f8d3f0a80f0dd2b8ab1d929437e73c1421b667a59f76ead898413b1b418a4598

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260808-rcwdzasshs
SHA256 f8d3f0a80f0dd2b8ab1d929437e73c1421b667a59f76ead898413b1b418a4598
MD5 f589c16f15c7bb06a16eaf3f9758f86a
SHA1 2b853ede0f24f0ec9b9752fad125ad47c0c79ca3
SHA512 8358e516a9341a2b1ed97319b7bffee051f03036c170be573211bc5bf78ac32098a73f3659486b198a3855e6446849c99f88f4113c2211e02fbb5258896aa885
SSDEEP 12288:2UYJ9biyUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3u:3YJ9bvt2rR8FfBhRJUEbDk1ulUe
TLSH
T1A9F40221B2C084B3EAB3493019F8D771553DFC761F619ADB27941B7A2E306D09939BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4216	elevation_service.exe
1228	elevation_service.exe
2904	maintenanceservice.exe
4884	OSE.EXE
1184	PerceptionSimulationService.exe
3960	perfhost.exe
6096	ReFsDedupSvc.exe
364	SensorDataService.exe
6004	ssh-agent.exe
3360	AgentService.exe
5984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a56319283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063d679b83e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d0f4b73e27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000563e1b83e27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cfc01ba3e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e7395b83e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca90cb93e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe
4216	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3360	AgentService.exe
Token: 33	5984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5984	SearchIndexer.exe
Token: SeDebugPrivilege	3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3948	2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4216	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 2316	5984	SearchIndexer.exe	100
PID 5984 wrote to memory of 2096	5984	SearchIndexer.exe	101
PID 5984 wrote to memory of 944	5984	SearchIndexer.exe	102
PID 5984 wrote to memory of 6124	5984	SearchIndexer.exe	103
PID 5984 wrote to memory of 4188	5984	SearchIndexer.exe	105
PID 5984 wrote to memory of 2232	5984	SearchIndexer.exe	106
PID 5984 wrote to memory of 2928	5984	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f589c16f15c7bb06a16eaf3f9758f86a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2904

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 64d750eb9f6978a3cdbff6bfeb69db6f8a478d4ace71b6c49bb9ac88b9892780
MD5 85788b7142e249b64a5a028e3914676a
SHA1 e781069c650342cf67cd50386cb3015af6811a8d
SHA512 0cdab0bba2e35f6acf1a1deddf0bd10bd8dd27b6a59c703ce9678b698e5f0c435b788df30cda792eede8b18e4070ef0a3b6ca1710ce885ef6eec1a73d97a1e45
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyt2r4PRSEk1ul:u3q6HjBlt2sEE5
TLSH
T1AAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0273b537eaa68c93adbcf7c91680d18ddb22339f5b5dff2e80454829eca28341
MD5 34f50f90a7d8be5b89199f328408758a
SHA1 f9b01c9aba0829622150ec4dcbf34b9c3ef3737d
SHA512 671299cc17449b6fee2069d9e9dae67d9531d4167fe76d834154c90b8cf4bcab77fa7598263b4548e1cc048246ae5d2b3ea92ccc8e5b5f275ec41887dbffc820
SSDEEP 12288:v1XLsswWkxy2lRq2czApUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7H:NXYfDtczApt2rR8FfBhRJUEbDk1ulUi
TLSH
T19D05F129B3E408F9ED67827CC8A2C511E6337C4547A0EB8B07A499351F336D85E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a40096436be76de2f6065190f0658bae9e87c8028cbfb7bf63bc7d985206e5e5
MD5 9a58c546dcdb1f8cf6198228c62bb0a7
SHA1 dae3ad5249976acb715ec1fb3f31208d63e0ab91
SHA512 6109e28d7345bc13c13decd00245088b9107c236096168eeb3aa2cfa43f1b5d184121e0c28fdd4d787a7259f0f4c397995ac11deb986fc4acfb6dfa7f4299da7
SSDEEP 24576:W0Le5ji0hmxirMKt2rR8FfBhRJUEbDk1ulUj:WPji0AcDt2r4PRSEk1ul
TLSH
T1AD359F16F6748731D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d7591040c552db008abb9e06ee37e97645f5cfc9e1bba531183858e0ffec495e
MD5 5414b6c539e111ef6c8c72e76b85f1c5
SHA1 136ce161cc93a3a60273d11df454275a39a0a3a4
SHA512 dcd5e1cba15594ad8d7386d20a95c1ca7828dbe61512ee3790b6c3d326c81652acd222ba52f16b5fe4813fe0d7a09936810993f0c58728f94482e2b2cc87241c
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuIt2rR8FfBhRJUEbDk1ulUw:C/ezSC6vUzPvxHjynt2r4PRSEk1ul
TLSH
T151755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 462e73f46b070c2f1dc220ce9908cfd76c0e27a66dcb815a9fb26a950d627a93
MD5 cee17bc182d1418ae2017e6e29dbfb80
