9f9b38d30012bb19d5dd46ae45a37044bfe65865d3f4716cc43c1198ff9e85eb

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample261102-talg4axv5j
SHA256 9f9b38d30012bb19d5dd46ae45a37044bfe65865d3f4716cc43c1198ff9e85eb
MD5 8755f5524b2a0c375cba7ff60ef85bc6
SHA1 12a5944a4f413813075cc473e560c15165a502bc
SHA512 a01d28975d4ca7583abac40cb7c4435d176d80a11258904e47ebf8762d7b904d33471362491ac17e7bb20464fd6d3ca123feacdb7a1ff459fb5a59c9c49c7533
SSDEEP 12288:5cPrGxzQ9TA1ubv6IQ3okt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDp:5czGxmsYtd7mPuI7cpctubZN
TLSH
T13F65021077C1C4B2E9B3453095B0CAB1693EFE341F784ADB6385676A1E702E29E35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4028	elevation_service.exe
824	elevation_service.exe
440	maintenanceservice.exe
4640	OSE.EXE
5896	PerceptionSimulationService.exe
1920	perfhost.exe
4716	ReFsDedupSvc.exe
2428	SensorDataService.exe
2476	ssh-agent.exe
5832	AgentService.exe
4368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9089bd2467fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a868e4ce26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf0e8d0be26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0b4a24ce26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5832	AgentService.exe
Token: 33	4368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeDebugPrivilege	6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6032	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4028	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1384	4368	SearchIndexer.exe	99
PID 4368 wrote to memory of 5008	4368	SearchIndexer.exe	100
PID 4368 wrote to memory of 2136	4368	SearchIndexer.exe	101
PID 4368 wrote to memory of 2828	4368	SearchIndexer.exe	102
PID 4368 wrote to memory of 5876	4368	SearchIndexer.exe	104
PID 4368 wrote to memory of 5732	4368	SearchIndexer.exe	105
PID 4368 wrote to memory of 4516	4368	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:824

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9843f8421640c4bc431e7bdf7e89fe31a712c4457d9b7e74ea37bce27c9086f
MD5 cdf845296f3266bf4a30cdc67c6e4e48
SHA1 1527fc543f251618be8379c6e438ee98a90da378
SHA512 6571af26f9fd43c33d7763f9800e969f52bda9e6f0cd53b0e1b749e5e2a12bb59e461a3d6e49676b3d52142f737f343b7000c1623e1eb6f38e5b8b26558ac157
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqWPuIw:M3q6HjB+PuIw
TLSH
T162D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ef183d97cc8fae9b08afe069459e17c7ec39100d931233f99c6f5cdb9d02e0ac
MD5 b076806afaae80d53b1bfae7d56dc36f
SHA1 c8e78101c525fbc2f7a9820f1cc9ee55d948b1c1
SHA512 af1f80bebbf175586a5621f206b289b22ca0c83f6e64fbabdbb4d269a16a37e5ef9bdfa9110c78131e8ff566424ea6c68654f7bd46fe61adf6a13684a7ea16a8
SSDEEP 12288:c1XLsswWkxy2lRq2czApkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDA:qXYfDtczArtd7mPuI7cpctubZU
TLSH
T15F750128A7E408F9ED67827CC8B2C541EA3378554764E78B03E496661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cc15825074ba1c20a9d20d2965630110f0a6455b7a6a158fe63de12640034b81
MD5 6a916d7fe23755da48d431d21592bc08
SHA1 b130bbc80a1edb03e2be5338f0c8171d443fe453
SHA512 3aa59b3c63989bf1354964394669651de203994a622ba7adbe91c96af04f735a29631fb9450d17567ae8c72e1f95a493955a21e34b37570e293e20cf47418efd
SSDEEP 12288:5XZNYVLeyUji0h90ZD0wxpGZIVuprHsekt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWm:P0Le5ji0hmx2rMitd7mPuI7cpctubZU
TLSH
T146959E15F6788735D073C0B9C5D2A68AED7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd1356b7f9378f41e14c6206519d5a09d2aa2e8090afb983c4dbe6ccc5e476a9
MD5 b1df765ac2fbf0dab2aa98bcb4347c2b
SHA1 7b4d73d21793e8832891a55edad12a91389aaa8f
SHA512 8c30f274ff332fd88313fbd7bc3e0b29a08946b58bfe45994cec027ba6bd8fba19a7aff80c0aa1cb17ae2beb81c0946f5e88ab9220e8cf476255bc965d8aa6b8
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyuUtd7mPuI7cpctubZl:o/ezSC6vUzPvxHjyFWPuIw
TLSH
T14E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1466ae274affd1db1a5895696d8528211ded21cadf6642fd7606097751c6a369
MD5 72ce2d8d2f3013464c82833f34868681
SHA1 ffa2682a1e2f197b8860f60e0a5df36043731a66
SHA512 e2e6a480a12cb495bd43f9682c88cf9310e0c7766dc99cd89c2309a898b5ca6cda43bfd8d09630b9186b0ce5e48c8b4b520cdfad79fa229094cc4a1dc039a754
