818a5051053bb0d546237b7a5ca5e96f9fef62795e91d5b117d497bfce45f561

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260803-xetaaaea86
SHA256 818a5051053bb0d546237b7a5ca5e96f9fef62795e91d5b117d497bfce45f561
MD5 1ce2f00c798e86932804e8a984db478c
SHA1 40b60d94c5cfbcb6f0680aa4269e9c8c3913515a
SHA512 58cd7ad3aa3d9940657833b114145f21dced90c425f55f8042c30e391e08dfb1e4acbe4cae96fba74bd160ff49fd34fc9702c4d6163822fadd99d267c85c7e6b
SSDEEP 12288:DUYJ9bimZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF0:QYJ9bk1W3SEt7vRuy15V/emWu
TLSH
T1D4F40221B2C0D4B3EA73093009B49B74897EFD711F615ADF63952B9A5E302C08E397A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2304	elevation_service.exe
5324	elevation_service.exe
5484	maintenanceservice.exe
3488	OSE.EXE
3552	PerceptionSimulationService.exe
356	perfhost.exe
744	ReFsDedupSvc.exe
1012	SensorDataService.exe
428	ssh-agent.exe
6020	AgentService.exe
2456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee606ee9238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000515c547d7823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9aa52767823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c73d4777823dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a0230787823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051d93ab97823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052ff937a7823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	744	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6020	AgentService.exe
Token: 33	2456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2456	SearchIndexer.exe
Token: SeDebugPrivilege	3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3332	2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2496	2456	SearchIndexer.exe	100
PID 2456 wrote to memory of 5696	2456	SearchIndexer.exe	101
PID 2456 wrote to memory of 5480	2456	SearchIndexer.exe	102
PID 2456 wrote to memory of 4124	2456	SearchIndexer.exe	103
PID 2456 wrote to memory of 832	2456	SearchIndexer.exe	109
PID 2456 wrote to memory of 3880	2456	SearchIndexer.exe	110
PID 2456 wrote to memory of 2016	2456	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1ce2f00c798e86932804e8a984db478c_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2832 2852 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2824 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2824 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2832 2852 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 edc81a69193518a6679dd6b2a247423c632f33042ef81a272b3ac08643ae9fe1
MD5 ce9cdb10f1568299cb4102ff0411ae94
SHA1 e57af0b217578fbb8417e58f9968acbaa5b64fda
SHA512 2ab4fb5c92dc1e857e5d38f21d7749ca63a21901e95f933dfb3a866ad14c517a91d79ca6ba3bfffdda8269424d90c1f4681c32cc681e2764455691e7ff7ae9f7
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuoVvxtJW:X3q6HjBg3W
TLSH
T10DD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 90bc7198381c251aad5d74b02f27b5d51ed234844dc46f590b189248b996bda6
MD5 dfcdf3770a4be07521954f91cea9ef2a
SHA1 b5069cc6b12665b1aacb0e9e6c86ac6827cfea58
SHA512 fdacbd254ea9261fe95684d499cfcdf9ce7fbebae22b2e9ced2cd450d61db87c9490b482d04e270d41777aa9c1b9f29ebcaeb046c48d2beae04d16fb39bf447d
SSDEEP 12288:w1XLsswWkxy2lRq2czAyZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMum:mXYfDtczA/1W3SEt7vRuy15V/emWp
TLSH
T1A605F129A3D048F9ED678278CCA28515DA737C5547A0E7CB03E49A251F333D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c6fcc069876ee62d7349dcc7f06bdf73bd8f1a572351b648b13f92817d2479f2
MD5 8a0bed6d1760dea39be8de9a00e6a5ea
SHA1 9e9f7c06dce8277bbd00e0d34bf449c9a4838def
SHA512 33588338bc388b17610470237c52d3bb1f5294a1ee7c47dadb8d814daae813ce9bc443e989c9a75fdfdc6169c2e961b6a432370b9eea4891e3c402cbf1014796
SSDEEP 24576:Z0Le5ji0hmxirMW1W3SEt7vRuy15V/emWp:ZPji0AcxoVvxtJW
TLSH
T100359E16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b50389e1afb9dd17d9c7e8a75e3344b7d1cabc426f11c387b61688850e018e01
MD5 0ff0ddd07ccd8059c1ba303c3553a2fe
SHA1 9fd96c8e3d210a869a4829db04eb4f2bc83e769a
SHA512 380470d351566b52f06317633a1270a7938565137b266b2b37cc3e03ced6e64516d980256e5bc82bd901a422ca0eda27e651c1729f2e441447ce3a4f64e347c8
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyus1W3SEt7vRuy15V/emWD:Q/ezSC6vUzPvxHjyFoVvxtJW
TLSH
T190755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9a0f6759d83578a9c6a4a4b0ed79a58dcb006ca31fe2978d97dae291267d2581
MD5 9c960def674c79a6dc547726080a4c60