SHA1 5ecb2087b0713c2c3ea8dff295c052e84dcece3f
SHA512 21ea3fdf30e5edf4a5222fdc3affeb0c5b4ce514a3cde74aec895c64cc24c6955a0316b8a0f83cf4b111b561e9923a51e7da82946a0ef6964ef70d44c7923bf8
SSDEEP 24576:xVbqPb88hv/l+6Vt2rR8FfBhRJUEbDk1ulUd:xVO88hXl+ut2r4PRSEk1ul
TLSH
T1F1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 40199b7fdcee2ca783e78f70689543cdf6449bc8d719cd87a9850b2d90829228
MD5 811db08ad6ad100e7b34409c997c6a7f
SHA1 588039c381c55dc17e88273eedadbc9f377fb941
SHA512 97e792a89dc5b905bb8e2427bbbb8e325813b74f72805e0aa3b9b01e0e84d7b813ce2341512c7a0b0dbc19c0b088242d5eb877f0385488f3f0e5901c3a76c90c
SSDEEP 12288:bR2UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3E:bR2t2rR8FfBhRJUEbDk1ulU0
TLSH
T16BC42312F3A848A3F3A74A7478F9D72114122C893FF5AF021D60693D25389E5F5FA6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a5547b3402660fc1fb73f7c235945f30d9b690ce88bda519d816c9040f131ffe
MD5 4f1c9ac22672fd743d95c7b20dce730a
SHA1 bd44872376cb21ed869915c072e4ce9b25ed2cc2
SHA512 b344f978924b800cf9392a71e955fa34c0517b888a6755a1af0803116c5e81bd14baab252d137e0a158e76d86004d46a81e0a4f0f4f2f7f9a4a408ec8e0f1790
SSDEEP 12288:neBNUbTVO86UNUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3+:nJIUNt2rR8FfBhRJUEbDk1ulUO
TLSH
T1ED05CF3BEE28FCE2C27A8D785A91C700977278704F62A3CBD175821E9E235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 36a6dd4d932530f61aec80a96965ce5f38eadf44111f9199e493c3f46ca747ec
MD5 00b547d44f18ee0615d8fd156bf1d013
SHA1 464f95133bda96e7361e734b8c486762701478a5
SHA512 7f7ae913b26b0ce3a913c438d4e9f2860ffac2fb0084e387b804111b9c9752594c82e216db1dfa5b8ba06ab6a3b398721f6fb5f3af9ea798e63dc643972a944a
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:fQvGAdlCEL8c/yRNw5C4t2sEE5
TLSH
T198267C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 97ee56228c6576f47370829f7f25d82547e71770780a684c8b828f5bc7b0f2ce
MD5 aad7652ed24065f7fc81378e60517583
SHA1 ebe7a7e207e9d0dd8958bea7964aa634373d60aa
SHA512 8d3d87cf310c08e8ddffaaa56d15fd6389bec707110cb63be163cf41a4a66c8e55143c20028e484645d0449601b23f274595f360f5fb2db76b5036cf134e89a0
SSDEEP 12288:3AwSfxL/2Dc34DLLmt0LDQewsAjzUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7m:QdewsAjzt2rR8FfBhRJUEbDk1ulUp
TLSH
T1AF15E031FA74E432D3BB0DB62B76C716142D79204FA11AC3E3E88D9E19302D26776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9b0b8a71ced0756acf050e11cb63fe7f499a5c1dcdea3dd9a6b1148cca33f932
MD5 4d6298367f600cc4fdc6aa2d98e3572d
SHA1 67acb0bf2a4c54337647855b281c0161f460ca9a
SHA512 f2562736a625c78c9e3e42db50a8c48454608ff7b6c09bc4b0afa7fd4ade705a238c8be4511661a6831051f075b616e0c07e24b9b53bcf8085f0b0d717622ccb
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbt:zUEtQevvqc2W1cpV2EI32
TLSH
T10A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3816aff431243bedec5713315e0b9a318fcd422d693d18cfd1a8cba5aa3c13a9
MD5 8b4c8985406293466b16cfd5b97ab897
SHA1 e81f979841d6b48640022de1ccb4df794e469cb8
SHA512 9efaca6a704cccda259cbacfe26483928002c35dd81ab68f03d5635e2b4942c8404b3227f56663af3345a90b52a65c7d6379330d89f5eaacd64368616695a7e1
SSDEEP 49152:kCbRquA/m2yL5zLfFiV+XenmE3/zTt2r4PRSEk1ul:toq2Vjnmct2sEE5
TLSH
T1B9D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 86866873cd1ec6381bf664707e798a9a63e111d74804ccdaf93b1e65a916e72f
MD5 8141e327bb4d4098146ef2acd8dce483
SHA1 e1753840326e73d8145220cb85848e012fef40bb
SHA512 db7665c8735abf999ca9dc17e7c2d37e2ed6d6f70dc8b2a3318f18f2d87d1b54920b3e3aaf6b3df78fcdd9efaf7545d141f0cecce2fea4584e1aa3f2edfa9b7b
SSDEEP 24576:wAhGLJIFoiwtA5l7S538t2rR8FfBhRJUEbDk1ulUn:wAMyFoiq5Mt2r4PRSEk1ul
TLSH
T1EA35AD81E7F945D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 13e0be1dc3ef95b3fff3e9a9599d06ef6ddf106fd0eb84b4c5c4db97ad4bfde2
MD5 b45c493cd1b9bb74f94fccba392265a0
SHA1 9c53230211cee057c29c999cb1b26009b185bcf7
SHA512 3ef0e736a91699a435e76fddb0e8b6b062f418a94e726d316db8fa996912a682ee3f5b5991cc57fc03763e72485d6913b4a59cef4b8fdfc003cf21e0f7b3b062
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CoUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1r:WwuoOWHt2rR8FfBhRJUEbDk1ulUg
TLSH
T1A605F14673A40CF9E56786388597C136E7B2BC062B61DB1F1760C62B2F37261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 95d82c30aebf314f3016b1d6aacefee8bfb428cb36511e18f02aded713f8a912
MD5 90dd7b883d9d73bdb67568a258922dde
SHA1 c2ce041edd89a987ad5d386a38355ae88dfc30aa