SSDEEP 12288:8VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im981kt2VtKqbUb4mNdonIwsI9Ec7tz:8VbqPb88hv/l+6ftd7mPuI7cpctubZF
TLSH
T1C5559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 30e9f76c1c2bc0048d9bc2006041431d28a5cc18c30eb531220fc4a1580ea62e
MD5 60f26e970e9438a311423e83ab02b8c9
SHA1 611d946be56868e46a2d234c5f7e775cd466d5a4
SHA512 8bc4e2a46a46fe9a30c28210a36ad3c7da6e1c8d0d2f553210f002ecf1e371fe47466ecb8e6a0ce2a9601c6b87204816d03a5e55f2ebcc50e255654016b7f040
SSDEEP 12288:YQKkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDf:YQWtd7mPuI7cpctubZr
TLSH
T1C55523148B2D8CE4FBB7C1B0F0F2C9D27A174E585CAC5752C647F39A1A7913AEA32191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4efc89cd98570714b52ccc87b61ce85d6473dca1ccb056df7739de3c81abd379
MD5 1ab86e0f6c75d93ca357742bdbc6abae
SHA1 cb5365136916943fa62ba6a1feb57a79818cbb64
SHA512 ba5c0ee611efddcf2affb9788b57cc144a722a8436db3f5ea6546b9c850c6bed05c01a2e7f862c103aa588d01ca240c76146b6255e52b4cc5291a59dfa429177
SSDEEP 12288:eeBNUbTVO86Utkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDc:eJIUXtd7mPuI7cpctubZ4
TLSH
T11A75CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 44ea7798c05a6238c89eb5ad7661b3f342173d07aa81eebd820ce2a1822e3dbe
MD5 5d5be3e8236ee6ebe1876ad255dce56d
SHA1 74205074c88a9ff5e702d37c21f34622e7cc2508
SHA512 f32a7412962fdebed98e88ee881b316cc2718deffdabefc25c68694ad9b2af220ad2cc9dfaaf7b5a77a38dbb3dc12e3e389445980911c326a73547b4400b8e7d
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:JQvGAdlCEL8c/yRNw5CbPuIw
TLSH
T1C6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 331d276c29a0117eee2e86bcd0dd9dcf6aad54fd9def24652d733bac7487d116
MD5 8f481a896ea845d4effa15a1e5fa8dc6
SHA1 0579263086e307ba5b06a6610ca997b2ca0fde10
SHA512 dc9a12dfba90b0e73e57a9b262ed1159382ac08f012d9e5d7c890de2eff935e0dcbd1b89fbfecf94f12e2435863d4f9e0b935147ab8325b9d037e7f49977acd8
SSDEEP 12288:SAwSfxL/2Dc30DLLmt0LDQewsAj7kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:XpewsAjZtd7mPuI7cpctubZj
TLSH
T1B475E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 37baf8678269666c332c71b7513fd52b158ac9466cd18a907f90a0be1c561270
MD5 ad5bcb7c7210498929e4e463507ce9a2
SHA1 42961902a2c6c5999df7822650b28946c342af1d
SHA512 89d09a40e8019169d4e291101b03c83456eb3005bfc0a9f8ceeb82aa41ae904b845df22b3993443ce1a23fb851ffddace0f9ee4a6a21c40d4c47276deaebe6a6
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsbw:sUEtQevvqc2W1cpV2EI32s
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a72b5e61ed4b2f64e4492d38755b092dda8d966bbe820eddc7a9c06e6f688b4a
MD5 07e5974f30e5d797afd326d691a0fa34
SHA1 3b20dc328ce8365e5860c59c3d4ec80f43b3186d
SHA512 f47a3a3302498777b22c60b04cc426e9c3b1568d73781caf7cc877df8506b805220e43951470d06c6f50677df504de496ada770af554cc8b96cf26365920963a
SSDEEP 49152:nCbRquA/m2yL5zifFiV+XenmE3/z5WPuIw:woqHVjnmnPuIw
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c2270c0fc492d5b71f579a5be9ae5e2abc8be8b31bd4e1e8f3c98551327144ef
MD5 d647df4eb0eb2d29c88b43d0e806f0e7
SHA1 e5925c992f3c092cbecdf602fb9081fa64d9475e
SHA512 5b533ac7299366527c6f90ebaeb956a5642add9ab4761ff0b9e9cef9956af758eccabe226577d56487129a0273a9f3f1f45fcee17d1a50705584cd54ec8cc98f
SSDEEP 24576:DAhGLJIFoiwtA5l7S53gtd7mPuI7cpctubZ0:DAMyFoiq5QWPuIw
TLSH
T14B359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ecaf2e71b57adc2cc6980c7ff74ba79c34d645151dc32226cc390c562304b05c
MD5 9aa89d505f96a6410944550eaf90ce8a
SHA1 8d9465ede75e35f6a38f8f5a0637b6a6d6147c77
SHA512 1bf4cb3e8b76eb3649bec7cc58a58387b807821abecfd806c1c73f32164fd0be2e4d5444ee9eefa80d99b9539152eb80eae97f4ef3fe2fccd8b4e4e1135edfe5
SSDEEP 12288:Qmw5HEjsChNJBFgl0WDm+Cckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDr:NwukOWltd7mPuI7cpctubZ3
TLSH
T18A75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 18c3bbfd40e90dde0d84d1321de8d86cbc79bccd17c6d03a5c534da8a4938284
MD5 f956c705346b21267f8d1eae3c7d16f1
SHA1 ac362f2804ffb6e1fd08a288b0da2adec3ba047c
SHA512 37ef70e42c7b3f4874664932aca0e50c1f905007dd286a911282bc4edf65dddb26ba56731abdf5cd2599137a8b9121d16747dcb690cd5b643a72c5d56c979630
SSDEEP 12288:4WZ1Iyrkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:xZu6td7mPuI7cpctubZQ
TLSH
T15365224823E864F9E2A3C278D8F1CA81E7337855277943CF4616935A2F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0019522a586cce1b6567bd9ec4b1edaeda295a36504d5e13b3f894204ed33b5b
