA65231EACCD8AD6E703CBB2885D16BA4E697F7CFDC480B6B61421742B70CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 12e577792d86676168d04154543cf82cc6ff528c1aeb2a899f2a7eec9863193d
MD5 d80169577e00a5eba7d67a90a415b9dd
SHA1 0b46cd0f1faf1447d999851bab5e7ab5cd8e205d
SHA512 8e86f4249bb0f11193c675632e2bb13d00b23a282f4aad2b4935c95c4ac2d85e9eab054a6add8eb5d70d35246cc31d94c349994b2917337631bd45dcc7fd2a90
SSDEEP 24576:xfwv+k9RX6wkyAITQCBq/McxvN2T/u1mWXMHM9:BMnYI0CM/XxvYT/u1XMHM9
TLSH
T1CD95CF2DEBDC44E5E177923889B7460AF6B178691B31C2CF129A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 790f64ff3ca33a7d00acb9029ffd6721d3c098d911ebe5f64339b5d30e75aba0
MD5 b603c5cd1854ebf41de1cb34e2cbbcfe
SHA1 f9ed67997390dbb2071754b69ac29556de22b8cf
SHA512 80c84b741cdba2087330c7d323a4c9625cba1731383d58854001ab3d316dc9824573efdab780ab2181e7ea807347b4f73db15a70918781f58a4ed8bfc36eaee1
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hCM/XxvYT/u1v:IySzP8M/XxN1cHM9
TLSH
T140066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ae9fb7787ae895f29d53b93dee86b492737a4a8e2359780c33dc810f3b129106
MD5 93e412446d05f937902b153a7ae52e29
SHA1 e3dde603b84b926cefd6f8c65dfabf6d6abd261a
SHA512 9fda38b9e7bd6e25ead5fbee278a2ecc436db581ab6aa160648534cd9fd90254db53ec0ae257e70b5d235970f7d87a84436ef72b2657b3f160c242683cd2b1d5
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYyQCBq/McxvN2T/u1mWXMHM9:+47JUQj1irIhCnDHUPfF/xCM/XxvYT/c
TLSH
T11465AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 fdb9ba3937c8a31ef2ee36f6e584d90b491e1356311a613fd104d034bdd0dd4c
MD5 c2afd3181070bb7201741761b12f80d0
SHA1 011fbbe83bbc821d722c16515ce543e5bfedcc4a
SHA512 af6da3923e6f780673fe67530ff66531459c5038a83cb776b895c1229cd96d743a68c59fd9de554879f139518e1cd9b7cd68247f2abbe4bd2d0325b3dbc6db67
SSDEEP 12288:WzsfPVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:BPQCBq/McxvN2T/u1mWXMHM9
TLSH
T12075F01ED29842E8C16E9276CB594A51B7337D349BE0C3CB62C0F53E1F359909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a15e01efa5035cacefe719c782e43500094b53ef5208fd73483024e2911aed95
MD5 f76dc95e09f44b7195a064cb0d1e638c
SHA1 c984ebd308566a6845223d404940e454827bd4ba
SHA512 42197ba331ec1946c302d4e96f45c9a479c8100376b9d86149088fd84f332e16830f10ad87edb590025df6d7348f363fe8e054a2fb4c17ea71c5d58b36f859b0
SSDEEP 12288:FfCkU3fWdCwS+JtmFH2JkrkRl1qxWrlT3au:FfDUPl/QRl1qOlf
TLSH
T1663528007666DB4FC6A940321E37D1CCAB707D51EE04AF0373C98B3F9576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 24eb0cc2c0590abb9f5d02e4d434804b05bcea4b07ccffd5e809ceb21705cad7
MD5 9302b4ca6b060cfbb2f3b86172d307e1
SHA1 4a7d7255d2e0653425d5a1ab08dd0e62a4262632
SHA512 fd4ddc53284ca1b8f7dd16d0f26bee3cb73ed4d2b63c0dd5229fc79b110afcc8b6f3f02c1514f3d7dc8652713d9c0832cc7d4f9cfc82965d0542af1c4ad69466
SSDEEP 12288:2+/Ubx2kFrzUdcjJVagld2cjJVapmYaowBn:2+t2r8cjJVaod2cjJVapmCwBn
TLSH
T16555D7416437E68FD1B62032072B5B8C6B74EC13B7096F27B3C9453AD86BB11A4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4dda0622d0606119b1fa5c947c3f573e6d97c6c7bfedf19ab1daa1d3962daee7
MD5 bae09f4ef47f6e47c312b6ac2b60357c
SHA1 115b7435ad3a81f9bd648991f4ff6d7b840dac1d
SHA512 cf85faf1527af558f3ba9aff6b9f5f63b6c31c09b2073c46e331dc1f2be9004d4a585f0e943bfda054477834835baf0752b59e29d6c2740e7aa46af48dfb8ed3
SSDEEP 12288:GL7HVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:EHQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F865232E9DDC9A96F75787B1446D52361E2EBB78BFC0C0E7B50022B52670CE19C39E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab7a1e66a6541db0f5a3e3b6f51fb6ce9d50ee7501d663c7d6c1e355fe922589
