1bf70d1ba67923abc125818e1fa734b678d03f1d64bb35d5834cdc37619e82c1

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 725KB
Sample260804-p8kagaxtgt
SHA256 1bf70d1ba67923abc125818e1fa734b678d03f1d64bb35d5834cdc37619e82c1
MD5 145e758f36d1e65d4939d4ee90236133
SHA1 faac236000aaf8472274e3eb9d5985340139a7bd
SHA512 6dcc748f051fc80b7d18680840ca9eacb2ee1b5e83696ff01523b92cdf3508d1cc94fd75a2a19a02a29f6b63807d6767ad1db11bc966ffd9cee5238e595e4a43
SSDEEP 12288:xv9PGxTszBAGubvonon3RM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqI:t5GtIv+K+jr71UHgLSxqalTfB
TLSH
T198F4011272C08477C933163116F1EAB05A7DFE342F6589DB2391272E1EB47D24A39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4984	elevation_service.exe
264	elevation_service.exe
3776	maintenanceservice.exe
4900	OSE.EXE
1052	PerceptionSimulationService.exe
2344	perfhost.exe
4420	ReFsDedupSvc.exe
5764	SensorDataService.exe
3696	ssh-agent.exe
2860	AgentService.exe
2628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d55c853ee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d75570341124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f76ac7f1124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf7e79361124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000840bfe321124dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018f34a331124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeBackupPrivilege	4420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4420	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2860	AgentService.exe
Token: 33	2628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2628	SearchIndexer.exe
Token: SeDebugPrivilege	5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5736	2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3040	2628	SearchIndexer.exe	101
PID 2628 wrote to memory of 4652	2628	SearchIndexer.exe	102
PID 2628 wrote to memory of 5344	2628	SearchIndexer.exe	103
PID 2628 wrote to memory of 4424	2628	SearchIndexer.exe	104
PID 2628 wrote to memory of 432	2628	SearchIndexer.exe	106
PID 2628 wrote to memory of 944	2628	SearchIndexer.exe	107
PID 2628 wrote to memory of 4640	2628	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_145e758f36d1e65d4939d4ee90236133_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:264

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7087748b2fb641596f5ffd4478429e514f6c9138b2c7476ea37f92e9b30ec25e
MD5 818af6f7d16988075127ded5bef3b003
SHA1 dcf0f7f7ab2101df20a2abaa4d6606fc39ab1f72
SHA512 93a09d347865dcdda330bdc2479eb5a9a19faf734640d2a2dff3fceb531169977c2eef005b3c270d1c397ee4d9042b8eaa48a5804cc4affc886bb4155de6d4b0
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnK+jrxE0al:z3q6mjBT+ne0al
TLSH
T105D59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4b02a01f2d75121a08412a937b4a93d3b1039fd39b1508939bc8d570e757ff80
MD5 05e86d6744a608805b4c34f7f8de537f
SHA1 cb616ba292e6ada8be013165dac2092c567059be
SHA512 595f45e6e479b8cd760e4819fe4322fba454401b2f236cda8ceaa1fd8b9557be252acab4b116c100dbb5b0d0da3d40e0fdfdd4ee961f44bd47e425b9144c4d19
SSDEEP 12288:o1XLsswWkxy2lRq2czAIM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqan:OXYfDtczAH+jr71UHgLSxqalTfB
TLSH
T18105F129B3D408F9DD274279C9A2C515EA737C454760E7CB03A4A62A1F333D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f10c5db19ebe69f778471f688ec53fa2f9c9921566754d75262ce6714d10c643
MD5 afcdb90bfd8dac4a02471e2f42909356
SHA1 b5c3307b90ca7725400805fe9066c9922e2f65bf
SHA512 a461652db0cc4289b0ab2f9d4973a4fc22d0940cc40ef13f0aae0eb5e94ce27b05b2fddc7a8bdfb13097abec5d07d07de6d029fd2d21ab644d3cb3bf7f8a969c
SSDEEP 24576:A0Le5ji0hmxhrMy+jr71UHgLSxqalTfB:APji0AzF+jrxE0al
TLSH
T16B359D16F6748735D073C0B9C5D2A69EED7130861B308ACB4286D77C2E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 240247720f839bbab8f7c2ba1c6a52d63d113290840b35d0b7ac3d626416ab95
MD5 01cb881a022470ddad6a10200978193a
SHA1 7a69854c964f2fc10228fff078b19c1096b1edb5
SHA512 d68a95d8f348a34805cadd973f860975284f5f707d93781305da90b3c5e5c29197ccff066437b30b5e038a4a99c4cda7343fafdd6b92c509e1c3bd7855890156
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWj6q8wyus+jr71UHgLSxqalTfB:Y/ezSC6vUzPv+Hjy5+jrxE0al
TLSH
T119755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cd9c0b5de2b9385988ad7c473d37c2009a6f155ac540fb818f1a94d5d3881399
MD5 6c0239c65e7a9acbbe9446de471202a0