SHA1 9b83b52fd6f81aa5775f58944ff6f484d6340ca3
SHA512 0c5548d22960c1549deeb5ecc726cf00a86f1424fab73ac591513197b5ee454e025e965eb64dfa8d200dcb490c36e9c060cd3cd7e0f3d19c640bb35c77240db8
SSDEEP 24576:QVbqPb88hv/l+6L1W3SEt7vRuy15V/emWR:QVO88hXl+6oVvxtJW
TLSH
T128559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E777E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ffc88e894305b24337df57108d0c17b33d05b848d46728da83aa40fa01075c90
MD5 ed6b5761f2c6b8c02b37ffd7cc82814a
SHA1 089601c4261e190a0586738c39459d986bafa7d9
SHA512 0be686c7b044cc9a835a9cb60562354c93a9b8ebc8bd682a1ffe8816e6d6ae1f8f05eb460d5872eee48b03a793be0708c44e67dd78949e17c3d141afdb0de0f1
SSDEEP 12288:BRZZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFo:BRS1W3SEt7vRuy15V/emW6
TLSH
T144C42302C250E463FB790B705C765F1CC4ABAE682CC5B39777C7774849BE249C9862AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7c69f423c4821d475bdd18f921cb2a0d392fd98a85a0db340fcce6d4b9dda05e
MD5 4bd8b6572f6b7ae99cedc6d20ac06e9c
SHA1 7eb4290d081a54048defeb43df706e008ddb8f69
SHA512 9a67a91891b788d36ace145a35b6d745c6ebd700038540a2c8a4b621bc2dedd52df5759d6ad69171390753b6e191a344eeb0f7a5db4d3211269fba71b28d1e16
SSDEEP 12288:PeBNUbTVO86UOZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFo:PJIUT1W3SEt7vRuy15V/emWu
TLSH
T11D05CF3BEE28FCE2C27A4DB95A518600D77278704F52A3CBE165830EDE235D54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 72481d8723c9fdfac50427cc11605154770f6054eaa3b0aeb2d3390e53411906
MD5 f736cc09ee63ba076a1e19c334893735
SHA1 1612a95c94693b297e7b0c99e843b99fed171e57
SHA512 2f8f014693fdfdd742433793875438daa0f26e5bce8929e7d4378b9abe129ac5ce0b828de7087329159503b0b2075216a549dee81cb7845c8a5f490f71f1de7f
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:4QvGAdlCEL8c/yRNw5CZ3W
TLSH
T1C5267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4bac6000ae645c77b18b3739f43127cc74653642f11633bd2dd223a0d2a6e4eb
MD5 84a65ba6c31a073c6a7119886efcc273
SHA1 1053598377fe4930f985c985b1e3714ff1e92deb
SHA512 b14c63f2917360f84e528aa19d1bf9665b7769cc635642ef185617c374be8fba642897124d6cff100eb05977929afd02374516311f4a36842dd0c199fe127f6d
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjcZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5o:OdewsAjB1W3SEt7vRuy15V/emWz
TLSH
T1AA15E031FA74E032C37B0DB21B36C71A546DB9204F912AC3E3E89E8D59742D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 14e204d7d3bdac1e2e4b53791b6ff8643bce92a9742fa21e74a41b85c63a677b
MD5 438928bddb2841f6774bd8d5deb3eaf3
SHA1 b6a74600955f93379ba978ee0f8200b0bd03c81c
SHA512 572714b75fbe801804c519af35fc04bbd2973b4c40cdc182b9c82cdfd58209f1c31828d248367da35375d3d8ade2d53873cb73439a6c222a35493d2290ceec12
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH63:AUEtQevvqc2W1cpV2EI32
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5eef0409033960af17833cd0203d97061ce2eb6fca64fcff643dfcca6f4f1557
MD5 ce1faafae942203d3fbda415f5eb243a
SHA1 4ec6a9787e2a16947085640ca9a62faeb4d09bb4
SHA512 02ef4b5a3db5846d0b7a045462181d52de1864b5d5637125a0b8a604e1bb23a67df2d9f6760b4f1fe6ae75886320484cf875aa166995c8d3dd22e68469a9f826
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zhoVvxtJW:boqtVjnmd3W
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 be8ea9eeeed6df5e2caffae60a4e46bdf6e4a5ca4b1869fbfc5bdefd9abef2b7
MD5 1f471d93c86d8e251271f06a259bb3cf
SHA1 0b8febfc77c82d22142a6b2b134d52fd5c16ef6c
SHA512 16b2553383a01a698d2388e05bf0dbd503b33bb0df0b4938924eec6cc49500f834bf19427658622273d2133324191b4e80f851cb5b49f3ff1e19dd9885274360
SSDEEP 24576:dAhGLJIFoiwtA5l7S53w1W3SEt7vRuy15V/emWz:dAMyFoiq5goVvxtJW
TLSH
T196359D81E7F955D4F5B39A7899B68570EA77BCAA5E31D20F2250D20F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 140498bc38c5553dccaaaa781c2f72a0331354c3e67bd76a4d6199eac7de8fc0
MD5 73f699106b4d51691c64aaf88934a856
SHA1 01b6bd0fc2a27e32cd0d2e52dd2f18159261a722
SHA512 4dc3d45654fa6cbfb8afea58f9b79624d4585cf78dac2b57bf63ff2c4590a88d49a581664d18e580dd70743b2429d4a59d395304642f56bf1e2f4531866a2629
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CzZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKb9:NwuoOWl1W3SEt7vRuy15V/emWW
TLSH
T11405F14672A41CF9E967423889578635E7F3BC162A21D71F17A0C74B5F37321AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ffe269017d8558bcfe210824ddbd86967368455092c1408af451483ce22f70dc
MD5 a5fa90ee7a15f2cb414304f544816e10
SHA1 c0505f6087b8bce57a0e7d61b11c53984c27fccc
