9216a40e6f9c0acfc415d61d02fc574903ab90a4b32461f1f0149e70b7c15a1a

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 725KB
Sample261002-p3esssshmf
SHA256 9216a40e6f9c0acfc415d61d02fc574903ab90a4b32461f1f0149e70b7c15a1a
MD5 6aa526d72984a6b2d7f271f1ca8afb29
SHA1 038f6834d16e815014cce63a7b284a1a6b9bac09
SHA512 cad8fedfe52a4cefbdf589e84aabd41373d7dd2f35726d3b7d8c8d1f17feeb928c45fa8f721209e7bb47b4c9a66af9c5ae831f839704daff103582c144985c85
SSDEEP 12288:Ov9PGxTszBAGubvoXmH3lfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:y5GtI/4VfJ4yL/tNCJPXUQrP0
TLSH
T138F4026231C0C0B3D97306340AB4E571963DFEB01F7956EBA7812B6A6EB46D24D38763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4612	elevation_service.exe
5796	elevation_service.exe
5988	maintenanceservice.exe
3636	OSE.EXE
3528	PerceptionSimulationService.exe
2848	perfhost.exe
5108	ReFsDedupSvc.exe
468	SensorDataService.exe
3892	ssh-agent.exe
1464	AgentService.exe
3844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\350ffc9df1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fe753b96c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c78b8ba6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000907fd4fc6c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060ba10b96c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ec4bbb86c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	1464	AgentService.exe
Token: 33	3844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5552	2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4612	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3916	3844	SearchIndexer.exe	100
PID 3844 wrote to memory of 3420	3844	SearchIndexer.exe	101
PID 3844 wrote to memory of 4920	3844	SearchIndexer.exe	102
PID 3844 wrote to memory of 4984	3844	SearchIndexer.exe	103
PID 3844 wrote to memory of 2604	3844	SearchIndexer.exe	105
PID 3844 wrote to memory of 3060	3844	SearchIndexer.exe	106
PID 3844 wrote to memory of 5052	3844	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6aa526d72984a6b2d7f271f1ca8afb29_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3636

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a1e7516a7bf1be76d808ded419e6d83e5a6a2b7514f1c64edc8db7514b8a797e
MD5 89b5dc97f4da7b7c3d38024733e3f889
SHA1 e56982d864f4eb6480602df92ec9f3ca92e0f32e
SHA512 937a31d9feff0b1353274457e9afa5991ce94c961ad8fa080e9a4a7d4e8589d2b834ab422f47510600612260f86d5c02a56f4e9130c4d37f38f5faa6be0e4b1f
SSDEEP 49152:Lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+fJ4klKXnM:Z3q6mjBdfJ4k
TLSH
T183D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4fbb48055dbaeef9d2f4d257379ba59f3444320635741fb9b50465011df3d9d0
MD5 777f9b8b6025fe168a53f0b7801f2e59
SHA1 09e7e0dffde05f6096cf45b6727ad24fbbda1656
SHA512 cd2ac7883a966023a11b0cfd04c5160976ba459bd64141d85ebf7207cf8871559c68b87845324eee9e9117b829d59c6340b26e6b3c8bafb769cf270207bad8b7
SSDEEP 12288:31XLsswWkxy2lRq2czA6+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:lXYfDtczA6+fJ4yL/tNCJPXUQrP6
TLSH
T19005F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1a9366a7c1dbadcf65ba4384f6ed839e380d183fe6ba848b15576c01a484585a
MD5 1eb39b1449fb53e14b52950fca691dd1
SHA1 bbc86ec8514b87a8ae99f81ee25edb4de30962eb
SHA512 8869d4c48c7da6faccb35b659ae0fe9002b2d26b4c2aa882e54aa3bce56469fd0233d0dc508e913c9feef57369fb673af3d1b296b3c560cf03ba7b329fceed91
