493d83db2edf9f5f6bbf2851b40df09c5a4a617a7b60d27a36c67d799476a799

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 725KB
Sample260817-ank9pscl71
SHA256 493d83db2edf9f5f6bbf2851b40df09c5a4a617a7b60d27a36c67d799476a799
MD5 f5e8a25194df57d6d8726b971c385e1b
SHA1 31c6205e908b6e8b3468060738353340f514ef6d
SHA512 b5c5f03e8c7146f2727c1caf495038165f7d2d1afed9c4e9f91b9800ad81da255ba504c17808c7bdf903bff126c63d005f0690ad2f28bbcf6548f54d4b1139c7
SSDEEP 12288:+u9PGxTszBAGubvoXmH3fOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q7k:L5GtI/4v0Djsf9nz4mloFQnpXUMPQDRE
TLSH
T1DCF40151BAC080B3D4731A3418B0D67196BDFE302FA56AEF7390576A9D703C28939B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6496	elevation_service.exe
6160	elevation_service.exe
6756	maintenanceservice.exe
6444	OSE.EXE
6736	PerceptionSimulationService.exe
4612	perfhost.exe
6184	ReFsDedupSvc.exe
6960	SensorDataService.exe
6412	ssh-agent.exe
4384	AgentService.exe
6356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92014019957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed7cc4a6de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df1697a6de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e3edea6de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa743d68de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084bba367de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8d56d67de2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
6496	elevation_service.exe
6496	elevation_service.exe
6496	elevation_service.exe
6496	elevation_service.exe
6496	elevation_service.exe
6496	elevation_service.exe
6496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4384	AgentService.exe
Token: SeBackupPrivilege	6184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6184	ReFsDedupSvc.exe
Token: 33	6356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6356	SearchIndexer.exe
Token: SeBackupPrivilege	6184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6184	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4420	2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	6496	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6356 wrote to memory of 7064	6356	SearchIndexer.exe	101
PID 6356 wrote to memory of 4284	6356	SearchIndexer.exe	102
PID 6356 wrote to memory of 3156	6356	SearchIndexer.exe	103
PID 6356 wrote to memory of 3804	6356	SearchIndexer.exe	104
PID 6356 wrote to memory of 2044	6356	SearchIndexer.exe	106
PID 6356 wrote to memory of 6848	6356	SearchIndexer.exe	107
PID 6356 wrote to memory of 6456	6356	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f5e8a25194df57d6d8726b971c385e1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6756

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ee929b7bacb1513a90a8b54cb973482226fc61e1b3d842a3b4655c5f23b27d8c
MD5 590ab14915eefcca2a851efb819785ee
SHA1 4180f79638e334494f210930dae9de9e3d551c0d
SHA512 a525297d1ceefc71b3df7176f15837c3fa6e6415ab87320c0b4db903e37277d28b9338ed67f0584b031bd75883056b2bd34f250f5c9957db993a9dca9c4e3cee
SSDEEP 49152:Bb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnkDYf5zaCpXxPuR6E9dA:H3q6tjBjoDw/z
TLSH
T16FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b0ce4af1188068899efff06a39c6dafa572f41c09e4a0474955fa3d367b979dc
MD5 7d7622959ee3d1e264ff51ee7ea2ca59
SHA1 dfe8a0bee608063611486db31e3d93c6705e33cd
SHA512 92f1193b2711539ec9baace0479bae499f336a7ea478cac755d94398988b0f9d9fc3f696b31b8bc918fdf3a31a1930170ca17aaf7466d9268ef0187a3c7ca705
SSDEEP 24576:UXYfDtczAo0Djsf9nz4mloFQnpXUMPQDR6q79dA:Ttc6DYf5zaCpXxPuR6E9dA
TLSH
T11D05F129A79404F9EC77423CC8A2C511E672BC5147A0FB9B03E499665F333C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ecad5306154a77e490a4c0693f1dd8a185ea5e7db30c3c5841bd7349cb055219
MD5 325527be40246e81b9139ec844912b29
SHA1 cc01574f3ea34a3414593a9cad4ec4426816e5e5
SHA512 5f4eb43162176e5843d6279bee18925b25000229cf17d47e2f9bc708f2fa00c12f0ebbb89fe4787372980d49e0eb21f04850351e238b26715b08562d708738d5
SSDEEP 24576:a0Le5ji0hmxnrM/0Djsf9nz4mloFQnpXUMPQDR6q79dA:aPji0AxtDYf5zaCpXxPuR6E9dA
TLSH
T1F735AE16F6748331D073C0B9C5D2A69EE97130825B308ACB5286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e130d7e793630481f9f70e9b8351815a3f5e065f3f837e6b2c912a1cfe1d88c6
MD5 25d73318dbc5bf5ef3e06c9aed36c49b
SHA1 2c6e217560c03efda86778d9fd79e62f9b93067d
SHA512 5320d7b5e80b0db74f358dfa6b40325a1b0fad379c4a13db21509415a9fc2504f149c02281b3bc354de8c5c649769ec54bf1069b8a4f5453a6352fa55dfbe029
