d1ec647363f69a7d8cc22f341dee8efc23e49483a50d4a09725eb095e40e1946

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 725KB
Sample260828-n4mpcsxbpg
SHA256 d1ec647363f69a7d8cc22f341dee8efc23e49483a50d4a09725eb095e40e1946
MD5 936948135ba6ca32d80bb6e1ac0c1620
SHA1 f9c3f31ac12ae84a56c2f686a1b08eb39229e3be
SHA512 bd993dccb8e7d59eb0877b2f82dda13c1d1263e6999f6476aba0be6f2d8896bb4c4f1cad64aad01fb0b5a9855446fdb829c62860dd6919f66ef154787e13a5f4
SSDEEP 12288:P93G6vHzOASubviBNDYa3A/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/D:PVGGTWBZ6HoGjhZFlScIu6UKTl/QHa
TLSH
T192F4022132C1C576D8B3193044B59A71A63EFDB41B724AEF23646B2F5D306E28936B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1956	elevation_service.exe
2032	elevation_service.exe
3920	maintenanceservice.exe
6196	OSE.EXE
1692	PerceptionSimulationService.exe
6596	perfhost.exe
2064	ReFsDedupSvc.exe
2768	SensorDataService.exe
6012	ssh-agent.exe
2776	AgentService.exe
2128	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\824f36d7957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ee3d064e436dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000f5e466e436dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007610bb65e436dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf519c64e436dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004ad81966e436dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c626b966e436dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f91b265e436dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1956	elevation_service.exe
1956	elevation_service.exe
1956	elevation_service.exe
1956	elevation_service.exe
1956	elevation_service.exe
1956	elevation_service.exe
1956	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	2776	AgentService.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: 33	2128	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2128	SearchIndexer.exe
Token: SeDebugPrivilege	4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4088	2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1956	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3408	2128	SearchIndexer.exe	101
PID 2128 wrote to memory of 5068	2128	SearchIndexer.exe	102
PID 2128 wrote to memory of 4360	2128	SearchIndexer.exe	103
PID 2128 wrote to memory of 4852	2128	SearchIndexer.exe	104
PID 2128 wrote to memory of 3260	2128	SearchIndexer.exe	106
PID 2128 wrote to memory of 1260	2128	SearchIndexer.exe	107
PID 2128 wrote to memory of 6560	2128	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_936948135ba6ca32d80bb6e1ac0c1620_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3920

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5704cc366b6c4365583d69271abb2750c3e95fc8285f903b6b614185f02e82b1
MD5 ded4cba9842d7d20c8cb40a72a96e9c0
SHA1 c3c243aef617bedacf607ee8b7746e2b9d12ee91
SHA512 58a254d06c0485416d66ca0e6cffc8823e7ee73f29e5ab32df5fa286e8b41b57e0786b5f9a1169d7e4aaa74abf431d1744c6f17b07d19092c2cd9c7491ea5b6e
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWodRoKTl/4:u3q6HjBMdH/4
TLSH
T1E7D59D03F2D901E8E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 87fc88b96d6bd617f6439c14893b61495208f9820db3e62aebe842c6c6c5cb09
MD5 7a043d711cc066ba5213eecad4785b94
SHA1 c215ae6dbf2145e8ea34d37d312547d97a97b016
SHA512 f0fbe84d4606bc8e6ecb3fd755e6944bc287641bfb50adb5c23c45b91e1661a73f9e23963b7188c022e55c5b3c90b7295ef63121b209611d0752fb37a38e9f02
SSDEEP 12288:A1XLsswWkxy2lRq2czA9/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4d:WXYfDtczAPHoGjhZFlScIu6UKTl/QH9
TLSH
T1F205F12877D109F8DCAB8179C8A28515E633BC954360E79B03B4DA261F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5568e0913594f7b788b617e9ed11f47a2323b700270c68f86939064adef9c229
MD5 eee28a01721dd99d4cc534a26984d935
SHA1 12a0cf12e9cd441121b3f412c796de9b75bc47c6
SHA512 38c09163ab23eb97527d51fb39d7da13a45538694a3ff7f604fdbd1a9b647647e537946c3a515c1754eff98e9c9dc281e0f299029e3467b35e6df8fd0bced571
SSDEEP 24576:z0Le5ji0hmxirMsHoGjhZFlScIu6UKTl/QH0:zPji0AcdodRoKTl/4
TLSH
T15B35AE26F6748335D073C0B9C5D2A68EE932308657308ACB4296D77C7E27BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 18b3d01d76e60a083b6380afb0286ab34b0d7a47833a3fb20f2909cc18a2be94
MD5 48a933e240dcb2f87b78e231757ba862
SHA1 c49c4c3c8255c638e4a7e0163fdc99995e83740b
SHA512 11cfc145d32157433de34e777042ecd81523c6b8c23a9a5abe39c747808d9c2cdc93554994eb829086b58b16f91619f8c7ca67453f56799ef77f5bc9d5baeebe