MD5 291d672fecd246a2fc05c26eaa3cce0c
SHA1 84f7e01a1a59d4feb7c56727b4a578eeb66d90b1
SHA512 0876c9779152a75a338cbfa0a1318f6c4cfafa89ab8509efacafce96f4a222b910e6dac0ee7b346565e60c4235e0d6ad8c737967345e3a01490d4cd0ad1057a0
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYdQCBq/McxvN2T/u1mWXMHM9:bgb4mBIBhGFLCM/XxvYT/u1XMHM9
TLSH
T14365AE1E22EC02F5E1FAD2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2cabeef52775a60eafc23fb6ed672c0c921a47e479dd4362b76f8ad2cafe6475
MD5 2d47bd206b422288d7d36a03fe6cb12c
SHA1 db23cfc1a00b5ec00b15b340af31824a64db1028
SHA512 52ec4b04cfed882b20ebfcef37581ad72580c626b98ec06b3d3d4fdb7c9fd3cb411f91ff40b9938024ce9a91d02fdf5e1edeec7afda1d036821f1edd3391be60
SSDEEP 24576:PG88u8FpJqH1hzria7/miQCBq/McxvN2T/u1mWXMHM9:+7ZFPqVoa7/6CM/XxvYT/u1XMHM9
TLSH
T18295026976E502F0D477D13889864663F6B2B8251364EFDF07A88B511F23AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3aec05383159bd829169249b6afe95445d978389a52f622d5fa59fb96b6851dc
MD5 a4dbc56c024d59fb56581a1dc0078f29
SHA1 33cc3db5a911173db5679b0de6710a5168b5b523
SHA512 6cb37245e1a182f5acad457601e0fc97adeb3889b421f7b34a903d0cee7bd0fb86cabc62768e3bcebbf9342dbd4c119b602bb37f26bc1fa04eeca90d3bc233bc
SSDEEP 12288:lHvUrBFrEjwaQ+VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:lPUr+NQ+QCBq/McxvN2T/u1mWXMHM9
TLSH
T15A85E12F66EC18E5E676E17D89864719E772B8721751D2DF02A0817E0F23DE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ac8e21a14c42bd850c4e40177ec74052507686b2c83c18c720ce0dc5d7d8216a
MD5 1c3584fb23e5bd506f7427dffbffa7a4
SHA1 0454eaaa763db856b40dfbb6bcc63ff99124b2b7
SHA512 7925e0c2c14829f09de469398f7d1066582d3a7da9b296d1205fbeca96aa7b1bf8cc15c12ee350631d803e477a0fb39ace11a388158c04f40c5af259c9803ac7
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvCM/XxvYT/u1XMHM9:WG05lO43bvM/XxN1cHM9
TLSH
T103D5CF6E62EC11F9D1BBD17CD9C6460BEBB23825033456CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b3c139e41857b2c6b59a1b93cda19b2355a442e42b20ed1d76ea85cb1c7b9c4
MD5 deca2200f6cdd70337f8c5286774d88d
SHA1 ad9e81f97459c1069d9337cf6f7f2dce4fd875fe
SHA512 75be71f0927c54fb445e1596c7df4cfab9ff13919db83a28862b410ed497cc110ece019bf8cd7da4cd1584b3582be8c2d00d20d1fb21c05efb0dad20987a1926
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnUQCBq/McxvN2T/u1mWXMHM9:ea5POZ3+Jt2pasx2+mnCM/XxvYT/u1X/
TLSH
T17665BF5EA6FC01D5D1BAD17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 605885ffdad477660f216be4b573a21dd8b2ae82be7afb451bdfe3a6851146e0
MD5 8d5459139ae9881e9118cabb4278e141
SHA1 7d55818913a6ca637ed3164a7ac2ccf2e750a3f4
SHA512 54169794e4ce74fcb09a6dffa3e615edcfc12b64d9780b2709a0701afb425d19d8a413eade4e689af290d44f69e5fdd133d9d23511700a65629bfb016362c8ec
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkqQCBq/McxvN2T/u1mWXMHM9:ENc/zEOVHFaCM/XxvYT/u1XMHM9
TLSH
T17E858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c89c2178ecc541555a655712c972ce0ceb8f81ff4812c5361c2a1c96b3752281
MD5 20f253d0e112475ed92675ee74f3cb02
SHA1 eb058076889d59266f38438c167713014b95dbce
SHA512 1087a1b8c678f1f8e12d3518d424a769caac76298fc7a01dabadb50b4cacd56f0d2da26e0a3a2b275346d2d2b278bcd2ae608159ba17dfd752a256eb4ab81a52
SSDEEP 24576:U8kNvNnaFeYhJNtmZBmYQCBq/McxvN2T/u1mWXMHM9:U8MwBtOm9CM/XxvYT/u1XMHM9
TLSH
T1F955AF2EBAF846E4D1FEC6B5CD238512EA727461173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 6ac4a88728c81242f873edf44b6ea4ac6b7b6e0beaa5499e2d2626f411e31203
MD5 2eefce256ecf97c884ff81bd8b0388aa