SHA512 bda03f8f33ce19f21c1e53f1a7f32c5fd1d0b45a33ce98ee99b0de92a64a1934266357df81c3fc0ffe12d2b2ca52b8e913db88b2fcbfdf39b8ed9d6629eb6065
SSDEEP 12288:LBZ1IyjUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3n:lZuit2rR8FfBhRJUEbDk1ulU3
TLSH
T1AEE4125633E420F6E2A78638D8F58705D3327C462B7287CF1A60463A2F32ED56D79762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 52453e257fc73b22a8b3ed89506ccc0d21c88858f9ed2584da48cc1f56518abd
MD5 19a3fb0b72643fc1ff295afa1cd598af
SHA1 4b172c92dd03498a55b2aa3542b46362dd34c03f
SHA512 0c2c8d3d5cda241c8db4e1559b0fd43f344c8c0da19fdd699cf8b30169019552731b9f00a00d6dabd0024263b3209c93e60e6a8095efe7d35934808538405509
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:JQRQyi36YOcPQLvw2gAf+PN3Bt2sEE5
TLSH
T1ED666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d106ddf96789900566f4976a76ee1932063813b91e38e5a1cd0b4ae55934fa3
MD5 b272419fbd125faf4f94fda154f3f955
SHA1 d3ae3f0bcc2551b21a8011380b7a0b4617dc6cef
SHA512 38585a88c2f09805df110cfa1ea05605a32e827688c3e09d57076cf4c983ee279ffec82a4ed3699ba0fe49081a8dec3f3a633620f32b6e08bde3ae18e13fec10
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:yQRQyi36YOcPQLvw2gAf+PN3Bt2sEE5
TLSH
T16E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 99161260ed27609bae60a7be0ea47c35af4efc2ab05c54decf0167e8d0b7ccfd
MD5 2a632ecd2d6352a1f7554bd57cd90a65
SHA1 514a065859cf1d9364aaa41bcd5e791770297d20
SHA512 7a65df4621fc6aa9ecedbb598c9b9e78604fd0b89cc53f82425d830b7c00b010d6407beae35af0f721b0018ed1ecb9108c6d8de85c0d83ccbc777a5164749caf
SSDEEP 49152:b68Qg55nhheWu7PNU3/Dt2r4PRSEk1ul:lthWRc/Dt2sEE5
TLSH
T1C6B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 556fd12dee0192b35c2c7f4b0e38e8efe3d1cc4aa269ba3d205ff01fa4dcf926
MD5 ad1876c2be4af976a587ec8a50b76525
SHA1 59c6952835b2b1cc6f34073737196be023a0ed7c
SHA512 8232981a83111da089ce6747b185a5a865c3b60102120113231c6c046f3e9037e7a5b9168c406c90893bdd45b3e4df7f2e8fc0628841bb94410235ab3bce9622
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:My5112gYy5azzVvL69nLKnhZ2t2sEE5
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13439b5ca4f0f0ba5682ef89a37f6022d898de91fbf3b327455a7dac6c3c2568
MD5 0d838f2f21dca543c7112dadf1d5fba1
SHA1 2c8315dd293eb62ccc8cd410b81d09c98f8b5d5c
SHA512 43d840423e813774100d679c8d821c4e78b01705d321597c019358398e03596ad8aed4022cc6fcdddb0b14ad0e62abcfd33ad3d84213c26419930c919c709639
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5t2r4PRSEk1ul:Hu6JmVxd2d5t2sEE5
TLSH
T18FD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1d83229b7c79f0929fdae569c27703a036bb160e71eb1263ad5a6c9e27bea389
MD5 1b36359f50885bd3131a070fc1d0aef5
SHA1 1e911b0dac688cefddf670267199a0c796bf2734
SHA512 5cae7a6d3e3d1c32d5d55eb570a4b8069d01ad0b2d0aca330c6d3b3c2cf9b593226cefad8dc6d53150cdd815824c019786414f897f59689ead5d259ae1fbca8e
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xtt2r4PRSEk1ul:0mifPbRct2sEE5
TLSH
T1A8B5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6435b3435fec4de66a8d5f201e7f09255bf61bfa07b3165a0f286b9ede492e00
MD5 09f732f3c569e6f71f2bda056b667446
SHA1 ae9876de2dbaacc057e77113d191395a83ed45a5
SHA512 2239afd2761a635e4a8180c23a80dbbee6ac1fad616885125a4f8b3e6d605b8b490b466a86d6607cc5de3a13a7fb73787de127a06b61b93fb683e88c7655e54f
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqit2r4PRSEk1ul:r5dKTi61it2sEE5
TLSH
T1C6C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3689dbc23b7a1d9aa15a34d6bcb321e68417d8013d7d2940d4e05b393e039219
MD5 c762aa4f86a85d7ad624fbea46ef5402
SHA1 9492ed65d52925d66ec4ae0486f8ad0b16ada97e
SHA512 f862e3c995ea1fe8751077d570067e3b1f6c15974d62162763cd781e2943e0c1e8d4df3933f9a9116059df7414a3350bccc067289311ff90e2bbba7957959dcc
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wpt2r4PRSEk1ul:7X2iyphgt2sEE5
TLSH
T19F95BE13F2D900E8D05ED178C7568632E962BC060B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e7576795a86aca52e55e82d72ced08dc9b853c1b0c46064579b924aac6e7bc0c
MD5 3187d68be0313735ea517338ef52a63f
SHA1 e6f1d59b6c67e9e710731eb4ca99764489c36267
SHA512 8d370bc86b2d83db436a488d6e517a2b94395907bb68dcfe0387b1ee42f1acaaf99ad582111f535051ebcd91ccc725d04918b8f97ec3c2d87a0a4b2c9c82fd96
SSDEEP 12288:JuUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3T:Jut2rR8FfBhRJUEbDk1ulUD
TLSH