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyueHoGjhZFlScIu6UKTl/QHV:W/ezSC6vUzPvxHjyxodRoKTl/4
TLSH
T1E1755D15F5788323D0B2D0BAC5D6BA9AFE323086573089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b0232d07088afc98466faf34c6efab839bc62bb068d4f3d1826e989b3e6d4c95
MD5 13fe1c900d42f35c3cb6e1f37bdbf9d2
SHA1 924b89a842ca3a6659864fa9862f9e51af6baa70
SHA512 220fed14697df0597ab9ee66c10ee72ce09f738c87080caa5af9b62b596daba995d4fca66ad53ea421c52d6b4aa36f4a43e26973ef1a1ac0a8ae3cbbef261140
SSDEEP 24576:0VbqPb88hv/l+6bHoGjhZFlScIu6UKTl/QHM:0VO88hXl+CodRoKTl/4
TLSH
T1FA559E66F5B48331D073C0BAC4D3AA9AEE32344257318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 34cc94a89300b1cfc779a6880ba5ca403ce1f511b114b02b571b2535854bbf7c
MD5 e1466f6852c07f1b2eb450ff22d5e2d5
SHA1 e7944d25d4bb98aac7f8a3ce8b619ff48af24c31
SHA512 a7b2acb6f9574c6867d085411fe39a6397145ab49e96bea672ca36975dcf735e03377c36a743fa43be80e62d42221d89c295553d450056cbe2031b0d02196f34
SSDEEP 12288:DRi/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbL:DRIHoGjhZFlScIu6UKTl/QHH
TLSH
T1A8C4232557C24B68CDEE087250EF4A5EE23BEDDD50235A2A1335FF6B8C38666C1A3511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 81f13254994d9d0e8c5928e81b429d50e88258c13fa5a2fc43fc7565e9488b22
MD5 47d62726bd9ae7a61402c13542492bb7
SHA1 dd91022be06ab4e7e31a430b28029987c1777bce
SHA512 dbbebd1485d058c8437201e32174c289ef7a0cc4a7cfaca1971377e7a5274f559ac5c9cc76bdf6d2b63d1ca631af7258281871fb84816d57b3c611cffda326bd
SSDEEP 12288:ZeBNUbTVO86UR/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbp:ZJIUzHoGjhZFlScIu6UKTl/QH9
TLSH
T14905CF3BAE28ECE1C67E4DB956918640D77278704B22A3CBD235C30EDE235E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2cbb30a6718c4ec41e4937997fb0830704dce97c50f18236cfa01c1274cded74
MD5 35a859f047125966ac75f93c705d869a
SHA1 b98435de6868b054a48d8b8f607b81e60b341e53
SHA512 f5f8266f9da556fb81c8c240abf2bccefb916861ccbe47bf714c514f96d79f127b2f817667cc913c6c32b405021201f87a24b0a0575f8b628a8ef8764716cdb3
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:wQvGAdlCEL8c/yRNw5CHdH/4
TLSH
T151266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 06ef41148c06e127f4bd79bd3e7aa34ad1d471ee3b920256e26a4178d2571449
MD5 90a9a26b3beb59ef03dc859b9ba27eb4
SHA1 9ac45a99572042d39aa9864e765376ed0667719c
SHA512 612a79b8e9d0755b84c69c85a7a988031890338be3e9859b9d4c9f04cdf32a60913f68a1699231218396e3c90db926213af211e03a00b7f5c818f6296b577b0b
SSDEEP 12288:YAwSfxL/2Dc34DLLmt0LDQewsAjv/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/t:9dewsAjtHoGjhZFlScIu6UKTl/QHq
TLSH
T1FF15E031FE70D436C6BF0DB21B66C716543DB9604B621AC3E3B89E9E49342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4bb159824e3bcc1bd6c09637fa5abf2d7bab94a259405f7e27e2ab2d2af9c918
MD5 b894c7e6d3809e73ddf850c5bf8fb514
SHA1 8bacc96036c687881494a1d3244e37c9f70d313d
SHA512 58691c306689d04edfe7fbe95c6a477742fe740af18d31ad29a3762a3a6cd6d13617e0bb742f920e5fd6a7ae37176c2ec22abdbfaf872828dd8c373c4b2b4689
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHudH/:mUEtQevvqc2W1cpV2EI32uR/
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc59f1c45628e063a80ffa19485bc909823400f1611b1fc2bfc2a90463b32b5b
MD5 32b3e40480ac5ee2e5e5ededa31813c9
SHA1 eff64d47930491203a968129b52d7ff49342c0e5
SHA512 f6a6ab412722f6629d753be7de285286fbc0d0676203cdb0f3e337783f1104d32c44ec77ba939b9529d3460fb8b4b92f304d9b19d58cabec4c9e841ad3f5cb6b
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/zNodRoKTl/4:3oquVjnmbdH/4
TLSH
T171D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2604686a8a8294643ad43a1bf87311b364476bbbb9fe93ae11f453ad330b09c5
MD5 5d114b94e74a3def041f7a43eb4bb2a4
SHA1 5b8d24f3a1b0e8a362a11bb26071a1fd39a621c6
SHA512 c02d992bd4c2c43bd725114bea5df16ca0c5efb48c312b4ae095d0fb8ce44dbf6fcfc016c93ddb80ab64fd842d409c48220e128e25dad91d34f9fef6ed527420
SSDEEP 24576:EAhGLJIFoiwtA5l7S53yHoGjhZFlScIu6UKTl/QHT:EAMyFoiq5EodRoKTl/4
TLSH
T10A359D81E7F545D4F5F3AA7899B68171EA76BCAA5E31C20F2260D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7de5e58b11621023fda38dfc316ed83abb7da5897e9833d9d6560ab2a338ee10
MD5 d9f7dbf8db0bf644282e95b8f5a8b8f5
SHA1 0d23655e06147cd1b59cdb65685e80ba44efca86
SHA512 b6dd280ba26cd432a763bdeffb51f8f6fa62c2d5e323e97916415b259a41edb31474c7f8877db49ad04b3241a9b0bce4e6854098cc833b897dcdfce5e3073abf
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+CE/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJv:xwuoOWRHoGjhZFlScIu6UKTl/QHI