SSDEEP 24576:pa7/ezSC6vUyDZaqgrvWx6q8wyuV0Djsf9nz4mloFQnpXUMPQDR6q79dA:Y/ezSC6vURPvMHjyhDYf5zaCpXxPuR67
TLSH
T137756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e81779168975e4b3ad12adb003d0264eb4dac0db6072ea5d20101448cd3969b0
MD5 b7f935c6c39c347ca238d3410448e38a
SHA1 486af83021728a1c2baacfdd9d5a49de8cf79e33
SHA512 20494413ca9750767440f3030417b3b64ebf5adafb67e7f2649b0122fddc5accd6ef500552105b1f3d4040c84fc391359da7ccd8f3b095c91ca0e6596bc93eb7
SSDEEP 24576:NVbqPb88hv/lV700Djsf9nz4mloFQnpXUMPQDR6q79dA:NVO88hXlVDDYf5zaCpXxPuR6E9dA
TLSH
T1EC559E66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C2E777D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 80220f6321728924715053b81cb54d4a4ccc5b9320d0ca3bb0be383d9e1ca506
MD5 be298d3d6d979614d4a70bb1e49f1bbc
SHA1 3b7041f4ddff079d79d6fede3d80c57206e6f9f4
SHA512 ef37dde5c534cb835977d75222abcb72ecc7138b3e4aaf55fdd9936a1da072758aca0c5884ff3db2970ba85f4a3e6c5cded2532afdcd7995e821b7c0eebcbd11
SSDEEP 12288:rGLOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj4:rGL0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T190C4238ECF0810F6D4722F3C28B1E225D2D4BD207DD53E6AB7A1E68A8C7574BC4A5587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7f4370fd96be4f3982a6cb3d1d2ac1bd2ec0fec15e4f6b950db05b95e0ca25d1
MD5 b6019376bd38d36aca63f78b56f041f9
SHA1 bbafd7e6fc693253404132c6172c578b9157e74f
SHA512 cfda9ccb451f6ac395b3764a7a96dd89b1e2a56db18e61e4eb14454c5c1fbb73c6b521d7552df34119dba258ae7883246adf07b7f7c18124820aa0241e1023cb
SSDEEP 24576:hJIUc0Djsf9nz4mloFQnpXUMPQDR6q79dA:hJIU/DYf5zaCpXxPuR6E9dA
TLSH
T1AB05BF7BEE28FCE2C27A5D785A91C200D7A278304F62A3CBE165C20EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5b1ab0c77770d2046808071b3c9c09181154fdf971efb30a34a025b0a4ba7cf6
MD5 a797af0444519050954b904e9dbdb0e1
SHA1 c2b517400cc2340e1823409016762d6a8ee018ea
SHA512 922066e46b2029ad66edd1683667475a7455c7fe17faecadb6417328dd0fdfefb24979eda71cdce11f8f43ace58f0f7dbe75ed7d01d0835add6b7b81e441cc82
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH8:GQvGAdlCEL8c/pRNw5CkoDw/z
TLSH
T1B4266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c65d711ddd76dd894851bceda38a51153b14a38227a8bb173325e9bcd8db9908
MD5 3d6c4330ea05f5dcf61196b5dac0c028
SHA1 468cb50a31bbf751ca8a0273f9f2975057cd586a
SHA512 fd2c02278c7625843ff460e49c0142faf5ead2b4d6510a449dda0fc697ed5f8d2685c2bd48573058b6faea9e414973bab8adbe4580cfff57fc26d3caa5f3abd8
SSDEEP 24576:rwewsAjy0Djsf9nz4mloFQnpXUMPQDR6q79dA:EljdDYf5zaCpXxPuR6E9dA
TLSH
T12915E031FE74E036C67B0DB51B36D716546CB9204FA12AC3F3E88A9E59702C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 277ad3b5f7b3b5f532e29fd2a159196483a3d4643b9c7008a35f3ee76ee83106
MD5 46a7fd9c49b14d9e7c842fdbd58900e4
SHA1 51f28a129a851019600798643959eb5773b56b86
SHA512 9961927d1cbcb2a6a3cc28204faaf9071d4ffc27bac21d9c2e31bc6e5e886837e080dc4d9294791a8574a1bb34231363b90d7a6741592308c65e91546467802a
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHKA:UUEtQevvqc2W1cpV29I32K
TLSH
T125474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 62ec1ae815c677e61f2cddc8d2b54a00360941d408271a1aaa4b2a5b5ac227b0
MD5 7911b5867de267da84425beb9d32d870
SHA1 3ad7d05ef025e3bc44f899da49946a11224b22c4
SHA512 4efd8051ef9c7c1a43d5f3a041fa39d30aec9cbfc6d8f63622561c76148e5400dde095de54d9f4b05e52a6bf3c32021e15d745112ed9dd0eb6064f6a5602996a
SSDEEP 49152:ECbRquA/m2yL5zifFiV+XenmE3/z9DYf5zaCpXxPuR6E9dA:NoqHVjnmgoDw/z
TLSH
T179D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8845abaf01ad7d89d187c25ec6f9a3436150092b2bca0f7830d12864c291d9a7
MD5 514b3fa54802d24490e7b8149f546ff9
SHA1 f1f524727a2eea57a246b30d9ed2dd2d7a26ae3f
SHA512 b6f0e38a02a3d1804920b4422bab9c3f9eefdb14d135bd7baba481c82a71c796862b9891e23682c4179b68615de9ddcf0caad74ec4adac58b2eee41a8c2068b0
SSDEEP 24576:CAhGLmIFoiwtA5l7S53J0Djsf9nz4mloFQnpXUMPQDR6q79dA:CAM1Foiq5+DYf5zaCpXxPuR6E9dA
TLSH
T19A359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4269aa13b24c8e87568ee21d6c76555ebcb6a6b040c85590d3c98767615609e6
MD5 a74081d05fa718fbd86bdf89678d78a7
SHA1 0b8955be79f46971f5959f009641aa7415176826
SHA512 55689b6e06e969e090124dddd8fc328ab9f925bc4595ee9022c3c2e5c530ff290bc661990f8cc42460d364a1ea37d110fa76a8f4a61cb5d7f7b884042893b180
SSDEEP 24576:3wuXOWW0Djsf9nz4mloFQnpXUMPQDR6q79dA:3wQOyDYf5zaCpXxPuR6E9dA
TLSH
T1AA05F14A7B9408F9E97356388597C136F7F2BC112A21EB2F17A0C65B5F33351AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 403f1f0c6e4087a72a00476774cca1d80aff40212993683c5a06da397a338e7c
