a3c0d6ad5c6c36ad1abcc3049a37bfbebfec8ccf4571f78c4561bc7c6fab6728

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-a2edbacz2z
SHA256 a3c0d6ad5c6c36ad1abcc3049a37bfbebfec8ccf4571f78c4561bc7c6fab6728
MD5 ba928a954ca3bacdb107a40d00b54974
SHA1 af236bff7fb74ea2ba36027e54459e43399f91b1
SHA512 72123ffc0e51e6612476b58df48546cbd503c932b4897d92c5d9b67a8e5ab58ce7a30e90b49c97523b04c1b2aedd2a515a6305e9d1a9ffa2a0e5daa276486e5f
SSDEEP 12288:JUYJ9bisN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:SYJ9bz8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T1B1F4022072C18473EA73153259B5EA719A3DFD714F1089EB23907BAA6E346D0C93DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4264	elevation_service.exe
4104	elevation_service.exe
4952	maintenanceservice.exe
3708	OSE.EXE
5536	PerceptionSimulationService.exe
5024	perfhost.exe
3000	ReFsDedupSvc.exe
1908	SensorDataService.exe
2284	ssh-agent.exe
2500	AgentService.exe
5432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7c559656238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008a539a7e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edf093e6e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b91b1ba6e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a87914a6e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005f9c9a3e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000928e73e6e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfbf27a3e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2500	AgentService.exe
Token: 33	5432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5432	SearchIndexer.exe
Token: SeDebugPrivilege	4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4308	2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4264	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5432 wrote to memory of 4416	5432	SearchIndexer.exe	100
PID 5432 wrote to memory of 1992	5432	SearchIndexer.exe	101
PID 5432 wrote to memory of 3544	5432	SearchIndexer.exe	102
PID 5432 wrote to memory of 1228	5432	SearchIndexer.exe	103
PID 5432 wrote to memory of 3536	5432	SearchIndexer.exe	105
PID 5432 wrote to memory of 3496	5432	SearchIndexer.exe	106
PID 5432 wrote to memory of 3516	5432	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_ba928a954ca3bacdb107a40d00b54974_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f766ba10950c92a1c25375ca00ffc9234769ca3ec06cbbdfe80b066a6d69c887
MD5 bb26ba8908244ffe70d00d04ef28ff8c
SHA1 4a6dad1d3f4da5f3932cd70149fce84662a2f8c4
SHA512 a6047c9b1c9f9faaa1865790760aaafb4b510ad8c7e4bfb9e60c000e805f735abb8053e2c56cfa2796f142a6e79720812aea6be6b3a0fdeaeea3b3ef7a7d7d01
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn78U7twh0gYUub:Z3q6HjBIbpi0gYz
TLSH
T135D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 53116a355ee62c40c68f14b2dd44f5051e265a74bf2070a1bee111301c5735bd
MD5 0ee407a471aee78ad60654a253085660
SHA1 229c9e6022c17b6b0a5591111f6e943b9a7f8266
SHA512 93701efbfb9f33318c25674286bc67b954083b8b1053f614f36e36cf1ba6ac8d7c7ab9f71bcfe5c6c0ddfee1e1483343c9eb5a37c7ac2a2bb0ae444e79164941
SSDEEP 24576:jXYfDtczA88U7tTK3VnChd4Q4PQpUcrf0FGDQ:mtcl8U7twh0gYUub
TLSH
T13205F128B3D108FAED674239C972C511EB327C554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4f2c5cd389077769281c02b0935a1c08d67d53168183aea3856aeeb5a1115c7d
MD5 c4b8d8e0bb72baec49c7353ce2fe6511
SHA1 b1b4b45cf0f24a6ff8d09a99567b95e149c7c574
SHA512 6e5664f81a20b62427dd750e5a3913976694188c367057829f9c593ad3e1e70b98d470e4130b2f3d6d4a3c23f071252ac8a9eae88c3cd01bd0cd899b10c3c6ea
SSDEEP 24576:E0Le5ji0hmxirMz8U7tTK3VnChd4Q4PQpUcrf0FGDQ:EPji0AcC8U7twh0gYUub
TLSH
T1C135AE15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a6caa1c0e144ee435ce072d81b591f5aa09885e970966b3291d1a8c838c669b5
MD5 fab449be951d99d83a1898aa066a7322
SHA1 b99c8148a56f559efa7d60d32a62c54480f4aa75
SHA512 52466aff5bbcffcf4bfb10717fb56567f1d4568a372727fda326aee62d17fbf12b5c366cba3f0222267dd87ccc709d852760d8f8a11518b6db1a9855f9a8c622
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuV8U7tTK3VnChd4Q4PQpUcrf0FGDQ:H/ezSC6vUzPvxHjym8U7twh0gYUub
TLSH
T169755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 209feff1b3775e6e9b0947677e97ca56e40f15db7a5870a7737bb356957fe574
MD5 fcf1016626d9787bbf0c4a4514a34a5d