T18FC42312F3A848A3F2578A74B8F5C31154122C8E7FF6AB032E64183A3635DE575FA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4950739e414f325a6c91d52c10a1ce13618a881eba45dc78946dd400d2a9b4f8
MD5 67648883f14d05e51701cd654c0a3400
SHA1 e51ed1567c525a34ae532af258bd43d107308d59
SHA512 dcdf415ce23978b724f0dd9105720cb0007d7f16fd35a2fe981d0496cd513e8bc0e553ad31ffe33af3dd611e5c61e1654ade658adae13a8f585ae0f1789a6055
SSDEEP 12288:KPUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3T:KPt2rR8FfBhRJUEbDk1ulUD
TLSH
T1B0C42312F2A848A3F2578A74B8F5C31154122C8F7FF2AB032E64583A3635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5d6719f23abbdedeb33559e1a96669254de603286fd0386c2d77b0cd95b10b55
MD5 34255a446d9c5408d01319e0e28c4bca
SHA1 fa2b782ad9de6a8d519866053b1b845680206edf
SHA512 9f586b0740e4b25b811cf1558024eaa0d606e5311264c638e1873dc98025befce41f13ad4a1c000c259ffe16cf702491bf33aca7b418e431e48cddfdc8e1083a
SSDEEP 12288:1lUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3T:1lt2rR8FfBhRJUEbDk1ulUD
TLSH
T1DFC42312F2A848A3F2578A74B8F6C32154122C8F7FF2AB072E6518393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d72eb98a2b09439be87d0f859573e70c1b10158fa094c3d922eecb89e17b28b6
MD5 7e81a20ac9eb2b77e706973703b4f0ce
SHA1 70fcbbaef2296c2bd12e674f9032811c479498f1
SHA512 286f7432362664f8c253c62d3b1f14142b3b88da221b8d85dd1731014f09f9152f57ed9be944126bc601ec151a7c2676a3993d3f35946c77d8c7157fe989b61c
SSDEEP 12288:6VcUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U35:Pt2rR8FfBhRJUEbDk1ulUJ
TLSH
T1DAD42312B3A844E3F567D674E8F6C31191227C8A7FB29B4F1E50083E1A31AE479B5BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f81d589861d69b743e0c048f50d5e8a74391bcbdd4756c9b4594f217e174f3d8
MD5 30ffc90bfecd069e18c255136a1534dc
SHA1 d91356916e36738d76a28a0bdd20f507347e10df
SHA512 3b177f859a2f9075ecf51c256387a20e1fa2a6c913ba48301c806412490eaf3da0ecc3e44ce9d273d6233a92ecf7641797a8d0c83701bd5f882c7a165d0b4ba8
SSDEEP 12288:XEUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U38:XEt2rR8FfBhRJUEbDk1ulUM
TLSH
T110C42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB072D6518393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a45efce765cb3c43bd254f6596aedd864615b1714891b0a514a7ca2a18812008
MD5 38166b8f7f5775ad1f516c11d7c8a3f5
SHA1 6214d5a013dfd3ab8fbb02f91396d7d4b5c7ff29
SHA512 e083fcbf098d9382fcaff8cdc0c66085cb3cc03df3522c7cd46b91181496ac06def780fa1dec4df32da96955be899fdbf124fff58ed379b895a941c4407d25e1
SSDEEP 12288:XLUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U38:XLt2rR8FfBhRJUEbDk1ulUM
TLSH
T193C42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB032E6458393635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 212e1602ec1f204a76e953b4bf48548012a7eef845d45fe1c9ab483babb9940f
MD5 5db40d0448892668ddad21d3db80d4e1
SHA1 0724dfeefa7a7b26914628ad7c3a95a97215e258
SHA512 09b89bc836e31f9044507de1896669d210e925664af7db1f8bc6b4a32c848fee33da147f53c8843ed025b41dff93f9cdb6cab811c19059d0c319d45a805582e9
SSDEEP 12288:zXUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U30:zXt2rR8FfBhRJUEbDk1ulUk
TLSH
T12CC42312F3A848A3F2578A74B8F5C32044122C8E7FF6AB072E6458393635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d86c55e2453f6eb268cbbd30dd27ad6726c8bddc839a61652326e14e14f57eb1
MD5 d808f23d2e8c52ca19cf3092adcee950
SHA1 5d192c3a4a09ccee8928d83c1f1a2a902a234610
SHA512 f1d5de0e5310b314e5ee19d95b295771f60211f310655a39f74d3a42147b1456c179df0d29a81030dbed4aad1ec00c73b4ba4901aefa499be51b2e97ee69ec6c
SSDEEP 12288:hiZwb6zzFEoS2cPvyvUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3a:kZMSzFVSOvt2rR8FfBhRJUEbDk1ulUq
TLSH
T138050195B39018F5ED67823DC8658916D2B27C5A1BB0CB0F17A4362B1F337A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 91fdb214ba13010e1d8ef0fff0e931189bc977017767496e5ede3d200087d262
MD5 4d43be6ee19975c302e40d511cf1146d
SHA1 44e40265607ea37649432a2d051319b05ecca961
SHA512 ffae6c741a17ca90c04c9e9544f0744dffed892b5c32b9bceb9ff0baeb6748852b8fc07d22ac55b97db2e07e52cdd58121e40d381dd8446f4ec36238ee3b6f5c
SSDEEP 12288:qSUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3A:qSt2rR8FfBhRJUEbDk1ulUQ
TLSH
T159C42312F2A848A3F2578A74B8F5C32144162C8F7FF2AB432E6518393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a84ffe5900d5c84ccc093a9c0ba68884b232e8873b48d8e19208dc78a5196d4a
MD5 7c669432141de455ba7256d294c3ee38
SHA1 971aa060c374a4676e3e56c811cecde80b408946