SHA1 1391b43895e73b9786edc09ed93263e805b03056
SHA512 b3e8c246bd7aaeef8d3d3933223b97551aa2f324b7a9b1f4761d56ad4e854ea6f4640c901998dd6eeadeb7fe3b808ea1b721b77516354a92bdf499476b90a1fa
SSDEEP 24576:/VbqPb88hv/l+Bj+jr71UHgLSxqalTfB:/VO88hXl+l+jrxE0al
TLSH
T197559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8d1ca3108d742daff19a77ade0acd17c610fb8dce6ba123ef720957dfd087764
MD5 26fd9aed97e44913778c72650ffcae42
SHA1 95bc356afd279bf76ec958e9f62887ebbf3c4196
SHA512 26754b82a59e0d9bf2ba34eab0a0bf192f8ea122b38433e23b50f479ffb902ac1058e9b88ec5948285f83440295b457b64f0208804d24a3d5f8380f091b9c77b
SSDEEP 12288:KGVM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:KGe+jr71UHgLSxqalTfB
TLSH
T168C42347D2945C1ACB2B237332F3E9AC9E618E4D740995861313370E1CBE7A9C526BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a0e8b107233356634544b4c83792b62440d75c8e980fc2e77ea82df91a4255ec
MD5 ac0743b8db0836b4a59f1e651e903149
SHA1 7514ae50e89d69832d236594024f1ac798b02575
SHA512 2aefdfcfc6dfaf4c6650f0513e57bee1c2d162f6c4135be2b328d232c98376417fb279c3fd3cd5e1082feb4b3342467c13a981bd38b117e9584af9b649825b2b
SSDEEP 12288:EeBNUbTVO86UcM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:EJIUL+jr71UHgLSxqalTfB
TLSH
T17105CF3BEE28FCD2C23A5DB95791C640D77278304B12A3CBD165830E9E236E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 156951b6453912cf6911d68bb019ccd648be80eeb5c56f66814d6fbe36d51ad1
MD5 44838470d42511606459f487ed2b9286
SHA1 48c0db4b1480a79ca1925e1b4366b5daa533fa3b
SHA512 908ad8624ea345b79f4579d993439e08fc858e20ff27065c278fb56518020425d1e73bd5284d2e0b910613e06c71ee8aa9aa4ced75eb710a73324ab2f06ae7f6
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:IQvGAdlCEL8c/WRNw5C8+ne0al
TLSH
T1F5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cb94d2161f827b9b468ac8306ca0f715ffabff0c239d743589be7abe4edb07c0
MD5 abe8da5724702776e45a327c156bf3de
SHA1 f1edd0864cdff3ec831125f52608c440fd1f039f
SHA512 2a46158ea24a0fb7eb942444fb889e8010c7a981195dcaf196682c2159858658473204ecf72dd28cd7a67cf0ecdd4084d1eb32cc85f52fab4960a64b98d6f19c
SSDEEP 12288:0AwSfxL/2Dc3mDLLmt0LDQewsAj+M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goAL8:JfewsAjV+jr71UHgLSxqalTfB
TLSH
T10815E031FA74E436C77F0EB22B76D716183CA9204B511AC3E3A85E8E59742D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5018d2eab1572678189f177513a7ec5ecbabb62557eefd0f60f4c582f4ab29a
MD5 d022c2094de0a318004390e90a0b6e2d
SHA1 ef7bb3c7600386bafa241ff703189ba62730a586
SHA512 94bdf7fd13d611502fca01588f06fd0e56d8717489ee0156ab2399298e3d6760b1701d564a804fd7aea4b7c911e85c72597d8b84b57f35595ae7c7f36f96650b
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHQell:cUEtQevvqc2W1cpV20I32QeH
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1855e5b719f9b65ac928b436b19603a66a96f6cdd57f61776da03ac098a250be
MD5 39fa4d160e523f3de54846f97390d9cb
SHA1 0e78e5436afa11ee853ab9a72a20a31bdde28d57
SHA512 a69abc279f112610f22014febf648393783b564bb52fe47e5de58c4aa1f3f9a005a90e2ebdaad5abaa07ea43c7dff3283f94b83f347e3898c5ddafe46a0cadbf
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/z1+jrxE0al:Koq2Vjnmw+ne0al
TLSH
T1C2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2f5532d470df1d8ee891d438dd1f5a5092862e04f4069ef2ef1eb743afabd033
MD5 e86c74af3e23aa990d9e4fed0dba65b9
SHA1 37887fb38e9cdc7aa11d05a0a81987e0e502295e
SHA512 fdf1ef6060caa849be8c11c888dfc2a13606efde27ab35b5433d789d1cf6d5f4eaac0d86b027bc81bf7cd0c76b5609aa55613de451204fe690c22a56467e2068
SSDEEP 24576:jAhGL6IFoiwtA5l7S53Q+jr71UHgLSxqalTfB:jAM5Foiq5A+jrxE0al
TLSH
T11F359D81E7F955D4F5B3ABB859B69170EA76BCAA5E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8b9125ca6be581a58ea833e1d4f73170200f4a5543b6e32ccd3ec5e24571b229
MD5 455cf720960b2c8d65a69c6039dcc11f
SHA1 cad667bcce5990a02dbba8fbb50b13da88eae3ef
SHA512 1f96e1a0e055df371aaa6093b9aec85311bee7451c38ccadb5dbda2ebb5b669de6ba0b99d121a80279223ebc659ede5a12579d45c9f431e5b7e3aa086446a147
SSDEEP 12288:umw5HEjsChNEBFgl0WDm+CbM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UE3:nwuROWZ+jr71UHgLSxqalTfB
TLSH
T19E05F14672E40CF9E96752398697C135FBB2BC062A25D70F1360C65B2F37361AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d29ab9574500c26957279ebfbdb5683af51907569fe98bf24169ff16195d4043
MD5 089d2d094bb9d76d76c6cad2dd2b8780
SHA1 1f7e318f5c7427ce7482a42787e705bb568c1ebc
SHA512 e690a47022dee8709c7d9e493f8fbfd7d3fb55c4cf7b902b920e7974bd8f5c20ab1a0966357645022e5c5a9a438db918be4b5b7c3aa6f2e153f12b9cbef5d3a4