MD5 5bb7a4d4ce316a1664cc06cb0d9f19b2
SHA1 54d67dbde178fc50cad27a674fbe0cb729ede2f1
SHA512 46c6573a29dcfdfa10474ad5a65c826edabf1d1906cb62e3465b794be922ab00b861083ca53fe28e4ef539f5f230ffb8cf964527419d0623f3f9550a0579a7cb
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:2QRQyi36YOcPQLvw2gAf+PN3yPuIw
TLSH
T103666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7ad9f15ff8b0e06386e3417d1e66b5725197d85a2b62e43c249cc137b0e09646
MD5 67be06267374b8196a98b730ab972938
SHA1 8f4a03211010df7d2e5ccad26d7a663927ba1b04
SHA512 8451c74d602a864cc7bd86bb268166ac9d455dd4e093ba448500bd66c7c22435a610213003d8b82e7d7c8d5d7da23afcc47bb96ab987380b6701a50505e5c3ac
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:GQRQyi36YOcPQLvw2gAf+PN3yPuIw
TLSH
T19D666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 241b1148662cc049468a5873cea7c999b65a8e2bf0fd7f651413a758c708a5bc
MD5 ecb90713c5af08685b29688bb1558b12
SHA1 7446ff00263f9bcdc2e851eaef35297f5fb0897d
SHA512 0a425854a67f6ea59e0182762b282f78bf076c42f52c9f9b3249a23fe972db11eb20404efcb2583bc4deafc8ac3dbf7a42a08c533c723515665b12ed32f80184
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qtd7mPuI7cpctug:i68Qg55nhheWu7PNU3/JWPuIw
TLSH
T10EB54A33B2F600A9C44DE1769F4A872196D27C758FE0E3DB850572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 72af2aa76a7ed1e5e153663c7aa1ceffa8525e8696572bc5f105a14ccafb8393
MD5 f23286ad1c24dbc966cddbec45580590
SHA1 95cfd983da9a9c30ae34ec3d7072f60bbb04a2de
SHA512 caef0b11b7c96b5cf554e0f2c5d4f824a4ad5d911d6f72ca6513c22c671b1e5f372f98bdf44c8e1f3b629b410fe4dc37fed8bf8192a7704bfebf5ab026aa8491
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:ry5112gYy5azzVvL69nLKnhZBPuIw
TLSH
T138167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 661dfaf43adf3ad8ea06cf9c84ad0899b293790d287ccf70a8ccb1ae1870d448
MD5 0727fbde7e92f8a6c8b982304ffc2b9e
SHA1 5e0b24a38276dfc41fe121b1b66b0cf7d4c47b88
SHA512 88dde338e4eb3c20e197782447ac9d83667cfe055853924df8ee02445427796d0f34887fa002cdb398177aee49052648c8cdb2915bd57a54029c43d9a5ef4807
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbWPuIw:wu6JmVxd2dqPuIw
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 76b3223fde6e896ccfe782ff1d3c4eca1e93d0f8c777a31d1ede2ae97847eba4
MD5 7f6a668fba0931adb72389a4505de568
SHA1 082aa69756d3abc568dcc9707b3c794d14189dfb
SHA512 f4c4379a4320c08ce2b7dee9627d1a28f7e8d0ac596c182e27f066f5ffb2e2b551450f2027be5c81990f8ae38ea71d4d4490c514a6075329e75dcd0dae8c1a52
SSDEEP 24576:Jhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3Htd7mPuI7cpctuq:L1hpsNoJpF1A6UU44CwH7R4x3WPuIw
TLSH
T1FFB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 297d97cbdf6937b1de245752ea9f01319c02a398dd70cd1b92c17f85f32cf213
MD5 16cdcac16d8079d0614479f2f5992cc5
SHA1 eae35536461016ad8e3eacf2b7fc1ee7405c2e54
SHA512 14e2864ca0b855872d0d73500b836ba8c5c662d78ff0885bd169d9cce1a86550bbf465911953d1732ea36247eba7770c79753b2d2243da436cb4ae597bd8959a
SSDEEP 24576:a4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnq6td7mPu4:uSuZQIY0Be2KRRVtOnks6NMHq6WPuIw
TLSH
T165C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7e66348bbbc3db8763db1a84c426b01df97f99dc730e0f09d545669d923f3162
MD5 a462820ccd699aa0c57f33e5625eda29
SHA1 b5506763041ff02d72fb3b9db3867e65a1a75b0b
SHA512 f64d1bb216c5eb9a34adedbfb6fb9332557935f3dc1f9dc59865571e4a133ec13b46af48d242eb3959f09b3e06928b15eaac2e92de4f7fbaf8dc88a97dd627fe
SSDEEP 24576:nhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLHtd7mPuI7cpctubZq:nhtSn8EApI0figngiDn0AP5wrWPuIw
TLSH
T1E595BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 466e0d7b8dbec9791337ed38f92470a28168c49ffcfab33e8477f41462c860ff
MD5 c9c2e96999d6660434d044e15b75c4a9
SHA1 d6030609405096a37238c3f75ff8049a6ea5d017
SHA512 d81f07829783b7c1796a628f02c9697f028c820a1d991fe9eba15d9850b08b7859a3364672915b0f241708f50c25414fffa3f419ec7762c6096be7e331094946
SSDEEP 12288:likt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD+:lOtd7mPuI7cpctubZa
TLSH
T1575523189B5ECCD5EA67C1B1F0F1C9C1BA1B4E4DA8AD1352C74BF2162B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 251c0041be375a429e2ebdb1dff5dfb24e93f97c992b0c44d1e349a3c43d6a84