SSDEEP 24576:C0Le5ji0hmxhrMv+fJ4yL/tNCJPXUQrPQ:CPji0AznfJ4klKXnI
TLSH
T18D35AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6ede5ef0fca1703fd7a912a38daef5aed3c1a0147ce8aca51d0b9a83a82c9d13
MD5 0b6dbdc9f857c4b2ac0340f7622afec2
SHA1 51ad20fa7a058e55ba9e1aa03b607e808b49a3d9
SHA512 0e1387a9608f14e1fe9adf9c46faf747ae013225ae7d2e038435fd885a6c2edb4fa46d2fe3e780d8b43ec40273afae11383a8740431856955c0b801ca838a3ca
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWj6q8wyuN+fJ4yL/tNCJPXUQrP/:p/ezSC6vUzPv+HjyzfJ4klKXnH
TLSH
T119756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 81a9666824fe3d2cdf7dd97bc8328b93451b5a9e22b97151a1cf13132933eeb0
MD5 6e4bb9bdea988910fc42b8038258045a
SHA1 d4a8251ff082b606f30a2e48fc9585dfeee7a3a9
SHA512 cb02701a1361f4ab3bc23fa12525762be83d0122b702e1176b194bb40b9e232c259064d8f24f663763d04be07951a96a7566359b407870a456fa463ee0b1135c
SSDEEP 24576:yVbqPb88hv/l+B2+fJ4yL/tNCJPXUQrPz:yVO88hXl+HfJ4klKXn7
TLSH
T13B559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5818aab5d5b0c8bb036485149b4cfaf2301f97ce9026cdc1841d5d9feee3dec5
MD5 d457a34e2db8d7fbc6b3982abb952e4b
SHA1 1453083e90833f7df1ad3743cff95da55673e279
SHA512 0fff7d7465fca10c93ac6a51be72762796a76e7b67e8c2c349b6453cd5625164d1a1667aebee48f17898528b02b1025dfad816b58708ad5aafb7fa52d4b8ad24
SSDEEP 12288:uGL+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:uGL+fJ4yL/tNCJPXUQrPl
TLSH
T16AC423E751849486DF6687F82A88F001C704BEC5562FA2F6CE42BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b625771ef06d8395bc120f90d69023760d3a9f80ef0e55794be4e4bfe9b387d0
MD5 9121c49b326c4786f311eecc9d9e44e0
SHA1 7a22fc23d00c463d60cd80b49d6922f6d00200e6
SHA512 4084c7d7d0c68628d83d6e6c89da200623f19df3eba1ef7b57e45e2edf1e8693ca6405aba2841d7671bfa38bc07b0ccfdc55a90c8b7f916a94ba73cd933bd0bb
SSDEEP 12288:QeBNUbTVO86U++fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:QJIU++fJ4yL/tNCJPXUQrPt
TLSH
T1EB05C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63979c808a43b034630edb7aca8b29a63bd781548d487c739174afc317570328
MD5 a257e169e2cb6b02f2949b9d667cd823
SHA1 f0a210f957da6d7165986ba0afcf729947900151
SHA512 be9aea6f67b4c8bf5cff07fbef02602015838a19cedad71cf3071c86e602029403962556d764b8406d35b2b9c66b856c4c6e36dfd8619ec3bfabc6645b046f49
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:YQvGAdlCEL8c/WRNw5CYfJ4k
TLSH
T1F9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dc266891a5a5515420ff948b36d766a7da6b3f5fb2b3bf9e3053f0a306422a0f
MD5 e53709b395f38fc255853490f27fdb2a
SHA1 e94cadfe482a8a930b6e5f7973810529e7954984
SHA512 c87bda84e3ef12b01964260bcff73a6efccde6ccd878916dc42f388989671a210727dc5110b0f7b182241d0e40eefb1b852395b76df1749814ffc1dfa9e062f6
SSDEEP 12288:BAwSfxL/2Dc3mDLLmt0LDQewsAj8+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yD:ifewsAj8+fJ4yL/tNCJPXUQrPs
TLSH
T14915E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6b3d4947656e6bc60c80a4cf7d6788a055bee78efb768de65e390907376567b3
MD5 e855ce0a3c902b16a5c8623c4ebc63a0
SHA1 6c4572c26c80d2a8da47b0366e3b9a7fa1e5b0d7
SHA512 44991d6ab9cd1802818bc1deee1fcdbc8f69036c99236209f76df688b052871b1ec1efe95eadcc672ae8dc66484b3e6528df60dd1f6f25d45dddfe0c43e42ea0
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHffJ4:AUEtQevvqc2W1cpV20I32f
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 701ca4f5c2cfb8eac624bdbd0240018a8b2b17e94d637077df73e4a8017a4c26