SSDEEP 12288:lyZ1IyOM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:8Zua+jr71UHgLSxqalTfB
TLSH
T193E4124A23E424BAC227137A95F29648D7717C4A233683CF1322235A1F77BD65D39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 78667b8450a5bb267552b72a50ef98346ddbd86f6df3d679f73a51cf631322ad
MD5 ee88400a2cc55757610624fc2ab641a7
SHA1 b1b337a1d6d93bfa1a591b6ae639cc8d47b3638b
SHA512 dc5d4663669c6a3a533a7c958b8fc91976c5a0f4d5f0ac738dc5c6ef03837f4032845e7ad359759c02863258256245cfbe7c2bc3159a5f4add3bf0d71883aa7a
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:hQRQyi36YOcPDLvw2gAf+PN3v+ne0al
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 04acae6f97a769af6f7a7093b076cf732d13c95f7b01aa9bfea75ef9c3cfb495
MD5 7a05045c5d6d7cd864327c2b99c15725
SHA1 012fa876564d79bd53efdd1f5ba7170fb18a3a5f
SHA512 191a6f295c235af2ea6655b0551f1fdb77eac03cd6195322e323fb8ae1903e3ce440e99949d2a8f2aec012a1bb7bd7e36a2b71cd4eac4c415d57df2a69843a44
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:3QRQyi36YOcPDLvw2gAf+PN3v+ne0al
TLSH
T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7a05f763493583f8ddf7f7321d5e8d429b4ba9054c107af42b6223eac54bd8c2
MD5 6d9ec691f565d2d84a24dd81efdeb82c
SHA1 eeed1b58279847399451f9874c0086941e4daaac
SHA512 506320f5ea6d0af21503a8a17007a0bcbf0678b460aea4ffb1d777c0690e5e0520f7c115ef2de817491b61a97d4815c017ebd5909a4868aca5719eeb4dc24240
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0K+jr71UHgLSxqan:i68Qg55nhkeWu7PNU3/F+jrxE0al
TLSH
T1D6B54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e211e3ae0cc14885b6faa5ad448fc2d5422ba6aea928b61a24ba3d288df1d746
MD5 3348da968c38a87e716e6174a58baef1
SHA1 0af03fca8629f6927877377c03d79f2b399252e4
SHA512 5ea3d8076310f98b6a7de14daf0c88b882ca99a63cbd1a54cc1f7ad285a03ad1c129d8fe880682620e9d767bbe7baca10c8a1fe387cc3d587554f206fc753f33
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99R:oy5112gYy5azzVvU69nLKnhZe+ne0al
TLSH
T106167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 996e0880c153ca3559862fee229d65005e50e8e9d8925874d6acdd8664fac5f5
MD5 a9389b1dc7839a94751efac9959e8c0d
SHA1 dde3a2cacc8305bda689ac6a74b08a91757cb3f2
SHA512 bdc48f7dc118d7615daa627c6d1142ad46c0caa2cf51a2575a8b1bd1ef82cbf582ee99a2db745b2a34edfb38b427388c8d47354682333cac75df73ad48b7f833
SSDEEP 49152:2B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3+jrxE0al:Eu6JmIxd2d3+ne0al
TLSH
T154D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c91d68e4d7f98332aac7e5a12b8c28845b5c889406c44a39fc3edea75a9bc16e
MD5 f60bd78a427a8edac78e5ff69a339bac
SHA1 4e44ced668f31fd015f020e866f313b3ef6e3aaa
SHA512 f795ce65e2cc7970084108448932bbcba946ae9db2fc51d88691c196e1fa4d8b195b42e4c8b5e484b3386bb9ab5492a31eead0af79d0484d5cef8f5de61d28b0
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4xr+jrxE0al:bmifPqRw+ne0al
TLSH
T187B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f14d5a92fbd56062636a6783f264245a3bdeaf9421337475168d7894d064b1bf
MD5 5774308f10cef236be56f73b6a546254
SHA1 d335b35d33f77a55019e54f89b14fcce6234e0fd
SHA512 d8f4b18abc9aa1fded49290c0205ce5d18dfc631ccbabf720b21bb882da8869270aa25b83e80ebb814800e33046701ce739e0e0447901f8eb3d1dc6d59c64364
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqa+jrxE0al:Z5dKqi61a+ne0al
TLSH
T154C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 da98b4cfb6065dfa2307adce0bb6a45eb17c44caef0c83cb64d37f7ac13d69a7
MD5 a0cdabf6797d3573c4469fe0b64c698c
SHA1 206fe1776192d30b2be16dba33be6e767b295f67
SHA512 016f563ecc950b8db29fc26b50f5a3ce589c740c1edaf53d796883b3cae637ed28918bf55b2cdff1238a1fbcdaf497181365151192df5ea5e8cf9ce30fa4d5a9
SSDEEP 49152:+htSn8EApI0figjgiDn0AP5wH+jrxE0al:fX2iWph0+ne0al
TLSH
T12B95BE13F2D900E8D05ED179C7568632EA62BC060B39A6DF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 54cc966470446362ee3cdb0ab715277c7f846e6388dcfd8d56282b0c3b4cdc2e
MD5 f21bee54b320a6adfa43566cdfe45b7e
SHA1 df8ee9fcf7b12d255c0de330e239dfc4e19e0f4b
SHA512 5a10743439432224e2ebf0e1c9334acdaadf6bc6efc2edc75b5ee8feec70227b2e3d49ffeaf9c27657e3560f568d0f5c64ba1ea4934398f451d05047841366ba
SSDEEP 12288:nNM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:nm+jr71UHgLSxqalTfB
TLSH
T1F0C42347D1D45D0ECA2623B333F3E6AC9E544E4E750A918B2313320E1DFA7AA4526FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 51f4d3f46265bccf47ca3a52c475c254fc4c934efcdbcb30c5fe73a5215b5325