MD5 fd1841af0c7d68625ceac51c418a8000
SHA1 300e7dc2d3b21b1985b8a3c988f834d415bc00bc
SHA512 52c1cd11523a9796f8daa6a57ae332052a880c57f5dcfff3a0ddca4266766bad7419a8ccb632d9a3a8b2cbc40adef19bebf78c1f529eb147f641ca5466c749ec
SSDEEP 12288:uXkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:uttd7mPuI7cpctubZl
TLSH
T16B5523189B6E8CD5E667C1B1F0F1C9C1BA1B4E4DA8AD1352C74BF2172B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 ab0b99a452d92362241728c2a4122cb93b781080ec95d7d20c55f7410284f1d5
MD5 3973b0f738bc473f24d6721b86bae3b1
SHA1 c4dd7f95d36cfb9e61cbbb5f53194db3af4a74d3
SHA512 98b0bf95f1fa84b084660d2ccf546300645e8f9f73205dd48ced70c40df3587ff50a90b18371ef911806a4dd34cc263363d04aecc2c99af172b2e47f1a92889d
SSDEEP 12288:uFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD8:uPtd7mPuI7cpctubZw
TLSH
T1A65523189B6E8CD5E667C1B1F0F2C9C1BD1B4E4DA8AD1352C74BF2162B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 00a008380fcbfab962e77610f67a1c8306360e9700265e9ff58af531ec7206ee
MD5 81b0848f858b5e45c2331e24acf6bedf
SHA1 9ba9b074af5bda295fde6be9f8d3c49c32b402cd
SHA512 5b95379febf5b31ca130c818e4c258b9c37242e4c1c7c6de855727f8b3b56a055e2b0e4da6d0383ef0d5f93ab2a546b39b081337e20db06edfc2045f1ad6b2ff
SSDEEP 12288:NVgkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDT:Itd7mPuI7cpctubZH
TLSH
T1035523045B6E88D4E973C2B4E4F2C5C1FA377D98A939539BC702B24B1F71379A931A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 e40697fd9a47e2c903d5a7a4fa9ce38bb5d1aaa2cd1006e83eed577c2cea61f0
MD5 e8465760710c768bf69dbbe06b849525
SHA1 824be8ac7436d3f97d6b68d03800c52f7e553444
SHA512 b75d93360081de4921d1218e6c4b56ba5507a5f1fff82fdb0fd63527b75d4cfebb3e25472a9543de1a13e1ec58b269b7b31660c8bd1006455b5c92b8b979f5e3
SSDEEP 12288:Ookt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDZ:OItd7mPuI7cpctubZF
TLSH
T11F5523189B6E8CD5E667C1B1F0F2C9C1BD1B4E4DA8AD1352C74BF2162B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 14bfa58b47d590e29616abdbe51b13c5545de53996244c7292d9ca6bc79e88a6
MD5 769029fe8cf8623ca1d6ca7e51bd14b9
SHA1 b07425d8e4dbb8fdcba4f244cdeda5bd71328ebb
SHA512 2a12a477fe3e99b4e91b122f41a70502d2ad70381860da23f465c498a99b7f5a37a9c856130c25ec01742247752c44414968d966f85f50fd26b3f9ffe593ce6d
SSDEEP 12288:1zkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDl:1xtd7mPuI7cpctubZB
TLSH
T1FA5523189B6E8CD5E667C1B0F0F1C9C1BA1B4E5DA8AD1352C74BF2172B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 e3314f7bf410edf8287a586d8b8f3348fd9482037fdd2294fb055f7399755e05
MD5 e0dbbf5d58fe727089ec5046c97cbe53
SHA1 dc69c55208ac0ef383beff4a322127bf14bc9cd0
SHA512 f3a48d07600992d7a437889e32785447467064ef43996924d536c1f890679e4a42f3e5a2da4d9f4b1581d2b70e6e88cd0da45b53a1727f64045dcf7cb0dfb371
SSDEEP 12288:N/kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDA:NVtd7mPuI7cpctubZ8
TLSH
T1245523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E4DA8AD1352C74BF2562B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f5ae039a138cc2838d8f9fe370edad41ef5f3b3a7a9f60ef0739ea61f482d822
MD5 339660a9ca4a257a53e0df671d5e9316
SHA1 997257ecef6bdbc6574e1017c69ea8ef89fc7e70
SHA512 572d40b3d34e603ff42783d117a82b2ca18e0ae947d6a0172540cd06a1babde7392996a21639aeb7e6429148cb1b3a9419758b5896f06e508644f4d6627d6b45
SSDEEP 12288:ZiZwbGzzFEoS2cPvy3kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDm:cZMGzFVSONtd7mPuI7cpctubZK
TLSH
T106750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 b6e5182154e697102106a939da39cf40b37353bb761c7f0de2f3805f4887a2b0
MD5 1b0131e700b1c408330707f232f2ef45
SHA1 00fd58e7720cadb35dff7f057252568529d61a7a
SHA512 0567ab81b62bc3a8dc1e4834748016ce40f1c884de7f42be296b89cd994c70faf31ce3f587d6c558cb74fa8330d97735c7112ccfaa0c9362d70b84a7915d127d
SSDEEP 12288:ZGkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:ZKtd7mPuI7cpctubZJ
TLSH
T1405523189B5E8CD5E667C1B0F0F1C9C1BE1B4E4DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 f32e41ab3e4b7eebea5e97ce4c495da68e5cbca13a9bb7447af859fa329ae6d8
MD5 48bd14c8be9f721864a27bb0894dd0cd
SHA1 37a923156ba18dbbef0c9e8c9503cd256c564f8a
SHA512 7053e95deb2bb60595f6304a0c9b8c0dbfcc81279277f66c7a7eacb7544ebe2b2f9e0eb478c277224c6a8e53995873a50595e65405dc39532a96863d62afdfea
SSDEEP 12288:96kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:9mtd7mPuI7cpctubZ9