MD5 8b58f24002f728ee74a97113e38a6ebf
SHA1 2691ed8f1e1a4180d10cc38f8c5ff28d76ef4f23
SHA512 6b95eb84284cd8b8283e40552d4f809f703e7bdcc9eb4a196f78c5c255dfae3245b03fea0bc76fb9800b5fa5698a4bd566aa84bced7386fe1f999590a82d57dc
SSDEEP 12288:8bZ1IyiOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjP:kZuH0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T118E4128E6B9420F6D0B31A3C98F19215D3B17C227B7127DF2660829A5F73BC65D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5e693daa6f525f4684c1a1e0a1f8ca1062afff879bea014ac65231a294360956
MD5 c67c1335493178e6bca7eb1637ab9f64
SHA1 dc9bc9ece9a68ef489329a8a27113de486d07946
SHA512 e8439c5c73b2eaa3000bd4632b0b549e18d6899814cc08ea8f8d5281bed5bd127f144225b9cda1060e63fd7f3acb3ce58faef84286aaf2f2cfb8d651b433ab36
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:ZQRQyi36YOcPuLvw2gAf+PN33oDw/z
TLSH
T1B0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ee20542d331a64a931dfec9d04eef7cbc6764f8602c33b08aaaab21e0bffb60
MD5 f3749b38dbd9c1b9c076ca53d651f349
SHA1 ba8637279948e5fb4b51c08f77d9e557dfc35e5b
SHA512 d47462054fd3e232c32a496a06a245d79a1057c28ea591457970731f0cbcf59849aab127170705530d91b773b04f29b5d37ceb699319080ea3438318947d381c
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:8QRQyi36YOcPuLvw2gAf+PN33oDw/z
TLSH
T15A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3c73341748f4d7efc776dbf43a9a6a6ce5eb3e8cc57fec0a237c3d479bc217f1
MD5 7a5f950c460e3bbb2a16f3d80f138f35
SHA1 bf14f30b28468c3ae4e02d03630b8a45fb7aafd7
SHA512 030a0e9ea239fe0411c6b10f668090e010bde5d926e78c6e6508d2b94a4981849c0ed2ab7c96a65863ec5b4da5109c29b427edcb155c50bdc4e97932079f18f7
SSDEEP 49152:q68Qg55nhxeWu7PNU3/tDYf5zaCpXxPuR6E9dA:YthGRc/FoDw/z
TLSH
T181B54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dfe42cf0c6ec21e60dca7236df4e4c6e0f1ec656464acd61ee121ccfd7eeec41
MD5 24cb6d2a762c2d6138fe937eb055c14a
SHA1 4d21a2292980a42a8b9f33d2375f51f89d58a275
SHA512 f7f0c3c5519f4421449b647129ffbb7671f0a3b382ffc28fe264201f2da83d0bb765dcf6aee9e4c78bf72461e1693396df1bc30f5abea43e8406ce5bff683692
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:My5112gYy5azzVvD69nLKnhZmoDw/z
TLSH
T12E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f961525b68042b9c85570fb7f097ffaa556a9be2c642572bd4b62c1eb41fa59b
MD5 761173647259c725dda231acc7f0c8a1
SHA1 13d3677323ac94f7c99e9b8f200cfba15ec938b2
SHA512 46ff52955865aab12fdef4213dbeb4877f694769c65f7ee6d6232d853ec30cb320c5dd85b7a66a647bacb04dd8795071be0c5f7ec329210006ea212a99404d29
SSDEEP 49152:KB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl7DYf5zaCpXxPuR6E9dA:Yu6JmQxd2dPoDw/z
TLSH
T1D6D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f8368e57ab0762513bfcd02c50a2fbcca11bb0bffa0fae26767909f8d4324c23
MD5 5a1f6e00412c58d1914d88904713476f
SHA1 a9ade9a91aaf88667faaf7acbd37b41f860ee74c
SHA512 b5f568e2b9782d3e2113a268f84046bca908a26340b4c15f1f9bcd38b4c6fa9c5befbad3df4ffa0b5fb09c9066111917efa2ec4f868fe2f64554e94ed934a7f2
SSDEEP 49152:c1hpsNoJpF1A6yU44CwH7R4xfDYf5zaCpXxPuR6E9dA:cmifPVRgoDw/z
TLSH
T1ACB5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7eb366090f34bc55b857c8f9de98a90b6dfd9f90759d818dcf7c1c47502910ef
MD5 d3903746a2431a189c10282abf1f7cdc
SHA1 b1558a1e439f650e205ad7109601022c9df2186a
SHA512 82aca242ae01c3909ed12ddd5e0f3a935083c53ab102dc889bf1ea676dddac877d07c5a3a5412d39f14a4dac7c26d719a075e9056ba911ea9e8d714ec41a6097
SSDEEP 49152:4SuZQIY0Be2KIRVtOnks6NMHqUDYf5zaCpXxPuR6E9dA:i5dKOi61aoDw/z
TLSH
T105C5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 db453a10b5f54a70e0ca9dc40dd89d824d806f221d943e2eb03bca033d8d99b4
MD5 70187bab0cdd6fde02ab82be13289ffa
SHA1 b471d5abf963a2491d619a67febf3e7f708c263b
SHA512 b6fbb4cf128b0efd9254769cf140ef5fa7846a7da31e51bc7bb8e99633e6bc406f991cf61b1f8f634222b55d39b7e3969e06f97f16079ec5d42f558b28c44242
SSDEEP 49152:ihtSn8EApI0figGgiDn0AP5wrDYf5zaCpXxPuR6E9dA:DX2i/phsoDw/z
TLSH
T14195BE13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e7437f3f790e6384c06bcf70afa49f322d1ea08a3dd927b074704fb47df74cb1
MD5 02fb5c2cbffea373cdc1ee89100b99b7
SHA1 3626be470e2d734214d51aa83ee7a560c54eee82
SHA512 183d3c90f43ee8f84a0a2eb05143fa659be6a4ff0aecf107f3792416024a4b8969de555273bdd6ad5953eff61eb1fa46dbba0faea5d817e2fc00a8c31ea396ee