SHA512 2050fcd18cd531a35d7bc37c5e3cc5f8b69c0fe7e6c0dabdc8a366e225c4f835dbe2a9c3ae04f24ea60e9972d2a7e349b8610bb31cec2850d3d40fc682146b4c
SSDEEP 12288:gmUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3g:gmt2rR8FfBhRJUEbDk1ulUw
TLSH
T13FC42312F2A848A3F2578A74B8F5C32144122C8F7FF2AB032E6458393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 03e2d80957a53e120115066f7211b1d11e842265f515c3b73d7bf4ef81995f82
MD5 b87b1b969d4e557eabcf4e59477699ee
SHA1 df42f860b51fee7d6d99ad598b46b338328e3d8c
SHA512 2e24bf883d57b5b8d8428fd80b2f652e29169152c28c3cd5c5e998dbce30f0c30cae428697326d518679918b3fcaa4f9c2df3d90f1c9dc586026331edc6e5905
SSDEEP 12288:NyPz5L8jUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3W:kzyjt2rR8FfBhRJUEbDk1ulUG
TLSH
T1B2F4021773A420F5E1678238C8A25A11F3727C761B719F9F1764063A2F376E0AD7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0d9b170b663e3439478511e3a503c53728a5bebf21ce5cb1dc021d5b5ed900e6
MD5 9e1a48481839fabc908082da763086da
SHA1 5c849fa23731455cb6f8e17eb8a295aed39af3eb
SHA512 8a4c368478029d69b0c8f3c5acc6e3a4bff83c7bb69f8a0db3e27d0ba9fb832fea74844376fd77d582bd94af24844b1ea08114fe8cd76eeee547834fe8fa8aaf
SSDEEP 12288:aSUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3q:aSt2rR8FfBhRJUEbDk1ulUa
TLSH
T109C42312F2A848A3F2578A74B8F5C32144162C8F7FF2AB432E6518393635DE579F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 81e8fa66421360a6b81cbeb06ee348b5e5431405113951fd725fe4012492fd90
MD5 b5ed9cdb9593a701c4c6ee4e8e765417
SHA1 b010875150b0d287f559a7ee617d8c5107f534da
SHA512 922f1af15cbe7227c76b4373f1bb26e9eeadddaab288f51481138efee0df2f1ff5e7e5859b8d55fedcb950d09f77c919cc7ed1934cda28d5a075599a82af6145
SSDEEP 12288:KSUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3q:KSt2rR8FfBhRJUEbDk1ulUa
TLSH
T113C42312F2A848A3F2578A74B8F5C32144162C8F7FF2AB432E6518393635DE575FA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1e31e4c3850f64b76a3d7c57230450512c4b9e04d7d3007456318df672208edc
MD5 e63146e897598eba72d3f15b3aa14a23
SHA1 33f3daf4085596bf46620feb2d4154c95d55f851
SHA512 8524f0d4aa10ae86dd5a28f6ed5472e93998097a9112b7f8b8eeb6c527761a81058dd94951655ceaa534781365de8af0535d8987f7d11af9c601a5a3fd5077b4
SSDEEP 12288:UyPz5L8jUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U30:Nzyjt2rR8FfBhRJUEbDk1ulUE
TLSH
T107F4021773A420F5E1678238C8A25A11F3727C761B719F9F1764063A2F376E0AD7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f92cf138d64706bb02cb497ceb75d7e08b629004c23daf15e348dd0ba7434e6e
MD5 c3a325b82da42388d17aeeff805e0394
SHA1 9280f42c079667457a8db8f10ccf8255f720a4e4
SHA512 6f890a45da13a2bac58919ec029b5c780c2b3156324e16bbbbb0819c3c63a9427bded46a22dd06678b92799706b3fdbb2c72ffa6e36207e10d7279c850110acb
SSDEEP 24576:WTHaLl3z0zD1t2rR8FfBhRJUEbDk1ulUs:WT6LljIt2r4PRSEk1ul
TLSH
T171050195B39018F5ED67813EC8658A16D2B27C5A1BB0CB1F17A4362B1F333A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6ccc868b03a58b60c0c516540648fcf46817c344b51d11bdb8078f9b8d3dd545
MD5 9d27c1773c0e07bbacd65b3920747136
SHA1 ee6a2f5e63982c184d40aaa32e5e7be2b8c26280
SHA512 b1be3e64040eb1e72c5aeac26f0e3eca5b0fa0433c6ab2ae85a6d4775ab1526d8311ed9174b7a27a38c1e21b138dfedebbd1259330ac66d2ee79afb507e4552f
SSDEEP 24576:y37d9CHKy7GZht2rR8FfBhRJUEbDk1ulUR:U7d9CHKya7t2r4PRSEk1ul
TLSH
T1B225CF90F3E414E4F1B78A358D768611DA767C9A1B71DE8F03A4252A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f5b511517201208e2508e7ece2500e2bd8d1f0230a6d5599ba785d75ea449bb8
MD5 8f8572becbe5560148bcca708c081437
SHA1 9663f5f50edeb01e9568e475152d6bed7c647a29
SHA512 ed16dee9daa57f24dc3663a3b084b0ca765af1a5176fa3b528499f36b567aa3ecf7dac215dd65f465100d60c48bc826afd785fd836838dd3e100daeaea2eb798
SSDEEP 12288:EFUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3m:EFt2rR8FfBhRJUEbDk1ulU2
TLSH
T1CDC42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB032E6418393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 16daff8e7d1ce1ce3b23f9904c6274544be6d1f5038b0f235c900161fbb87b61
MD5 be3e45150703942a44968b33a011b216
SHA1 d65e50bd5af8fcdeff119310535651259323ac39
SHA512 b94824e5c4e804b42b79c7a83bf88eca71f755166346a2f566e83773528bc11eba706590d465b0078ca5145f1e79f52fcb64e3ebed6e8dccce4676716c9be8bd
SSDEEP 12288:kDUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3u8:kDt2rR8FfBhRJUEbDk1ulUb
TLSH
T1F3C42312F3A848A3F2578A74B8F5C31154122C8E7FF2AF032EA518392635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1e3a2653beca0d4cb846f3b5a171207fd6f1b071e28835941c6291fdeed67233