MD5 4f011d75995bc73dc587f0cd09f8b7c8
SHA1 d42eee819c0656df664eeeae8b5cb4251fdc7fe8
SHA512 c2369ad6c20780088be4f9943670f8cf7a1d589c1aa718a38eb74cbe3a8495d27698075f86b0b4ea46f9b0a564de4330fad0b159221e048d3e1f43731c6c55cc
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/z3fJ4klKXnr:DoqtVjnmUfJ4k
TLSH
T10DD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b68de9cbeb3580ac394dd6479ccaddd94f14e4515361774c6784fc04201858f5
MD5 8a38e63a7040069db96ad1e11b962a0d
SHA1 edc11eff2d5df6c4172ff64a601b25f751843ab0
SHA512 3d9256a907797e8316c975985b8673864446b0500039b7bf43fef60007920c869caafc16ecae3fd0fe8a6a05c3b4ac19b20e22efbb0b282bebda15d18fafdd15
SSDEEP 24576:kAhGL6IFoiwtA5l7S53h+fJ4yL/tNCJPXUQrPL:kAM5Foiq5EfJ4klKXnz
TLSH
T1FB359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 88f87e78e2a0339a64b993524fe18cbc00095725a9311fd868e9ff41f5632dd7
MD5 fb63b2621e9657aa68d09f6095035c0a
SHA1 2d5ca089bda54f8ad225e115a5c6d81565afae43
SHA512 2f2e22da305c737bb5cbb91574cd62f001bcd96d8fb60847d0d8ad8122c9b8758afb3ddd0085ce51b3e7374cedb34d54f9daf9622f46a122457bce3c0c056ade
SSDEEP 12288:Jmw5HEjsChNEBFgl0WDm+Ct+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYL:EwuROWA+fJ4yL/tNCJPXUQrPr
TLSH
T1BB05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7e3b3437b5133c3940b842931b40796ccbbda7bd4db74451a433a49a92be1b43
MD5 d4beb0f0d979c84b5602a88b573de854
SHA1 c45139f2f131d28a28abf931444bd31c6c7ab585
SHA512 8ba16e92071014f193fa640f02d28999119f81cbdd9946311c98cc9d11114995a5504ce66cb800cdc910c2a002d695637a984553737e0cfdc632cf1c27b5da90
SSDEEP 12288:ZyZ1IyM+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:QZu3+fJ4yL/tNCJPXUQrP6
TLSH
T14BE4129B32D460F9DAA782BC89D4D101D3317C92273A83CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ccc7f942c2e2776f415a93e5ea0172ceff4313611da035297a2fb5b1fffe457d
MD5 d5fa97b713a0dc5116716e0e40703d50
SHA1 5a2ea23349e313a8798741ad8c68a175fc4a0ccf
SHA512 33e90de4dee58006810e74225e64ce6f40d314c0a8e6c72cde1c5348a872237b3857276cb987d7ef59b71454140032a3d4a08b643747937c1f7f2e7a8f7c7058
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:YQRQyi36YOcPDLvw2gAf+PN3RfJ4k
TLSH
T1AF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f6bfeb36ca1dc39868e976cbd088534d88b2a0ae34c0fa71d569d9ec17b490c7
MD5 ea1707a681ae2c8eff6c206ee2e627e8
SHA1 48e9cf4bed2059a2fe73ac6351513e7cefaf4361
SHA512 5fb62110810c32bc9dd8776628816fb4ee4a2ded01c8caeb7a5e77b8318ef19e55cf345c67bdacac9a0f73c27b76aacb709694b531d1bdd36b3e62871cb88c2d
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UV:WQRQyi36YOcPDLvw2gAf+PN3RfJ4k
TLSH
T1B6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 61f30fb866af1247369b9ee830ea90c554836433af90d7aba14c092ba4b12560
MD5 052eac265066b27f12cc262be1795f0a
SHA1 3fc7f03d847951ade0fd6fb34a62a31ab1405204
SHA512 7ce909e8f1c764966c6a2e23ac9c6e58cfbd8276df1dea09ba050fded0815cc87e1c01a08d50706d94f29d5fa5f34d0a9e433b562119f484b9d9a40fa891c354
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0n+fJ4yL/tNCJPXB:H68Qg55nhkeWu7PNU3/nfJ4klKXnB
TLSH
T174B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8cadb7657da6dc98a44fdc118711bd9110a0637da8e5ed06ff57fd066868689c
MD5 1d03e59fc259bbd3982aad5769be33f9
SHA1 a6545eaa99c8d2d494b299dd855d5b664ed3d13d
SHA512 53c8b3aeda9b0c38123993576b84b289359e6306de6dfe3fc36fcf9f48b49935f1386b347b6d5a471f6b0af394f175ba22e957c0a22b7c78bd0629bdb71ed9f6