TLSH
T1575523189B5E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF2172B7523EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bf4ada57f5779dff3e8abeaa86b68201642e29ed317820b9a683913234c4de83
MD5 0598d27d318cf6914ddacb804f5480bb
SHA1 35e18f242f63bc0ac783219853d765405fc35a01
SHA512 a7043f4aab9769ca7ed5b54358a5210ea56496644cd18c291309a1c3b6492480adc63a73d7dc7be3799ec9cc801a93ea12c04287fce693c9b1518320bc5e1e81
SSDEEP 12288:kyPz5L8rkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:9zyptd7mPuI7cpctubZs
TLSH
T18A65120777A520F8D177C274C8A24A82F77678354B248BAF479453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 01aeef92e882c1d455c7538fe1d2ba911a6a7cb1cee05849bac5ccea24cdce1b
MD5 334fcf1dc57d4bd901ce096ed76b426f
SHA1 3b437f0e6a6f0cb526778a091a9745177245d7cc
SHA512 1012d0d10d40b9972bdb54c45f15e5292362fa966c4fe375394dc941625bfb2c8cfbbf872c1e49d562326fed3fdf92ed53f443a29d32abc5dc92e7aee10237b3
SSDEEP 12288:TGkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:TKtd7mPuI7cpctubZF
TLSH
T1805523189B6E8CD5EA67C1B1F0F1C9C1BD1B4E4DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 3ddbeae80f4821b0603517e936033559275b1724f1572fcbab0e57536db1665f
MD5 c2928237b3a4dffaf06265a62f1de8cd
SHA1 5ca9dca389a30ed268e9f802b998bd56267ec700
SHA512 8db57435e59c37640bbadbd791cee00e59bc105a2ab627dbe9714439745dca2ff933cd657c100046baa68faa513f1aa69ecea7f737a67ced9849906b078b5232
SSDEEP 12288:8Gkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDo:8Ktd7mPuI7cpctubZc
TLSH
T1215523189B6E8CD5EA67C1B0F0F1C9C1BD1B4E5DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 299763463d465255e66dbdeb6d01b3809cdcc89b5ca44bd18cd3e6b89b4e6b7e
MD5 4a65129c9b51f78200bc973f3c944c32
SHA1 b52711eaefedea8b9c95a014d51ca55ed3946c7c
SHA512 b4b9012bcd89a054d63287e1d56f3f24d15d07c32be4fb5349bc737bf1a734ac8d9756f4b900443279f9c812904ea14d8ff748d0e714ef81a29d6c6b595fb19c
SSDEEP 12288:MyPz5L8rkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDO:Vzyptd7mPuI7cpctubZq
TLSH
T1C265120777A520F8D177C234C8A24A82F77678354B248BAF479553772F332A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 da7a552c922444c3b3b6c26b69db9f70c19041e55e121d3b08eb01c24f9ecdfb
MD5 28e7ee152b2bc4243b589c37b48b334e
SHA1 ef36000d1394e732d00e734cb6290bae341e21b4
SHA512 8566a0496e730a4dc6a92eb00c96aeb80e3faff2e6f31e8745ed7e2365eafbf63b59b5fa783616e449944eaadcf1dafb9763d49afacff10f915e64d04c2fb624
SSDEEP 12288:2Cd9SWYoaLHF3z0z04PDvhVkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDD:XTTaLl3z0zD/td7mPuI7cpctubZv
TLSH
T1387501A4B3504CF8EC67817EC8658942E6B27C5A0B74C71F03A9366B1F333A15D3AB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 64a5c5ff279c7f1686f17b4f0899859ab34114bf3666d96a68fc019ca8a79f49
MD5 560c7f12134ffea36f0906780404cbd0
SHA1 73783f656c8a764a0b07e29478d49b98f17ec750
SHA512 f8d463f91c44c29b40f41b4d21867135156a9f809158fc93ffdaf7f2316998855ebfa1351f4e0dedf6f656a7417dafe1f156e2e8805bd47cb918100d800398ca
SSDEEP 12288:Gi4e7zRdTfgwCHKy7GLbbdIvkkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:G34d9CHKy7GZDtd7mPuI7cpctubZh
TLSH
T1E785CF90F3E814E8F1B7CA35C9768511DA767C5A1B31DA8F03A4661A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 b859344d0d441719e9e9264f8a9673e14af1f0b4b205d1f0936fc5c423660e2b
MD5 16e38be2daba7314972ac16d76649fa3
SHA1 be74adbd7c3a68bb60d590fbfcbb130beb46b837
SHA512 4a1c4035bda4363278174adb772c6e17e365f964fcc2f336663c8c607051c510656f236e6a4d98c061cf7e4690ade870a042a25e984793203d51c77b0173346e
SSDEEP 12288:dlkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:dvtd7mPuI7cpctubZs
TLSH
T1355523189B6E8CD5EA67C1B0F0F1C9C1BD1B4E5DA8AD1352C74BF2162B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 0075b1a9332cfd2ef96ee9c4fce73af28748f05223b528f1c74bb01f614054d7
MD5 a7971df36680f3c344cdbe60a340707f
SHA1 e56c7b9ed210255650ce7a8514e869f0f920cd44
SHA512 f4102bda73e3d22ceaea7f569f001820aff2179e4797aa51c9a1ad4ccf8cf70dd75457ad0eae2f2e90e0151b100eef80189d66c1853df2704cce3a99a5bf5e8a
SSDEEP 12288:ALkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDg:AJtd7mPuI7cpctubZU
TLSH
T15A5523189B6E8CE5EA67C1B1F0F2C9C17E1B4E4DA86D1352C74BF2172B7513AA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c08a0fbeed30c459d558b016f66283495bd900042eef68e52a3bda1b602dc367