TLSH
T1A805F04637E50CF8E9A7813985978536F7B3BC462622DB1F1330C65B5F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a3d62f00e9418791b09fd4672c7cc41bf069bff9b2b5a1e079dbcb38e1380e7d
MD5 2b53ced6ab7872f70226de38679666b3
SHA1 e6678f9b8fa9014c330728f9f9d28f0747368592
SHA512 df49be194af0d5a34de74ff73c892b6dbbd6a0ad05c2d8e3211b7bbb828251d6b7638a81801c79efa661287b06118fee79fd24075d18dbd93b2de07e57c6086d
SSDEEP 12288:RBZ1Iy//lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbO:/ZuEHoGjhZFlScIu6UKTl/QHy
TLSH
T1EBE4125A23D022F8D5E7417988EA4649E337BCDA233243CF1335A76A1F36AD25D36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 691cb30c16456c187fb65b765a42b70c0ac643f0048b5115071c63242fe91731
MD5 e7f362c8675bec40d0ed8f81c6414fab
SHA1 bd6bba24ce576098210e677d1a368567bbd81f56
SHA512 5d6fe62d3073c10c9d562fb123b0be565c57a3988899ab41b7f31b098e7c2de48c47aad858684d8dac246bf11a76f7fc520a1adf79c30edd543364a761e126aa
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:nQRQyi36YOcPQLvw2gAf+PN3IdH/4
TLSH
T185666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6a86773fe9dda94d55939dcc8e56cd6221d939d5bedac7f0580866ca08e82d34
MD5 b44de63ecd576f09537255faf71ef889
SHA1 d5560598ae2e5715088b7966f2ccf9ec34ff91ff
SHA512 8e806fc12e7ccf73e38277ebb9edcdd83b14337f7ac666119a52f3bdb0f826ff1ae7c753a4f128f8081713df462964d8f408941a5b281113fc3ebacbe255df53
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:iQRQyi36YOcPQLvw2gAf+PN3IdH/4
TLSH
T1DE666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 72319afa55f401686967f0ba91233aa8fbe0052e36456e497b4451ccbcb9020d
MD5 cae86ec9e3220a2110c8310f4f75d6ee
SHA1 2d921b75699054866aef0ed41659e1fdd17b8024
SHA512 e8696f86ab85656866fc6400ae124296eca0fcedfba364d72a09a997de1649d1496c067bdf6d8a54f7db2d336f4a6fca39dac851e4529eb97f963c2a709a5dc5
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00HoGjhZFlScIu6U:L68Qg55nhheWu7PNU3/dodRoKTl/4
TLSH
T117B55A33B2F200A9C44DE1769F4A872196D27C758FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53a673bad584c1266ee7943907d11ef1d3e270f7b539dad5dfef60acde820d72
MD5 5242e6bde87da68d183a3d413283b39a
SHA1 50b1c72692b6be2b7d60804b502152f7b82402d6
SHA512 5d51f4aecba91639148e1d72f97d985658db74ffbca13980f30c85fa8150f1188c15521d7d058ffd6b17d761fd6989e946f9bb523422ec7748f9bc8259e06312
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Wy5112gYy5azzVvL69nLKnhZpdH/4
TLSH
T1A2168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c9619b1a6571cdedb65ece30d4e40230810e7370aac242121df917610b1c6410
MD5 70a847da01663178d301dddf7fe69384
SHA1 e08733118e0bc9ba10b3cd68528bbe4f7ac701dd
SHA512 293bfdd527b96dc74824dbf881e756f43240f1a29d191cd3ce067ac9ee299ee6f64492d5ec4de4f135d1bb1e3b8ecb13009c44f84535acd06d74f517036ff6d8
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfodRoKTl/4:vu6JmVxd2dQdH/4
TLSH
T113D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b9d6fd045993145dad3558911b3853d12f98385591ac04c0edcb943b343083f4
MD5 69515bc775c52af33651510ef6e356b5
SHA1 4a2ab10ac07ca414f650d64ea1e95aa807179c9e
SHA512 619a0eda825b8f429420f14e1dc01081e5345cddb060307533d8f54b7355e4ee0ecfe7fe550f810cc95aa7e1eb6b279dc6f1cf1e008da76ef0e554531261d3aa
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xjodRoKTl/4:jmifPbRbdH/4
TLSH
T1E8B5BE13F2D901E8D06DD17887569232EA72BC460B31B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c1ee04d1f36697c7be5cf4e81ee8edcce91bbb69d714470d4672061b7da15644
MD5 d7c409d186da8fbadf254872f52b57fb
SHA1 d9bdbc345e3d06b1df28ac87806ad6dcdd6b0417
SHA512 5679fee15167b3e9f421d0d2c64e5db0bd24dbd25e19839da46c68490aa3e411a3c281752967e45a585ec57b6001762e4fa2fa427e07cb0c623cc31f7ec5192c
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqmodRoKTl/4:C5dKTi61VdH/4
TLSH
T168C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ab66fa5490847ff5fd637eea5d3738452163db73416e98e7384fcffd1801e3b
MD5 cef8128bf9c8c3fd4cbd2043d6f47762
SHA1 337d5a06297dcff65159b32b152b1e618689b794
SHA512 0747c1d93776781813421fecf7aef9471b0d8424f92701cd4f1cb15a5db38cd5b7c1e701734676d7c9f17d99ea422e788a66839a6617d2a005046ade046b3b0f
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wvodRoKTl/4:9X2iyph/dH/4
TLSH
T14495BE13F2D901E8D05ED178C7468632EA72BC160B35AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a6427ca392aacd27941838a98475279130bea337ffa4b5bf5f09dd89ce164b61
MD5 dcf2f1630dc4b6220d7d0ae763194cc0
SHA1 8a1533757ecae53be8c9e4d3e92733d24491b457