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99V:Gy5112gYy5azzVvU69nLKnhZ6fJ4k
TLSH
T1B7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf31e2a6dcb608451bf4dcf7548ca501362d4f7bb7ef9e01320a05996bb1b513
MD5 e5dd9a237a7d89c6f50f2460623250b9
SHA1 d4b6a7c8caf56620363400df49c35ec4183c0234
SHA512 ce6fd458bf8727c341fb7262181416c56a377c6bfed7d7228f35d033ca5ea4e8bc58bebfcb466266dea136167e6fff7084e230b7e9a8d0a7309909eb3709950e
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpfJ4klKXn9:mu6JmIxd2dpfJ4k
TLSH
T157D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8defbacd629e53f93cc506f4e0bdb80a7ed43dc6c2284ec593d8543e910a3b9
MD5 e311a814444a2ce78ab776e3bb19f16b
SHA1 ffba66dafb2b5569a6536911aca582e60a881166
SHA512 fa0acf4e9a13c9c2edae7613ed86eb3ddb2475a6cb5f0a98f14d9d2cb4d67753baa8964f888c12e4f75fe53309084e51bc82f99eb8c5da33766ce39cb8bb87ea
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xFfJ4klKXnq:RmifPqRUfJ4k
TLSH
T1B3B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24cf6420bab99ee42a7a8f31369f12058af18fa93555afb9ae9fb1e83521a39a
MD5 3019e986ccd092a82b5ff33b951e054d
SHA1 72ee14e821ffcdee1c07a627247bd60357166802
SHA512 0c0f2dee4df6debf41baf4e1b4e3755bb241826c115d356ba2cbdfd16d707242637879ef841e4b87251688d63f5706a7776089606d973fa0663d85c3bda10215
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqufJ4klKXn4:P5dKqi61ufJ4k
TLSH
T12CC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f9ee6e964546761040746030d4cf26e58709036d397d92941eb5978f0ff36e61
MD5 0b11b90d213c868f9059c372aa83dc1c
SHA1 521e6ef125a1b911cb15c9d27acb3eb3284e9981
SHA512 996646114bf64df07e926f53cbb68b4bd1db8fd23cccf1821b78653e53b080a5009a939b9f9276be79ac409fe699a81510a37f666db027885c832ecb08ddf69e
SSDEEP 49152:ohtSn8EApI0figjgiDn0AP5wZfJ4klKXnI:5X2iWphAfJ4k
TLSH
T1A295BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 005da610069276fc7e793add4a962f7c4a03671a3856b445d607e20e2a16e704
MD5 f78a44d8aec9a1647d546dcdd8df48dc
SHA1 893b262757692a63bda1a64f477f27b350af4a8d
SHA512 9e134e709f47a5404c2cc305f83fea854460345ce8766c1c8ffa777e50cacbd39a8a99574b5d634a9ff39aaf30f459ae3011544c1179bd1b6e1e6f282c08bca7
SSDEEP 12288:dz+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:dz+fJ4yL/tNCJPXUQrP3
TLSH
T1F8C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7721789a9316d2f8ea7f8c88ee5e8774f77e66e399f4fba4111689c8a938ba99
MD5 5cf42c170c765efa5709e2bab0ae0e20
SHA1 9a80231d53bb08d722f2ca8e41dc0d6d54b6bc3a
SHA512 40b52f1c5accab78d363420c8cc0269db7c0fb46c6cbec5b36ccc3fc22b545fac71c0537d8d27eaf51b803c9055fee80b40c6d4490c9c523e93291762f312216
SSDEEP 12288:eY+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:eY+fJ4yL/tNCJPXUQrPt
TLSH
T119C423AB60D5948ADE1587F81688E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dca26792190379a6c1ebbf3bc3800020b0b1d61eb5b57226411069d0dd8affe7
MD5 f35d86a07d4a5115b88d3d2d160bae48
SHA1 9db9430f3d53196970931a41c28459fcdfbd9261
SHA512 a704ced599525b0f5af9ac6565c8490a026307ce53e945b2c1405fb2f3670fcc1456b8a387685834c07e6e3c865244779a48fda497118bcfe473fe39de8efa26
SSDEEP 12288:bm+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:bm+fJ4yL/tNCJPXUQrPt
TLSH
T1ABC423EB20D5948ADE5587F81688E001C7047EC6672F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a06843de95be2be2ef2832303261333ecc2f5f9f8b6d4960ba3e4347e9e46b34