MD5 6638f09f56150f28f0b0366778755759
SHA1 9d7fb2afcbe9517643252ee788d5b3e89d34ebd4
SHA512 86e588fc67b43c37bc8cc7010f36a588ea5b2facbbb1a74fbfa805ebb061241887b3bf52705767619675b1bb155384d2b4ea18333844d7f4851142c07c5c2ed8
SSDEEP 12288:vQUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3C8:vQt2rR8FfBhRJUEbDk1ulUH
TLSH
T196C42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB032EA518393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 1866af3fda276530318bffcd1df8012f58d787ee639ea7c6193a7706a62e22df
MD5 41353925dad468a8da9c1373e2686f37
SHA1 54796957952d2b419e3e2d2a2a14536fabbd9b67
SHA512 caece89d863c264eba37f16f6d409922f29759c072b64d4ab0d7e045b7577b38921cf1c1a443014d970ef32784c6a438914312d737c26983dfa2811ea3a3c5ca
SSDEEP 12288:USUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3/:USt2rR8FfBhRJUEbDk1ulUP
TLSH
T179C42312F2A848A3F2578A74B8F5C32144122C8F7FF2AB072E6518393635DE575FA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b39cfc598823c8f3e76065ef47a374bec976c0b25abf38fcede26d5ec287da08
MD5 c4346e06005304697710ad8d16cfbe93
SHA1 59c44abda4a3a90d5164ef6c8bce9e7b55813ea0
SHA512 1bebf52020769ffece5473be2eb507b26d5005c8d281b375749523569ab033605ac6d75c556760ddfc7d3f75ff78d11db14ea263a0eccef31d83313d6917fa28
SSDEEP 12288:EFUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3T:EFt2rR8FfBhRJUEbDk1ulUj
TLSH
T119C42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB072E6518393635DE575FA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 69c40eb082af5023196c18b955daf9e75300698fc093b75381a46bfdddec8b25
MD5 ab7737699667b846d19e00faf75c22f7
SHA1 4e025d6a70c5afc53ae98efcc9e51f4e980d2697
SHA512 ad154eba0e3a4c0a7cda222a783c8da694dbea8ad45649cb98977793dda44332f8bbda2a1866ced67db891a7e885a6ee8b3857f748298d3fb8a0532be3ba8faf
SSDEEP 12288:yaUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3EU:yat2rR8FfBhRJUEbDk1ulUz
TLSH
T1A0C42312F3A848A3F2578A74B8F5C32144162C8E7FF2AB032E6518393635DE575F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e6e2fcb144bf2cb4e6ba604d7f7964a201845377da8059c1608f271ba36b007c
MD5 833eef1d1d32c8fd61004d067753a590
SHA1 deaf3240f8a3ecc13f6b754f00f7dcca0710542c
SHA512 6b06fd147f26ef07bb71709da1e54c36f527fccfcc5cd0e4fe62c13fbff61fc5cab1c54b1bb9daa0ad0e0c3fab2700f1fe380f8ca4ebaf3f0db0cbb76158b49e
SSDEEP 12288:PEUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3U:PEt2rR8FfBhRJUEbDk1ulUE
TLSH
T150C42312F2A848A3F2578A74B8F6C32154122C8F7FF2AB072E6418393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 85dbb207e0f392fe937ea421f34625d13cc62bd548b7e4cc32b4116898ceaa2b
MD5 753466fb6d53df8864c32f9520d1eca0
SHA1 ed3fbc34843d8b6161817c3e4368bb24a8569793
SHA512 6fc02869a9824c7fc5aa8bcef524755ebff592d8adae1f77de2c7b424350f76c8293413a20cd4a0fbb49714ecf4ebf6a86bdd6cff2850039cf0c88286bf38819
SSDEEP 24576:Efwvok9RX6wkyAIWt2rR8FfBhRJUEbDk1ulU8:kMnYIWt2r4PRSEk1ul
TLSH
T14A35DF29EBDC44E1E1B7923C99B7460AF2B178591B31C6CF029A536D0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c71dae2dff722f3a05537c59d1c70810fbeaa910fd677ffb9427d59c90f94ce
MD5 3ac6af869ffc43829e9e03393792f305
SHA1 ea66a9640aa11ff4dea4989f894cdce85916bfae
SHA512 e2a8c640340b8d0b9431007156622d37e515211368436cd62abbe855e8de24612f76e08ced53708b5f01895c5f1a58ada5c33a8b90ea69526ecb242b37628275
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jt2r4PRSEk1ul:wySzPht2sEE5
TLSH
T1A5066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 73e4b655c615e179f6276864cce26d4ffdc7f6e3e8e1922553c68bc0a15c08e6
MD5 b5df6f034d5b8710ca99d703ce277ad4
SHA1 d44491599a7e87b1a58a08a856ae6eb48e9ef8b7
SHA512 3dc754b14d993cd529a386dcd2ea58d57172a4a3b32bef9868086a2963d7e62e603f4c5c6203f1a8c38527bb9df24ca7e10d11826879bf04811b0ed3fcd24ef4
SSDEEP 24576:X47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYft2rR8FfBhRJUEbDk1ulUu:X47JUQj1irIhCnDHUPfF/5t2r4PRSEkI
TLSH
T1EF65AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3fc6360b1b9e42115bc7b03e8fe73d3009cd9482b9276e48bd1970b02250e74d
MD5 f932b849a44ebf1b8d9fe28634a43059
SHA1 d3d8e4df0b475f1fab79953065df2e87188c0f0f
SHA512 5d945a50ced443fff313a5aa38fa2d717bd0464c7ea5a05b5e262f6e5deb28fd2a429e12fc0905229fd5b4c5a439cb67123c2d7f90f429f5b09804e9bf55c614
SSDEEP 12288:6NsfiUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3D:zit2rR8FfBhRJUEbDk1ulUT