SSDEEP 12288:uTOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjc:uT0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T108C4238EDF0911F6D4312F3C28B1E324D2D87E21BED53ABAB7A1D14ACDB574B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7d61d99b4f0a1550aa4fb63e75497499ab53c06e05a83926b3c6dbdd7e998029
MD5 564130615f8eeb866e8156e1bde672c0
SHA1 d6ce8320134ae3d88b70e606ac0ece55f6020b51
SHA512 96f2995fae6dab8a1d6829390f16051d3942dfe23d26b5e6963960f9b8fcd2dceb4efb6b0b7f3c02316e1f2ce257bf5a8d1b5a9cab2399e03282805cfe8efe6e
SSDEEP 12288:AOOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjk:AO0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B0C4238EDF0911F6D0312F3C28A1E324D2D8BE21BED53ABA77A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b0bdc9d1496a3947b3763b1bb54f94d120ced9b4db7b7c41140784a143df67da
MD5 b838ecddc9cbe6ce344ac058385cea3a
SHA1 649b3346301369c03e59b9358d9195c18f73d39c
SHA512 a73c36b72f5fc7806e71a2e7281733e5e988430825d5d5321160e88e890957ce6cc2ba77925460c4d38aa1100c5d770ea1baa6ae571ef9868b58d2679bfe8d5f
SSDEEP 12288:IEOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjk:IE0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1FCC4238EDF0911F6D0312F3C28A1E324D2D87D21BED53ABAB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a138fb35331f83726a355fb73cc8c6c51a6a5a0ff192da4d2d06923a31544c59
MD5 09cbb75e97687713b6f7ca5aef2be0ea
SHA1 ad1e8b00bfd25354dfa96acb8bf312a7215d09b5
SHA512 6c48bdbd8034397c7d7752c7f1b97f2d673a9f3c965b12c57dcfb6a57905ab1a0185de0d479f2dad662496c65e9500f8857d2c81b78d1db244a8418ae2a3730b
SSDEEP 12288:nVpOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjL:j0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T170D4234ADF0911F6D4722F3C58B1D225D3E4BD20BFB23BAFB750854A8D7178A9474A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 462dccd4d94677d8f21ffdd4b2783e5ad09ec8efcd6fd12173b1065c3ae1d30c
MD5 e1b350b44c0b5be682f2b2c604c13c4a
SHA1 d69bba7198438f051f8f0d0249e5d85d1baf6c7d
SHA512 c8d43552fabd38a5424961f805a09b55d81e8926b08c5d9e17790b27fefbd74c248c4f72072608a3b855507e3f1bc5a74e9b4fdcd7b1ea12407b090198ba3102
SSDEEP 12288:yBOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:yB0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1D4C4238EDF0911F6D0312F3C28A1E324D2D87E21BED53ABAB7A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2937249eaf731954278c542fa39621d0472ce4dbaab542cc57a838e2b4cbbbf4
MD5 2b8a3483b42020240326068cce2c9a54
SHA1 7739cb9b3a079a02954a2fc5d5ad686f3846efe4
SHA512 28c0ba7a284e5b4b6676ab29b543838e48233bc24b7a087fb31b5a637e669970cdc3d3ece1b5bf4da2e7caa3de371c62e61badb20c6dbe5207b0380786cce356
SSDEEP 12288:u6OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:u60Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13DC4238EDF0911F6D0312F3C28A1E324D2D87E21BE953ABA77A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7ea4d79ed5abe68659262db5e02582c229b239f89798bafa725ce1cc67f54d3f
MD5 a30fba52efcfc452b3154390ffd71b19
SHA1 eebbdde11ef8db065507c59ba459bae7fffeadf1
SHA512 c100dba82144acd02d84838e58769abe0c2816b1bea0ee70248ec7dd91ae5a92cd9d7326c20a04da054780ec574bfd21941562cbfa9993897601d7ac96f563c6
SSDEEP 12288:ZmOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjl:Zm0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1BEC4234EDF0911F6D0312F3C28A1E324D2D87E21BED53A7AB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c5a27f4bfefee36d9e6fa8dafa9efe2952605b2d15f4263285a3d0e00a840bb7
MD5 18e8e6f5d28f6363864f5db463681c7f
SHA1 cae7a9126b86b42d8abd7dce3f84e80757b81360
SHA512 8bad5fabf175763f5e735eac44c6514ac15d26aa225c862b38032ab1a555150cdf2da801aa3937726f9f9e7488dc3b05de35bb03e773266249c6dcf4cb1352e1
SSDEEP 24576:7ZMJzFVSOu0Djsf9nz4mloFQnpXUMPQDR6q79dA:7ZMJzf1DYf5zaCpXxPuR6E9dA
TLSH
T16A05F199B75018F8EC73463D88618A16D2F27C261BA0DA1F13E4366B5F733911C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 65a521066f1fe65888d48cd371d9ffe7dd87aca751bc974466840f08907bf74b
MD5 9e4b12eadb9bdca4db1c2137777e51f2
SHA1 fe0c68a58576c4d27661b702e54fbdeb8fe6b8c4
SHA512 a0ceb2add27c88ce7a5d46d8272c8d7e0470eead95d24c19daea063a4e8fc9c72a023a4f4d8b1458d9092b5df7a5f18d77c9651576f5ed15c90b9da1d3944069
SSDEEP 12288:r3OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjr:r30Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13EC4238EDF0911F6D4312F3C28A1E324C2D8BE21BED53ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5901a918966e85a5c996459ec092d7f8ae77fa2ef5cdc44056ead0d703150f3c
MD5 f3d2e6bd7485facd9e9543e2d4c8107e
SHA1 9e62042eb8216cb49de63101661468529c25a99e