SHA1 6f78efa650b5e1d5827c352fcebad5bd36a5f33b
SHA512 eb5801d64ca77ddcceb9a63d7b69f2129ddc5c774c386749e1bea45b93ecef56d3e75eefd0a1fd94b6d25f059d7b29691c88ad97da345fec10fcb9b4c71a6415
SSDEEP 24576:SVbqPb88hv/l+648U7tTK3VnChd4Q4PQpUcrf0FGDQ:SVO88hXl+X8U7twh0gYUub
TLSH
T1A0559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 06a8f3f7490833126c2ed729b3ba6d7c1f74ea31445f34bccf0a99f544bd8bff
MD5 69b8cc04cd45f46ebf805a6f3c0921fd
SHA1 49477d2d4dd0a732934efa5aace6aa45630a63e9
SHA512 3ca8827dce3e97fcad53fe8992e997cf9709f28d039e3e578243f8809340a9ebe932f7f3e25dcae9d94f94c0943f793938bb676147f959f078653bf6b44b6d87
SSDEEP 12288:6RpN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6R/8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B3C42320A7858807E3662B33F937E9A4EB111EB45D44CE251460BEE46E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2c3814bde676049d4ef38b2eb835a5e05f1fc42db8c2979a5134f00c8d6217f2
MD5 2341bb96a00e0a16e973b71c6d81d71f
SHA1 ace34e298fc65a09647753574baa4051b44019d0
SHA512 568c772e1f195d60092a32be669aff734344c56ef4cdd0dbcd7eb212840b1a1511d6b35531bfb3fa536048eb4e84cc5367fd9c64fb69a8033b1656353e70d955
SSDEEP 24576:YJIUQ8U7tTK3VnChd4Q4PQpUcrf0FGDQ:YJIUQ8U7twh0gYUub
TLSH
T1E305CF3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9afdabab4b2a95a0d5329fbf233c7d3947fecb5fe37eb7acfff808c7616ec371
MD5 7fc5339440071f6015afdf25cf7321a6
SHA1 906ac33c1f1a152585769378e88289ea30459972
SHA512 7d76d880e277831e82a04de3fad6c3edfb9c71a2755d3354b7014d12dfdde3520c08c5caff7d99d13448e7d8977f7258147f87fd54d9e2c1b55b332914f93cab
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:0QvGAdlCEL8c/yRNw5CFbpi0gYz
TLSH
T1C5266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a22c7ccba4fb462df368d46d95f24c5999ae1c335bf332361c053f81be4efadc
MD5 9594bf684798415f02322a94252ff080
SHA1 10d824159ef5256f50b389cc354e5b42932d895d
SHA512 456e6c263f9451aeffcda0581fbf317a24faeb9146b1b5470740baf5a2c3db14c75c1adb7daa3d169e8842b14852c327ef2ec4243ad239a86c382a6e6febf186
SSDEEP 24576:QdewsAjy8U7tTK3VnChd4Q4PQpUcrf0FGDQ:gljy8U7twh0gYUub
TLSH
T1BB15E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1271fc79b0ccf323408805b337eac10e4e15ced0975f6f6020025e8ad1ce481e
MD5 b9547ce3d6a383b1265ecf5e601a17a0
SHA1 1b064d55fbffc8f40032289aeaa365e978a6bb20
SHA512 348b1283dfd744cbbf5e7ab247979b745ec113f133fb6ad7f23bab5eab52110bd3d10229562ec9f33384a606e766cd5c80532a2f2d579587bd9f7459d819d359
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3H:FUEtQevvqc2W1cpV2EI32X
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8c79b457c9447cda7a4cead1e0d416102814b5f86ad1d8431ca58e010b29ae06
MD5 492eec934f977b9ca4985a48c8ab13cd
SHA1 0c52941ccdae1cb605dfd694f5f9dd0b375f3c94
SHA512 e3f749344172ba65a171d9ffea25bfed0108e547d3bfeecb2c9df2a8fc6f23c618912644b35be5da41c962316318b63f2aa0091b39d0645560d517eeefcaf1c0
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zS8U7twh0gYUub:OoqtVjnmJbpi0gYz
TLSH
T183D58D0976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9eb51b580397fb5846daf976baf4c7963df17b5098ddeedeb347c1f2eecddd3a
MD5 2ecefc558e6950ce0f8cd59771ffa9bd
SHA1 0a7cb303a43436c17182c9a252f41cf40665992a
SHA512 ba70dd88767bce07f1ba270478c86e95f182f2606600bfebe2d1c6560dc8e2a6b26689ea963f4f4909bfabcfc9346b388c7695b2a7d9802d27dff08ecaf25e1d
SSDEEP 24576:dAhGLJIFoiwtA5l7S53p8U7tTK3VnChd4Q4PQpUcrf0FGDQ:dAMyFoiq558U7twh0gYUub
TLSH
T191359D80E7F945D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0b751ec7545106d6255edb5e7612d7db0f72bde6224ba3b3406907f79078c06d
MD5 2d1d852430515259b28e89160f7a19aa
SHA1 124aa6dcbf9f936cca99c1535ef813b9132250be
SHA512 cbc25662bdaea32a66ed2ba8307dd721d7f78eb1704e882576d5dcb2c2cfd467c9b4531e03388ca4caa749da7e3900e972fdaf4cdfb72da43b50f80ba830c1b8
SSDEEP 24576:CwuoOWG8U7tTK3VnChd4Q4PQpUcrf0FGDQ:CwDON8U7twh0gYUub
TLSH
T19505F04573A40CFAEA675639C567C536F7B2BC112A20CB1F0760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f46a2f5289d1865369c6a09f95692e3e9d3fa92adbf4d49a3452142854e7b49d
MD5 1942add5dc3f20064f73bede4d6a2fb1
SHA1 731aed6d3d32ccbd58d2308504db1b9a0fd7d4ae
SHA512 1d27a8ad036f2acc6f5a35d19b7bc061d457d81c8834a627e55e011e343c59703d09536b862ee2d9d19d05653f8251312462464a35d0bf59d2140c338760306f