SHA512 b8710964101f682f84f7221eec8dfbb3b1ead8d899808ab1dc4d1fff2219f324db3a9f42cc4244c8cf0ea70f6eb5dd5d5c92399e838eb86b5216660e0b4fd972
SSDEEP 12288:IBZ1IysZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFE:2Zu+1W3SEt7vRuy15V/emWW
TLSH
T109E4124A62A470F2E2A70238CCB15A08C7B37C66277693CF279653591F776C58E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e437e2b22da54777a7214211b058fa7e5564a1eed3d15299df96b991735df9b3
MD5 92d97649242d654a5429d0a05cbbf230
SHA1 13cbe915b8cdb5ff44eee503554a5feb0568bda6
SHA512 866c5c259e67833afc2ee586c7bb451edca7c168c49a6526191cff05cedd49094a98064cb7fe3384fabe5c3c04b6da28d574e9335eb5b00887e547b026312c49
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:DQRQyi36YOcPQLvw2gAf+PN383W
TLSH
T1E3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 501fc7b6c76d4e7c88d5ca9a030685811622e723ae7d39103ece409b282b580d
MD5 de95842d0927ccf251eac11e91eb3e7a
SHA1 7c0f8b153bcb711b7084be0c922e895a81544667
SHA512 92b083b52be43e1d29f2e211498e8fbea15cc335b19711bf405bc2b2f885f25e910e013336209ba19e99fd22634a2b5cf8cc9384253b19c264858314e35f8ddd
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:AQRQyi36YOcPQLvw2gAf+PN383W
TLSH
T103667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 047d0440dfb74aa601e72f0bf53f6a6d83a496f926c8368cbe6d85b0466a2737
MD5 ba7fea1d92feec96a857cf1a6d33cc15
SHA1 83d0e18a55b7c671bf52a708c67673fca5766c17
SHA512 6ed60dd8eb2b25cde9abf12acd95761ea5f4ea0d2943fa92a70fd56a099954069f708909850c9ab1a86c1f573895b43bd8130fd902cc65dad22a51b161e6bda0
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0u1W3SEt7vRuy15b:e68Qg55nhheWu7PNU3/xoVvxtJW
TLSH
T1ECB55933B2F200A9C44DD1769F4A873196D27C758FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bf98c080c69293a5698b3a2c77bb15f1ba83276ca7d5cac7e2f7fa98d51f99d7
MD5 c904460c86b26c7dcc7431e313804f1b
SHA1 d9d3a3c306d1ed80f135953595c6ed3d6daa1e67
SHA512 51cbf66961f0b1d4d38ee417d9475ba6b1fc2e1bd6969322d5a6fc83e4ab339f9d530440e6bad7c5d1f733cd95978e8b04318599ee2a8e09d811de9e93a98213
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:Yy5112gYy5azzVvL69nLKnhZr3W
TLSH
T134167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f194d918f3f5bf304e441aab9b9b70314d77d57c2c8ccadf416f3a572e95f07
MD5 09915d1b877d1164959b65cc491f5ccf
SHA1 f74efb26013a8471ef3b82f3ae79b1b378d76803
SHA512 35ac3b9dcb38c6c1806df9ad3128a53b1e6e70d180f3f7f6bdcf205de19e87aa40c226b8a5ebd1904fc9b56823b9d1a8b8caa65d9909c3a7a2d3ace5d3f3a161
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvoVvxtJW:Cu6JmVxd2dU3W
TLSH
T128D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5eb8d1c687db5883a6eb4a3c52c057f4a9e58bb5350685d989ba8581ee3e5d31
MD5 4d3b4fcdd939ba283f86baa0360f00ee
SHA1 f2daaadef27c2987db9eecb3c015fa73d7db8431
SHA512 da16ce3db4947b51faa9f1c118b03eb187083931e17febeabf1480bf3a5bd438f189bdcc7e6743d101aade08248f8324e67ccfdee5dd6ce4b8780a94ebbd4720
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xzoVvxtJW:+mifPbRd3W
TLSH
T1CAB5BE13F2D900E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5164943444b7efbd482c21a2de25acb3a9d6282c21ce31540df6f1eaab3c3f1
MD5 4838487ae312487b902dacf8abcb14e4
SHA1 07d7ee5b7e00b435a8b605421d47cc913025341b
SHA512 00a17c18efc72cfcca133dbf744acd6e30378f3ffdbe691f67f28b4387073029e38c9b06c072fa7fe02086c8ca1f0857a3d9fcf50e0b63ae4cf674ebd09b49ff
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHq+oVvxtJW:H5dKTi61X3W
TLSH
T1DEC5BF03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 daef614890db238f9201babc89b3b49799ebf46df20df09f256884f52b718525
MD5 f2dd02ace2eb1fa4b929a67b8cf182cc
SHA1 1a758f553acddb79914ce1502dab4d87506d905e
SHA512 d0d69b7242dafec4281385eb4548cb4c6c607b874e83afaddd1738ddc244b70ed84d3f976cbecc79e58cd074b3cb8b019602fd62c582778ab70cd1411cc87551
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5w/oVvxtJW:jX2iyphh3W
TLSH
T19295BE13F2D900E8D06ED178C7568632E962BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 be56bc914c1dbf9e3b5078317761fc4d4ae36a877dfbd6a94aae84a34f14b836
MD5 c615c6f91167c14af1e148fc5b8447b1
SHA1 51b92ee203db0561bd24bf2f8ebc9980bcff1a8d
SHA512 35af3c302a20d54c8811fb6f2b6b1d8c8115eb21fcd947220cbcf8ea5c88ac3a487a2a12b9870836ea53f549a9acf6ddb3bbf13ef1793007a33dfc8f58381537
SSDEEP 12288:0xZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFH:061W3SEt7vRuy15V/emWl
TLSH
T111C42306D151E423F62407709C361F5CC49B6EAE7DC673DB77CB33044ABA2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 01e4e6071c73817165edb8d2e98e87550a17b8c440d4cef41efe83193d09bd00