MD5 36108639ef88f7249ab3ab140ebbfedd
SHA1 83fb9e14f9246005deaaf35e4affccc5ae2c11e0
SHA512 c9651fb860e970bf54ff775d44276aa14a6ea6f66d99e6b3bedb33cdf3e3dd9b57fbecfb171a3ef15165750ec9413b0c6ee64c9436e28bbcc40dd8bd44bc5084
SSDEEP 12288:CVB+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:Q+fJ4yL/tNCJPXUQrP9
TLSH
T16ED4239721D580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659296C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 cb00150938e5998344efaf5ecdc372056bff2d52b93d9a5a09b809b2809bd749
MD5 22d4d9778ef3cebb4c3c0c81010d5ebe
SHA1 ccaaad25820610484d918e0e99df93f53933d5eb
SHA512 32c347bdf7cf2c5f504cca22b4cf8edf05ec373018ed752da6a46e62e4171f38f25a1c739df3570dc468b7ec895310c7f9e43cb08687994701301444c9c91219
SSDEEP 12288:WZ+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:WZ+fJ4yL/tNCJPXUQrPC
TLSH
T176C423AB60D5948ADE1587F81788E001C7047EC6772F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 beed2114ceef6b208bd02ae0bb171e1b8d1889d12580dac15332e223f805ef6f
MD5 1c181d477bc1f4ae53b3d1a14d053ac8
SHA1 1f335d7933f9a87fa819d0035008e12171f50163
SHA512 3900d47abf8d4f34962ba4b20faa5d5ffc66638074b3f6e68beff6e9045a53e43a66cc57ca4a4b058fdf26d9a39eb9d7b81c12c6b2f24b24e7e36d68d78ff077
SSDEEP 12288:6k+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:6k+fJ4yL/tNCJPXUQrPl
TLSH
T1D9C423AB60D5948ADE1587F81B88E001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 88ede7254f7f71880a672e40a10d1ec3a2840ee8489c7e886f7a02b21e74821f
MD5 fcc1864c4c1a03ae972e34c2c15e97e2
SHA1 d0f3de67eab870c2b314b36eacf36d3fb402a4cc
SHA512 e63a4785ffc05dfde28a0a98f267fee3f0e14c09b635f961983a15cf2c1a1076cb43a3bbfab27ba187ee2aab2baf76d06c165e9fc2a4c99dc73880d289704cab
SSDEEP 12288:tw+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:tw+fJ4yL/tNCJPXUQrPR
TLSH
T11AC423AB60D5948ADE5587F81748F000C7047EC6662FA2F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d9a1ae065c2378b7f41797ea8dfc3b2a852558808338c827bf62dae8ec2e19d4
MD5 25404c01b572738883f629b98459ec03
SHA1 01276b0d66133c06ace27a92152d07f4606fd997
SHA512 acfd53af5b75fba8ebc2fda677446b4f4d383e5598b62525cd4402237c2a549f2b92825c8d2692642316ff9571a8823f47d5a09e05a1a192ae665ed9e60ce1e1
SSDEEP 12288:ciZwbDzzFEoS2cPvy4+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:/ZM3zFVSO4+fJ4yL/tNCJPXUQrPz
TLSH
T1920501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b1c26a25ee19eac7aeeebed54fc635294691caffa72e9e2a95331436d9b24e74
MD5 a29e8fd94fb99b3461ce8f76d65d9fc1
SHA1 ca27283c6b6bd7d298297ac1ce47e94cb7432f3e
SHA512 93f2772a0692b649cd5f33a94662d71bb81595fb508e860044f8786345f9938ec333b53b8a609b975d058cad99930b3e1430fc9fc2dddbbb184ec4d6904c6284
SSDEEP 12288:7H+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:7H+fJ4yL/tNCJPXUQrPD
TLSH
T13EC423EB60D5948ADE5587F81748E000C7047ECA762F62E7EE43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 776bee46149180fd3f8810782a68fdd0c77f0c4b259bacb0a841ee36b8e8a3b5
MD5 8622a348286e2935e187103652d2acb3
SHA1 46c00ef8e6f8856265596e6cb4577097bd252ab0
SHA512 e59333b38809afa0da02c564b2f934f8a5903fb27e9103dd5d6f2a97b82a11d9ffbe7dbb920688d0aad9982e875b07d0353a6d84ad11c35962d44919fea22ba8
SSDEEP 12288:Pb+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:Pb+fJ4yL/tNCJPXUQrPu
TLSH
