d9aa34996e89e2b69e7d094c56498962811ba5fb19d929083041f5eef224f016

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260807-l619essepd
SHA256 d9aa34996e89e2b69e7d094c56498962811ba5fb19d929083041f5eef224f016
MD5 6c36a655cbd5897d65c493202a38dc48
SHA1 bcfc98570470a162ec7502559ddd8e781452a762
SHA512 5e0b6af844212189d0fedda66153a1d0c759124c5f96e609cabc9090713c13fe011c3e3223a6679e2a1d20901f1f33ff29d4cbcd4b9ec414cd70ed45f108f255
SSDEEP 12288:WUYJ9bi+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:XYJ9bTEk962hZqDfX0Fiz9DV854P7JQX
TLSH
T1F8F4012171C184F2DEB3053049B5E6B2997CFC724F6098EB639067AE5A346D08E3DB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4420	elevation_service.exe
5308	elevation_service.exe
4572	maintenanceservice.exe
2588	OSE.EXE
472	PerceptionSimulationService.exe
4808	perfhost.exe
5220	ReFsDedupSvc.exe
1652	SensorDataService.exe
6112	ssh-agent.exe
3160	AgentService.exe
1416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1f7fda5e209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d6edb235526dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b46939e15426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e38f19245526dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8ff4be15426dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3160	AgentService.exe
Token: 33	1416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1416	SearchIndexer.exe
Token: SeDebugPrivilege	5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5312	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 3304	1416	SearchIndexer.exe	99
PID 1416 wrote to memory of 5884	1416	SearchIndexer.exe	100
PID 1416 wrote to memory of 2996	1416	SearchIndexer.exe	101
PID 1416 wrote to memory of 3820	1416	SearchIndexer.exe	102
PID 1416 wrote to memory of 3032	1416	SearchIndexer.exe	104
PID 1416 wrote to memory of 2612	1416	SearchIndexer.exe	105
PID 1416 wrote to memory of 4496	1416	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 83651aabb78f6641f2b977ceb07b5b2256c633edada0786092638d025788c714
MD5 5629c9b7efdbfdd96d69b82be3ebb659
SHA1 3c7d5d6666a9d522c2b922991a2bbca6fef5587c
SHA512 a4c611a9187165dc79625b4a8acafce0f144c245993f09b27e71bd193f5449a2b58f2e0f5be7ac4b26906672c74184655287789a079293178ecb6a78b46600eb
SSDEEP 49152:qb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnoEkoiZqDfEFiJJ854TJQE0:c3q60jBVousfEkW54NQX
TLSH
T1AFD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 56fe67df1df63e15e445a8d73c076d85d8ad4169647a31642bd3edb90bbabb01
MD5 428754ce9bada6a15bf343afb7f57426
SHA1 8a109737deebda19aac0f9a9a3da6f2f800097ce
SHA512 f78bc1c4bc97949270c7773ed5adc20095b138efd46a815adb802e294fd1475d68c268a00eb003e679165ce0d78d1336d4e59bb1f4e52a6c161f9964eb9f700b
SSDEEP 24576:iXYfDtczAfEk962hZqDfX0Fiz9DV854P7JQEtK:ptciEkoiZqDfEFiJJ854TJQE0
TLSH
T1D305F12863D408F9ED67823CC8A28512EA72785547A0F79B03E4952A5F337D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 87351a8edc93fbb6d8e27d32bbba41ace448d8a8e2b310f8b4f95dc9ce06eaf2
MD5 47372e8f16f16d98d69355e47ae57edf
SHA1 97e88a1cea2f4cefb37f969cff34b51c216585cf
SHA512 dda04037b04b88471e59993ef58dfa435179f45fdfbe780bb0f569b2518ff24f4273b15a89ae5fae3f0b7df1fb3bda6c83c66f873c07fb4758a4321504200edc
SSDEEP 24576:y0Le5ji0hmxNrMgEk962hZqDfX0Fiz9DV854P7JQEtK:yPji0A79EkoiZqDfEFiJJ854TJQE0
TLSH
T10D35AE16F6748371D073C0B9C5D2A69AED7130861B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a9a385dc1e25c5d58c0af200053d1292266a28bac9bcd93d6cb1d3703bd7131d
MD5 e305b40f14a966990451a0a54792dd34
SHA1 21f1c56882b3cc78bf86f246e0ff0f3b2131680a
SHA512 d5d4e7d7c4a2f26e6dadeedf4ba7b39a4a3b18823bb6597ccc971e718d47f6ff5e3af8ed77915b68ed23eac15c2fa0fdc36742184f02842318022453df778d1e
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWr6q8wyuyEk962hZqDfX0Fiz9DV854P7JQEtK:W/ezSC6vUzPviHjyZEkoiZqDfEFiJJ8j
TLSH
T1EC755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 43e7909e97b9004608f6bf80f98720e3fc689e38e0f0a22e78a0d5b3f7b87fdd
MD5 bddd27d77e0c1cf01a7756f0c6cd640c
SHA1 ed39dc8474ee0d96fc24678b8f5e846abf117c72
SHA512 531d05004f46d0cc1b6baf8b45da3217c9291ffba806840a7764d8c0772c99b9985a95df00bc9e3585b9af8a65dbb699c49846e04e43643617ee8f3ae5fcf40f
SSDEEP 24576:cVbqPb88hv/l+bTEk962hZqDfX0Fiz9DV854P7JQEtK:cVO88hXl+nEkoiZqDfEFiJJ854TJQE0
TLSH