MD5 d6e3d49436c5c4e7716b92bf5ca5b63e
SHA1 063db25bb0d9d1b16fe06868f9f1d165ab548876
SHA512 d1b81fe47fadeb78f672909115202dfd9db11476b62653220237318961d57223902400f034c14b44dc8fadde355e237227d0f79edbdc3ad8a5c190f291fbb6a8
SSDEEP 12288:ekkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDa:ectd7mPuI7cpctubZG
TLSH
T10A5523589B6E8CD5EA67C1B1F0F1C9C1BD1B4E4DA8AD1352C74BF20A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 93c173409ef7396a47d7e0b6fffc6fba3a875c44554946e475fa928956e11dfe
MD5 de1ef9d07b5b07ecc0955d5aa3621c90
SHA1 355e5a462cac2dfcf53f727756d5df2aab5078bf
SHA512 55f123696934d88501fb63b3393648dfe302a82d6676c2243b53ac7d423ea2fe9dd465c4942620baf5689a4ddaed8e15a75af3daf7243d630fdebf82174e8bf6
SSDEEP 12288:lGkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDq:lKtd7mPuI7cpctubZm
TLSH
T14F5523189B5E8CD5EA67C1B1F0F1C9C17E1B4E4DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 e86ebc5d790bd1036a963e51e01aba8f12580a232de25af5e7b7c8faf30ff795
MD5 90d6a0ac619bba8d8f13fe8230bc5190
SHA1 cc4d1019c2adfd5c784158fcd8493efba4c8533b
SHA512 3304c39e8e27a6762c54d0cb5e962bbed1a6e27525241f37598b0257e032416905f5b4d172b44210530a16acc5023bde380d50d7abf523427bc63b87d9c77cb4
SSDEEP 12288:+lkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDS:+vtd7mPuI7cpctubZ2
TLSH
T1705523189B2E8CD5E667C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF21A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 03009f7fb5570e6cd5a39d8eef4e5fe651521dac1fd1166579342927a156d2ce
MD5 38d7629686d5141b36516dbfc5adb191
SHA1 9340582122d7c8c4243dceaad9ff7c9590ee5632
SHA512 df4a6282f7c29eb3ae535fd092eb95858ba063c783d45bcece6e1c99ab3defc5c4698fd672ad3cdbee52774c106acf7b997ec2144846356447a2f5ee3e5b72c1
SSDEEP 12288:wukt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDC:wStd7mPuI7cpctubZ2
TLSH
T1435523189B6E8CD9E667C1F1F0F1C9D1BD1B4E4DA8AD1352C74BF20A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 731f974610ef87a3a54bde9f2ccc5b4c3fabe8bcf0ef9076aef3bbf361a2c9a2
MD5 dc25cfe4f852ebe96ebc816411fd8f07
SHA1 066eaa0b9ac7fca71f255e7038241f9dd9e29757
SHA512 d069d3163f5a08358f45dc2338552028aaa07551c46d6d0750b5a893f1743f5df3c1ed1ea9fc59ef7b1ac04619d7e80e73b3e83047338f6b64aa7a351b26e92e
SSDEEP 12288:2okt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:2Itd7mPuI7cpctubZH
TLSH
T1AE5523189B6E8CD5EA67C1B0F0F2C9C1BD1B4E5DA8AD1352C74BF2162B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f2fac68acc564b616fb62020d14eb1d700d24ffc7bbec33d0c55d4832e336b74
MD5 a5804a12ea6fec9fb10d98c9399e6429
SHA1 1dabd8149901ca223fd260df2eccf455ec3ad7d3
SHA512 9041e0ab031f0575f612f4381c158d8781f34217421ac1353a0633d241f68c4c23272c9cb0e5d5fdb72b9434fb898d6864bc4b786242a90927ed99ddb7d76743
SSDEEP 24576:vfwv0k9RX6wkyAI2td7mPuI7cpctubZ5:dMnYI2WPuIw
TLSH
T1D285DF29EBDC48E5E1B7923C99B34646F6B178591B31C2CF025A536E0E33EE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 12c96bd67bd16bcc9c6f72b2c7ab7018d23019df758cf8e2040103ee8976cac4
MD5 c2d25cfae9377b6622eae4b95bec6b65
SHA1 dd3b88318f27d2b1edad47751342099ef67f5dc3
SHA512 93ec75926f155c789c43a7fdd98376bfacb00d75bbcc9729603721e1224182bcb3cd670d6e9b1e75ea498ac1e2c1bb8deb34dba920bf495fe5df0b3eda1cbbf1
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LWPuIw:NySzPSPuIw
TLSH
T16E066C96A16841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 513d476706b984e6c01e17640557d1f90dc381661a9a0321aabf3f4580d801ce
MD5 ef7ef27a6c46324b0ad1d4447e4424ba
SHA1 9a82216bc8e5f3922afe1316b84180e39ae7c30c
SHA512 1178a9f34ceb9815ff2e74ee1e43c36c6d4e41037e754fa5fba6b9330ae033204bfdaae0c8d61e419f4096b9d6d30f068f10087e0da081df104d37c8ab81e8a6
SSDEEP 24576:q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYdtd7mPuI7cpctubZw:q47JUQj1irIhCnDHUPfF/bWPuIw
TLSH
T11A659D1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b00118963369735414237da34165113e9ea2f5622039aaecb6b8ab9d5667a595
MD5 06e4e726674e919a88c305dfe4d6dd2d
SHA1 352ed5ecf238e6d761525712545f349ddf13a4f3
SHA512 10d855e424d4f5a7379b936391080f565f57872f986d2851d46d7158aa191ee8e63db476d32f1b3510aa5f2848e8e3995f713bceff8752bad308ed1385f96f0c
SSDEEP 12288:a8sfWkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDV:s6td7mPuI7cpctubZh
TLSH