T163C423AB60D5948ADE1587F81788E001C7047EC6762F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 946aafaf909ff7fc6cd428fb59c1320bc64558dffcdab52177cbecec45a76281
MD5 31a96d83da84b94cf3d6effe389bde89
SHA1 303487d74902d2b39f229cc451f56cec07a9b223
SHA512 00e24ee344fc5bc207088abb04ab276e8d9eb89625e61537381c8ebfbd33ce4cd8e3b10951d4364c7bc24e65b9b43a9ff16702b08cdb7d4e7364ce34faa29460
SSDEEP 12288:OyPz5L8M+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:TzyM+fJ4yL/tNCJPXUQrPw
TLSH
T1C8F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b0c525356231a148b822dc71016755b4d2e446988b373ba9891db22038338c83
MD5 118829b1591fab8f423ceda3624406b4
SHA1 7c1e111afdd6a3215578bd42e7070866439d5784
SHA512 a34877465450e02d9694531829af5c89e56f7b5d1cb156ccfb5a801dff1d7ca6d20c52cdd06656fc0c7055cd3064d5aa1b787227b250750ffb08bd189a40b0f6
SSDEEP 12288:dH+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:dH+fJ4yL/tNCJPXUQrPj
TLSH
T1CFC423EB60D5948ADE5587F81748E000C7087EC6672F62E7EE43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 31029c8b28bc8d7beee04524075104deebf103c908706d32b015583d2fc19ec3
MD5 eb076837ce8c5555562b185ff56ae288
SHA1 e173723cae5457961b902b59676145a4b5757f42
SHA512 f61a2cc411f2dbadfc07cc4f1438bfe0a2505569e62d113ff90de27c64a031228e68171c6941385a897a7617bc97d3dc6c5b5e2a93ac5e2addb5bed8538af462
SSDEEP 12288:qH+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:qH+fJ4yL/tNCJPXUQrPv
TLSH
T119C423EB60D5948ADE5587F81748E000C7087EC6762F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 16368959b2183c55d288dacc2af79873ff6011c9039e2523a3f4c4b2f1c74b39
MD5 2eaeaf1587f10b3a9c8a2fda40fd25e0
SHA1 44c168aad2fa4bc84b737537083ee12cf3ac92a6
SHA512 e5497fef6e2afd9d1803e64a370f839dd000009c0120cdf438108602f35bd1c2b340352fb68e7da109cd77782e4022b4e8b8fce161ae30435300b0eba7019958
SSDEEP 12288:cyPz5L8M+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:FzyM+fJ4yL/tNCJPXUQrPS
TLSH
T1A7F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2a8a12e6421a2c1495c9b06cb4f7959c79ca42ba7201661d51197aa9b9a9737f
MD5 e121f3619f34588a3cf7acfa7fa547e9
SHA1 0166f7f0b47096e8e1f4b00a144b3dc8689e0288
SHA512 c7242a88748466835b391c867b9bab13420f0592ad50392ca9b84cb04b33878ab1d8f2a93af0c76c17e6c3ab56ebfa2ebe05dc09862f86e723268cb3410f410b
SSDEEP 12288:oCd91WYoaLHF3z0z04PDvhW+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYo:xT8aLl3z0zDW+fJ4yL/tNCJPXUQrPI
TLSH
T1720501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7ef61018f2aa417f5d5ad93de956c068541e1d13b84de0bda865ac6315d5ed5f
MD5 a77fcb4c0527d836fb178bf545c26e3f
SHA1 6a4738846831cc366bb4ad25d60aecbf5713cdd3
SHA512 2bc3112fcdea09453330c326aea91d989683ef0292bdb73add047af498591f620f88f6620d4cc6c85ce6aa733c92dd51372fadb80754fdb67673280dc83f070c
SSDEEP 12288:mi4e7+RdTfgwCHKy7GLbbdIvl+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GD:m3rd9CHKy7GZi+fJ4yL/tNCJPXUQrPL
TLSH
T1EF25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5f1dc68305f552f2755f65135d1c982294f7473327873326ac8c7f3fca2b10e1
MD5 3947ff48af46cb7d38cf2cb470d4c3cf
SHA1 4e5245137b2f89b6989c411808029f87e316206f
SHA512 42acd3221410a631402b8abd7ed13bdb0369f715ab4c1d19d0a503a9270e7a1805499ed4430a7e508d7c139bef1b06eeb5cb4e02626936a6211d017ea2050377
SSDEEP 12288:kG+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:kG+fJ4yL/tNCJPXUQrP1
TLSH
T1D1C423AB60D5948ADE1587F81688E001C7047EC6772F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0300cee1982301809a7adbf36948dcc981c7ded78069dda13667c92186bb4596