T180559E65F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ddeb7ce5e1a1785e44db5309a90dac1d5d40942ed7987c3742c7753e46f3b5ff
MD5 ec16356d4d933bd42419c7ae2f38b72f
SHA1 c50abe5f40d7a5813b2380d66ae9c206162d7e5f
SHA512 f6ddd7147f25b4fe5f04282c2a44fd16b0368278450ab56e5dcc702adb2e9ef41bd619c47f8aa5c4c8bfb30bbb770c6b239bd729bc5a8b7b82ed5a5a9092f0f0
SSDEEP 12288:CjUDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:CjUEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1FFC42341454528F5EE730634E4A7A4E768B87C899FD0B9274B91F24F803EB21DD2EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ff7d39d3c6a9ffa79df4895b32b217e4aa521c85ce2857a747379733c23154e9
MD5 114171f105b7f69bb5d0fc2da33860b1
SHA1 2a302fa24423de702a64146295ca395ec22f6018
SHA512 4e4f553594a75f9e3c4aab701e0afa4b0810a44f53cee9160c8ae9d6a52da1bf78b03aaa1442fbe0c6b11a4fcd0779df64eb7278de542a4e479feb2faf87b6b8
SSDEEP 24576:aJIULEk962hZqDfX0Fiz9DV854P7JQEtK:aJIULEkoiZqDfEFiJJ854TJQE0
TLSH
T10C05CF3BAE28FCE2C67A4D785691C240E77278704F51A3CBD165C20EDE236E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bb0e0ded3a74f60c267b57c3d89fe9195f2209831fde9afe5ad3f7e2ac1ed0c
MD5 6b8eff22fdc9d733f34a682692c29687
SHA1 81002a4af5afe2425b716435156ce663bc65c5eb
SHA512 713bdf1fbef07e15c7855ffa981f859c83e2e083de032bda701f8ae3162809184f158ef0280bc0a8967acfa493aabd75af93db9c969b577d75d83c329596ff3b
SSDEEP 98304:CQvGAdlCEL8c/RRNw5CQousfEkW54NQX:TvyEYc/R3w87u8+54NQ
TLSH
T1C6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7d540ca38025c5799c6bef372667ec04f9786f468ab2e3dfe1fc45d05cb1b664
MD5 065f97c26e10a0bf185e9706cd7102e6
SHA1 bd0d2e0f5686fa8d6a9ef18d66e378c449f3f795
SHA512 a1f2cf1b17fcf61aa72f8b8b14c5f269509c70ca0c1c4d7b00240b8f0fa86a06890605996bd5d46e710093c9b4db8b15b3daa94beee2478fecb0cf2f333daa94
SSDEEP 24576:CSewsAjNEk962hZqDfX0Fiz9DV854P7JQEtK:dljNEkoiZqDfEFiJJ854TJQE0
TLSH
T1DB15E031FA74E436C67B0DB21B36C716187C79204F9129C3E3E89A9E59342D2277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f271c6a476f16df9dd0fcbf2f50dc0a526548c2a9833b2c2784c1f75c45c30f6
MD5 4f9c94f742b4a980a69109a514dafa60
SHA1 192e4b1850b8fca6cfd0027edd1b71cf4157118f
SHA512 0a1aceb0444fa9cb72c4e3699d2fc98c7b971187d7a57ee46019cda9b4ddc4c7e5db0468696a98c1493088050521d8f549425e0ba0128245cea89ce1d3ecc450
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHUu8+54NQ:vUEtQevvqc2W1cpV2RI32P8y4W
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 479790f92582e41ae83f9968cd109de5d1da77e824e086c5a355f6cfc66f807a
MD5 882d235b68368efb2809535128a77533
SHA1 d56a8ac67d92abee39a56bd2449c09bb861f3645
SHA512 27f520fff42b52c66cea7cf1cb34d463691b3806e9ce2b79c9a1511016b6cfa2c63ec0dd81644745f483a40046e7408e140f2adb30e7ce041b1a0f98caed3a18
SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/ztEkoiZqDfEFiJJ854TJQE0:IoqtVjnmcousfEkW54NQX
TLSH
T1DAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23b2ba943922777982b2d216b8f11269352bbc0b12aefdcb85e24ad54c2e4bf8
MD5 83c5f6867deb9cb46134c83a5dad8793
SHA1 aede8f8158882b7f98324fad8c528b7c36a7cf72
SHA512 b2959ec3f432f1bcbe4895fa8c1e7669e41d2f2286cde5430f9a63b2f8b06ee98c46f189607e4cc702a3bcae83b3fe6321475b712de0eceac50cf54a758d4b10
SSDEEP 24576:fAhGL2IFoiwtA5l7S53eEk962hZqDfX0Fiz9DV854P7JQEtK:fAM1Foiq5OEkoiZqDfEFiJJ854TJQE0
TLSH
T1CE35AD80E7F955D4F5B3AA7899B69171EA76BCAA5E30D20F2250D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0e146511ee13cdc89978ad5f69bdac68abfd29a304e0d178f94138ae9d3d7dcd
MD5 a1e74a369a92eb781390272585d08efa
SHA1 13c1b6829bd506fbe42f7390eea8e22214761117
SHA512 53ff186ffccebcdd30083bf0a79e35944a5b2113a1256fd17f54cffb951e21e3dd79df8eda0ccdb627b142d15f0a36790d4a107c4f6a50b4ca475c20db639c83
SSDEEP 24576:KwuXOW5Ek962hZqDfX0Fiz9DV854P7JQEtK:KwsOKEkoiZqDfEFiJJ854TJQE0
TLSH
T10205F04666A41CF9E9674238C597C136F7F2BC062A61DB1F07A0C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 efa06bc4005bcc6c8cbca60d45becbdbaebb0892f91441e5e53894a1c82eda5d
MD5 bd91be73385563002aa25159ddbd8fcb
SHA1 cd3179d633103523547371b6a3031df819fd7d0e
SHA512 63f2797b68f5333780c39ff3c054940cd30e22bea5e24f841af9401aed3df11a83dee09751e280fe2aa037da1575eeb56ef6c985b3104f75912e46bfc35799bd
SSDEEP 12288:Q/Z1IydDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:UZu4Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T13CE4124522D434F9E9A30238D8E29586E7B078566BB193CF0750925E1F37FD25E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8949d4dae19e0ef82ccab5478ab71bd1a8e3b0611b5c47ec1042fe4142cbdaeb