MD5 efd9b91d7edb251621447fc79d192f11
SHA1 bf2b9676e374609967ee544c11d9eb55d81f261f
SHA512 06b19c87f017dc2d94c559163e7cd8f155f07691b5982e0ec0aad6eae331a7d3a26a3e37f316535e4cd9683073178e3cd97cd08b71989f725486ecd4f1eac1b1
SSDEEP 12288:yAZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFC:y91W3SEt7vRuy15V/emWk
TLSH
T13BC42306D151E423F62407708C261B5CC49B7E6E7DC6B3DB77CB73044ABA2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9492d357809487b3007f274c6004f431596c71629b9a5960f604e57fb2c416ff
MD5 d7e967c38c3cf0f18978914427b6c728
SHA1 9a57fd2def3445cea2740038a00d06b64526a1d2
SHA512 ac1acab1890e4911470c52a0fbd3f248416b593e077b5c9ce0e1bebbdf302031b35bad63ed45a40d42cdc5940a3cb9bbbe5a3d21c2c9db15bd55c3690f81bfe5
SSDEEP 12288:tGZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFi:t71W3SEt7vRuy15V/emWQ
TLSH
T1DDC42306D151E423F52407708D261F5CC49B6EAE7DC6B3DB77CB33044ABA24D8E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fbaf197a0ae4d707716d412bb84e0856dd22e4702b9b18ec09c228587f2b0bc1
MD5 a27392c894fdad1aecf56181e3a27db4
SHA1 5c4470391248f752da22eb31b6031480a3e97842
SHA512 900e661939a73ac2edd1156dbf418ba0b37e6f6f3c0fafd720351ba7b2077a69baf93ab6b6380feb7a036c9c98c710cf6287bed749ba7e1fd338ca6c102a6fca
SSDEEP 12288:NVPZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFK:I1W3SEt7vRuy15V/emW4
TLSH
T18DD42302E25190E3E5754770CC325B1CC1B7BDAD7A62B3DF778227090EB63888D65BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e60ed5e758b4bc080a487f1ee9636bd9f00d1997868bed2c898f2ab826a4fdbe
MD5 73188f85d210267e4c91b9af2efe7a58
SHA1 bbadb1ad800c43c959a9a0511bfd27d3fdfbdd43
SHA512 43677da902bb4f0f66855762f0a3b27e750c3f4542f6717de49a1f83b5b8d637f5fb43c7156f7f861a9eb5c9931a88138101fe8f0a5fabcd395aa3dbe82ae7bf
SSDEEP 12288:Q3ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFm:QI1W3SEt7vRuy15V/emWE
TLSH
T117C42306D151E423F52407708D261F5CC49B6EAE7DC6B3DB77CB33044ABE2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 582c682d30baa45fe9be9a251a7dd6d55cd4ed131fcdc2b36d26da906f62285d
MD5 4aab8ae8d7a194517403cc0ea60c1673
SHA1 1ceae6fcb8edfc2024523aaadd8fe94d3b8f8997
SHA512 d79a8e6151101ff05842866cb24dcd8659f1754be6218430c793fb35bc8f4e80c9b95731742eae699df7e60ef3f5399dbb571f4e45236a49905e832dd88c8137
SSDEEP 12288:PUZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFl:PJ1W3SEt7vRuy15V/emWX
TLSH
T11AC42306D151E423F52407708C261F5CC49B7EAE7DC6B3DB77CB73044ABA2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b14352e8902d19ce17c42a619260b9e40cb5d02ff4e8d5261a57e4cac203b91b
MD5 e497d0d43cddad021a364c44c49a318b
SHA1 6b7c4bee4ea6e5bef629ce8633b285709f5fb4c6
SHA512 5d7b48f99ec4049ed43e7e7dddbf03b58ece5cc61295eb2b51786bc85416fc909abf29f1414b1ca3b92254ffa2ff410cf1e3bb16c887b83def61e761497cdf3e
SSDEEP 12288:mIZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFg:mV1W3SEt7vRuy15V/emWq
TLSH
T15AC42306D151E423F62407708D221F5CC49B6EAE7DC6B3DB77CB73044ABA2498D866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 08872899580356d4d39aa480a23daab012fa1e03f6a4e3249a460330776d727f
MD5 db72d5810e3f5b3e234ae28dd557f2b0
SHA1 42ed37dbe006d714100da8d5d0811624dc187d88
SHA512 c76fe02079810835e3a28268b4858ec80f6f5e2d393da0e3dd0c32df5fe68d203ddc7b01e83c50ac0a42a7253022a93435fc8be96ef45c3fcc29e6c04ccde429
SSDEEP 12288:uiZwb6zzFEoS2cPvygZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMumm5:RZMSzFVSOd1W3SEt7vRuy15V/emWE
TLSH
T1F7050195B39018F5EC67423ECC258909D6B37C5A1BA0C75F13E4361A5F733A10D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 443636622397de4407f76f7f463492c47ba1d4fb958656818e64c22c4357563e
MD5 c5209505e5e4d4325f83b17f1a0d7999
SHA1 34061a43c615ece5b401b7d52067115dafc3da7f
SHA512 e3d7208d83704664739c2875dd974d6f025f4ba7605e5097417012b43bf2eb4c7b3dd3bcb525ffb499d7ab064a6d6ca343076f1995913dbb040215c837da1d6c
SSDEEP 12288:G9ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFY:GO1W3SEt7vRuy15V/emWu
TLSH
T1E6C42306D151E423F62407708D261F5CC49B6EAE7DC6B3DB77CB33044ABE2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d748daaf6087e519605b2169c6bc0a2db0734b2da0f4cf2b940148e497dd9984
MD5 496037eaae60e2a47a794670298fcaea
SHA1 c1fb6c6184eb2ae30627bfa108d86cc4e3a150a8
SHA512 1bf735e2bf8f0359bf96bdabf091b59130650e85e6066bb0f1bc1ced43cea654c649c4232d2f6750d746127416577c356bb64e0362c787abe170fdc93598b916
SSDEEP 12288:+pZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFy:+i1W3SEt7vRuy15V/emWA