MD5 f8e1ba41c3a57a66d1a831c0d53d14aa
SHA1 7efc22036000e82c266e8817dc01180546e2c348
SHA512 8ad6b01da8f5c488b833a05220f038deef71bd6f799a31b9a31909b564c44de5ada1b51c495b32d91043a3a94520ca0182ab0f748e175bfe4848e24629521593
SSDEEP 12288:Ns+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:Ns+fJ4yL/tNCJPXUQrPO
TLSH
T1A0C423EB60D5948ADE1587F81688E001C7047EC6662F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 14a3359619f627b5dd4bb1d81636ec2a767ecc409ac8c7c9024379f67b77de1e
MD5 a78cf15b066729ccfbdefb7e2d6cdae4
SHA1 7e84cf71c128d81621fa4adb9cd99486080902ea
SHA512 ac28e95c8c22a663d71781f05b2b2bd95ffea451f0fc02bf2ab31acf5db565944b779aac726df2487e420e40a98c77e906f39a0b3a10e1cba8762a1d332f0290
SSDEEP 12288:el+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:el+fJ4yL/tNCJPXUQrPO
TLSH
T1BAC423EB60D5948ADE5587F81788E000C7047EC6762F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 92c4fd1bfa9b758b77b2ff243ed1bd90309b3f5854287e8f3bb646673c79cd45
MD5 0145bb23ad406637b2a5f5729ac98aa0
SHA1 c79a769f7b6d0be7ac9ae9c3c8ac70a0e802d8b7
SHA512 9090171a24c4e86b8250e59f4d4647adec728a8601a5ada72335e549db1fdb5d85a0848e2457deae93d31e4fe482db942cec29162521ba3efdc2fdc69d6d1b27
SSDEEP 12288:pH+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:pH+fJ4yL/tNCJPXUQrPP
TLSH
T1F4C423EB60D5948ADE5587F81748E000C7047EC6762F62E7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 919b56757bbf6859a0d3c4b668d4fdd2ae520279514372b3af9713b711bc6d4a
MD5 5321b5cb2c3a95cdccbbedb185a94621
SHA1 44b56104f63cd2030aecc18e6c291d969e8afc09
SHA512 bdd064831848edf1b24dd376e0506f133cb91e5720296f42e84dfb516ee0324470b234ff90a196cb0feedec09ac8e8d695614791b94ceb4aeac04588e34ae07d
SSDEEP 12288:TG+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:TG+fJ4yL/tNCJPXUQrPH
TLSH
T1E3C423EB6095948ADE1587F81688E001C7047EC6772F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9ba121e5babde1792201320469857d76e342d69bd671d2be78125351647602bf
MD5 5bd5c69f77b3ee722dfb6871ad58b870
SHA1 884fd57959a0c9b9a4b917b82cc05318d1fb04cb
SHA512 56132d2008e8d6c3c3d72985870041c8cbd64b6a1b84f13b0e28de36225da74da605281d488d900ee6f1c1ab4d25727188747151d8e6c507abf987b5bbc59c8f
SSDEEP 12288:Tf+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:Tf+fJ4yL/tNCJPXUQrPL
TLSH
T14CC423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d7ab3380a9fb193afc5af47e9dd852264a274a807a72871c31085a998e5459e6
MD5 7cc0194641d6958cb7e68f2f50caea34
SHA1 8d62838ad54b0050f7809b6ae0628fcdafddc54e
SHA512 fee6b16b3acb74a19076fbddbfe6260fdcf5ba378b49524554748cc7539382cf7d8426f9696abc56ff3b0a106de42812bcf847f6d525aa80d18f3340b2495bb1
SSDEEP 12288:lZ+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:lZ+fJ4yL/tNCJPXUQrPO
TLSH
T1CAC423AB60D5948ADE1587F81688E001C7047EC6672F62F7EE83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3e508959bc7b7a3578948d44a6abfb9f82e5dde9fe1d299c64554a8758ed0699
MD5 7efa33931468432b66112cf50fd5c032
SHA1 8531b6aaeac6244eafcb3f30da5e511119c7ac3b
SHA512 aeba3aee7e2252c0a97572d27cca590e552a031102c46b733884f4e38b191c3ba691193cc6b6a2355ea3b9e718874f01aa69ab9ce9f211ece8959bf99c33150b
SSDEEP 24576:wfwvzk9RX6wkyAIr+fJ4yL/tNCJPXUQrPr:jMnYIafJ4klKXnT
TLSH
T15C35D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c654b98923d897bf8cbae44841a7a2893ed818a16359c1217d764f9cdbfa0025