MD5 556bd7477f48357e3d7ff235d4019ee0
SHA1 e205dc90189fdd9d3406ee7ca39b78d4358c7182
SHA512 3b36fb580e91c5421a948e3a0b2d7e68043d96e249552d4f4aa702ca2855a5a978686193c307333dbe6e3cf5048e26480cc35bff21066f22d3c4916f42345ec2
SSDEEP 98304:DQRQyi36YOcPhLvw2gAf+PN3ZousfEkW54NQX:SQyiKahX+PNuu8+54NQ
TLSH
T1CD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d9318d2d2a35e79c83560626228b3017b54b564ad97ef954a0fd685f6db007d
MD5 fef09524d48c2524a0dd33ee40d2830f
SHA1 ae4b6281eac2aa8c20d8fdefd29522cce4dc8c5c
SHA512 11541ec2eeddc1881995a9a6db16b7e6d11520877420df936630caea7d9950c5bcad526cbba7391cfdc526eddd66006d93a1fc23976b4c47b94209d3dc29ee1d
SSDEEP 98304:JQRQyi36YOcPhLvw2gAf+PN3ZousfEkW54NQX:gQyiKahX+PNuu8+54NQ
TLSH
T107667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4476fc4861c32152337386c025dc91af3fcd765123d1deebe2a717ae6913f65b
MD5 d11a2012c8bc01589ca534b3ddbc35b9
SHA1 5ae0302a5c81d22b56271f3b054e5eba9308cf67
SHA512 7efd4002ded55da9382b048ddde8ba19528f53cea3a8e30d8beeb6de2daa30241ed9914dde4dc7f2ef4b68ced3a251e76ca6a4cc3d3a188a48efa517515644bc
SSDEEP 49152:n68Qg55nhceWu7PNU3/9EkoiZqDfEFiJJ854TJQE0:RthLRc/jousfEkW54NQX
TLSH
T1D1B55A33B2F200A9C44DE1769F4A973196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5dbf632752909f86cf5ff6902c78e9af8f04f8b036e29a231e114bbf297177f2
MD5 f6a79dd28742a6fafb4c4de3940bd5a5
SHA1 d520ad046dce6d03aa7fea9519d14f03b63793a7
SHA512 bbbd10f1ba1b47b49d18e397fb6fd858bf73141adfe2ce5ef12f4163e307340e09ab9ef67293ba7c5bdf302ea336aaf30380074c412eaf4f2305651c92d9fc60
SSDEEP 98304:ty5112gYy5azzVva69nLKnhZmousfEkW54NQX:QLIHjWh3u8+54NQ
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1efbbcd1961926dea5d930a9bf9687f0fae5636c6fd1656f187268558ea951f3
MD5 3304af5744d117f4ec13a0f11aa1bf2d
SHA1 a945fbccb4abf6befa8aeedd76299741fc00ba50
SHA512 8d3272a412644e4519a93bb15931f9e9e415fa069e54efbc01e9d8fd9cbe0e7dd3222a2bf628281caa3e5f3fa0356b033af17f06f96ef61268027598358bceca
SSDEEP 49152:SB+taZ3usBWOBr4tEG20bqx0z+n217aau1glPEkoiZqDfEFiJJ854TJQE0:gu6JmUxd2dRousfEkW54NQX
TLSH
T1A5D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 570cb1ac23471859186548c2a8a7a9543e1efcee660b416a3ec49dd30846b901
MD5 2770416962c502d686a2c9609b7a0f10
SHA1 24a283a128a144483be79ae7ad08503f1f81df4e
SHA512 bae0a34a41fabf95e534316c68f53682d5e2b082dbb46eb5843ad60cd46c7983282c666d32e9e625c25ba9ae3c8309aeb733c0f4932d331262786103dd607f17
SSDEEP 49152:G1hpsNoJpF1A6BU44CwH7R4xrEkoiZqDfEFiJJ854TJQE0:GmifPkRcousfEkW54NQX
TLSH
T1AAB5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8b3303fd13b121cc28c4bc18cd43d19729c107fad24dd0dba9d4a1e1966b482
MD5 37da91ce6dc0042f1a2750e0d9a1eaed
SHA1 6e7aff0fa605c1914767dcb8233cb267170bf28a
SHA512 b706f41cad2e23e9c76f7f42455c0c68079cbd88b3f1eea95a29d1202e37464ed89b517260037830aab87dad68226d2ef071400975a0e85d4fcd3434b83077c4
SSDEEP 49152:USuZQIY0Be2KNRVtOnks6NMHq4EkoiZqDfEFiJJ854TJQE0:G5dKvi61qousfEkW54NQX
TLSH
T104C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6f5f8670fec614e989546bdcd31a08422edf676af927b377ee2fc92c683e194e
MD5 47de4e20b41fa4d81cb46d2fcd1c4b10
SHA1 788875ecb2207842e9efd39fd151e31448d7d59a
SHA512 36aedd832be451933410d021b5d7f7a57c377088672c171752634a4b06761c154cfe73546ab9912dee8603bf0307afc73473b79cf10d423565f8064188dc0b9c
SSDEEP 49152:WhtSn8EApI0figXgiDn0AP5wfEkoiZqDfEFiJJ854TJQE0:3X2iyphYousfEkW54NQX
TLSH
T13F95BE13F2D900E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c91020f58dc255c827ad2b2286ae64ee0a6ab42c31b8699ae1c5d42382192fcc
MD5 845b7a6e50f53f27776fb20e28a2ed96
SHA1 7514523f42305b08c7b102284247983ddad0ccdd
SHA512 b681e4567ada1108f8af395f86510e284376f45b753b4c1d06ee2282a38635e98311d52e33051e5799df72988c967dd4eafc34cf93f0572f90cb2d81bcedba96
SSDEEP 12288:csDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:csEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T12FC4234144562DF5ED220334D4A3A0E7A8B83C8AAFD1B52B5781F10F917AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e536414995fed7546efb8095839103e291ea5f214f8baa3c19018188ef9ed23a
MD5 571bca1e054011f094c3e355a9d3a1d2
SHA1 0ddad508e8244089299cb1c6ddc290d7842e4788
SHA512 38592b49a7053def17c6e5c4db0f2bf957a1fc471d822f88b622f72feed947c48411462f34c2c41f9cfa0b6ef4dbc44a88d7f144b03ebee8dc3508499fb7815f