T15365F109D39841E8D06F9275C7928A81B7337C2597E193CB43C1F63E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5214eb1443f65e716394d39f842214c4ced8aa4d6d819fcaf324739a2e439121
MD5 6d045e7d33b8d51b9c0141c26cf3c8e4
SHA1 c8cdc3ed18988ef47e8ccb261fb561a091d7f0e8
SHA512 69daba7ea1ce7806084efb967f0794d1b23573c9982817701fb984f893d8fa9aba50e23dd0f440be3adfcd7423f5ca389ec7e0ec064ef59871d30ae2b0a58411
SSDEEP 6144:m/sBC2naj2S0Yv/5V4vwotMxG28qU3fIkAYI1DU9gukGFdh8yb1AuROqylAIasPf:mgypnU3fGHukGSG/kJlAIFPZFntHiu
TLSH
T1943518407666CB5FC6A944321E32D1CCAB707D05EE04AF0773C98B3F9576658BAE2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 cbe4a9f6f4b54bd47ff3e23c21f9f59c28c4d02f2edfdedbb507a0f26ea9bee9
MD5 480ad55087f31510e98254752e01f675
SHA1 98f5a91daad6ff2214dc7ac048e3d07d833df5a8
SHA512 cf3750cf3271d7229631b70c2dece37d53d5f9344547dfe8cf63996e8641fc746714147db52f3c3575f26acc7215c4738b3712a91c6b84af33003615e563aa99
SSDEEP 12288:KnIdKHA5NWgzVpfuGk+kLLl+Kiw9T2cbE:pdKH+GLo
TLSH
T11175F9415137E78FD1B76032033AAB4CBB64AC07B7056F26B389453AD86BB15A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 ffa416308fb68cc02613257cf329c0d909a151a3a7f0d79a805b832e6ac78fef
MD5 afadb4df6ed053c8772b4cf9b2ee221d
SHA1 30f7fa131f5dd4a816ea13aec63a927d784d7da7
SHA512 77fb7f2798803c9757667bc7c4dfa177fc0e46fd58c9d9c3ad0c026880aedd53d0bf42423861c17817827bf65e28326591afea24ff33358b9122de9ab8cf54de
SSDEEP 12288:2k7+kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:nCtd7mPuI7cpctubZD
TLSH
T1F35523148B5D8CD5F9B7C2B0F0F6C5E17A1B4A585F6842D3C607B38A2A712F9DE32681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1eebd3b1c824fb9bbb6f485c72213f62f89d66fba08516a282b7c4a4091372ae
MD5 283b27fd8109cfa36d8c85006ab2c3eb
SHA1 aee46c861af7c009be22c2d013451171db1e3296
SHA512 5ec0bceb05dab19609b949821b371bf7b2e2fb09ac24aab630240a53445294280785f89587ddf17ceeab96188bf73ba9dae6e18a7b533b4c237228c0418d96fc
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYUtd7mPuI7cpctubZa:ngb4mBIBhGFdWPuIw
TLSH
T11165AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5fdd97b0f6cbdf986a82acafb6ec95740e8d569e03c5f37b032acf4fe144fd7f
MD5 9118effd178cc9a413749feab26b06e7
SHA1 0837f9585e24956052a384e8a9d9819fe3913b47
SHA512 13877bb0c938af19287559160b536f6321b077e0e1a27b568c2b64e1add82cc749a014ff5fd6109408f0a02d55337dea24d2546ddfe09402c72fd79ba4f1851a
SSDEEP 24576:fG88u8FpJqH13zria7/mNtd7mPuI7cpctubZ9:u7ZFPqVKa7/8WPuIw
TLSH
T1FA95F16567E501F0D47BD138C98286A3F6B2B8250364EBDF07988B561F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 01ef28c7d1288d4cef915e6548e67feaab49a4bbbc0d9e3eb39d89e71239f754
MD5 7cdaac157a180dc28a4b63b275e91f2d
SHA1 6dfdbda5982296af0a39d6aee1097ede1fb42a74
SHA512 a4eff681434d226d3ebc240889f784e90a03a8f34961fdb65163a60504ae98b6c2cc66cf67f0ca9493e7bd8685ce0b68fc0753ac3fa463ebe3f3adb120ff5b3f
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxWPuIw:MG05lO43bJPuIw
TLSH
T187D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ba05dd9957e23ba37f2c8495bcc5dcefc094ea8784c0e2299944f5ed509f6ae8
MD5 7ab6d52f8a15a92b37fa403c7935d4fb
SHA1 37f4869c9226560cc0f45066b009a77c39bc6865
SHA512 038e0797bd0184ba2f0275a669cd8a97563a1b8cae9c7c5b565c01da3c59218c74ffb532ecd04cefdf7315e8ca06a199e50635b8b354fe219943716e4dbbe352
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLtd7mPuI7cpctubZm:za5POZ3+Jt2pasx2+mJWPuIw
TLSH
T19965AE5DA7FC00D5D5BAD17DC583861AE5B2342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4bf900317b07a799b046904cacc319d79c155ce888287caacf882f9f48a6f345
MD5 b4a7fdf7dafb461c5fc05cabb6d7a7c6
SHA1 74a8fb1d4d9e1c65053230d981a2beb71be1caf8
SHA512 884780b7f1a81aebc2c2c0ae9e758d203e532ba18eda883a92d48061eeff3dc0c3097cad4c59eb096365ac9ac136f4764481ae514b4fc077eba05798340e8d25
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkFtd7mPuI7cpctubZL:ONc/zEOVHFcWPuIw
TLSH
T1B8857B1623E901E4F5BBE1BE89779946FA717869133486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4e2a96a8b02af96feb178b6a4070807c0f5a25c733a880eb92b64b5b24c204c5
MD5 68fdc496954bc83adbc23c43822f21d2
SHA1 cab185d6f22bb95c55f83b8074712c923c417f4d
SHA512 cfac4f4f096bfc0094032160f3b0acb1fed1fd6093e2f8822e79f94fddda6854e87fd59f7901b74c563a630b49a51df8551a6923448d1c9bef140e959d439141