SSDEEP 12288:yBZ1IyIN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:cZur8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1ACE4125433D460BAE363133AD9B29A54E7323C62273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 025c0cd267a09654e33339ad3c1d88c82914e7165576462e18e02b946f3b7984
MD5 ee85eca1dddd15f0fae6d7c774026927
SHA1 a06bca8029f584cc962ec30ce870bed19a1aa4cd
SHA512 50ac614b4718ab3497e945469f4bfff508cf61482e92a8d63bec9200322ebf98731c36eb9872a7de0120e425f92ffdb3030352f58bb4a903167bae2f74891c1e
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN30bpi0gYz:UQyiKayX+PNxH
TLSH
T1D8666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9216e543acb8716ff868af30ec48af91ad47246253b830940691bf340f286b6
MD5 145ca78d8b8d3f9f6bf8f1484a88d558
SHA1 40d1a9564d0a94f3be98cc14b68f2d5c6c650e27
SHA512 6cba99681b5044072c80bab732640a756db2a7955839e37aca8a28a96559433db5179a1fd8aa5ea7091392bb8ccf6027c000eee98e9110d90ae706233dc3cb0c
SSDEEP 98304:sQRQyi36YOcPQLvw2gAf+PN30bpi0gYz:zQyiKayX+PNxH
TLSH
T174666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bdcefb7e25310610cccf25a76f802debfbd41c8287d1ba872215d1a2261ebb5f
MD5 cdf6001b6b59dcec88ca09d4b57cf6d7
SHA1 6172dc886e2cf6060176c2b18e595f11b575bb77
SHA512 b571029d537530243d01e7c5e1f8fde0a700addeef13e549896a93c2977d4aca028a445ea411145507ea22817d0a66dc0ee0bb1fd1f6b0e977ba6592280e2ac0
SSDEEP 49152:W68Qg55nhheWu7PNU3/C8U7twh0gYUub:0thWRc/Cbpi0gYz
TLSH
T193B54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f56d31626b66da5627ef4ccf55f3f29400fee9c3dc0edebedb4f6683bf27952b
MD5 bdd38b37d98d06560f0bc63bd0e79d80
SHA1 8860044fb808e7d33569f765f5b0631594d2d057
SHA512 5fb956faf2ac1dfa05240c60b4feb7f517489a72e25471609814950cd860ffd2acdef777bd8aded789ff1bffe7322350443c1a7c261e0c89c81496939dc331e7
SSDEEP 98304:Iy5112gYy5azzVvL69nLKnhZ/bpi0gYz:hLIHmWhmH
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e14c996f3ebb8126228ffce2b729f4bf3ddd103816c000ce92297009c6bd90bf
MD5 614206352ff389baff782620769e1718
SHA1 5b5b40cae7d216d40628ac1ea468d569cd921a2a
SHA512 88df50d0455153108234002733f54030db63cabd7d9f2ecf4e296deecacbd32ba74ff71e9f03b97372bcb94dc1bba9963231acb11567dc9db091be43fa83be37
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glM8U7twh0gYUub:lu6JmVxd2dMbpi0gYz
TLSH
T124D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98b353fbe9827e2336b874aa15673749a396dbbeb137e8c7fa8f2b9d0fb1eeef
MD5 50fedeeb8da3ba574a60b74324ae278e
SHA1 8e53e24dc255ff8ce39aefe4bb2c00193ef3cfd1
SHA512 18e7152f8e8fd60d954fcba627188662ba5e9ac49a58a79fdfc75512077d3a85624d0069dcacfc784ae5b78dae5f119093cedc1e6ae3102b9da00b623f37281a
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xw8U7twh0gYUub:6mifPbRJbpi0gYz
TLSH
T1E6B5BE13F2D900E8D06ED17887569632EA62BC450B24B6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b1943305557294d230727b3375e9f59d28ace61d5b45a49e16d3b0da2be97e1
MD5 5e7b2937218ff8bfe6d6f68f2589a26d
SHA1 910cf2ed223e627071851e465cc7600eb0b3ff17
SHA512 e11ee3d6afef4f41c7dc7ac1a3c09fecdf51078efb9f3f93dbebeeb63cba43105b688fb09c37ab18c6cd0655c050076f550bd2c838ce3e27ee72962544f293ec
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqr8U7twh0gYUub:55dKTi61rbpi0gYz
TLSH
T19DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bdea96271a14cd078bff4b8e2e37548b99622fe02503281c843fd9a339ee2f64
MD5 2f4797a937da4305975397698bf073c4
SHA1 a3ecb697fa5045ef62a3c4241170e4fdf7722fb7
SHA512 53d632a19ed925c7a8c6beb5da895884e112d01bb68a2985235700949bded31ce6ab2e74c71e9fcf626eaf9e001e751766f690ccb62156969828f0c3ff1c593e
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w88U7twh0gYUub:LX2iyphtbpi0gYz
TLSH
T11E95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1333ad0a4f352bea0e5cfa625bdb9e82d4abbb5f5173db6a48cae2dfcb38283f
MD5 6392ea5723cb3762aecfee17fd032188
SHA1 360e608a604c3155ed62eedeb6be8ee4ed28a557
SHA512 c7fd81df33d478490f47c5a10fb9635878acc665e92a175b3fc092a28266589e0a24163632d0fcc82a634a6f49e74debb6fe8f06b48911f7d76a2f32d00721df
SSDEEP 12288:pBN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:pX8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T141C42310F7964C0BE3112733F537E9A4EB141EB5AE4489292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f4dd64e5b016dc0291b0d22679562817515c86e7c1e0f557316076299e1f1c18