TLSH
T1F1C42306D151E423F62407704D261F5CC49B6EAE7DC6B3DB77CB33044ABA2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4d86cf37f001eb96d44da7d6e4c27526cd760d54a69fbf0564a96d7f7e95cc3b
MD5 7b19f66baa143299829c95a560cafb85
SHA1 985247d6b40013a4e0052ab0bae5813d95ee397e
SHA512 e3d622a8afb76b2b370935626059f1efae802d06c0418b5ab65bfb78143a9db1ca553209c8681ecd66dfe5daa19da7fd598145c1d05467d7a4c24854584da3df
SSDEEP 12288:7yPz5L8sZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFU:2zyR1W3SEt7vRuy15V/emWG
TLSH
T186F40207B3A170F5E1364234CC621A05E7B6BC361B609BAF2795177A1F372918E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a76ee75b3cb36beea447386a8d299d5f2d97c35a591dd021ebd042d5fbfe9ce1
MD5 16304dabe8da3c18085fca0dbd44d96b
SHA1 fdc1d6fec9984cf7ec3680acaf87df98a537bf3d
SHA512 c678a4a79f5500822c5adb49dc88a4f8cc31dc458132216c5ff669a5df0fbba163af041a3fc0862f176177fa472a1c97f4ecb2e930462de985db545deae02dc3
SSDEEP 12288:j9ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFL:jO1W3SEt7vRuy15V/emW1
TLSH
T11EC42306D151E423F62407708D261F5CC49F6EAE7DC6B3DB77CB33044ABA2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 46832f5e75aacec63110d4be5e79d8b9370e7e39e4dcfd66285b5cd17d90b730
MD5 3405b352ce57b2dc95f14257c246a38c
SHA1 61943aaf66055eae0feb3cf1cb27bb9b8564a101
SHA512 03d4f0ac787b2f49b3f9b199904a10336d597e9f1f14b8f7d86ea0a494a3a3b8c310149296c7a09987bdc84912234cc3aecbcf3ceda0bccc6d6409990d90dfd7
SSDEEP 12288:29ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFd:2O1W3SEt7vRuy15V/emWP
TLSH
T131C42306D151E423F62407708D261F5CC49F6EAE7DC6B3DB77CB33044ABA2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 072ff2696f69ebe60a5b9f1f04974ca24f0de38540cdecc87b2c3e137c7a4ec6
MD5 3a4d2d8a785b94d3adb93b1d933e001f
SHA1 ce89f7f58c4c8bbf31a6e48ed71388672398296b
SHA512 42d615b0655c1482e6aecfee1333b59c8db29ed0e9e1b1484384a1f0b827ad5ecdc1ab44e82e1806cf3eed7bd97f96cebaa9f4c080144d3e792521236b810a2c
SSDEEP 12288:ZyPz5L8sZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF5:YzyR1W3SEt7vRuy15V/emWz
TLSH
T160F40207B3A170F5E1364234CC621A05E7B6BC361B609BAF2795177A1F372918E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c2ff5fd64a68eb9a33a12a54cfce170bb2181f92c6feffd78b011cbf6f67e1fe
MD5 7f8be24007800e6f35b3113bddfecf2d
SHA1 df5c425309d9b315632631cfd2bfc8af98c10540
SHA512 dcca8eedd71a37cfd3b10703170ce97afcb31d486ef9f40691799b6dece10d8112ffcacaec5820bfa550841a1d296969c94acc1d615683f85c55d66e866de4df
SSDEEP 12288:ACd9eWYoaLHF3z0z04PDvh2ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKb9:ZTHaLl3z0zDr1W3SEt7vRuy15V/emWK
TLSH
T1CA050195B35058F5EC67423ECC264909C6B37C6A0B60C75F13E8365A5F333A14D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9a22d6364fbcc20b9d9cd187b70a72fd65f2885a02a0e145b3bd4ee5ea8f18d4
MD5 058feb75bb956837cf2544c459a3c5c1
SHA1 c4f8a0732621be79ae3cb31eab24ab78312cd691
SHA512 c02f0aa7809c8a87d02087f0babaf648632f5442da65322484c59b6253925f1abb76513cf47ece1854b24e327b30a340ba6481f98f1dce18933fb7a7b269f83d
SSDEEP 24576:137d9CHKy7GZn1W3SEt7vRuy15V/emWU:V7d9CHKyaZoVvxtJW
TLSH
T18325CF90F3E414E5F0B78A358D764511CAB67CAA1B71DA8F13A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e4eb92cb72eef7b83c00e962e9d451b5db9b63547dee02b32cbe5f63e999380b
MD5 6ac386b80a890bf9810b42c192c05e7e
SHA1 977e741e596ea2c1a62ef00b8f7f2f212fd86e68
SHA512 a1bbc5354f3417e7679df945687804d7ce10bea776fdb45cc8bd8408f68d4c1495d8f4e7d541f3cda504b032dedbcd100dd00f8964b4b245ec0a1a518db32f6e
SSDEEP 12288:omZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFJ:ob1W3SEt7vRuy15V/emWT
TLSH
T1B3C42306D151E423F52407709C261F5CC49B6EAE7DC6B3DB77CB33044ABE2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 20961a6ae3c79c9f9d641c7fd6c0437a5dd5d814dfc869db122b03e2e9b855e3
MD5 46a24a224d727b1f72c7464ffb3c0532
SHA1 69abd04e73d5c6c859c49eb985291f51ea9d8c91
SHA512 b6778c0d4b7486d5eebac7761688cd4851e6abdc729a9b90e5718a3673c6148bacffe1331a6d301bfeeddd167be90a4008ca1fdd36e7cf1de2bd10fbb12e5e2c
SSDEEP 12288:+MZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF+:+x1W3SEt7vRuy15V/emWY
TLSH
T155C42306D151E463F52807705C361F5CC49B6EAE7DD2B3DB77CB33044ABE2498E862AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 86ca8f25dea00915bb9eb7902c12442835c05e14b40c656a4193821e2abb45e3
MD5 d1f36b3de84e9888c9573ac8a8b0a49b
SHA1 ffcaf108644dfa4c7dbb087139fbbbf6777f186e