MD5 8875b67fc26a5b64e6411aea944d21e8
SHA1 d8c46aa23f9bf2f6166c06701def668772fc4cb3
SHA512 e6bcfc63f3cdbd97dd304fff59b666945e16ec0df5bca6c6b97324b4919686af1a92849cd0a84566d11a263fea237822038a97e53e346412fb7e70963cb80f44
SSDEEP 12288:waM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:wR+jr71UHgLSxqalTfB
TLSH
T106C42347E1D45D0BC62623B333F3E6AC9E504E4E750A918B2313320E1DFA7A95526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 818a55a973ebaeed0ac2bce4cdcf4f640af00c94594508da0e874f44e1de9771
MD5 9ae8e7c65fe588a1add81568d2ab7c05
SHA1 ecbdf78725bf3bf6655ade83155a74299828fcc0
SHA512 b781ff477245f701038041088e8075275aeea7c57caeaddc3028535e9c26d522f821f47ca0f3625df42d8478fa79c059a69f9595212dffb2861a06c2862d7aba
SSDEEP 12288:C0M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:CT+jr71UHgLSxqalTfB
TLSH
T15AC42347D1945D0EC62623B333F3E6EC9E604E4E750A918B2353320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d1e7a983f091df966b718ce4454dbb5fb8cdd1d059f49809172686d49513cc4d
MD5 15bae9b0a329948f1d90492856efdb00
SHA1 2cf5020c1fc4db6221817d8e22205ce94617d6c0
SHA512 92f07e1068010370e262200f45ea1b26c9534a5ada7d2fd8d41fba16596057581c295fbc0b35088a71bda49369f76b5034e6379ee90b038528ed146a91dad9fc
SSDEEP 12288:zVPM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:C+jr71UHgLSxqalTfB
TLSH
T18CD42347A2D4088AC927637352F3E5A8DBB0BD8D762692CF1303360E0DB67985935FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 df5266795af69c32d221a37c7fb3dab8d8c9bd5d9c3942bcbe28333dd6984fc2
MD5 cd4d7831164d67091f739a1b143aa05f
SHA1 209f251e699cfd0b28c1784c6d266dc46c7483be
SHA512 9dd16c4af28a24918b139f5f21bae32193a898b50aa2d466e999da00a873bcce5a3c6c0c1a82ddc583031779608be151040624c97384621b4d84e4cdae0de8bc
SSDEEP 12288:d3M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:dI+jr71UHgLSxqalTfB
TLSH
T144C42347D1945D0EC61623B333F3E6EC9E604E4E750A918B2343320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 172bd8b0aca6327dbb5717756483fedb709c0969f3fe119c16d362b561c2d7b3
MD5 9d3f2187594b50b6c4c7ba6451e438a8
SHA1 276a9cd9532cb076eeace6e8b25637a4e8f313b5
SHA512 b9e406357ff0e3655b142b9e095c07a4f1a411acf997eb0095eed17629e29fa6bb70c63fc17fec582a9f03023d2ab5dcb421503864747186b7ec680ce3d6a3bd
SSDEEP 12288:dWM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:d9+jr71UHgLSxqalTfB
TLSH
T112C42347D1D45D0BC62623B333F3E6EC9E644E4E750A918B2313320A1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 66b5436529e1fafb105c4bf5993ee028ba448fe5df2f8fad70ccdb40c8d8fec2
MD5 0bdfc7b46e7f4c1c38b2ef5690f122be
SHA1 67b2202ffab3a2ee06a5c170278f224a8c13b447
SHA512 1bc273d0fdc7669b0cc0af73d4a4f6c36ac180be8a14f3c0fbbe113c63139b06300404612d83b73b3d883bb62b9cdbe56ff1f25726ea7534dfec9649c0f517b9
SSDEEP 12288:miM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:mJ+jr71UHgLSxqalTfB
TLSH
T111C42347D1945D0FC62623B333F2E6AC9E504E4E750A918B2313320E2DFA7A95526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5de6d1cd32d414476d0ee825dc7056a9d7e57090efd4f467ebb97031a3a44177
MD5 7528fea48f36ac704d936bc6d02d53ce
SHA1 1430b3e7674b5f74036434e9f74f8e635453ab56
SHA512 d97d896ccbb27b3ad8e55263b4ebae90f05bc035e83ab9e1f77d2d4b545380d08f5166e14ff6f69e8646ab95b96670a3ebc75b1a77452b7a34497424126cbd39
SSDEEP 12288:RiZwbDzzFEoS2cPvy6M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalT5:UZM3zFVSOx+jr71UHgLSxqalTfB
TLSH
T18D050195B3901CF8DC27423EC9A29915D6B27C5A1B60C60F13A5362B1F733A11D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0c075b45549f8b614c51d8d57f97b0b8e077d88a93a46826af2d332ef51c5f6a
MD5 65675670ef4006b54efabbbe4508b247
SHA1 b45e888e5ccabfa9c035689b4f832d3be79c87a7
SHA512 afca5519069dc2a81ba583a56cd5ea9988b916f5aa121345e91d3e5244f643f72899d245a9529e2d9d6bfb0a8596ca5ee1f5e3a6fe41a98ee0f0ce05b950f3a7
SSDEEP 12288:phM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:pq+jr71UHgLSxqalTfB
TLSH
T1A1C42347D1945D0EC62623B333F3E6EC9E644E4E750A918B2313320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1fc1aa4128f2c2cea8619697a2452d2a23798bb8d24bdb00305a7b5d777e05bc
MD5 cd5b4423740e2d2a5b94f21535914013
SHA1 f1445773e4ad89a70d16fb593ab946a3f90baad2
SHA512 1a23bc99c61a0f680719e61783bb23f13c81e99e88c4effd8da992c95f56537fa66a3387ff7ff094051f5e28b16126ca462da2c65f5d11a3554b76cd92a41e86
SSDEEP 12288:DlM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:Du+jr71UHgLSxqalTfB