SHA512 efeb6596943a835d46ef88a85645abc9a258f02935ad735e7e8b92c8caa36ec605d4a1174919446f438acd0bdd7e47b17ec609d5c230547e68d3134b1b8c873c
SSDEEP 12288:S7OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjS:S70Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T151C4238EDF0911F6D4312F3C28A1E324C2D8BE21BED13ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 2c9f20dd86b673497be72c2bb0e7dadb462a6e492e882efe2f05ac848efd30d0
MD5 1fbd1c056276f3f918572c24e43bfe2d
SHA1 62a6d49360ed3081720a486c8bb94685469cff79
SHA512 0cc126b3b73292d41ef086b061a6cef0a89b84a5fea68b1df6057187706d460b57ec45e71fe8dde3837407c4c56dc31d35da7d15284cca81128c2eb36b67b764
SSDEEP 12288:pyPz5L8iOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjL:Izyi0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T18CF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 822f2532bf384baf059f3ee12a524a9eae46fb55a711ddc4efad93e1a7d9cdbb
MD5 e82b4bc14ac67fa11432e05e93bd4959
SHA1 b28e576721d49a90ceea989567418218fcc6f458
SHA512 e510722e4a27816d33a9c9f0440ac4fe82e21cb7a8253d8444590915dd72a213cd7618d6240c106ac8425d9cf7a7b6b75b110a777e165350452dafb586ff4f94
SSDEEP 12288:c3OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjS:c30Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T121C4238EDF0911F6D4312F3C28A1E324C2D8BE21BED53ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cc4922c0a68e11da9078e8b6e67f9b33ded947cd5c52f9296f199b059ee9f5c8
MD5 040af4f1cd72f568faea4f7a6988edf4
SHA1 0b98c13f21488d9c96148cd7d4ee9ad3ae81f25e
SHA512 158d5617309727a6e093599ec9273c2f7d4d64764d7aabae3080279a0619d9866b94cab2e326adb61713aa8ef682e04d7679c519768c6cfe10fb59faeb6e7b0e
SSDEEP 12288:r3OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjS:r30Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B0C4238EDF0911F6D4312F3C28A1E324D2D8BE21BED13ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a41196b7915dd77dc0365036bb16413531678a85fe3d3c88ec4977141fc2c295
MD5 fceae0bba4d530a1c95c0f5823ec7a95
SHA1 43b34d1cfe3c2dafb1b3a79e4570d259c9d73bd2
SHA512 e43dfe4ca34f6ace239a039cdc4e55471dd4e43f8875305278db5d09d61c3902d9410a0d479c1917480b1a74a48349cc9da0e0851c93f9f76a8add98af36efc3
SSDEEP 12288:YyPz5L8iOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjQ:5zyi0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T15DF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 bb794267f65f079c1f62610c029ddf8d36355f6a03a0e7515a268e357adc7343
MD5 8dfcdf3c41ca20995ac9b98cdee6a963
SHA1 bff4bc3574a1e9d0c41c90c17ce9d266ad49e2dd
SHA512 713cfa882d573a4611241739c1d7ee9a592d0b93e3cf4bc2331e9b3c878fc2480c5b718fdcf9d1dd6dc441fd3072f2d490457adbd8bdc54a0a6128d6c9d1d74e
SSDEEP 24576:5TuaLl3z0zDU0Djsf9nz4mloFQnpXUMPQDR6q79dA:5TdLljqDYf5zaCpXxPuR6E9dA
TLSH
T17F05F199B75018F8EC73463D88618A16D2F27C261BB0DA1F13A4366B5F333915C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6590ac7b86992c7ac50ede1ad0a5df38e02fb8fbda28f69c46ac1d743cfdec83
MD5 fded041563baf0e6f63a73105314e437
SHA1 d012469977a7c2a4d8a90b91628392e6490f269d
SHA512 57bda4379ee7c4421719455f380a7e1bf69939dc8cd43669ddf67695a4c21b5a8cf5b98d19825a91ed89714f97a27e4a2efee0f77539885c76c35d0f28440b81
SSDEEP 24576:o3xd9CHKy7GZw0Djsf9nz4mloFQnpXUMPQDR6q79dA:yxd9CHKya1DYf5zaCpXxPuR6E9dA
TLSH
T1E825CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3b31501bfcbd3b4332702af549eed2cb6096e380f4f2afda31e88c1532424299
MD5 cb349956cf7fee46a4d307fb42122c66
SHA1 8cd20679a1b406021638f026f4db5f3ff2805dd3
SHA512 27238585044d604ac99c2aa2ad1f69637b7b21a38a731b7319d2a5fccb968ccde27b3a96d6e8b5c390995a90d0855cbb0e964cf01d6bb45b1b5f1fde36199267
SSDEEP 12288:okOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjz:ok0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T109C4238EDF0911F6D4312F3C28A1E324D2D87D21BED53ABAB7A1D14ACDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6320a7d8765a7bbf8539696ad93d32b5411c3e6fc99acdc228d7d06ad931dd4d
MD5 44ef7f1028e660e71da0f5560c6662ae
SHA1 d1e4807023a8c8d5428a522da228285bb8fc5c99
SHA512 c6134bc31bcf33d29769e424cdb31d047e3c164e0fc850a85f1325955cc2c912d17d744f1ac8a2947c8bea4e9c557ea620d06e256415109ef699c57f486c3637
SSDEEP 12288:nCOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjr:nC0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T17DC4238DDF0911F6D4312F3C28B1D324D2D87E21BEA53ABAB7A1D14ACDB574B8065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f3ffcb0119fd65e97d2ba4620d7e3f9dcfd26c1a22c640622be798e7390c41c2
MD5 9e5b2409960fb84e044dcf127aa42d8a