SHA512 69a5f8dc30ac827447420ab88952554ccf32bb9be1f68e6274bc3be25ca6ca170d6ace6b6ee78b0745c0dd329d7bd53a14df6ab4abe182436e43a8be303b8c11
SSDEEP 12288:t7ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF1:tk1W3SEt7vRuy15V/emWT
TLSH
T19BC42306D151E423F62407708D261F5CC49B6EAE7DC6B3DB77CB33044ABA2498E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b984d0bf6690118ef78ccfdb6ccc6b55826a5fc24e63824bc687572c3f7b24ab
MD5 0754b3f984b2d68e940f554d8b82e5c4
SHA1 d7ac6faa073f605ab7ff8a72c34c82e4234e3484
SHA512 760300c70571f43cfba1535d4ade4758b188c501030bf2748756120cf71456cbe27351126ac5b7d69a2f2f0b415326f625a40b3524c6e198dbca8106a23b6382
SSDEEP 12288:v9ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFg:vO1W3SEt7vRuy15V/emWG
TLSH
T18CC42306D151E423F62407704D261F5CC49B7EAE7DC6B3DB77CB33044ABA2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 beb6b7d76db70e6bbeb656b27cac25f12d7782b6ef5a55fba48febc7ba33eb64
MD5 324418d63ffacba5025c918f1e4cd4fd
SHA1 bc5f9899150b50602239aa536ddd42d2dea7fde6
SHA512 1e423a3d59e73c340e500f05467d1a76c36d3b9b9f037e2c9ac361dc153e200fbc06f982d2fa04389c9018c22e77cde690e66b4c7d1f9d7b752e8b355b05424d
SSDEEP 12288:2mZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFc:2b1W3SEt7vRuy15V/emW6
TLSH
T112C42306D151E423F52407708C261F5CC49B7EAE7DC6B3DB77CB33044ABA2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 766623957178998380a275f82641e158ea3888951a5da93044e9ad77b3f307e5
MD5 a504f9edf64e55d4a48da741f9197b04
SHA1 21b6767fea7c867d3853fab72a2e9e2368999663
SHA512 90e065e77e0a82ec118d1ca9c770167139aca1f58f2f223e65f1bf805b879de641835f1990ce2d8a6a17627e10fcb4f125e08ab9b35593579a1b3013b75bd408
SSDEEP 12288:bFZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFK:bG1W3SEt7vRuy15V/emWk
TLSH
T179C42306D151E423E62407708D261F5CC49F7EAE7DC6B3DB77CB33084ABE2498D865AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1cb26f6b902a3a4d59ef9c79706320be22c3fd989a1b2c7f4c9d2795ffbd42fe
MD5 53cb39f0064d5ee3d9a4c9903c39a394
SHA1 7ccf8da83c7224b59e11287acaca44c226f2ec0a
SHA512 981af68a1360d9c3dac2f25a955ed0dd43b3318f6c8a8039120051eace4e50df97a8d70ba85e883157179e282e93c583d33d843604dbe367f1860c76c7876a6e
SSDEEP 12288:X3ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFR:XI1W3SEt7vRuy15V/emWT
TLSH
T104C42306D151E423F52407708D261F5CC49B6EAE7DC6B3DB77CB33044ABE2498E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b47ea437bc55ebbb6ffdfd99287292d393907af7dd3e76b7d16ac595e83b48b6
MD5 7b87ef76cbcbdcfe157c37ba6c9022f6
SHA1 42f4b6a4af881999b3c0b78c420d20b5c99e5c85
SHA512 1b42e330a963c1aad2480769d2266b992a17216e89846e6e7e1aaf80856d675663e66b1dccb43af11e815098aab2cf99d4147af2cbe6a59598b1142c444d8146
SSDEEP 24576:9fwvok9RX6wkyAIy1W3SEt7vRuy15V/emWu:7MnYIyoVvxtJW
TLSH
T1BC35D029EBD844E1E177923C8DB7460AF6B278691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7f24eee8a315a46126a254c94a43e60699743872002113d2b552c72742db8ea9
MD5 8a4398a0597c3e1f99a98bab9c19a5ce
SHA1 b6c0bc2c6dfa59f1de73e9269954808ed9faa918
SHA512 01e08a4d3e0175b7f2eb4c9261ad86497324f038787743a0f32db812f624ea71210f1f1f00b6a93216fa96b6115e13f7d004a30b6a6faf79a0046996a678bdc3
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0foVvxtJW:4ySzPc3W
TLSH
T104067C96A16841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 368c91dedf20a3d2b648520d8d38c62f3de717d53235f7fe3136de9cbffd6946
MD5 6374d24e57ed0bda2e31b749849dcff6
SHA1 3a17e097823ca30de94972cfcb6443ae836cf52c
SHA512 6668b9cd2e0293aabb9d21bb3e146a68cba97f3e66e2951d21030fde1ed4bf09b27567fddd4339a029ce8b4c0576a03cda59a39c442f6907827c8f51e80716e5
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYt1W3SEt7vRuy15V/emWj:C47JUQj1irIhCnDHUPfF/voVvxtJW
TLSH
T16465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31D6CF22B0437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 54db2ef1f7be5bf9f1607edcb236dafb91a67473ad741f4f72e0354f8ad80544
MD5 a7482e16f5bb71fe06e0809cbe8e196f
SHA1 ec552c2de11db5ee0a989391ca367d1ccee18f5f
SHA512 aa1d992c3b7cf00e67cfe9949f18e32df7c2a9dee06afa97a44caf88feed8fe15b311f6f298d900e9ee073c8ca976180652a2eb90ed6a643731e886e19fda7ed
SSDEEP 12288:oNsftZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF0:J+1W3SEt7vRuy15V/emW+
TLSH
T120E4F00AD29451E5D06E1275CB524A44F3237C6997E1E3CB63C1F63E0F7A2848EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 4d855f14157c2115fcdc183070a0702c85a58e85c1d1e0b0c39faa9fcd997874
MD5 6be0bd4d35c709d363d3002437814e71
SHA1 59045741f722946699025bff710f2e47fa166a05