TLSH
T12FC42347D1945D0EC62623B333F3E6AC9E644E4E7506918B2313320E2DFA7A94526FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4829178acdd4580917e5d33caa291bee50d2f857f8055bbe962d97b609391ca5
MD5 78f36b471ccc7db6cd36d93dfd8381d8
SHA1 abf1bfe07a78f435853eae40a557074a18900ba9
SHA512 40f0ce56e76e0bd4194338f360769c2c698cedd51cd6527dcf70f73c364f7318417e9e9ab9c890dbc77118323ae0d4f9ec2e4d491de1a2ff37c6479effced0c5
SSDEEP 12288:ayPz5L8OM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:Hzyl+jr71UHgLSxqalTfB
TLSH
T1FEF40207B3A030F9C137533589A25A55F771BC3A17208A9F1360277A2E777E19E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ba8a699377ae1baf8d755e972f6446a44c51ee057cfd8ee8ef6284e59728ee00
MD5 c9337bd4dcff5b25a0caf4e25a7d3cb3
SHA1 afae345ce3fa4275a8596ebf687f0216ba6d9ef7
SHA512 f74e9247f9ceadd126960324d0d81300ed5862742b9a71497830137999081fc94fe01c2a8e7953916dca2e7579802910680cb30798c139b4df8fea01a10215f4
SSDEEP 12288:8hM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:8q+jr71UHgLSxqalTfB
TLSH
T1C8C42347D1945D0ECA2623B333F3E6EC9E544E4E750A918B2313320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1620bbe3552cd9407f6a23d87b8b7a78dc5eab67a77c0ae179f0c090a48ba0b4
MD5 eb79312a35bdd0ae660ec0969df1209d
SHA1 58d7e580fa96e83f70e888dc232d32c83168ec4a
SHA512 6df1f23aaf98aa110a27b1f2dbfcdd31ffad2537aecd1a9f55d011cdf5d717897e21b36a3ce2911cc76011e3e2704147baac44dba308cfbc96bd7910b80d2dca
SSDEEP 12288:zhM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:zq+jr71UHgLSxqalTfB
TLSH
T136C42347E1945D0EC62623B333F3E6EC9E544E4E750A918B2313320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fedebe8acbcb1d27116826e01f6252e88567c0c79b84e50dda46f33612c37940
MD5 2e32d312310aab28eda9c0f1dc4fe83c
SHA1 1d8bc832cb7fc911186aaf2d0260074a12aca3ab
SHA512 9566108973c5764f353d86771a6d837aa6da3fe6486e03196652c53a918f7f5e5105946370af81dd1a53465c626b25b10ee22af0d3697d0c13afcf89345ec609
SSDEEP 12288:/yPz5L8OM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:yzyl+jr71UHgLSxqalTfB
TLSH
T11CF40207B3A030F9C137533589A25A55F771BC3A17208A9F1360277A2E777E19E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e7a67149ec63bb2a297a2d3216882237d53ceefbaccde6e564f27c2dcf3e2e41
MD5 f7173125584fcd44559190b3e67b2f8c
SHA1 daa3d704ac07af6d23a8dc14f4383109bfbda64c
SHA512 051f71bafeb8ab56da3c72045ba7205f1740e9db6f5da6536ad9af6d11a24365cee066fc839ef15bb503b1ed64465a034b7a13020227e813321515a5b4fe8406
SSDEEP 12288:MCd91WYoaLHF3z0z04PDvhkM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UE3:VT8aLl3z0zDD+jr71UHgLSxqalTfB
TLSH
T15D050195B3901CF8DD27423EC9A28915D6B27C5A1760C64F03A5362B1F733A11D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f9ea1328d29a889c579ae0489c905e3eb8e587a82324cd06af8c06d0d1044834
MD5 3591e447943322741fc7e996c3b84cf3
SHA1 326284adc346aff18b3b9ce6a0a3f2e911fe5444
SHA512 37c9accda45f2d127d19b1ed9bf52f2b8a88708158d0956d465a15c18255e50e0ad204f78425905c3bced0e85bbcdc8f8973f865f21ab31c64be280b9a73b69d
SSDEEP 12288:xi4e7+RdTfgwCHKy7GLbbdIvjM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31B:x3rd9CHKy7GZP+jr71UHgLSxqalTfB
TLSH
T14825DF90F3E414E8F1779A3589729511DAB67C9A1B31DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 29a139020e2e5a6fd5aa0633aff1784c594898c7c0646729edc601379242a5f3
MD5 3859ae0cf5e90dc613baddb913a162e6
SHA1 4fb4af175053b937ebc374b654c6aff5ac7f5ad4
SHA512 2dc7204a5af9bbd7abc90e507c74e756f9af18988cb19db9915ef281548e3a334b5518e0da57b9957a735a7a4710c53fa9fb1b583a947361ee19c9b3ef7a5d75
SSDEEP 12288:IUM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:Iz+jr71UHgLSxqalTfB
TLSH
T1B3C42347D1945D0ECA1623B333F3E6EC9E604E4E750A918B2353320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4a44d7a0d34ecdd48c64bcde7938dcbebc6ed36ecbb3ccfb96da18007bf88d05
MD5 36cee60c545eecd3f0568c8ade8504cd
SHA1 fa6c9b8c3ddc878b7f6915c3236ad43d569965d7
SHA512 811b008f7e0ed57a74096f61d8e365f11b95df168561ce99ea30d74a0f7c6906fc4bac0e2297dcad1b642980c266bde08e83633b81eaed51afa35abe4552d398
SSDEEP 12288:yuM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:yF+jr71UHgLSxqalTfB
TLSH
T1BFC42347D1945D1FC62A23B333F3E6AC9E504E4E751A918B2303320A1DFA7A94526FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7e7c53ee6f66530c0331b7b8862e8077f9914770959be8f91c27bca29f2e883f
MD5 95ad2a9cdf89e0373266023344c63f5c
SHA1 40d3158946564a77cf1d76dd3ff5230d9976e29b