MD5 32fa0fe9645c73fea430f8ff0b7bc72c
SHA1 76d45963b9ed5c5931a14e21ee978c3458f5df90
SHA512 03e7082a0c938ded4cf905a184dafc75c4e8da42481c4e5fadb9db42a5b28e451ee2dd51fd66e6045e6342733a18d931123b372e08b1a81468deed6cf6bc855b
SSDEEP 12288:PEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Pu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1FBC42320F7964C0BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f3bbe984e712fb9a9395db36a58d720c153e5bd66f389605eb2b87f14c3872e4
MD5 a80a3e285a4bc2958802401063801aa2
SHA1 b580f639d7ddd9cd7d3bc46cac0e67c9fcb14d84
SHA512 3c8678dbe05eca392f9b5284f304e442f34bf4072289a062ccc72669575abce9aea4da75c84dca19516d8f46bed3f1269a6dc73ad7f77d797f88bf065a7904eb
SSDEEP 12288:xWN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:xI8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A6C42320F7964C0BE3112B33F537E9A4EB141EB5AE4489292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f517694573166f8d72eb7e57630ccaeb6d2ce32cae54a2faa5664714f1edda78
MD5 93b6ff9514484d8b1804dc5b2289a750
SHA1 605d44c1e4b26633933a01a977ccf58e82abf631
SHA512 430bb189c940ea35e595574ae2e13bc0fbc61a3c52e5c406e71b8c3171b3f3147520eedaee339c8d36014efc4e967b4f9b4ceed1eb08a9b40520003e5a47be09
SSDEEP 12288:hVTN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:l8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11ED42310B7964487E2222737E933D5A4F7217DA4AB108B6F19107EA52F37F9C8DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6cc77e5832b1f817f687fd41dd6e4771bccdedaa4c1a26a845c4c520c7785a09
MD5 40a3a0aea8b44c990cbc2ee4e8977f15
SHA1 90062353c818768118bf0d3ec57884726108cb41
SHA512 664bebd1608f972a7222b17b01f63199c49213dc97f47715b6d10d5263b999050df5b2f5c7fe98fff28dcc9dba1c849d5db6a33fd06dcaad0af45f90432f6900
SSDEEP 12288:9bN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:9x8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15EC42310F796480BE3112B33F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3e37d52f1732bbbed5e572b465bdfee9e61475a1bd090d0626524192bd9e5506
MD5 c2267aa50893e56ffe4fd9a7c72adc38
SHA1 69a4b94fc638301319347c3773e64ab8c2f16d09
SHA512 9a8254739e4ceae013c7c006c04800af2b19b2bf383a5d225f086df240ff421b9cfec76fc0b27594b69ed4114768760546b9e30ac3e469377a29d5ef26b9ef9c
SSDEEP 12288:jQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:jK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1E0C42310F796480BE3112733F537E5A4EB101EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d8aef0738dcff489227823c9e4a44f123b3c6e3500820143172f17d39fdf14d5
MD5 9833b85d861935e45d85ffc943dccb82
SHA1 bd37467ba80c645218ba6a43c35b41c4bf512830
SHA512 063214dfecd4851121e36c9d3b2a95598e2a56a8851dff157d3d9a1aa9b41175bb8f90368ea6a6fd7b158ff24be1b061aed1eee46bef6c25dfa0a9892af33649
SSDEEP 12288:JsN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:JW8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D6C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 bb0b9a88b7153885cb62f5eb670502b45fad114961436537026a5b997b70b342
MD5 a94fa8d94f5c256f20ce17eb1789a4dc
SHA1 762f9797ca6dfec6bfa9303092c147aad1d8136b
SHA512 9234dc772ab02e77fe72f8bef65423fe098535aa77c42382b06d56f7205a40aedb94f5150ebd19baddc36e81d73f2dafa08b884798705513faa6854bb1b60518
SSDEEP 24576:jZMSzFVSOO8U7tTK3VnChd4Q4PQpUcrf0FGDQ:jZMSzf68U7twh0gYUub
TLSH
T15B0502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 24df47fbf59c74cba7a6056d2abea7e981f071896fa139d163c945b6fac32980
MD5 1b74f7fc72054d304d5c55d13bb53ccc
SHA1 9ed3806d01852ff80cbfa69b16fcef28ee4fb6a2
SHA512 691851697e7fd06a15c94a5176db077d4f48bbe1d73280a6c0c8983ce29669c6a8dcd318617ad423c56a62d526baaff219126bbaba0e16b0991197b4e3946472
SSDEEP 12288:GlN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Gb8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1E6C42314F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 753127d620a1acb537230c95d88a4493f7b21d05d1b0ea18f9e34de53e216a3b
MD5 81bd84b65519d98f994c1f2856a28b04
SHA1 13d1b18aa1a750f1b151fceadae48c182ba45791
SHA512 8d4e774a9b7232d87f7588fcfc9975efa5db7db9a767c9111d9dfa592361c2dcfc52402ac1962390d399809f15df14906f847cf0a5ce4a6c74adbd9ef9b03414