SHA512 7fb89d4b6ee9ea594d6cfea4353be5a14b5c5fe2fe87744c60448f0c63a1626d8a849676d149002c103bec39bf512cbb3ef73013e77d3b5d2c64bf836785b585
SSDEEP 12288:NjbN2y5uprSoWjy5HakiyQJuFIUeWzywti9YIi/vYQwPFnYtNA+TW3o:N12FfXiy8cIJWzRi93iIQwdnpmW3o
TLSH
T1D4552841766AC75FC6AD40325E32D2CCAB707D05EE056F0773C88B3F9576668BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7205f849ea643e8081378243de617fd5d30edccc06c4b8abfa6fc52507e4700e
MD5 b53d1177e775e08e065e2b7bef211c4a
SHA1 9e01199c6c032abc56a2a697282b18efe7cb6966
SHA512 18e74dd508cfe1eb36c53953183e7fe15a17b5b834a4c00db186833b6b4ac5b4257029d5161cc9b223219e53a36789b5a313a4fcd28e1f4bcbd36c0d9873d31f
SSDEEP 12288:8HN7MHYrN1pOQYO2bdclBONJlQ/ulPYqNidhNvva3:8HN7MHYPpctlAqN0zvva3
TLSH
T17675FA815137E39FD1FB50324336AB4DA774EC06BB096F16B388053AD46AB25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a21f85316438738529805b51da09ca693e1dac124faf0d4549733d7dd2e85af0
MD5 86f013ce29cee2807a6837627bece791
SHA1 34bbe425f5fa97b098007ff313a89150585159e2
SHA512 9f1d588e9e733504e8cf89ccf2136b0f5e28cd274e6ee17971d015b7a08b8c05e422a2808d413d19252788afd4c049dab00c14b51b208f65926c5504bbb6d6d2
SSDEEP 12288:1M71ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFD:O21W3SEt7vRuy15V/emWx
TLSH
T1E8D42302D254E823F57907704C2A5B2C845FBE6D2F81A3C7B7873348597A2C9CEB665B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6406e921781d770889a6f055e23a9478831f0cc576f6ddcb598f78147ddf9cad
MD5 4afda9823de95e71bbc96150917c4fde
SHA1 d90d4598e5147439ba1c627b9ad01a152dc05dce
SHA512 cc0c693bf06ee32364f1a29d5f85547cf6437134fe7e51a6b83feb591ec067843ecccc4a5910713927bb296f4922e796cf3461f594df43dd49b44763b7714c94
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYs1W3SEt7vRuy15V/emWd:Mgb4mBIBhGFtoVvxtJW
TLSH
T1E465AE1E22E802F5E0F9D2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3ee700bda7e1231c131bac765f61c44f1802dcae9e8609b29d6c52edddd41763
MD5 5ecdfb4789b6bd24047937ef8d68c265
SHA1 81ac1f2d2ded56df074a1a38e465b8d464106fc5
SHA512 05a2a431ca3822fde58faad93a8d25344d6e41108fcd98ee39fb96bef7682167e030f9721749038fb6323feaad005448771b88548b5b82630597ae15d6d57f04
SSDEEP 24576:sG88u8FpJqH1bzria7/md1W3SEt7vRuy15V/emWt:P7ZFPqVea7/EoVvxtJW
TLSH
T127350165B2E001F1D47BD13889824667F6B2B8251364FBDF07A88B451F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 c6172fb121bb237f7c9a261a3aa9429600ec4ee6c613b5a9c6036e2a48923802
MD5 824bfa8d0da01bf3c89a1d8e41519c2c
SHA1 26e2b2c0ab7dec779e77569d2dfa9848acb8e769
SHA512 d87561f185eb7951b7dd1c02f8566e47813632c44b72d71f4dcf53d7f97eb2bccb8fbf37bdefa60aace5dc3139737638a6883a7394f1ac961bba92d022ce6472
SSDEEP 12288:HHvUrBFrEjwaQkZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTFP:HPUr+NQZ1W3SEt7vRuy15V/emWF
TLSH
T19C05F11F62A818E5E676917C8942470DE772B8661712E3CF03D1817E4F77AD8AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1c99f6de8be1e1526e753e9926d2a8d2832a7ce51e05a7c5e24450cb73f81bbc
MD5 72d530c73cff73a34377fc2720254db4
SHA1 ff9488effbd25cf1ad34cfb728dad067fd6e8e91
SHA512 bfe1c648d62f362b167b953cdbdc49a69d9cf49d87fc4d765ef8c070f2a1feca35ae4871612cbad483a55790057e00699d193ae99b50094b1439c40172c0d5d5
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJoVvxtJW:MG05lO43bT3W
TLSH
T1E1D5BF6A62EC11F5D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ee3da7588d42360d0ae45c01bd203bfaf265c694f3e39375ee50505ec0e24f04
MD5 8880f0d3de06277350e66e44f88c4292
SHA1 113da103cca3daa33b9b9591e392457e50bc854b
SHA512 63a92ab0a1df8f88358af97bb547c4b716472d37c3fa451c5372e9d835204cb730e91a2a011056bbd81acf9ec60eca60036e04938c92fada0739ead1d41da90c
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnf1W3SEt7vRuy15V/emW/:Za5POZ3+Jt2pasx2+mxoVvxtJW
TLSH
T10265BF5EA2F800D5D579D17DC583461AE5B2342653329BCF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5f2d3c0fa878125eb1f5320ac2f69ceb16d91ba5e1faef7d9fb15bce96bc2909
MD5 4d995831181c562ff333497577e419a7
SHA1 0991013275483c6921988311a3b0bc821435da20
SHA512 79c0f40c48e58b6fa94903c23e4b12b72e69a828edd7e47e7f52fef354488ebb660957f920bb04d1d5667fd64e374e583febb97acdaee88ca5f86c31fd83a04f
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkF1W3SEt7vRuy15V/emWR:lNc/zEOVHFkoVvxtJW
TLSH
T191857B1623E901E4F5BBE1BE89779546FAB17869173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 82d220056f63cfe6691d6de9125044b558588a94f7d7746be9b69bfe8c7087ea
MD5 6e40f443ea766996946c6c64ef4b93a1
SHA1 3418a2e98319a42031decb33382fec84df14c07a