TLSH
T19BE4F11AE29801E9D06E6278DBA68601B3233C5557F1D7CB16D0F43E1F36690ADFAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 a0841f1fb9c294a75af38ecece331f7b7f06dd36fa439621631ce6b790e1ede5
MD5 d96efe09eadc5bfd5a85c3083c72c8a5
SHA1 2de8cf7c18adf989eff8372478feea91156ab3eb
SHA512 77dfe376cb9f412ba691f350fb7f986c3655e493ea4f6bf9acad4d0ab671fef864862c8b9dffb6507fb27e4ff7d62097e0bcbc538576dc01dfa9ee9a60bdcfac
SSDEEP 6144:tsBC2na9G4ZR9yTHcbPotMxyZrnU3fUks+9lDOj2KTeIcyR91/ZSbJ8qO0EFkN/f:aUqRU3fNQ69NLO0EFkCLtcaA+p/iWET
TLSH
T173251740766BD75FC6A944321E37D6CCAB707D01EE459B0372C8872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 b2700b8d8fc2e4a0dfae2e95ae3217d82bd375ecda9f2de14a3a220569f75eb6
MD5 cbd2071638ba15f7e772b1a4315a5530
SHA1 9af36185c629d686e8450a8cbcf7851987e2075e
SHA512 243e72ab84ce937439564698ac6708baceea7e49ca6f722699c1accaef567ed2c6d84a3a82575fc3853642d8807e05122ee415920b85d1f7b2e463d7c75a09d9
SSDEEP 6144:ffTeIcyNC8c3DxTeIcyL91/ZqzMjrLDRgYaik3zK2QB+kcHf/Swv6b3I6YXMcbVQ:pzMjrLDRgYa/3zK2QU//K46dN4U
TLSH
T15245B6816137A3CFD5FB2072072A6B4CA764EC46B7456F26A3C8053AD817A65A0FC3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 12876750277e02c05c233778cd0593329a1f2737a3a864b9f8797010ab65ca28
MD5 c5e8c40fe6f2c5071e5805ad9dc4a564
SHA1 6452d1652d9b212dbdbb8fe20aba6efb3f16146b
SHA512 990a3c9af9a1698abe5b11b9d619e8faae795826aba8c2a07b2758ab2348642f734c6d3da82d667540c69af67ac25cb2bad1361c1c2f643b4775b52d64f2c095
SSDEEP 12288:HF7qUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3P:dqt2rR8FfBhRJUEbDk1ulUf
TLSH
T171D42322F3A88863F2B75A7468FAC32010177C492FA1DBC32D54153A3535DE4ADF9AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 41b140608664e0c527ad5fe4a61e5597d6df66925f73e13418876fcefdbe9f68
MD5 dbaf618b6e6f6a53284f49ee880c668e
SHA1 7d5c7b37457c1f1ab61c69109bcf0422cdba5076
SHA512 df6f63eae4f41e32111ec765daf4f022a8fe1a6d81de70d1c9b4352d885d3dbfc1e729bdb3927cfb16b8f5108f002d398fc19699c1d77dab5d8401a4db7d34f2
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYIt2rR8FfBhRJUEbDk1ulUt:Wgb4mBIBhGFft2r4PRSEk1ul
TLSH
T17965AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 13715c8ecfc762768f9c76e369eb573ba3094416a0290fea37661a5375dd004b
MD5 eb86f758eae1eda814edc682cf1870df
SHA1 c110445056e8de95872ec38614090898f9537440
SHA512 862a531cd6664183204f6eae6882b6372ef66cc995da7f7c486082dc270b1cbcb9677e870d8269c9f4d3975813878d4c855c10c6f023ee3bf478f45cbc57e4ff
SSDEEP 24576:FG88u8FpJqH1bzria7/mvt2rR8FfBhRJUEbDk1ulUt:o7ZFPqVea7/wt2r4PRSEk1ul
TLSH
T1EF350165B3E001F1D477D13889824663F6B2B8151374EFDF0BA88A651F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 7b10c25c0ae8adb3d70f6c372700a4b6aa73925db31869acdd7c5d68755bd982
MD5 9c5e57b7442b54285e8eb89953854dfe
SHA1 c1763a734456950b4111353e449338d48e8a4213
SHA512 2631fd367bb73d8776ef38f4c1db4197a704fd5aae946f8cfcc0740e23a40c29f7af204ae127d3391acb1950c939f8a1d95bcf8030473fe69bc5ad918d184634
SSDEEP 12288:ZHvUrBFrEjwaQ7UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3X:ZPUr+NQ7t2rR8FfBhRJUEbDk1ulUn
TLSH
T10305E12F62AC18E5F676A17C89928719E77278521712D6CF02E0813E1F27DE8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cb7c31bdd0d47f79018aff2b3d3380cd9b489b9aa07d246f420a9e701e4641ed
MD5 a235a6f84bfe7b213159129a26465760
SHA1 56878f867901035d3f02d4cd4585eed01304a16a
SHA512 f581059f9e4c5d58ba5d7b138873c9515b19a6a147ac22b5d439ea991417fdc751373c9fe07e57227afc30426b4980e5d104cee9f5b4c2eb6ed30d6fdcada2f4
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLt2r4PRSEk1ul:dG05lO43bet2sEE5
TLSH
T1DDD5C06A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95f48f9150aef3788fd4da376a36726b564c7aa7a3a05cd81d240b641540ddae
MD5 a7f8390e89c1cfac4b0ecbb166304011
SHA1 d102efb76656e23ac41221e571cac356f9ebc5d1
SHA512 a5661e719b4791d30b593ec764d0128c3342c43f6c1d955938778d9bbd894e89d568f3b5b33b3a7cf7c2c5942a55989206863722e171cd581cc82ce2469532f3
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJt2rR8FfBhRJUEbDk1ulUn:6a5POZ3+Jt2pasx2+mDt2r4PRSEk1ul
TLSH
T12465AF5EA3FC01D5E179D17DC583861AE5B1342653319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0efd22ba9c826d1a3e99a8c0e94d6c67be8a0ac0917a5d3d838f20f0637cfb15
MD5 67776331a5b59bd743505f38ae9360e0
SHA1 78b12db3872ee86b7fa5e3b38cd1fccbf7caf67a