SHA512 52f6d02401589f431a9042cbc4d8b015c060f8584d3c9de15861550ae6de4c4ff79aa1bf2be0fab53ae2c788cac63417da0e0031a5c4d842105fb119e5607dc0
SSDEEP 12288:Qq/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbI:QAHoGjhZFlScIu6UKTl/QHU
TLSH
T1BCC4232566C34B68C8D948B240DF478ED23FEDDFA023576E2739FB274D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 550c8d662c7d51d5e680615e45ccb0c22f3952e0277a60b67d025ae6d347fd44
MD5 998054b331ece3d4ac79bcc3bc359cb0
SHA1 b765da0e70ec20a06f111547a54d4fa880514576
SHA512 e4e3d8cc9ccc739df46e38fc1d58eb826d43939a60870fefd7b3683945ea261fcd51d69eb313f485dcaf6516464995dfcd8b536696d05c986c34857c80f012d8
SSDEEP 12288:yL/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbY:y5HoGjhZFlScIu6UKTl/QHM
TLSH
T1BFC4232566C34B68C8D948B240DF478ED23FEDDF6023576A2739FB274D38A7641A3950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 21340637f6bc88eddecbfddb72625c1eb6634c0b5ea9be06d1aecf6389d5e10c
MD5 e3c2ce5e8696291c8f33eef39a991078
SHA1 a74544824056c1f4b7d2a32bc1b91a346c2b75f6
SHA512 8467f5eee97fc23ccac168a12b6c9e32bbc229ef86671159f60e567eb1165f075aee3146e2dec624df6867e5c35585041bf877b3766e216f769e6740f8a5e3e8
SSDEEP 12288:J5/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbY:JLHoGjhZFlScIu6UKTl/QHM
TLSH
T1E5C4232566C34B68C8D908B240DF479ED23FEDDF6023576E2739FA2B4D38A7641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cd6a1573a3583defca0ed4958617203f0b81f5a02072df6654a3aa76e88c60b8
MD5 8f054e007cdfc05480d5421a614eefd6
SHA1 1ecf00e3ab4d8764bc6740a1c579b2331d59a8b9
SHA512 f28a4e32944890d53e8eadae9d14c290b45809645db5c8e58688dba0bce73c61ce53355979cb75a5edeffb10d1ff54dfdd0b9b64c7687b9f9924d426267ed1c0
SSDEEP 12288:BVY/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbi:uHoGjhZFlScIu6UKTl/QHu
TLSH
T11BD4232527C207E8C8E98572C0EB465AE33BFCDEA13357AF1735BA2B0D347A15572A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3ac4e83a45dd660c57828f9f61f06bfb6eb253049608db807d4301716f55b5b4
MD5 32246e3e35d881f1fcbef7cabed6eac8
SHA1 581096956daeda811625f62a4daf291611861364
SHA512 0769b999c13a50117ab34408c39c83ced6dbbb287ae51f82d281c54b590bfaa42e5085250f0aed991e8030d81882216266af5b164959b36f01ded66fcc0eea8c
SSDEEP 12288:5Q/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbT:56HoGjhZFlScIu6UKTl/QHH
TLSH
T192C4232566C34B68C8D908B240DF479ED23FEDDF6023576E2739FB274D3866641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e866fdd3c4c7751a6980f7b98de8ec50d3415608268a8d14cb2c12c6e69aabd0
MD5 0b266b2918000525008559ef3018bd51
SHA1 0c16ee4521db13a42493883d626c2efd3bc4b803
SHA512 61553384a0b3c70fa7b8c3f62149260e4dd8a8e85b32416e78e50589c4e93eaae3d0a066f66828b7a168f681f8f608d82d84a2bbdb71eed3b8d219efb7bc56f8
SSDEEP 12288:JX/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbU:JlHoGjhZFlScIu6UKTl/QHo
TLSH
T1BCC4232566C34B68C8D908B240DF478ED23FEDDF6023576E2739FB278D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 36b7ac1a3a873a6332adaed628c2572ae1264fdf8e0b1ee9a7ee3c3feae804ad
MD5 7aacd85b883a34e8417fd046cc077340
SHA1 199575872e3086060aa953b0020d3c40fa28f637
SHA512 fa8c119c973e9e7e6facd27e2c28a41dbcb64baddbddafd672bf566f36d06316678e94d4d0df4ed2a5639ad776d0689fdd7c6f9a9952718c66327bcfab085f5f
SSDEEP 12288:ED/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbc:EBHoGjhZFlScIu6UKTl/QHg
TLSH
T174C4232566C34B68C8D904B240DF479ED23FEDDFA0235B6A2739FA2B4D3867641A3950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 28520d11737e9918a264cb48dddeea14c9f46cdb8a3099d9756eb4cee201b3c2
MD5 a3101b789d4afaaf6eb32bb9652095d1
SHA1 b00640d3ca7e0e816b9b2d92dc6fb172e64c8eb4
SHA512 5ae042c169c98439a3237881b15336bdf1c0c5981ad5add99286c10ac35f1b6c9fcf59c930ad81e6c1aea23f69827e392aea241ec41f6538f845e7408471fc81
SSDEEP 12288:EiZwb6zzFEoS2cPvyr/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hb1:nZMSzFVSOZHoGjhZFlScIu6UKTl/QH5
TLSH
T1D305F1A5B3901DF8DCA7813EC9568906D2B2BC9A0670C61F13B4366B5F333A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ce36179d37f3025a0eb8d9f249c4e031d36b9f6c272c15ac5f8515da68adaac5
MD5 a9aafb8676ce6cf7c55af09691849e2b
SHA1 f9bfff4477065ca071b1c3793364b85a2ffc6c7f
SHA512 fa7d20c0ddaf463ed10d849d083027ba3998c14bcbff43972795303b9b291a80125e28efda846bf5880ba7e8a1cf60299ed6d13697858feead3ea9337a2a1ec2
SSDEEP 12288:iu/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbU:iUHoGjhZFlScIu6UKTl/QHY
TLSH
T183C4232566C34B68C8D908B240DF479ED23FEDDF6023576E273AFB2B4D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6e7e3e8a58d926eee0ff70be0a56108d79436225c99dadfcea960685e38ba518