SHA512 6df88f94d81d5eb083b799b6550d0953aae1a0ffa6e2f3023550b8027b611b64d4d7678b6fe5baab0c5eb434116780eb1dcf1402b8fad34906c919dd97cb5708
SSDEEP 24576:i8kNvNnaFeYhJNtmZBmj1W3SEt7vRuy15V/emWa:i8MwBtOmjoVvxtJW
TLSH
T1E355AF2EB6B845E4D1FEC6B4CD238512E6727861173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9dbfefd711a13e3bb6fc0b0c23229e05dd8baff9ef2795d8bae72013a04c9b73
MD5 a82ab89dbdd18d540507a6debf053b4b
SHA1 99f0bcd45ee5a1f1eb1658900566868574ee8e86
SHA512 17e449812396007db1fb183dfd9fe4293a735d2136cafed05fd5c67e6fb2e5d220adf8c2f93736dec6436a53250c378a8035d2fcbbd31c1b8916f3799aef3791
SSDEEP 24576:9D3FHshBIYQgAa1W3SEt7vRuy15V/emW4:9DVHeBIAAaoVvxtJW
TLSH
T1A425E13DE65C04E4E57AC1BCCA634A06E77238AD032266CB12D581B91F7BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/356-79-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/356-281-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/356-84-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/356-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/428-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/428-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/428-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/428-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/744-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/744-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/744-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/744-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/744-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/744-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1012-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1012-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1012-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1012-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1012-314-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1012-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2304-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2304-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2304-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2304-20-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2304-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2456-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2456-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2456-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2456-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3332-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3332-6-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/3332-7-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/3332-1-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/3332-65-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3488-61-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/3488-179-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3488-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3488-54-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/3552-249-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3552-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3552-69-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3552-74-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5324-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5324-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5324-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5324-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5480-407-0x00000149BBF90000-0x00000149BC15A000-memory.dmp

Download

memory/5480-321-0x00000149BC160000-0x00000149BC7E0000-memory.dmp

Download

memory/5480-320-0x00000149BBF90000-0x00000149BC15A000-memory.dmp

Download

memory/5480-408-0x00000149BC160000-0x00000149BC7E0000-memory.dmp

Download

memory/5484-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5484-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5484-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5484-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5484-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6020-133-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6020-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6020-135-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6020-127-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6020-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download