SSDEEP 12288:RhDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:RhEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T198C4234144561DF5DD220234D4A3A0E7A8B83C8EAFD1B52B5B81F10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6e8e8cc2f8342a44a2e048ad584248ffb392bbe89db736790947afd7f2517fef
MD5 385d7bcad7c9537f5a4be1e0537bedc1
SHA1 12ea76558dd4424feccc46abe0145de34091a6c7
SHA512 d3b24f969b3eef8f261e85b63c7cb0a0dc63cc265ad48815bece1449992f17653cc7a57f281b79b3aa2d3a824d6a9caf938b1937e2f76912fca1e7a8013dcced
SSDEEP 12288:8DDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:8DEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T143C4234144562DF5DD220234D563A0E7A8B83C8EAFD1B52B9B81F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 78493224802d0da8a48bbd0d2ba3f41a40a4d15cf56dd31949aa9ae7d95e25b3
MD5 e7bac9cb4bf50fd9d7f6365c6377ec0c
SHA1 56f3bd0870fa8d0bc935774248ec5efff6ef2f62
SHA512 21b579d5d00635d6e98ce7417d9883904391c8dd1f57771ed0f0e86b75399c5edb5eb58cbf3dc8a84bf1194ce7ee592dbb718a1e07ad59da2b8db4fe36bfc0dd
SSDEEP 12288:ZV+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:aEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1A7D42341069618E5DC734334C4B390E7E5B87C99AFA1BA6F9B40A10F4A76B305D3DF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c253b89cc9997c7de4abf5b1d0ff874602fe7357e85cc96b3ca1e8ee687568f0
MD5 2e76b197265118e86999628ac74bd8a6
SHA1 aa8003c05531b683178e65640018c01380d51095
SHA512 adbde741981f85e27cd51e9ff957620c43b0c09aea311f2f562131baf28d5c457ffb41cadd4ca06de568c3f0733a3851b1741f208adb1ea37931d5c51b8b6bcd
SSDEEP 12288:2GDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:2GEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T172C4234144561DF5ED220234D463A0E7A8B83C8EAFD1B52B5B85F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9e10d6dc93eaac287f41619ec65c6837731c87fff06ccdf0da943b705ffed3b8
MD5 64241e49d464e45ddec9bebdcc0bbd3f
SHA1 66275fcff2c40bb1f3a285880bba0598d7acd2eb
SHA512 ff70a0ebdf3e9e0e6b4b1e4e38875d2b901cf6cb3758716cab50970a22dbce304d53124b4f4afa208ed06276b45621674fe3839beab2dd1b076f0b33856478fb
SSDEEP 12288:3lDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:3lEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1D8C4234144561DF5DD220234D4A3A0E7A8B83C8EAFD1B52B5B81F10F927AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 8f84517a7c5a122d3284eee7ce86507952dd0a893658ecd1fd6e51d010d7dd12
MD5 9120d44ff7769600b17b71631a371823
SHA1 9905b6b18abc85eaf31d221db57a279c58628e70
SHA512 907fbf94501d6b229e8a471a03e09274923eeaaa93a0f68e9f6f099186043beab588bb14c60ce5fe293be972cebc32cb255f48d1f100f8d1f309ad3021387170
SSDEEP 12288:YpDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:YpEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B8C4234144461DF5ED230234D563A0E7A8B83C8EAFD1B52B9B81E10F927AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 47eca3dac9fbf204490d286b2bb6339fe8d8a5feb03b2cc9dfe86ba7051411ac
MD5 d47eea286e605e73889d4f4eb21da35c
SHA1 66696cefdff2f58a11f5b689d58c2189918799d9
SHA512 9ec8667e71be10c66868583372ea6c6e8cda8854cd1bc9733507c327f282ce0628e0ec62b646a3058a1ced6f5ef9f0e075a7504d886f26e41795a2fdffc3cded
SSDEEP 24576:FZMMzFVSOBEk962hZqDfX0Fiz9DV854P7JQEtK:FZMMzf1EkoiZqDfEFiJJ854TJQE0
TLSH
T1CE05F195B3901CF4EC63423EC9668956D6B17C5A0BA0C61F03A4322B5F337A11D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 01697ee16f525436fa6cf92090c18f418c2a2ddb940eb869d49ef0956af4d22c
MD5 1f751bd1d89ee6e9ce233b55ad8d949c
SHA1 d1a269cc895e1fc6d2a95b43f75d9bbc57636640
SHA512 8b6fbe82cd1b614f59e3bcc5c8f1e3b8e5196ad64b1b07f49eb5022a8c25266517cdfde3325558d3b7e4c75cd54de222b26e232053207a8479af0f3215669596
SSDEEP 12288:SIDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:SIEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1DCC4234144562DF5ED220234D163A0E7A8BC3C8EAFD1B52B9B85E10F913AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cd91810fbe07463e89fa1a3b3b81eba88ae97b8147a4353f4c0aff3888870f45
MD5 fa58dfa8f19d19b86eb399df89932382
SHA1 23898ced3f9dbe915fdb4efca3edd96580c43f06
SHA512 7f546a11bef21d59f9cdfc07c05024e4805dd66b8b8ff92e0edf606360c3480b5e51f022f8eb16fec40e492c73a8dcf0139ca3f156fb3fde816d6d6441ac75e1