SHA1 aa75462b367b18379a311ac34eac58c5a98a69e7
SHA512 e15e0e54780c087b195d381f3656937f78e0459721f9868d4750f2751beefacf21ed437f86bdc29404ac26e43d7fb0abda758a58d27515ef75584bbddb654111
SSDEEP 12288:StOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj/:St0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T117C4238EDF0911F6D4312F3C28A1D324D2D87E21BED23ABAB7A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a65e3ac75894ba022d84f5dfe8037739d271b426664c48d6165a80aecd8512e7
MD5 847b8119fd6039c9579b9c4c3ce612b6
SHA1 d3953321f6da2bd52a49684d85867b1f29bb3bc9
SHA512 8ee02df4cee13c8f9d8c5357412a326c78fbd3a843bcdd0457faf2709ba02725e2f386deeff74d234dcaab4de168bcc7388528259f627fa4093b9a75952e62dd
SSDEEP 12288:33OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj0:330Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T195C4238EDF0911F6D4312F3C28A1D324C2D8BE21BED53ABAB7A1D14ADD7574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 1c89cfbf20f5522cd1aba0eae69bbabb591ca46a10da3e7c262ce3de313c74ca
MD5 9315fd92b8d345f7932c3f3f4f634d59
SHA1 a95efcb5db3ef11a63757ca557c7c41214a174bb
SHA512 a809fc462aac625e9d336b70860de10f5aa70e324484263abe4211583cdc9e7955cf800a7a2c3a1ec2df80159945083db3550e2370e11ceb634a0e33b52d9289
SSDEEP 12288:GkOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjQ:Gk0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T148C4238EDF0911F6D0312F3C28A1E324D2D87D21BED53ABAB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 517ba52e61afe2ed3b83bd3b0dd2d7a7b0d2eda5505d711066c6924183f9c4e1
MD5 f8380af942afadf4307496b769635547
SHA1 aaf1f84c395126edbdc8e95f085efdb7320652ec
SHA512 f4ef995b48072965d263b07ed44b9c5a2f38a12c59adf01378a7cc421e10e99ec885bc47376b20c39c83dc1d82f3058f4a339986dd29269732910f21dd054ff6
SSDEEP 12288:QPOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjL:QP0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B6C4238EDF0911F6D4311F3C28A1D324C2D8BE21BED63BBAB7A1D14ADD7574B8065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 794b8545f8b8ea40505260a7646261dc4e2720ca280910fd10d124c44439db52
MD5 5bdbec874ed3665d5344c42cf4b127fb
SHA1 2fa6af0e75213b70e1f0015a3d79bcce0e5149f0
SHA512 f0bd18435ceb1da7fcb5fadb9ca1bf7a968d3fbfb6ea6bfa871a2d6e72e2bc1df5b343f22362bbd8fac937749007248081de0771e1a4802d24d3df2b71fcf050
SSDEEP 12288:bBOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjv:bB0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T17BC4238EDF0911F6D0312F3C28A1E324D2D87D21BED53ABAB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 34d9995c4a23ab243da2d1e132ca7da76a1c860dedfcb3bb71ffedb98e675486
MD5 ea08ae4f808c105466978d5ea1ff74a2
SHA1 8cc08c92e17ef6abd70da11d9741780c703a640b
SHA512 2968b0438e840600e9eed6eb4241a26b64a2eafcf3d6242bbd1913ad44c293e2316fd84eb0d28ac2013ab7756c69473eae457ed3f60cb7e47112792330c7070a
SSDEEP 24576:pfwvOk9RX6wkyAIr0Djsf9nz4mloFQnpXUMPQDR6q79dA:VMnYI4DYf5zaCpXxPuR6E9dA
TLSH
T17935CF29EFC804E5E077923C99B3460AF2B178691B31D6CF129A53AE0E37ED49D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e562370f6b51b32b6cbd54ffd5348fcb54add514e5bcd533c02a2db27ee43ea7
MD5 9240d6c12ecafec016523d5bee8e9051
SHA1 fd0689b621f96577f40f5bce8632bbe75de0a6eb
SHA512 36a29a5b9d9ebaeed3735f2b4f49719798067c0053724ced817d982f3d386d70f69d9c8631e3ee38d83ce4c027230508915465d0088f0677e11b14c4061637b9
SSDEEP 49152:LYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LDYf5zaCpXxPX:VySzPXoDw/z
TLSH
T1AD066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 64b5db81735987650b7ad6a3fb5f355adca6c4e4eb947057ba4d5d7db9d709c4
MD5 da94684558f84c3586ba640e8ff98999
SHA1 8a1066b92c8effaa1a5a99c53e61eafd2cd28ecd
SHA512 a28aca28bae85b7008eb8c1bdefee98a4d0ec23d8da3cd472dbdf1069aa42dbfe1aaf0ee69b94270128735a3809c0cab587a38d1d694348eabded4454dbe3ad0
SSDEEP 24576:F47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYe0Djsf9nz4mloFQnpXUMPQDR6q79d:F47JUQjairIhCnDHUPfF/7DYf5zaCpXp
TLSH
T10E65AE1EA3DC01E5E1BA923885158A1AEA71782D1F31DACF2270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 82c3d4d78c676610f29d07829aaa4217eac342d760dd7ef4de064e75a983f374
MD5 6680b4a8e65c11275eec89e6227933bd
SHA1 2167d5b7e55a6ed2bb25c2693d83e1e7ffe82071
SHA512 a1c2bdb1c8b705d8c57472e1075b6d18e0abc9bf287931691c8240b1b225f80d9954cb16d6e4861ba9e04b20860ba05a53787e5974c2931b9563afd3f42aa222