SHA512 9008a9cd6fdcf7f9b76013c77e6fe637b733510be4dc89a39cebe72bb064762dbe7409d54f941eade43a676d2766a830c911398af11165dd93d159d16647da33
SSDEEP 12288:PjM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:PE+jr71UHgLSxqalTfB
TLSH
T140C42347E1945D0EC62623B333F3E6EC9E644E4E7506918B2343320E1DFA7A90526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b2d170898e1c650a47fc0914beb9d7ddf98bde799893ecc48510aee51bbc4ba2
MD5 a1ad02eb3dcd65bf44942facff955f71
SHA1 0a53203ba90df98a13e71b675ad493bb851a33d3
SHA512 15cf2465875e62a3cf9d0f18fca301130f90225e948c4c5264dafbf11496ef9700d2be066c95648f4f17636e0af891b2400e79abf4493308d0aed21bb0e89825
SSDEEP 12288:ohM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:oq+jr71UHgLSxqalTfB
TLSH
T1CFC42347E1945D0EC62623B333F3E6EC9E544E4E750A918B2313320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d47c78e2ecb64593112e1654176d491c586a62610a1f3c29170853d87a714340
MD5 d51d6b6814c2f2e9810623e30d57e423
SHA1 0ba1bf37dfa5a67574a5cfcfce7dadd43194a1b6
SHA512 6b712b3e86413618e81573156b37c2975e908e259602f3882372ca2f27659a12b21912aedcd64d7a570246d77b53f8a803df4ec2f3f9816573fe5a38d004132a
SSDEEP 12288:5UM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:5z+jr71UHgLSxqalTfB
TLSH
T1AFC42347D1945D0FC61623B333F3E6EC9E604E4E750A918B2353320E1DBA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d90a20c522f8b33dc77c26639d6c749f30a069f5463b1ccbc30ff7c12c6dc521
MD5 b1edeaa3b19b229a3dbea90a6682aab6
SHA1 e57d6d99eb11d9daebc05d982ff2aa8a0d63ad46
SHA512 6d52e6c49888e49ee544dea462c1e0f8d547aacb420299164547ea4204fd1954e2dde63e33da7e788eae009237cbe975a8358a4e9bd322580058a7f7b5d76ad6
SSDEEP 12288:cJM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:ci+jr71UHgLSxqalTfB
TLSH
T1F9C42347D1D45D0EC62623B333F3E6AC9E544E4E750A918B2313320E1DFA7AA4526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 9d8c7ec72864e9741b947276023c1692875f374401df20f6e1cfe8501a9a445a
MD5 d37a091131a5add900bbe4ab3b3224d5
SHA1 66e18c0563570a27b338862c5587182fba9457ad
SHA512 2502247e6afe1063eb09751a098bc561c42c669fa494f7239a4975574f1d2f549a46b4b916097afae22aff63dda4c49feb1aa1398fda24e7e0e863971c711b4b
SSDEEP 12288:G3M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:GI+jr71UHgLSxqalTfB
TLSH
T1FAC42347E1945D0EC61623B333F3E6EC9E604E4E750A918B2353320E1DFA7A94526FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 8d991fbb9871476c23a5d142c1cf71ae462078383d3e2cbd737997ad99607ffc
MD5 4d3b2e75d6db181d0814c9beced88d29
SHA1 b8f7beb805718e58f4602da3b297a1d420099ae4
SHA512 429d6eba1d3eabb7ee76dbf4bf9591f9031144717f68e8f7d0c0d1836768fb6b60af94e206472614e5a8e1d32bf66fca82331c88863dff0447e0521431dc4387
SSDEEP 24576:Nfwvzk9RX6wkyAI++jr71UHgLSxqalTfB:kMnYI++jrxE0al
TLSH
T1E535DF29EBD848E5E177923C99F3860AF6B178591B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1330e4fbe1fa94d1ca4d98e4b3fe5468f6ad273efd218188fbd6d3eedf836a05
MD5 8949d6dedf27fbd89489571bf8989b32
SHA1 2ab40e99e5301726308eb2cceb5ed7b0b6458e0c
SHA512 234680c92ed5733c02a0a64d0a6876f54e4dc2982709e65d4803aacef94f7dbc2be5957ffb7e1e9f1a8648a682c5e9c89a5533e29bd951d5be6247850399cdc1
SSDEEP 49152:aYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0n+jrxE0al:FySzPP+ne0al
TLSH
T1A7066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eba768d0e4b70c27f0b7fcbb79ccaaefff7d96e13edc79fbfce01bcefd5b0e0f
MD5 15ee94b4063ae40a39fb553eb0a2bc34
SHA1 63b0a7a4163d16118ca3919df27ac8d5eb6f55d1
SHA512 2fbd3bddb96f460806e6ca91ffd94a9dfcbb3af478a96a792a9a28ceba4bbb308567ed9540ed2447a59de8b3b73e53b8b4d8eaaebb07ffc5968aac8630f77474
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYB+jr71UHgLSxqalTfB:C47JUQjqirIhCnDHUPfF/3+jrxE0al
TLSH
T1A365AE1EA3EC01E5E17A927885558A5AEA71782E1F31CACF2270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 41b1b9e5d7bd0f2e727b1ea08fdaf400eb94590d18bdd55be71c69e8be6b7459
MD5 48a7d1cfc4fc0e230b7cbd3b7cee4f4c
SHA1 2d5ce8d37e24552bf85e498b39af1a0aa95a3b92
SHA512 adc3ffabd753b7abd1e3011b372fe82a9b41ddc31d37d356476a04b4284a176e8a73b48514159fc0a55241cbfac2327d199111c9322caf09d059ebd871ed398f
SSDEEP 12288:LpsfRM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:8a+jr71UHgLSxqalTfB
TLSH
T136E4F00AD29802D9C02E2276C7A29A44B7337C5997E1D3CB13C1F53E1F7A6945DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 85de526195f5b428602e20302d4200c23fbd2219d8df13d5ad09e7b287e6134b