SSDEEP 12288:MkDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:MkEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T19AC4234144561DF5ED220234D5A3A0E7A8BC3C8EAFD1B52B5B81E10F923AF315D1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5daa1df5a68dba5137fd5c208ca77c047c8d731677047671114e925261350a4e
MD5 72ac8e113cc77bf58b1169ef54702170
SHA1 55d91390e7e5ce97bd231d8a36e2e2260bee998c
SHA512 537ca8f7b9101a5d48c065c524eaa55c50ef366249d33a6b96c48cf351d07b455a06d8b0aa4aaa081f65541e9972438dd32ae6914359a2f9cf20fde1b41a35d5
SSDEEP 12288:MyPz5L8dDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:VzydEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T167F4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fbe16afc37e6fbe8bc475a0d821ee935cb0a9db447d576b589c7506dd199d0e7
MD5 495c8e7bd6122541a948e11a36e6b5e2
SHA1 3de2eb8e09eb1c76645ecf9dd2218d17691d0030
SHA512 be7721564665cb98c86ed1322d155f2e654981e70aa3115b5cd053a0f52c4fbae4d102262fe3b9333d15a021665dfd4304d58b787348f6fd707532c988606e89
SSDEEP 12288:OIDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:OIEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T193C4234144562DF5ED220234D063A0E7A8BC3C8EAFD1B51B9B81E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 596124b6f412ff832dbf7e4f145e5c1724a2c2d2354761bac78087292c7cc158
MD5 5c6447f067fdd7552aaa24c42dd0f840
SHA1 6a057e70c7932d78d569f60146296a07da58875a
SHA512 364205f2bc5791e59371b6ff410f5c7cdefbc021849d3ef81a45f780d3e4909f30a89da9707eaeb600906288fc4dea409bd28f6c241738a5a01cb30d4f35b2e0
SSDEEP 12288:PIDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:PIEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1F5C4234144562DF5ED220234D563A0E7A8BC3C8EAFD1B51B9B81E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 bb4cd21444f012c8e463eba76b728fc69c82f34be6d35fde346443d7d254c480
MD5 53e00cae73466f1a0cda50c7eec22fd7
SHA1 10b2b15722ef9e2d2ac2028f36e2c0a58a60f076
SHA512 27b05371fa9e134cfd7af9e666ac1d16276e8a3f089cae70d7e0e3efa4c63a9564dbeca165edae2688fbd8e47365b3273261cd15c758be32a607ffd6a94b8e64
SSDEEP 12288:dyPz5L8dDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:UzydEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B6F4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 547d7fee245c2854033ec51b49de9556b08299704847099ec21fecdc89ef3490
MD5 2c8bc03b8297270181a98d82b3cebf59
SHA1 261c9d005c0bb88e87f86b748daf9dbda1c22358
SHA512 723b524fe87578c5531f5a5d57f8564a9b5bd4a4f387a8cf0a6d5c1cc1aefa125bb853802b31bae7f335badbf29a95548492d505caad529b9be0eaa971d4ceac
SSDEEP 24576:qT9aLl3z0zDzEk962hZqDfX0Fiz9DV854P7JQEtK:qTQLljyEkoiZqDfEFiJJ854TJQE0
TLSH
T1F105F194B3901CF8EC63423EC8668956D6B17C5A0BA0CA1F03A4366B5F377611D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 68a198baa9f8b3344e73081c0750f344c218281e031e9532e9d7a32bf4f66bea
MD5 77d3726850c530b0d114737e08e028db
SHA1 aa2a292bada9f694a532c4bc5132026739eb2e48
SHA512 6566ac468320d40c6b3e7e2a6f541fa8fa7deea7959caa8f15d58b80507d4bd99ab3700b7eb9c46c69773eba8352f95072233620328f0972cc80793382ddc320
SSDEEP 24576:K3td9CHKy7GZXEk962hZqDfX0Fiz9DV854P7JQEtK:std9CHKya1EkoiZqDfEFiJJ854TJQE0
TLSH
T10425CF90F3E414E8F0B38A35C9765512DAB67C5A1B61DE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9b1f24b440783d05d6eae074e267c367d6296a553854a1f613fbd58bc1744510
MD5 df106b48c9542514224092abcf0e7426
SHA1 ae49cc686664ce716c2fc1bcfa6e1308e9d02556
SHA512 8364d04589272595c5123d8896c061ab364055f3b6672ab053320b240f933ce49e4b8b791b149cb0fb5401897137cb308daa7404877a793c3d5977ff3b62ae2f
SSDEEP 12288:pjDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:pjEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B4C4234144562DF5DD220234D463A0E7A8B83C8EAFD1B52B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b76457187b7d2f06c17a818612f4d9c4f8d1a228721483495b989c479771852c
MD5 f466fb3f7ecc66e7a560c19765bfdf11
SHA1 4a3b39db697ebb15a9d0ea7a7380eef2fb3f26af
SHA512 dfc7ee49d36240453244db9161d288537113440f4d40b354d6de53f207f0b78c829be1ab9ade0c250369c301639b89a502f4cfecad0830c1d00bda158db42f56
SSDEEP 12288:m9DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:m9Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1C7C4234044552DF5ED220274D4A790E7A8B83C8AAFD1B92B5B81E00F927EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0db780555015a2a0f76e1fcf19cf7b73ff74e50ad6999c63ed9ec1cb40f81ca7
MD5 a0010053a2971241088c92e496e632fa