MD5 11aac450dbfbbe09fdb11ed8b7e88693
SHA1 6b9f7e0a31ccb7d5533cbedbf4d8fec91f86114a
SHA512 49ab61cf0a28339322d768fe9e7ea5c0c868046b318607ea21f8dbafc30fff1d316ad3fd902dcedf3002477f2c8bae6e0ecdbc810ecf2e139119799bb010d856
SSDEEP 12288:Xy/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbW:XYHoGjhZFlScIu6UKTl/QHa
TLSH
T1D7C4232566C34B68C8D904B240DF479ED23FEEDFA023576A2739FB2B4D38A7641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 250f667ba71935f2f25b6a8cd8921a03751aec758c37f0e387b23a24e21dde75
MD5 198721420e2428a5672c7dc6da65bbc8
SHA1 3987ca6b975c4d5a9c38a33b16999984a73cf71a
SHA512 e36002cb2dd8cb9973dd6681a05a427c385d77d5ca631829235073818d3911a4b88e3529ec640db62361c0ed58cde19c44b90dea764973d1918ad6320756e642
SSDEEP 12288:zyPz5L8//lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbo:+zy9HoGjhZFlScIu6UKTl/QHE
TLSH
T1F6F40217739221F8D4BA813588A60A06F336BCB653218BAF133457771E376E19D7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 04fc165f38dfe46b9f88d7d283e48a7b70573ffb58c8d0fc2a76f035dedbad94
MD5 1efc016bc6072698b76b2a8f298d5816
SHA1 8a42b80116025ce8705234eb622f4fe587ab78d3
SHA512 c19a5353f2312b2267d46a2483a778026bd211d3a322c6097dfecc778ff0f76ed61763bdc54b61b80b47ae3c648dc072078d3d2cc493c5df033d3039ae6c9a5d
SSDEEP 12288:Ru/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hby:RUHoGjhZFlScIu6UKTl/QHO
TLSH
T17BC4232566C34B68C8D908B240DF479ED23FEDDF60235B6E2739FB2B4D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2075d70887471cf16ab74ebf9234645a44f24fdde68937a6d9d7789207822b38
MD5 03e75b36e61ef413a8b6365e8fb4ce5e
SHA1 d7f60032f719b3fb0ca53ff392659b4c4c7d5ae9
SHA512 adabd15fd22bef331bd9a99a46f74e02c7a4a8bb242b45f2f55972485f2146e5ca02b613762d055b4ce705484be4d495628e8982008da251fc9465737daecda6
SSDEEP 12288:zu/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbW:zUHoGjhZFlScIu6UKTl/QHa
TLSH
T19EC4232566C34B68C8D908B240DF479ED23FEDDF6023576E2739FB2B4D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 736539ecb3afc647095ddc5b9ac1562ea36a6eb15b4d534d2954d3fec33fe43f
MD5 35d80dec6069d1a76586cc6e931083f6
SHA1 3cf125880c89eff9b13799bcbbbc9be7c197cfe9
SHA512 4eba2d8b1119f3a17da37497825e954f7e5b1b1eda7a35c70f30a3b068b904311cf186059daa2ca302d2307de4ecd559b52d945d9e2d03b30eb08441d9ff64ae
SSDEEP 12288:oyPz5L8//lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbK:pzy9HoGjhZFlScIu6UKTl/QHG
TLSH
T154F40217739221F8D4BA813588A60A06F336BCB653218BAF133457771E376E19D7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b822eba0b7c1b43363075ed35fbe32c34bacf2177d74df0cf84a8add70e4b80c
MD5 72fb92e73e90a275287f8ca2272fe3dc
SHA1 24c5eb8512649ed95150bbaee24482550d85a4a5
SHA512 0abb356e1f45bb03e2988af68c428373f71412d65d7739a508522d0baf7a1cc2b68808853a8a24fa07dd0a7939edc459f3ecd55b80c578cc0409ef0918700e72
SSDEEP 24576:DTHaLl3z0zD7HoGjhZFlScIu6UKTl/QHG:DT6LljQodRoKTl/4
TLSH
T1420502A5B3901DF8DCA7813AC8568906D2B2BC9A0770C61F13B8366B5F333A11D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6e716aac20137df4edef32ec0fe511701fbecb44fbb99e536ebc997d89b8d455
MD5 79558cb7cdd2ee6f61def0b9045537dc
SHA1 bf83898098b6c7b00662b42ca82364c5978b1217
SHA512 4007c7a3cc7d6108907dbfb382f3f50d89b17f73b32d19e956e877e78da428fb9ba16482bcda3e687ab077169840d497ad40a68de2bb774a82b70bce6b76f9b2
SSDEEP 24576:W37d9CHKy7GZHHoGjhZFlScIu6UKTl/QHb:47d9CHKya1odRoKTl/4
TLSH
T1DC25CF90F3E415E8F0B78A3589764511DA767C9A1B31DE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5f99aa26e0236c8c819ea71be5de8613b3fd3e72f617ffa23992785f44e185e7
MD5 6a294f35682d6ad3ee0be1975d589134
SHA1 c55527507f21d5ee48786c049c8c8e452ff4a882
SHA512 17a8588ab005a86613a48ae4d650470162a7cf50351bf1d0d7658a68e88ed2f33acba90cd94c79c71716bf7a1ec49705a88efe0189578533f2bd303e855961d5
SSDEEP 12288:TZ/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbz:TrHoGjhZFlScIu6UKTl/QH3
TLSH
T1E0C4232566C34B68C8D908B240DF479ED23FEDDF60235B6E2739FA2B4D38A7641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0b2eedfd74a29d9d8ca16fd5aac8b9f72027e469dc454b694316ff732f55f5c7
MD5 efa4442ccb83b2d2a03f0a0b9549aed8
SHA1 128f711ba2eaea22815a12260524290e0a6473fe
SHA512 e088810fc40e59fd693e4505c19776feb6dbc621f05b91d30f7b1026eace077e2ff5193a29a4c0151eb6bf49776937e29ef2b253a187852287cc2b1fe76810d2
SSDEEP 12288:if/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbF:idHoGjhZFlScIu6UKTl/QHx
TLSH