SSDEEP 12288:PZN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Pv8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T156C42320B796480BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5f49e39297c3d2fe84ed37e3a412c03358d3f5a6189a6b365c5ec077e018bf94
MD5 a24e5cfa34b223ad3452a3fa87d99797
SHA1 38b649f49bfd1d3a6dc8949eee0b23fa96022a42
SHA512 f14ff551903b200d2796bf401fec0be9e32ae988726890408f0da37317798bcfccfc719aee518d5f4fcef0c13333654047f4e0aa1d300aa0e5c95b4ab8de4b3d
SSDEEP 12288:jyPz5L8IN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ozyi8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T117F4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c4d0f604a5648b6e90701f1b63ab83fe8fd22c9858a9a03d9ad94722e00844ea
MD5 0bdc098f885124f3dbbe3c5e4fbabf01
SHA1 e74a7518fc7a332d6c675a255cb90077a5570b77
SHA512 3c2cb6279865bbb53a1ab8c66d3f5c588a9e5ae51646f01f2a41c09ecef6c652b2425b3dfe1cc7d437e6c35cded5213cf72ac479fd351fc17b25f939b80859f4
SSDEEP 12288:3lN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:3b8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T190C42324F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e96ca9aaf9914f9c9ed1449531cb29b4441f6d0a9ffb7b2de8e17b38c19a8447
MD5 7f2865ee57d0c156d8ff886c97199231
SHA1 a1d4bde67264f13a7a09de82494a858b46604fbe
SHA512 4c6ff93f70785ae3b61f470d30eb64729212089a4b4b8d6c168bf44bbf26fcd742171d95a0685753e0ee46a88c01253cb555993d33f5b1f053c3d8f6a566e234
SSDEEP 12288:RlN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Rb8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T144C42324F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 bac9a5b75256188c655b96b12fdcfaed48a6ba8477c746aeba884924f5ba6535
MD5 799894319433302c02f55716e414d66a
SHA1 df7c11b4517e929ca9b018cb1780207220380a25
SHA512 b01c046b4a399ce9cef837ab15c7e51210a46f3c8c3579ccfa1b58726dad8bbd9038c10b18e41c495a210c1f177c5d19f4bc4791d761e9f34637c02bfe813c7b
SSDEEP 12288:ryPz5L8IN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Gzyi8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T199F4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 fdfad4a11bf9b8efdc8f706bdaed79d4c21032edf5cd0165f846f939e1da9820
MD5 d9b3b602c0b6fc06146771d5416b02e4
SHA1 52a49810624e15f62beb010adba94a2ce7eb9a94
SHA512 521a8a8e37f54b3819471ac30bf95a07b455dacd9ec915b84c9834d47621b7a5682062b10794eaac8ba42d57d3cf4722c2eda8610a9bbaa756ea21ecc89d8802
SSDEEP 24576:UTHaLl3z0zDY8U7tTK3VnChd4Q4PQpUcrf0FGDQ:UT6LljV8U7twh0gYUub
TLSH
T13B0502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F337A05C6DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 90ff21c1abc5a3ba44049204cf8c2f27c860daca5bb76967a7ad835313a52770
MD5 5db41fb16d2f04a62d1fdf5b8919ff94
SHA1 934953f1651edc8319dd22b718337f8d304c1d8f
SHA512 7ec6f7075a4bdb4cc0439d529497f6799fbe20fb5200a903bce10e9d57796bb9d8b89f30e3c3f5f3cef6be2187ac68f7610f7f01361178ffb01614ea55bbbb5c
SSDEEP 24576:B37d9CHKy7GZU8U7tTK3VnChd4Q4PQpUcrf0FGDQ:x7d9CHKya68U7twh0gYUub
TLSH
T1AD25CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0edab414512a6d15d3719d86070a1763dbb808578ee0d29ab05baa4541d03d9e
MD5 6a77c1bfdf4b4ac3c2dc41a9fe50107f
SHA1 d8069536eb52ee5b198abfccfbf86ab097481511
SHA512 74d0d93ef4052d9a06e5cadf13ee9d80c447c089345eef234050a7108f0884d94c8d6351e2d46521c91a99a232e24efe9890b641855632b72a64498e696e6987
SSDEEP 12288:h2N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ho8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T180C42320F796480BE3112B33F537E9A4EB141EB5AE4489292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ad0add49c9be4608b31318ad60e30fe7b431a722b774ff902f6c9e54898dcdcc
MD5 67707f9eba0b1446f60b951d05e56fbe
SHA1 a3613833f5df6f0fbe40cf82f6bf1e7e991047fe
SHA512 d980af6edada251c7ac0f029bdefc8f059ff32e783c2b24fca18f5a00f9fb76819a8fea053d2b238164ceb0e6d2881eed5197fc492e8d33fa2d96959778fe02d
SSDEEP 12288:LoN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:LC8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1BEC42320F7964C1BE3112733F537EAA4EB101EB5AE448A292550BDA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 78bba71165a02329cf2c695f6325fe318224bad658b27f96a5b3229948bae527
MD5 63b0ac1cc23642020bf0902ed99e6856
SHA1 33d70f69b122dc8a63e5a28d1a05fd53da3b3ab3
SHA512 273be26e37c235b9e85998f2c805b31b8da70cdcf0f2d6ec9bcdd95b1dfc6c146f798f6cd20ee7ed72e298499a444b4750f0c59b9c5bed169b549f13e4879d03