SSDEEP 12288:WksfHOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjk:sH0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T14BE4F14AD64802E9C07E2638CB519601F3737C21A7E1A7CB67D0F53E0F766859DEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c28bc22db8b9c896d003d5a8e3a92cb18a5fd9a53d374175f8596caeb01c72d5
MD5 f0940f9633bf851562e6ccd665b3166b
SHA1 84980898592711174c443e12dd56c488f7a6a1d9
SHA512 fe11005ed5eb477e9b57d2b9cfe7265e13816377ce5cb1442f3fb3f223031cf93660a07482eda57419615b2c2cbe76a5dafa8368a0b6126f746a038712063fcd
SSDEEP 12288:FvMBHIU3f9QIa4srDpovk9/+L/t3ZCvUeT5Y:FvMdIUPyRobF3ZCMM5
TLSH
T186352800766BD75FC6A940321E72C1CCA7707D41EE45AB0773C98B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f54d517d2c46579f551cfdf0f30420eb3003ed2a20eaddaa43170d4a6bb84859
MD5 4909706db2e086cfd0a17ec0c43b7e4f
SHA1 e075b7d87d4ad7e86e727699af6d456edafc439a
SHA512 be2f1573172eea09e2129159bc1230878bab3a6350d77a07f957f9bf1b40de27ed852905e4230059e943957789164dfa4c9000957ebfbaa2cd8299fd46104869
SSDEEP 12288:ba4OL5NxEbMKfShk4/YnZWi1wjmWyc1SdxG:ba4OL5GMKfShk4/YnZWiyaWExG
TLSH
T1C165E9815537E38FC5FB2032072A9B4CA764EC46B7456F26B3C4453AD82AB25B4F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8a8215a4970a780ba9079299caa28cc0c7de0fd751de08e5a9d309c1a18734ee
MD5 ec6512f79c5afea04f15b322118db7d9
SHA1 bf226459cb41ba82b379b578dedc166257a9f241
SHA512 651e29c8f37e971449ae921a2d48a8f96f24af7e6d8b9f38caf7fce10288ded593b58f70e5531f4127cbfd93b5160c07b1b72eb632a8b4ec6349cfc5e9e61b2f
SSDEEP 12288:Qz7fOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjp:Of0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T199D4235ACF0911B6E4712F3C14A5D334D399BE207F903AEBB750928A9C71BCA8C75987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b998a7ea8f531632da524ec701d56493e02931c2e77c7c83b3f28695e7a08af8
MD5 51ab36ebeef4d3503b7516239821eca6
SHA1 0114112e7c950ffac4e9399f8db42d514a77816e
SHA512 e64b54827ea18d1fc8166323f41f39da39434d2c80a666d941169477581d87da4f3bb2b9d11b4059a73a5d8d5469a741cbd6eec88db624f1dde743c2eac268a4
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYV0Djsf9nz4mloFQnpXUMPQDR6q79dA:7gb4mBIBhGFpDYf5zaCpXxPuR6E9dA
TLSH
T1BB65AE1E22EC02F5E0F6E3B89DA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a2034b3170de25493ca69bc6476365a1e18bbc0f3c8d0421b983dfc63ac77127
MD5 bdc432c07116cd8dd2b5c40e74c8134c
SHA1 765d59d81d50d7a99405a4f9d4ccd6f4ff12ac67
SHA512 0bae659c4bf3a6a1d9c2e359ad36bf5a070ab24c7092fcf6fe2439f590dd43701018c48538667d00ca4c1d83e67d45ae3ea8ba713dff3e3be476105f519f16a6
SSDEEP 24576:GG88u8FpJqH1nzria7/mu0Djsf9nz4mloFQnpXUMPQDR6q79dA:N7ZFPqV6a7/iDYf5zaCpXxPuR6E9dA
TLSH
T10835F165ABE101F0D477913889828663F6B2B8211364FFDF07A88A551F33BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 394f47054720649c00e39e9d0b1a8709b1d78ed83c0fda4ca2779b1283fa9c63
MD5 32f2a43b59e1a7953137060d9b2ec889
SHA1 c0a45e6607c94b8981bad638093ba1b088156f94
SHA512 389179f892124c53d4a22d45d0c2602c56275c1c21900e6485c38347ebea655b908eb64fb154b70d4049fd70940d66581439737b19fab0b42bee5ef0bd1af0cb
SSDEEP 24576:3PUr+NQq0Djsf9nz4mloFQnpXUMPQDR6q79dA:3JQ1DYf5zaCpXxPuR6E9dA
TLSH
T1EA05F11F669C18E5E676A13C89828319F771B8621712A6DF02E0817E4F77ED8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4437faf7b9f708241ee56e831f1a18017d98ff112ca5168989f519fd5e63c5d
MD5 e8c48c01601c450f8806d42cd63eb517
SHA1 10d03cb5e7cb7bb5bfe627574e80271987612236
SHA512 7e93e6e7ecd79ab2bd41edff6e34b49f0e5c83c96040917bc851ab61ac0d81aeb328f5a27ed3d3fca98f791827f7c789f45ae8a79552368533e55b2472db2f46
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDYf5zaCpXxPuR6E8:mG05lO43buoDw/z
TLSH
T109D5BF6E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1c993a323c55e58b55362e43210024163c7b4f0f8073a7b0fc47e6b2106ee654
MD5 bb165301fd7fda95192e9dcc0bfe8d66
SHA1 16e75ee50556c786e9b13dac9dc40bea2cd52320
SHA512 72f7e460025ec750bd98633da80506e015e46020935e72297c689c90708be3987dbf5b154749296e04664281d217a6bb0bd1a2de1f3185ad20d5a029c29b588b
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnI0Djsf9nz4mloFQnpXUMPQDR6q78:ga5POZ3hJt2pasx2+mtDYf5zaCpXxPuC
TLSH
T1B965AF5EA7EC01D5D5B9D17CC583861AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7555801c5c1197d0e2a229a8200de7e9e19cfa5c1851284b12ccedbc581b4a96
MD5 1443fcb0634e54f481046b0a1a6173de
SHA1 9bc0d4d4c4fc2f72924f1b8351dce14554b9b4bc
SHA512 1e5be8b83bc9e4dc1dc3eb712a24e511491a4a0c7ac93bd706ef7902a35d538d5292ff0ced467cc1041bfe7711db0449205da35517a1155c409a56778ac5a1b7
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fk20Djsf9nz4mloFQnpXUMPQDR6q79dA:cNc/zEOVHFCDYf5zaCpXxPuR6E9dA