SSDEEP 24576:w8kNvNnaFeYhJNtmZBmntd7mPuI7cpctubZ4:w8MwBtOmnWPuIw
TLSH
T1FF55AF6EABB845E4D1FAC6B4DD238512EA727461173293CB4390C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 941f2f3763731ceea0680a19297e138f9a949e279cd7731a79a453b64015a8ff
MD5 923346909a5fd9514a2d83ad6eb8bd84
SHA1 583b3eed011aac517f14acdd8ee01c9ff14770ff
SHA512 a4063d64b8394888fd58d81523d3d526b19a4b06c3ccaf1660f39044557ccaa6430ff606772bfa32a91e2b5be0fcfddb288a0a7d0e55f869d820e14d1952ad49
SSDEEP 12288:mHvUrBFrEjwaQjkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDE:mPUr+NQBtd7mPuI7cpctubZo
TLSH
T14D75E12E67AD1CE5E676E17CC5828649F772B862171192CF02D1817E0F73AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 772475aeb633d73a3f2a5403abd5e2573d9bb9219f30f27897b33c56cee723fa
MD5 b701ae8e1ad5b0c44eca583751a535be
SHA1 6e6d59b01906df4d982d94d158117997678a6fc4
SHA512 19db1b682e1dda1876f5a264fa75b032f975e8aef6fd1ab75d0e5cb7f5ede9375e521f765551f8cc4a8a6b2dc8a4839f1686f71e5b632d913bcb46d46cd7d47d
SSDEEP 12288:JQcMxWDXN1Dp/fshBItT1IQgACkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDA:1D3FHshBIYQgAutd7mPuI7cpctubZs
TLSH
T13C85E13DE75C04E4E57BC1BCD6A38A06E77238A9032156CB0294D1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/440-62-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/440-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/440-38-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/440-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/824-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/824-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/824-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/824-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/824-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1920-250-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1920-78-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1920-84-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/1920-79-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/2428-108-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2428-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2428-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2428-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2428-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2428-313-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2476-117-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2476-312-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/2476-115-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/2476-123-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4028-14-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4028-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4028-20-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4028-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4368-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4368-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4368-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4368-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4640-50-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4640-178-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4640-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4640-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4716-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4716-280-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4716-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5832-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5832-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5832-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5832-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5896-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5896-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5896-65-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/5896-212-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/6032-0-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/6032-77-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/6032-8-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/6032-1-0x00000000022F0000-0x0000000002357000-memory.dmp

Download