SHA1 7f1914b6095f509bb5981d9f97477523b130786c
SHA512 5458ef6aeee055ad4b2fe7aed48e28d6d13673289601d1ec9ddded6dae9c3c79ca51635c5393796e3470cab335a2631701ff39b43d2ae3e6b503d2e969514812
SSDEEP 12288:D6DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:D6Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T187C4234144562DF5DD220234D163A0E7A8B83C8EAFD1B52B9B81E10F913EF355E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ab5f965246956df6908a2643a78fc2d201b9d44ca069190feff3432cefa9d532
MD5 49021a50a1b31ceed311ba61f19fb95e
SHA1 8a661660ba3645e0c40a48a61b68fedbf709546c
SHA512 f5cac4c02396ba29c19b803065d005f0013f8228ba36d79755a786875e2e14e8d40e64972d7436bc5485b59067652944d053a1340101298909479b4bd6869b33
SSDEEP 12288:+IDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:+IEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T161C4234144562DF5DD220234D163A0E7A8B83C8EAFD1B52B9B85E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d291a1094a9515b62cb298df0983642f21299ade2374661c4dbf00358fca7fe6
MD5 62139603928952501b55368374a4cfb2
SHA1 07f71c32baa8f92669201d0fdd49000a04c1e277
SHA512 576928919cdb48634c28b0d1aef606d68d7044d04a4d626baf259853e368b1433342a6888f0241bd99f7cc7f9b35fa8828dcd219b785c46dc64817acf3e44519
SSDEEP 12288:ZjDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ZjEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T17BC4234144562DF5DD220234D463A0E7A8B83C8EAFD1B52B9B85F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 c8c730bcff8dbbfe3b89229ee7482b3b74ccc5349fe135494a6bd87514ccced9
MD5 bb358694efcdeb9d9378850afb2626e3
SHA1 952870d08d8ff633a7bc8646f1dbe2c86b7527ec
SHA512 67a4cf45d7b121e79d6d1aee5d3209ec6b725aff516b8ee8cacedca44739197e555d7091a365efa06386c41674e26621bf6b72cd8753ef805a7a2cd9ff5ef1ca
SSDEEP 12288:yQDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:yQEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T16DC4234144561DF5DD220274D5A3A0E7A8BC3C8AAFD1B52B9B81F10F923AF315D2EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5e99d0ed760a1e2230148c5f46bfe442ded79bd9003859fb611c4f65f541b80c
MD5 47c9751d626669218c6b9247a28c9251
SHA1 53ccc65c3826e4361edf838308b9dd423c9bc2c3
SHA512 d0d6d3ffaa98781373d96a6a125559b79f7a5958befb8ffa7c5b20a88a23854b65dc76e02dcc7471b5dfeab29509fd3eda5f5ae65fc0f60aae228410e8d9d7f9
SSDEEP 12288:DGDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:DGEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1DFC42341445629F5DD220234D463A0E7A8B83C8EAFD1B52B9B81F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 190fe1007175a944e4f02bb91f0445225c71bb1bd57a025c0d777a99f773849b
MD5 35cbd78ab64fffca7c6dcb327478c821
SHA1 4322d1f314cf9338873e7dbc15ee4e7e3a3487cb
SHA512 d464bfabc7c311ec650a675a2276f344f5ceb1be634f76b938e04903490b54d5dae6bb5ec7635cd4b110368df225adaa1e7cf1274d4fecd73c4875c213198f93
SSDEEP 24576:Jfwvok9RX6wkyAI0Ek962hZqDfX0Fiz9DV854P7JQEtK:HMnYI0EkoiZqDfEFiJJ854TJQE0
TLSH
T14B35DF29EBD808E5E177923CD9B3460AF6B178591B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 50cde0ce5a617a52721f4d49a44624057a78d9361c2eb4b24f2ea8db78654e31
MD5 99f941ad4494529240a093b8cb4e54f9
SHA1 b02b738078885e2701fcf8f2827201057b0858c3
SHA512 cedca4733bbc3e288dcb08c71ced969d88883fb84c8734ae455ba2a8a6330c90729836a0ca3c958051038821c9ee48efdd950b7a364b4122b19012b2dadaf4df
SSDEEP 49152:sYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/EkoiZqDfEFik:kySzP5ousfEkW54NQX
TLSH
T14E066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98cf13d0e2235375eb2cb12a89c98a99a3c517ab91b7e60d28a0155697967738
MD5 b68b84c64a07cf0286d6385c40edcf66
SHA1 bf60b4f89e4c7b16f535ab764515271129aa63c0
SHA512 692d8e1ea5e3fcd2fd66876830ab588e06d30e3522fb47d28cae40780e5d6eadbc4e83e0cb31cd3e87c683cf50cf787ae68fb64c4b9ced29d40484ab30129390
SSDEEP 24576:r47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYREk962hZqDfX0Fiz9DV854P7JQEtK:r47JUQj4irIhCnDHUPfF/PEkoiZqDfEd
TLSH
T18765AD1DA3EC01E5E1BA827885158A5AEA71782E1F31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 38b53540a127d0aca7cf591cf277df56407a322c56df9385af4880d173f801eb
MD5 7194868b25c70bfe18bbb170c9e8b64b
SHA1 4f73b88c1ba90f3d6f29be6f66f7fe02f3d6ab1f
SHA512 95b5dcf756ab07b90815c6ac0e5db0561582fd00181741e2e306b2d25db7d93183b7e732f647a20f0e254a9815be83474346f8753f453c5c6a1d6deb665c21a1