TLSH
T153858B1623E901E4F1B7E1BE89779646FAB1786517309ACF0291811F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 06ecab3f5458b803de6626fdd4db11747238bb78d48731e57fe872e079bac8aa
MD5 d3c4b74820541aff130619e434ce68eb
SHA1 fb16c6e0df89729bed7d899172cec51cca3724bf
SHA512 230833a62b36018f176f3718b1a6e1e5fdf320ca1dd17fcdc4160ee12cddce11d769bf64e0d1cb1297248161268ce075dfed8fe986042d3318dacc6254257271
SSDEEP 24576:r3kNvNnaFeYhJNtmZBmM0Djsf9nz4mloFQnpXUMPQDR6q79dA:r3MwBtOmvDYf5zaCpXxPuR6E9dA
TLSH
T18255AF6EBBB806E4D1FACA748D238112E6727861173253CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 99d262919a291e4d49126bab4092d611ffacf0dd115d26b95c92ac38161464f7
MD5 db6003000ce4f12ea6d78409e8612b6c
SHA1 3794b6eafe0550f20c186723470fdc61cb330331
SHA512 d122070b71448254133e777cf48008bfbe1787b8c0a00bd9b3e34402c50df14bb6f8d341e700ccb198589af5dd95311d6d277908cd77cf796e5450c00b6ded51
SSDEEP 24576:gD3FHshBIYQgAz0Djsf9nz4mloFQnpXUMPQDR6q79dA:gDVHeBIAAgDYf5zaCpXxPuR6E9dA
TLSH
T19325E17EEB5C00E4D47AD27C99638606E3B138A9072266DB12D0C1BA5F6BFD46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4384-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4384-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4384-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4384-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4384-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4420-7-0x0000000002170000-0x00000000021D6000-memory.dmp

Download

memory/4420-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4420-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4420-1-0x0000000002170000-0x00000000021D6000-memory.dmp

Download

memory/4420-6-0x0000000002170000-0x00000000021D6000-memory.dmp

Download

memory/4612-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4612-84-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/4612-295-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4612-79-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/6160-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6160-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6160-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6160-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6184-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6184-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6184-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6184-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6184-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6184-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6356-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6356-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6356-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6356-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6412-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6412-121-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6412-115-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6412-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6444-254-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6444-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6444-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6444-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6496-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6496-14-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6496-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6496-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6736-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6736-67-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6736-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6736-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6756-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6756-47-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/6756-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6756-39-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/6756-50-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/6960-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6960-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6960-313-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6960-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6960-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6960-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download