MD5 28deb1ad5690ae0b08b21e5af07ffa7c
SHA1 71ae41453fcdc5b776a50ef2fbb874a708fdb6d4
SHA512 f09b2e42a47c107c97a99d37eca57a1b17a94a00f4fb1aeac006dea7ed626d8d2f31db0c1a74604e25615eba802f8d05a0c1ad7c798dac65c928d99e439578f9
SSDEEP 12288:T9y2dKU3fNV0lUcd8GOgb4YOTMPKgIj9uAM1Qwvrh:TQ2UUP/pk4YeMPBQ9uPQwl
TLSH
T135452701762AD78BC6A950325E36D6CCA7707D01FE05AF0773C8873F9476668B6B6382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 83d2d7feca6716a24f871516978452ae43323f59219aa8b57104d6218ce5295e
MD5 e484758b3de87342df7f9820da8e0f38
SHA1 27ffa06fea639289bcb751f04888b34ba15e50ed
SHA512 a9b1f7c8c79e289e4bf7f41743ca2a27fe7c7f3c1f14bb2179b0a86ecb56a9a1b93dd23df2b9eecda56868a21c488d374a6ee734d67d7b699650b6f08e564e02
SSDEEP 12288:p1CCKVHLaH2+3IFQ2Lr/KfNcHKYpvOMPla6UGR10qnJpcT+kZJjGLT42i:p1CCsruT4ek2i10qnJp+9ZNGLT42i
TLSH
T1AB653B0169ABE35FC9FE50374632C6CEAB746C06BB453B0173844A2C987657EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a6328980d2082d9b02bac052b177c6633b6dc799e087b888ec7560add9dc68d6
MD5 815fd52222a1594d1481d7aacb915de2
SHA1 92e66a5673492c00fb36c33239b00a148ac7a57f
SHA512 79d6c6221d0d673b673f17cb27644b1896bb2dd6ae0139a182257770b4e588d418fa24f9915e6cdec7ed73c818d73e93d6173556261d81612f4b027d73ebaa88
SSDEEP 12288:SF75M2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:OS+jr71UHgLSxqalTfB
TLSH
T11AD42313D2985D0ACA3A23B222F7E5786A159E4D6B05D1C77303320E1CBABD94D35F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ce8956c984296d504e346fe8fd391ecc3f2b6ca65d8baa0db0989669e21f3ef7
MD5 2d155ec216a1af007749e8a05a54f643
SHA1 174384e867597cf07412a192b9eff08a125267a8
SHA512 cf1316f0dd3a910c2cb1d02f16e6f3189321e09a3b3d4cc92e79ca3786857f3724e3787999e35b0e74c20498c2dbe3e00b04c8251ed9459957e75dd0556c774a
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYs+jr71UHgLSxqalTfB:zgb4mBIBhGFB+jrxE0al
TLSH
T10C65AF1E22EC02F5E1F9E3B89DA64417D6B278161731D2CF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 868396cd4f4053ba291eee36bc588776fc1ae4653729329f88a7ca6428b693f1
MD5 5b559dafcd6202778e00ceff8c27f8cd
SHA1 7b64dc8c647c62c605126f729eeb9db91da2ae72
SHA512 f71e99ca26432921bbf6225dda9100483aaa575d45f008c782335c4109fe40064e488c06e813ff8cd3bce53991d08ab24f5166cd44717d01d2f1d12d0811b43f
SSDEEP 24576:zG88u8FpJqH1vzria7/mx+jr71UHgLSxqalTfB:C7ZFPqVya7/k+jrxE0al
TLSH
T11535F16576E001F1C43BD2388A928667F6B1B8151364EBDF07A88B551F23BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 659d825cfe0e3e8f28c747342afd249d19af9f072dbf90236aef8fa086c3d524
MD5 7ca175bc8a8ebef706b274bd3f8737b7
SHA1 b9a43f0e4395d36fd11d50f0ab8909fcc2f0bc9a
SHA512 8fe3594d280d77e1072e7fa0602299717431a1a5fc0847ed9ee5ebc723ba4899ad7f495f4942292a0efff18b22a73a2f574d420b4ea7f758b32705c5d89b6059
SSDEEP 12288:9HvUrBFrEjwaQmM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY31UEzqalTjzB:9PUr+NQN+jr71UHgLSxqalTfB
TLSH
T15D05F11F62E81CE5E63AA27D8582871DE771B8561312D2CF0291913E0F77EE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bb0c836569ec157db32871feb0a269e159666b3fbdc68600237579eccb407987
MD5 985a79c688e3fc74443a33d1808785e8
SHA1 0e09fa05ce5a5834cbde3a0c3fbdc4bc29f3cf13
SHA512 ac0ae9ba334ef2ba08d807347d5bdb173cc7c74306cc541af2e9a82486527db54cea6191c1d5aa11d8cdad2c6da58701e951b4ba3b603427d325f1dc9391a35b
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9+jrxE0al:FG05lO43b2+ne0al
TLSH
T167D5CF6A62EC11F9D0BBD17CDAC6860BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eebf7944997ed3080ee5d5e3f0a5083a0cb2635e4c5dfa762d5c96655a79529c
MD5 400bfa9b957c8f09aa97f2cd60c2db89
SHA1 a2495c15e1f8a3bf392497791750e9bea8058711
SHA512 5139b80e579d343e763952d8341e9289f7b0dfffc94d23dc453476c1a492e6d5aea01ce0760bb9b748bc545d47e0ad968911326767c55e5b718f447d02e9db42
SSDEEP 24576:sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnn+jr71UHgLSxqalTfB:0a5POZ3lJt2pasx2+mF+jrxE0al
TLSH
T18A65AF5EA2FC01D5D579D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a0cfa6f43c89cf6d769f293df09d1dbaa3fcfacabba83197eb6a183a860d1610
MD5 d79df35ecad0212bb4187d93aa685de8
SHA1 a7c0718379a175fd3ec51967b2da55d3700d7724
SHA512 502fb7a80b97052e74c789b1ea9fbb9f9d402f157297b54c22950ffecf58c295cb2a2b9b65fecbc5969ddb8d2ea51265ea23dc31f8f69b3eedeac4361350875b
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7Fk5+jr71UHgLSxqalTfB:2Nc/zEOVHFE+jrxE0al
TLSH
T191858C1623E901E4E5BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 adab01773306ed7eb9c0a8e8d2a164292f753b8d73f15f02bc220ba12c45899c