T11CC4232566C24B78C8DD04B240DF479ED23FEDDFA0235B6E2739FA274D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c2b0a2ce27cb833d7ad38d40f5dcb76b36b2b2dd71fa442ed6ab5e888a6efafb
MD5 7e9f785c88a5e7c7d5a2efc11150e089
SHA1 7cf3721fd7e2227bc6df977a39613cce44d13190
SHA512 5681b9d1764744a5c2211006db51c4a2f3d4b934425f903422b09a410fee6043b33e28638a91a4e62cd1689175c829a0441a385f76a456eff58a8fc12e5a8843
SSDEEP 12288:Ec/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbG:EGHoGjhZFlScIu6UKTl/QHy
TLSH
T125C4232566C34B68C8D908B240DF479ED23FEDDF6023576E273AFB2B4D38A6641A3454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 23ddcee05f42d2bf44b666b99f43609103cdab27940cd2c45a864d744eca735b
MD5 d85457caa8563b9b2571807a6df2fb95
SHA1 14c2b04b9082d7dee758512dea49de2413e4a5a2
SHA512 13a83239ceb435c3a86138790321db5ea638cbdb36bdd8b6b766a5f400de81d666be3eca8ad0244b9677d4e552c49623f61f3987d76fc97e56887c8c6ad7037d
SSDEEP 12288:Qu/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hb4:QUHoGjhZFlScIu6UKTl/QHs
TLSH
T1A9C4232566C34B68C8D908B240DF479ED23FEDDF60235B6E2739FB2B4D38A6641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 3e4a9f723a75f87bafa3d6ef00b1636a2cacfdeb5acd8edb29edddb691948ab4
MD5 f862a0ab3317dc3a380f438d09d1d0e5
SHA1 8786d46d0aecacc46563fc421a1de17cbe661339
SHA512 5dc0679bcc39f61ad5246b9034ad9914226e4de1e05a1c46fa1efa7a7b5664ea67d8fd790c0e8e9569ff959b8422d2425df951e3bf787c493c753bc6e425e4f0
SSDEEP 12288:ZZ/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbs:ZrHoGjhZFlScIu6UKTl/QH4
TLSH
T1B9C4232566C34B68C8D908B240DF479ED23FEDDF60235B6E2739FA2B4D38A7641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 cfe0e810740808a223630aef22ec82e20d14ffb952189bab00a6c658f7a221f0
MD5 fc176695e437301a3b77458d25cf961d
SHA1 0c97ab4b8978b146ab1572a05082e5205003139d
SHA512 6902a036b7d4868c9ef7804f7b59ce88c4f0a9ea1da16dbef3211ccbb5ad81d346114e5667eb56296ca286e5e1844a83219cb573aaead210502baa6067ebe050
SSDEEP 12288:SG/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hbe:ScHoGjhZFlScIu6UKTl/QHq
TLSH
T1D9C4232566C34B68C8D948B240DF479ED23FEDDFA023576E273AFB2B4D3866641A3450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e6729339d0de5450349f3f8625eb3e2c71fed166aed56a7ecd998c2cb5803b2d
MD5 d6437ebddc4c24bb795ecb3ace3d5be9
SHA1 c41fe1e8ebbaa97f0c65c942b127b14ed1b8078d
SHA512 b603edbdf99bf5df6ea3f9fee8859de5d37443a3efbd12628e11cc8c53b925b9e3b413361eba1347d4ead18beccc40800262d5bdc9570407fbd27f6f56281a66
SSDEEP 12288:rQ/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hba:r6HoGjhZFlScIu6UKTl/QHu
TLSH
T166C4232566C34B68C8D908B240DF479EE23FEDDF6023576E2739FA2B4D3867641A3550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f968cb0ca87113cda2a37a159df72e55a72c68e68a8381eb939f4e16e8cacbb8
MD5 3ecab58681a14960f05054f60daf2dfe
SHA1 c8accb9f8275d2c4498237318f73f39a1021fd3c
SHA512 7962b2f5eda59dc337bbe6df6d0f7b0ae24474476057e6f93a7a589ea519ce82f05f15b9cda1eda6907bef4490b2190c8f6a9495f47b4833ed6e6f45ec6173ca
SSDEEP 24576:Efwvok9RX6wkyAIoHoGjhZFlScIu6UKTl/QHS:kMnYIKodRoKTl/4
TLSH
T19035D029EBD845E5E0B7913C89F7460AF2B1B8591B31C6CF026A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a360c99c8fec24b66ba32802f7cbfe4e25090bd669cfa629ea1db1655a98da41
MD5 f68ba3496ece10a6f53680999633a481
SHA1 710beb67ff53d36b3eea733cef4c43cf8d8df1f2
SHA512 1e1fa76811b741609bed84f26215b3dff96cb11eea93a385bf43c2d69cd2ef60efca04485a6ce21c66fb0e27f394fdbf7473f71ce82ad090c742335029598f0d
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PodRoKTl/4:UySzPodH/4
TLSH
T1CC067C56A1A801D9C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 310a83333862e988f5ea905c71238686565611d8e18d3a1a379b44a8ee06b54f
MD5 d94fb86d8284f0bf711db6d44a174e99
SHA1 e2f9d174144b773d36caf65f7b174ae364927272
SHA512 e494e18eef627b3dd8ad643445040a24045fcbaf8cd3b3cc771242a9e2cb50f16305f86883efea932ab665a2f07df78184f43d6dc4a3d0e9537a40e7f30b31d7
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpHoGjhZFlScIu6UKTl/QH2:447JUQj1irIhCnDHUPfF/fodRoKTl/4
TLSH
T16665AE1DA3EC02E5D1BA927885554A5AEA71782E1B32CACF1270837D6F23ED44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a6c23a7aefc5e9ab954f313dd6a02be7e4cf23c5a9c79199a77ecff530a62b51
MD5 2a60c2d635cfa29233bd2df89f1a0340
SHA1 52df8a98ea9fff77cb3216f4ccbd00b17489b669
SHA512 33421be05b44e03f5893e93af7bc2dfcfb0652e0612f3ced09b89b66813d7394ee508d6c89e2b756407dada24331c4b5e04fd78c6a17a80f20d76b79cacde486
SSDEEP 12288:ANsfe/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4Hb8:hEHoGjhZFlScIu6UKTl/QHw