SSDEEP 12288:e3N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ed8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D8C42320F796480BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0d6a36d0622e5806b8b89b3a9618ba63bd7f4737334ceb7454a612e04c34a776
MD5 c77ecfee0b8b3f968edbd767f422637f
SHA1 e739a422c62b1e6edcadaf7ab24bff7277f8c7be
SHA512 a6fcab00df09e5019fadfbf675da430723b66915b9ed3ff04ce690d2ef305039294784bf7fc11ab1b08e7f7a8db25fa8c0e1860a88f7997e9424b504709b4520
SSDEEP 12288:HlN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Hb8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B4C42320F796480BE3111733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7ba6dd36b6031136f2b05c96371a947c11826a4e4b908d6afc24e8dc7fe93004
MD5 5b4e8d5a7a5cd2bb82bb405e75da3c2f
SHA1 13b9987933e61d7fef7a8928acad50f9fd96d843
SHA512 ad69c15b2c34b670fbc207c12075832cb3357eb5783f592819367729d1fc2c8e4a80aa306707ace7399604c78eca5bf9f768eb39071df7aaaf3d59747a944e31
SSDEEP 12288:r2N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ro8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T156C42320F7964C0BE3112B33F537E9A4EB141EB5AE4489292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 7f6fc89dbe8af37a3165c07e7e4846c6be447a8b6ed32f792e492bacf78259cd
MD5 93d5bbe512c4e5ad5db3b1b49bc923ae
SHA1 6e7cb00477c677adec800443ad0e26ab351067fe
SHA512 d89ff440ac7778094a6e0092f8462f5af625bcc8823296ebcb16a0df3706f4094f58a821cd21132241eee1321ffe57f55628d81a3137f7ec52dfb97fa7461efa
SSDEEP 12288:OtN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:OD8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T143C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 9c0ee6eb7a844f2ac704cddc89a37f86907cb26be2e8d9e94bd9be64b2faa1a0
MD5 e69d5349f2f79f94957e514361ea825c
SHA1 17088b933d78f701f7053659c04e4c37c86128f9
SHA512 44a0a5f117ffd09155ff001c143fcd3de5e0ac2993783205f343e7ed50a0991875afa73fb256c213732b1c467a68622ccfeb8aefbf1b95dcbee43a714a64f000
SSDEEP 12288:BbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Bx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T184C42320F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b0216cca2a4c9b63897242d480e1ee591282c1a806a79462caa67bc364f1d0df
MD5 52cb629a37f15bb069ea7b027b0cb845
SHA1 ee6f99f856fbd7d27339a483eda861b40b74c5a2
SHA512 c36570c2583fd4db86d2597506dd1e6a8a60bc3c5b6ada6ddabf3132bac08487d8b50c098e92502a667898405280215df34c214039849c96aca2eefcb09a10c6
SSDEEP 24576:Wfwvok9RX6wkyAIf8U7tTK3VnChd4Q4PQpUcrf0FGDQ:aMnYIf8U7twh0gYUub
TLSH
T16735DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b583d886324166101f53c126c26291c6a811b1228712cf468217490d2f519ba
MD5 81bf5c2ea7cea23e61c6ce11821a3ec7
SHA1 398845a8123aa7067ecb12f5ddc9c9a9f752dfc9
SHA512 b631cc7b885dd76e0371dcb226d28d31a7904ebcfaa864cdb2641ee32d3f6308d54cb98970a5c0d7ea9b2726875118af42f6fe9c358d31f8ccabff1f69df5256
SSDEEP 49152:UYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0c8U7twh0gYUub:aySzPUbpi0gYz
TLSH
T17F066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 54862ae2e9b99a2f241c918ffaa0dbc0b20eb51e49460c104a59fc909d71465d
MD5 2b76f73853821e2406b1d957d6cc01c8
SHA1 24a0c835badf748b6c57a6b1174c3ee477cea783
SHA512 b8649f3fcd9fc746b8f8569456ecc5bb9d4c86cd1a839bf46af25136c070a41ba6d4cea89b9d253a6997bc2d75e0e5f683a46be9e5b6f19c415b77926154807e
SSDEEP 24576:g47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+8U7tTK3VnChd4Q4PQpUcrf0FGDQ:g47JUQj1irIhCnDHUPfF/M8U7twh0gY3
TLSH
T148659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 17e77948c6cdaa00110e10f269ec6c29eec1c078d32d51ebe0560f93b52c616a
MD5 9e8055fd9752edca28763d10f909b4c6
SHA1 fd1beb0d0cbf20d130a4735c950d6f27f7863109
SHA512 26edbb771560b1b23739dcab9c6cf3f2de99b82d58e45c95682c1c1852f8774d5ae9e6474d2b22a9e1207e8328f9be36f058d86209608b4de0c8b6b2f847e39b
SSDEEP 12288:XNsf1N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ur8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T130E4F118E39401D9D16E2236DB269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a215634631b2839fe251c00293dfbca982bda7f8f08367c8d0b1044b40175889
MD5 c60a2ad2f583f5c55b1308560fa4d74c
SHA1 3e68038c2fc0a9d25ee6ff7048ca5589c77d5f86