MD5 09345eac00effe5438c420fb6a24e610
SHA1 38769ee8cb2e68878f14da8d4e7f9f709983e01b
SHA512 6b70ba4305c3b3b64bf97b45c31b8b66e711d82307020da635e01775fe506a1a6ca8ddbd24afc69d41c543171639c602ccfe3da249ada870429c4059be99865e
SSDEEP 24576:xzkNvNnaFeYhJNtmZBmb+jr71UHgLSxqalTfB:xzMwBtOmb+jrxE0al
TLSH
T1CB55AF6EB6F806E4D1BEC6B58D238512EA727851173293CB5390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5a641ae6760b6707a8f7cd83c9513a8f2491bb05c8ad34e7c687446ae55d2e03
MD5 6e7789b6edec86e7171dc0b84b2e67fe
SHA1 7b3ef7e78218ff3b07b6fd7b5afa9016f69ca981
SHA512 8cce5c5428e4ad9027bdd3eb0a7aaf01c15aaf9a5e115e81a79942326167107687612e7455a38266f248d1d752aceffdcd1027a8f623fffaffa4b4aea4f2cfe1
SSDEEP 12288:WQcMxWDXN1Dp/fshBItT1IQgAtM2weVRtPwUaKpHGur7Zv6crVkLA2MN2goALY3E:sD3FHshBIYQgAG+jr71UHgLSxqalTfB
TLSH
T18025E23EE69C04E4D53BD2BC96A38606E77138AD032255CB02D191BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/264-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/264-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/264-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/264-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1052-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1052-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1052-67-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1052-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2344-84-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2344-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2344-79-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2344-307-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2628-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2628-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2628-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2628-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2860-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2860-127-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2860-135-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2860-133-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2860-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3696-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3696-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3696-116-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3696-122-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3776-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3776-45-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3776-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3776-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3776-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3776-49-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4420-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4420-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4420-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4420-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4420-329-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4420-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4900-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4900-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4900-271-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4900-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4984-21-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4984-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-13-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4984-20-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4984-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5736-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5736-1-0x0000000002130000-0x0000000002197000-memory.dmp

Download

memory/5736-8-0x0000000002130000-0x0000000002197000-memory.dmp

Download

memory/5736-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5764-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5764-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5764-314-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5764-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5764-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5764-102-0x0000000000820000-0x0000000000880000-memory.dmp

Download