SSDEEP 12288:3Gsf4DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:F4Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1C1E4F109C29412E8C46E5235C7569682B7773C658BE1E3CB57C0F53E1F3AAA05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2e385fd6bfdf78baed913560ccc41758491a9a64ae561e777b2c29790c1d7bbf
MD5 348af6247c90beb27c6eccec0b4b74cc
SHA1 e1bcd032d4e8b4f6b9baa70c1b38b266f87f8a5a
SHA512 18fd5f08dec4b531ca70c675e451bbe9e177569ded8509db127318181c18a4ef4120426c1343036204f4e35c4312ce76f31856be35a930092a097553399d72f7
SSDEEP 12288:+3kXU3fJlz8l6w1JNnNmJPGS6fuoiHFg2NTnlJ0:+3WUPJts6hvitilg2NTQ
TLSH
T1BD352840766BC75FC6A940321E32D1CCAB707D51EE046F0773C88B3F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 edc66816400fd4aa522eb4f0f873932d15770711731eb907e2fb6979582f388b
MD5 aa358aee0cb1b178b9ab267546b7b4ed
SHA1 a67b6c022aa055c627193632f02e37d24e7240a9
SHA512 d06e33fbb66b4d974419a006d02508230f70ec83d80daece512eb3dff38660fea29f4e64d0d5599610d71529bd8aaba4a6741363ebcaf626ba59ff801d1ade3c
SSDEEP 12288:88geWLzZvlknH2v+MkrHGrtDJ0N75CP7VWc9nFPY:8FeWLzBj7VN9nFPY
TLSH
T19E75FB816137D38FC1F7503203265B8CAB64EC16B7496F26B389453AD86BB25A1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 87521ac997f974465e26c2bbab3efd909ef449ed3c7152d772c6194c5bb721b2
MD5 d0f162e16bb04312002b8049ccced10d
SHA1 396f48a657aab554f1706a6b8d23cb11121bc9c0
SHA512 a7630f5e069b0204440f0bc1a6942a979d647acce1267e92b63d7ced60a1945bca45b0ac6b2d3fe37af6d7ab185fcb99f6711958a5070670d8d8d05016c44e1b
SSDEEP 12288:sM7ADIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:tAEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T13BD4230141992DE5ED720230D06B90B7697C7C999F80F497AB41A24F913AFA19E3EF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1b723829cd261893b72bbb302e59b12c507a37def06ac52f189567d43fa956bd
MD5 4c531cfe4a57bac574c7a7581676c2a4
SHA1 431abe48c57de0ee839d2d4f109dc1af4866116a
SHA512 4b5f3d5545951e81defa7771e5a8cf2386b33793f9c53835cf19448033bb9bfea664d5da2e8af60364ba940d1d3b93f2684761199bfb170c0de3848b44315213
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYyEk962hZqDfX0Fiz9DV854P7JQEtK:Ggb4mBIBhGFREkoiZqDfEFiJJ854TJQX
TLSH
T13165AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 99fb2c0f98304f4ef83efd08f26ca8c2affd00b916ef2eef10190ee16d979eb9
MD5 4307b2f01a70827e5c3c4f4acfbb4616
SHA1 6eda499c37235c0e8bd02058bd2e52f63523c1e0
SHA512 93016b6948df75bf564e13ab40618bbb8dcdc7d478e6338a7e8b106f29a25f648dc924ef7b146c96774c4c0de548c5cab0b6bd4f28a84207adca00d84f4a18c3
SSDEEP 24576:tG88u8FpJqH1Wzria7/mBEk962hZqDfX0Fiz9DV854P7JQEtK:g7ZFPqVha7/aEkoiZqDfEFiJJ854TJQX
TLSH
T1A935F06566E101F0D877D138C98646A3F6B1B8250360FBDF07A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 59dfc0c6b1e47c2fbea2a3d921582f25a687b065ab366a973fa38cdb78277615
MD5 46f7a6bff65cedf75bfa65ba52d1f95c
SHA1 cccddb37def05931a04c560a63cf8a032962615d
SHA512 7033d9066a768d70091249a805107f32e81233014a84fd70a1d5fe3d656c9d85cd1773d675d55de2ca5b9aec0a763d280a9ed315bf9dbab2d1fe4d806813dccb
SSDEEP 24576:lPUr+NQ1Ek962hZqDfX0Fiz9DV854P7JQEtK:lJQ1EkoiZqDfEFiJJ854TJQE0
TLSH
T10705E11E22A91CE5E676A17CC582861AF77178621711E2CF02D0817E4F37EE8BD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 99075ea3248e44545b012b274248fedf35f7de7923b74e6fb66461ec12370289
MD5 ee3d054079f90106361df08a621ed32c
SHA1 3ae750a803f1bd1591c11c57b10f36d158a5ad61
SHA512 7fdfffc9677b06af94cf9006c77f015d87339f9307411d013b22bc265c960a921f7b916f7119f01c44823d33aab48d7f4d6800da8078c8936ac0529262b26f32
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlEkoiZqDfEFiJJ85V:oG05lO43buousfEkW54NQX
TLSH
T1E1D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 27e36ac5f668b97041e7c830be0ec275f50316752829c6d4d420197a865174e6
MD5 5a278e8ac9727f8c1045442b9bdd4d5f
SHA1 4bb00160851871733214070716152c22b6295b56
SHA512 4105cc3a7815be10565be042a881c1d29045ce74b853ab56a42335e4b3c4a4433db09737e06da7207a6c8b434110247cca79d8b19beff1f0409f4b2d6caed4b4
SSDEEP 24576:mfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn/Ek962hZqDfX0Fiz9DV854P7JQE0:+a5POZ39Jt2pasx2+m9EkoiZqDfEFiJC
TLSH
T1C865BF5EA6FC01D5D5B9D17CC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a8f92d6a3fbb45d060d90802b4694d1f4af1d31d3f8947b257a40b8e5194852e
MD5 096bb69464282035dd30a071d66090b1
SHA1 95d9e00b5e733355378ea05c3a0c086d6f7aad48