SHA512 81e125e6ef3c458fdaadfddeff547ed1cf30186f2c1fe7ffa22eaa2d692fe247e6dadb1517660f0b68a34a8ecf67f47c937cb416c5074060df74b6ed9acf101d
SSDEEP 6144:p/sBC2na249FwrERcfKDexHJ4Ey5XavTdogGg/GObI2oSxMLutvXjRE+fbj:pgj0SLy5X6d7GxO9oSxJXjRE+fb
TLSH
T19D351851766AC75FC6AD40325E32D1CCAB707D01EE05AB1372C84B3FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 145d3e83d0931dec0ab4de3f3e78800e71483badba106df450245e7996bf48d7
MD5 0b59d1f61134fee46bb27a05beefb691
SHA1 b05ba197201d528b13ec8b1aee1495d81ac97294
SHA512 1157583dc23cd66d3eb76cf2dc8fb96fe187bb0d63c1ac98061dd7507469fe31a785f63b0be2768ea72119f47b7f6e1381bb53b430c1afbb55685424b6eccee4
SSDEEP 12288:qeS3kpde0Gtul2Mlx5cKRCWBZLP7kcpIHaQ/DF:qeSW2YxEWBZLjkeInDF
TLSH
T18955E7419537E39FC1F76032472AAB4DABB4EC06B7055F2763C8053AD86A725B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 393d375756ab3c560e625b06567158406126317e20df93665637d9086c49a90d
MD5 97dff9baf24c500adc74e6a6f57b8b9b
SHA1 f94b019d73dd9082259761cebe96d5ead9a905f1
SHA512 efc9402fb490f7f00c87f2abab379bc68822e74fe1de4a0510ace68020d5cca4d2d94690b379e7c3060c5ba6ae5233d79a8a9a16d1049ef4146ca5a0f7223537
SSDEEP 12288:SM79N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:vT8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T19BD42320A3958C0BF2752B32E53BD574E7156E745F00C9A76400BEA46E3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ecfe9b37643e6c7c989e38dc3e7e2b32d017061991eaa6c0535f14e6d887ffdc
MD5 67969fc77729b5c46c38658294fc8826
SHA1 313fb9c1750681e6488dbb437168d8f19e0a6bee
SHA512 d4de7369b528dce050b8d09552953dcbfd77fc596cfa26dbc8724f52e2557acc6a6d616cac64c71e06ecf6a016a3b260f0ecab40e415b557de08d1d2bc21e400
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYV8U7tTK3VnChd4Q4PQpUcrf0FGDQ:4gb4mBIBhGF+8U7twh0gYUub
TLSH
T1CD65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 abd504abc9039e61c8c716541a07234ea432dac45ac4f4613e69026d5257a1c9
MD5 fe33d760b2b56891b7564873247b9b5f
SHA1 26d10e5ef3cb9b2811fc5186caa5695d97c2c3b6
SHA512 aa6792edae0c2f238ae2f36fac505c3cfd578da54c77976b5b3c6844360e8ebdf6e30b522801e221c941516357c5616c89bf0f57890e5a1d98d9da0844a5fd8f
SSDEEP 24576:/G88u8FpJqH1bzria7/mO8U7tTK3VnChd4Q4PQpUcrf0FGDQ:O7ZFPqVea7/98U7twh0gYUub
TLSH
T1CF35F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b95db86361e179bf71aa848952a8d9b91883fa4b0df0db1d15057c7127d0b7a1
MD5 5f40529ee60c331bd6e98d764c5a3992
SHA1 a32518c9a3c4ba9e934e4f47aa6c34d1ae51dafc
SHA512 26b3728e098404000295828f41371cd23670af041dbbf2eb7ea82822aca687e484eb79c0731589138bd8fd5909c2ddf38b67e3d19893a7b75c0dbfabe6f236c1
SSDEEP 24576:nPUr+NQ68U7tTK3VnChd4Q4PQpUcrf0FGDQ:nJQ68U7twh0gYUub
TLSH
T15005E12E62E91CE5E676A13DC9528719F771B8621701D2CF02A0917E5F37EE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 07c45b53812c89dfdc0e11a89d7af4aac50c321e16ba66e69935b904b17a4343
MD5 7ca8d41051e13b628ac046c8f3d330d0
SHA1 b8ba67bf1d1365f28cf163f125638b208b11cab5
SHA512 cbd2808a47d91f04f9a5f373d9d8c33bd5a335e4832823f18715caef43f065fb85225ec9b7219823d70f785ea5a57381be834da2a4201652b3af95a772e0e711
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjK8U7twh0gYUub:bG05lO43bHbpi0gYz
TLSH
T1D1D5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8073440a049b6f9c76081801aedf7c7446c8b37b4b61cb01e7e53ebabb493b61
MD5 bb49332f1c89160e716eb11b1baa4012
SHA1 a63a795b040cfa2cd6df7f0fabaabef2640ca700
SHA512 009797f557268646b3f612606ac3bfa3539ae9a79e1fd6c54fc403a6730e4f22c8e31708fbb300c7cd3a7ded0289582735d54e25b930ccc04f4f726bfdb2273a
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnc8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Fa5POZ3+Jt2pasx2+mC8U7twh0gYUub
TLSH
T13C65AF5DA7F801D5E1B9D17DC5838A1AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d5d69dee284afd639295462e24ac1309bb1718524b2beb8595e8d2691cfe3ff9
MD5 77547fbf5caecb9a3fa42135528bf5e5
SHA1 18eb2ca17f62dcdb8c3a640fae1ad15d1b7f2f89
SHA512 ba92942b32cbb66796126c2355d1ddca21544d783677ac3c012a02ce64e4a1483db94e0ffa0eed5a21918d0ae24c8bc125acc55beabb9a56a8e2b3ba6c93b5c6
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fkm8U7tTK3VnChd4Q4PQpUcrf0FGDQ:pNc/zEOVHFd8U7twh0gYUub
TLSH
T10C858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 60c0e6212688f1208f2bcee9a8d1a2738c3f30b69a9594ea9156daaf8789e850