TLSH
T1DCE4F119D29402E8C4AE5175C7964A45F337BCA993E2D3CB13E0FA3E1F356905DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c7f10518050ee92033d5c71f5b6c84852ea3f25a9058ea12e1221f491028f4f1
MD5 2de260c065cdc25b4506dad9ff911316
SHA1 4ed603715f1b8c5afa13063271718014363d4758
SHA512 2122f04f9ca2f33bead1ab0992e8fb249d79c7aad0392a60819cee29472acf3ad58d38b9a467192ed8455271586b7ae5f67e888759ce938b580c82b385d0ed9c
SSDEEP 12288:ZnBVoU3fTktViXZOa6HyUQNHcOUVSpIRzyJHp+660aRMl:ZnjoUPAivXU4AVSpizyJH4660aRMl
TLSH
T16D353841766AC75FC6A940321E32D1CCA7707D01EE45AF0372C89B3FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e29dcabeb8aafc2dce773421fca551cb49f2a44a9c041d8796e9a7bd149edf94
MD5 1ef119499f27487a101bce1c8afacf3c
SHA1 3eb77f419d53590845f8e3f52cc1f06432543d5e
SHA512 c922073e1f158f4b3c86d38c963a4e90ffffc2fc647e30083650468cf8d51feeec146fc340d34c96aed717cff87b9fdb79de31a4697f2abdd1b735045798681b
SSDEEP 6144:jN3kZ+SdB/h+S/U8GxlPptMxPPptMxwU1Mc3o0DjvSt:ItU8GxjjS
TLSH
T19555D7815137A3CFD1FB2031072A5B4CA764EC46B7096F26B3C8453ADC6AB25A5B83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 53f3d68cba20ae86c51453361cc85368ca4ec1b70bd9cb629bcc3ef82df66614
MD5 dbf7b73ce70efe273aec10f6667c1e70
SHA1 26c9e2628e2c74b0d91ce6f4e7cba603cb58d9fe
SHA512 191eba3f5d69193d60f07ce8e186f69d0d98afba435c7bac9a9ceaa5ddd7585c22c1d27fe465a0e75755d0109a9bbe7ff31de3b478ea7a7f5df1bc8959ae2d62
SSDEEP 12288:W072/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbT:vMHoGjhZFlScIu6UKTl/QH/
TLSH
T1F0D4232157C24F28D8F9057100DF8629E23FFDDE531296EB6739BB6B4834AE189B3605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8c847e4fde61d1ffcf640ed458d1ab0f6163f8726e2a4b20ae6f1a6ab63b7fd0
MD5 723529899b4aed621c14746c2a77d60c
SHA1 11a841f82d57be30cda63f943cc4160cfb84c7b6
SHA512 2705963b38b30128731750fdd3d50d6357c8f08d1f03563b6c7a1a09e7650cda798acb9e5ff84ad9eafa4db7a60ff54d69bb91eefb0d02a4b1f9504a8edcc162
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYeHoGjhZFlScIu6UKTl/QHP:Ygb4mBIBhGFJodRoKTl/4
TLSH
T1BA659E1E22E802F5E0F9D2B89DAA4417D6B378161332D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ddc8980d44b60c6f4c1a6127b37d3c7920fc2807f457bf3d943c5431eb3cc349
MD5 46cd0ee97a275170e67c3c3589b7424e
SHA1 e94e52d1fc6a94c2431e701f3cea431818a5d39c
SHA512 f02c21c0f34a107e75fb12a30600b5a03c349e594ee07062add019920f25047028350ba0d566a1ca77248192e6e46e7f34f80c573c0c2eb51d8a543e7758fe56
SSDEEP 24576:tG88u8FpJqH1bzria7/mZHoGjhZFlScIu6UKTl/QH1:g7ZFPqVea7/4odRoKTl/4
TLSH
T1F435F12577E102F0D47BD13889864667F672B8250321EBDF07A88B561F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b3be52843544c1521d6882a49d9b28e77141acaab864a6725f1015c2db307da3
MD5 837efb99d70cd3d557cd4012859114e8
SHA1 6d0e01e00b966acb302952b4f3d8719794e5c67b
SHA512 892b22708d9665b541eff51e7884d1c162f40cbf682f1193460445fd023c3e2853e6d774047dff5690d184bb5c9993dd378758d900e79827e551ad8071e2734b
SSDEEP 12288:qHvUrBFrEjwaQn/lZVHorpG0WWKhSyFl8gaVcRTPGT9BU6U8/RFeWJ/P4HbB:qPUr+NQ1HoGjhZFlScIu6UKTl/QH1
TLSH
T19C05E22F22D91CE4E576A17D8586471DF372B896131292DF03A0917F4E37EE8AD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3f91941cb7355edc79bea489be6affe1ae2588dde2ae3f8df073a285b5f79dc3
MD5 81ab034d1baea4d790f4fbc8792b9009
SHA1 996aa7072cdcbd083e9e3066b2bb41bc6a3f730e
SHA512 43f057980cc53e627af712182a81327f91ea17f1b88921f5b7ad3c1f0b53793ec06de977618a84bc06447c914b1569c7bb7e683e590433d02a70be7c191ece66
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlodRoKTl/4:MG05lO43bhdH/4
TLSH
T181D5CF6A62EC11F9D0BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ad7dc239f1649a994f718ae3f6e413a673f9b4aab1f3e5ca27febb02d36f3b0a
MD5 67df03473907ee6795b09cba7da18939
SHA1 2b36a64d7b0b7be5b72b9a065e70fff0ab56b55f
SHA512 371d6c8418e9f34950a60995d575a11a70d45804b0f30c4e6ae4d95ebd471e38120c45ae173bea943834289b1a1459ee9af2f67e26672e5fd0fe118d31058631
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvHoGjhZFlScIu6UKTl/QHS:da5POZ3+Jt2pasx2+mdodRoKTl/4
TLSH
T11165BF5EA6F801D4D5B9D17DC583461AF5B1346613329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 723052d08c8f817a2c983328e3ff0717c1397ad684716cc583864ec41c0a1c60
MD5 a0d1a518dfcbfa2b508eba9fb02eb65a
SHA1 8c359600436691e62e3d055972282435bfa23c5b
SHA512 8d5ca2d600a9c05488a93daa7fe564fabde1cc8828b26d36d46b771e1e84a5cb08c509dbc57997c4186b3b041743d165a06042613454fbcdf42ac0b63b3ffbe8