SHA512 093cd1784603d96e3ca92335f95c7d27d211b47ea4413e817618f087440a59f55ff236e3b478885ed84391cfffa635353ba00f85d5609dc5fb0970b22e6affb8
SSDEEP 49152:KNc/zEOVHF6EkoiZqDfEFiJJ854TJQE0:7IASousfEkW54NQX
TLSH
T15D858C1622E901E4F5BBE1BE89779546FA71786917308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29b52f62421ab8ddb63917801bd536877f978fad199010bd3ebc90c69ff26297
MD5 5c9cc35b85ab1b8d370662547959ab11
SHA1 09dcf82b99ca525f981bad943351a93c6cdadb0a
SHA512 9844665647a56ac850161f6f16b47476233de190d6a63cf6114c73f1b5841fd3922f0fee29cd80dd30242c61a10e783d45c4b7fcfa436bfd54199d264559d565
SSDEEP 24576:ctkNvNnaFeYhJNtmZBmbEk962hZqDfX0Fiz9DV854P7JQEtK:ctMwBtOmbEkoiZqDfEFiJJ854TJQE0
TLSH
T1D155AF6EA6B806E4D1FAC6B4CD238512FA727461073293CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e93908a7a1b8104749ba5d12f8a4a962d9d939bd9471f4cafd02a19e22d669a2
MD5 d5f307499a515baab26e7c42917f1ad8
SHA1 f0486bc14fd326948c2ff2cfe9b22b9a18b94326
SHA512 594b70f6749cca55724a2c205c528e3e93b0e916fdf145f84a6ecf27e05571bdd074e48ee4d441ce2cb023963fe92d1181b759554154d18f7718b8941110d3fd
SSDEEP 24576:HD3FHshBIYQgAMEk962hZqDfX0Fiz9DV854P7JQEtK:HDVHeBIAAMEkoiZqDfEFiJJ854TJQE0
TLSH
T10625E12DE69C04E4E57BC2BCD6638906E67138A9072265DB02D0C1BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/472-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/472-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/472-298-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1416-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1416-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1416-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1416-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1652-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1652-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1652-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1652-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1652-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2588-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2588-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2588-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2588-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3160-126-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3160-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3160-134-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3160-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3160-132-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4420-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4420-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4420-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4420-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4420-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4572-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4572-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4572-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4572-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4572-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4808-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4808-78-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4808-83-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4808-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5220-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5220-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5220-327-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5308-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5308-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5308-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5308-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5308-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5312-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5312-76-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5312-8-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/5312-1-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/6112-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6112-115-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6112-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6112-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download