SHA512 afa2a49cead83079bafd52352a7bf6265275855bdfe9e2606d8958061c8bddf4c848876f7086eee724f0df7377f8d9af1ef573e9249283c785e6fdaddc9a6c6f
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7Fknt2rR8FfBhRJUEbDk1ulU+:INc/zEOVHFQt2r4PRSEk1ul
TLSH
T106857B1623E901E4F1BBE1BE89779546FA71786917308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a8165bc65b4dc7d9c64cd9ec0a6fa162d6daad8b87ea83944f2bf49996af527a
MD5 24823f1d81772f5c3256a5bf023bf6eb
SHA1 ef1db774242b4027c6e51b6d15485c0d070d10ed
SHA512 0f01b55454ece7ed81a8bb222b589f6f362ebae58ca463c21d2ca5224bde70e03ffb84ab4104183566ccca1d962e464a799b6f8c7d02db273b86f33cce8cdda0
SSDEEP 24576:M8kNvNnaFeYhJNtmZBm9t2rR8FfBhRJUEbDk1ulUr:M8MwBtOm9t2r4PRSEk1ul
TLSH
T14555AF2EB6F846E4E1FAC6B4CD238512E6727851173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b5b48396fa57b2bb662c3ed465fb2c034b4a63848a53fa7a055b60e2a3d31e32
MD5 c371c4742815a01949548e3034215dd4
SHA1 fe8abfe6609170c46f16a8792600325a487bb5aa
SHA512 69acf43f29724cc0d5a82f74bfdbd7e41a05f22f8969f5b99d445582d56e3dbbdee9193b18a1bd6f5baae506aa16a38092d28c561e3d3080dcb16c8522bc53bd
SSDEEP 24576:4D3FHshBIYQgAOt2rR8FfBhRJUEbDk1ulUN:4DVHeBIAAOt2r4PRSEk1ul
TLSH
T13725E13EE79C04E4E57BC1BCD9A38606E67138A9073256CB0694817A1F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/364-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/364-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/364-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/364-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/364-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1184-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1184-68-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1184-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1184-305-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1228-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1228-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1228-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2904-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2904-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2904-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2904-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2904-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3360-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3360-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3360-128-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3360-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3360-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3948-65-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3948-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3948-7-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/3948-6-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/3948-1-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/3960-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3960-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3960-79-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/3960-84-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4216-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4216-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4216-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4216-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4216-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-284-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4884-61-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/4884-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4884-55-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/5984-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5984-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6004-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6004-116-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/6004-122-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/6004-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6096-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6096-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6096-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6096-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6096-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6096-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download