MD5 c42537be074548caf3a7aa7e985a0e6f
SHA1 69f6028f3c18c0aecd38078e9f1a8866be1420f9
SHA512 e3758265e411a6d30bb6fd90ae0108e79a960c29804d73fc229f9595332e4ba3005b34549c97ff42914e5055c1559f4d6504833cbff6b4f796fa221ea75bbb49
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmA8U7tTK3VnChd4Q4PQpUcrf0FGDQ:T8MwBtOmA8U7twh0gYUub
TLSH
T14855AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9b965c85a32217b14231dbafe59af4c4b2c2f8ba3964a0c5bc18531e14256f4e
MD5 7d5dc20c1291f2b78d172c3bde7b22f7
SHA1 7acb019370aa422f0a1b51c25da42f29f1a7bbc0
SHA512 f615b16622aba73112de5e039cd90133b020e22e3251669d90c96756b096517f799174ea10216c9d4d17473a8e4759c18f6362f5f4699cfa4f39e3e458856897
SSDEEP 24576:JD3FHshBIYQgA38U7tTK3VnChd4Q4PQpUcrf0FGDQ:JDVHeBIAA38U7twh0gYUub
TLSH
T17C25E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1908-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1908-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1908-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1908-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1908-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2284-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2284-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2284-121-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2284-115-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2500-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2500-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2500-132-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2500-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2500-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3000-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3000-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3000-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3000-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3000-328-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3000-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3544-327-0x000001D8D86A0000-0x000001D8D886A000-memory.dmp

Download

memory/3708-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3708-57-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3708-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3708-222-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4104-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4104-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4104-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4104-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4104-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4264-14-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4264-21-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4264-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4264-20-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4264-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4308-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4308-76-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4308-8-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4308-6-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4308-1-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4952-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4952-50-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4952-39-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4952-45-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4952-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5024-78-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5024-295-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5024-83-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5024-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5432-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5432-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5432-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5432-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5536-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5536-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5536-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5536-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download