SHA1 4bff4785d98970ebe52512a49fa18fc7249d222e
SHA512 17c39cd8d5e9236f73eab86ec8f99a3862a241e4db5e29cdfac4227949085e425ac721780db1bd3b671fa1f50c9d538f59469f08c83f03c08a4ee2fedc630f5c
SSDEEP 24576:lD3FHshBIYQgAbQCBq/McxvN2T/u1mWXMHM9:lDVHeBIAAsCM/XxvYT/u1XMHM9
TLSH
T19595E13EEA9C04E4E57BC2BCCA638A06E77138BD072155DB129481B51F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1880-107-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1880-312-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1880-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1880-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1880-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3284-52-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3284-215-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3284-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3284-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3396-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3396-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3888-1-0x0000000002440000-0x00000000024A7000-memory.dmp

Download

memory/3888-7-0x0000000002440000-0x00000000024A7000-memory.dmp

Download

memory/3888-6-0x0000000002440000-0x00000000024A7000-memory.dmp

Download

memory/3888-76-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/3888-0-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/3932-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3932-247-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3932-66-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3932-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4148-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4148-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4148-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4148-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4148-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4380-77-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4380-83-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4380-278-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4380-78-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4528-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4528-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4528-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4528-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4868-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4868-39-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4868-45-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4868-49-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4868-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5652-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5652-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5652-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5652-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5652-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5736-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5736-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5736-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-291-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-326-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5840-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5840-113-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5840-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5840-311-0x0000000140000000-0x000000014021E000-memory.dmp

Download