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkxHoGjhZFlScIu6UKTl/QHZ:uNc/zEOVHFYodRoKTl/4
TLSH
T1C3858C2623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4512b2260954c0f07f648d5a89e7e67026df6b460e18c30b76033f65eef7fc34
MD5 61d42c3a51ceee4dcbbb3e7563d6886e
SHA1 560eddce67fa74c16e12aec1a81438b0c16e04dd
SHA512 5155aff50c29a2ec8925c4f3fb1fd47aa077890bc28dd9c49709bf3675d76d2bf2bffe89bbcaf4679e20781f55f1f9c0377f4d6b28c5524fd79fad21c3ce51fb
SSDEEP 24576:q8kNvNnaFeYhJNtmZBmDHoGjhZFlScIu6UKTl/QH3:q8MwBtOmTodRoKTl/4
TLSH
T1C955AF2EBAE846E4D1FEC6B58D238516E6727861133293CB5390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d24fd9e248a203ec533d281580b4df6372335340e706d413027813b041a7b3fc
MD5 6ff666284da676e799507c78074f0078
SHA1 edc9fc23ea35ecd6ccf94d4e4068a99e88a74a58
SHA512 f69c9bc086eee06b75b9cc5d846c300b38e20be2fab277f3da1836aff4d50aa18ce15216fcd5bb00cd5c0c2abaf432be2da86df13fad3a17aabe90766f4673fa
SSDEEP 24576:HD3FHshBIYQgAgHoGjhZFlScIu6UKTl/QHe:HDVHeBIAAiodRoKTl/4
TLSH
T10325E13DE79904E4D47AC1BCC6938A06E37178ED032256DB0294D1BA5F2BEE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1692-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1692-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1692-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1956-13-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1956-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1956-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1956-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1956-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2032-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2032-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2032-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2032-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2032-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2064-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2064-323-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2064-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2064-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2064-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2064-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2128-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2128-309-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/2128-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2128-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2128-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2768-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2768-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2768-306-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2768-101-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2768-95-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2768-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2776-120-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2776-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2776-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2776-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2776-126-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3920-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3920-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3920-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3920-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3920-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3920-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4088-6-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4088-7-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4088-1-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4088-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4088-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/6012-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6012-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6012-108-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6012-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6196-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6196-56-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6196-272-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6196-61-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6596-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6596-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download