MD5 3d977539465cad8bb56a0ccf3be34ddb
SHA1 925af587da9411fed59182738c6c2bee4cee05e9
SHA512 aacef2bfd42bb853c1670acc8e1beeb9d365e2287190d2c3f667c9c8b61f61076f6500ea5ea5b6953595b09473c0efde30bdfcfb83125e5b04b6e09befeaeafc
SSDEEP 49152:dYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05fJ4klKXnT:MySzPxfJ4k
TLSH
T147066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 771ecbf09e7d7cc46125d08e9a796324a8fbffd9b33b9a662f289d15151cf5a3
MD5 afae1263296928875bdc5e3e195126e2
SHA1 3a37fc08c3f33c1235f067a02e72307d11a76769
SHA512 cee6490b930f29c2176159d453b02054a7a29ada479f11c6ce5cf33d044fece95ee96b7b66f4945ac5e13c8179919b94af63d3e68f000d8cd300a3046033f29a
SSDEEP 24576:s47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYI+fJ4yL/tNCJPXUQrPD:s47JUQjqirIhCnDHUPfF/pfJ4klKXnb
TLSH
T12365AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0ebf19efa74afffe04ad8215f8d9fcb03f18a4951e164353d97730bc208995b6
MD5 8b8b7a897ae0c3958bcd8a25a336b330
SHA1 c1dabb9efb80de6cf6af4b519e9e500c7fe44259
SHA512 a65e9711c772204f03e9911f41d91167a62d56b9f92d880dd72080ac7ea9946fb7210060511b1a5b821292b24342d485e763f48f2156c47365de0bfede8c48c3
SSDEEP 12288:hpsf3+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:y3+fJ4yL/tNCJPXUQrPL
TLSH
T1DEE4015AD29841D8C46E92B8C7449201F3237CA593E2D3CB97C0F87E2FBA6905DE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 dc57cb425f80ca91510e0e348fe80d77f6c7a93e0ea13e31f13348782f4a6665
MD5 5ebf00e25c8cc4dd025ae94a2cb57b8d
SHA1 6b4a103bbb6d19c60f05f2eb5d52c02a8753fe63
SHA512 3edd236d2816a3b67045889a12e37fc2d8113ea246c014407cfd479fe6a27ec0017891f288a03a24d77e78bd8dd92ddd10a992fa735e231ebda10a9db79aaf52
SSDEEP 24576:iCtUSUP9lufBY8neE7vYJP/XssHz2v+Cvs8qG:6SUVkusvi/Xfz2GCvs8/
TLSH
T1B95528007626DB8FC66940325E36D6CCAB70BD05FE056F0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 8ddb3f96c158483eb5cbf193e4c021e15b4b4419b1f06ece3632e031479eccb7
MD5 280ddbc2f2142a0a914cf93cdf620686
SHA1 2977deaa52c65c95cdadad1bf6b11e9be8209515
SHA512 83309f11dfe8040b76d2b47e6e19d279292619a7443ce5eb230fbd93f9a7d02b59ee9363880ab7bfaafbceb5650c24d8bb59f990b40418b2596ebe0317cdb4ef
SSDEEP 384:eQWWsllGllZlTCBQWWsllGllhEBQWWsllGllJ:e5llGllZlTCB5llGllhEB5llGllJ
TLSH
T111723164F280E7A3D0B716768CC9E7EC2339FC596E400313B38153AEDC2CA815A9E5D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 876f021fc2ceabf849df5df20fe8c5d890db1d248fa634f3db63d6bd38e7581d
MD5 f8f8c6ac4cb5f00b4a5cc2c77b7cd0b2
SHA1 b8a84a5cd997f4a14cad6a0e617619a51867a2fc
SHA512 b45cb56f71e2535ae7a5bc1b14cbd298a8c72b36251b1d1fd334ac57a2c3dab2bdcc3524206a3b4ff4fd02cd15ffa62f13fd605cab9eb70643ce686ebe5b5f7a
SSDEEP 24576:3pDo5JI9N+60tnTOKI9sUEsasy3nFSXpjP3oJ:Vo5JI9s60JD3nFQjP+
TLSH
T1B3853B4155B7EB4FC9BA80370332968DAB746C06BB493F01B385C879987796EB5E23C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9c50738221b1f732067e7ebf1395ed88be3f173adf7c4e278b420148398db8e7
MD5 b8a6b95ea13273379361000bb8bb088a
SHA1 2d2cfdc08a8ebe5b54af08951b7a064395c7be4f
SHA512 3a0a1b385503b49778e03e3b91a9a49251f1ca55762d00ac0e35047450585807f478335e2ae810e2a85127d22f4a957110471ca24f1cbd86d0b039eab787534f
SSDEEP 12288:2M7P+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:zP+fJ4yL/tNCJPXUQrPE
TLSH
T1D5D423A751D49846ED7987F8164CE000D309BED51B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ca3ed8985f9270bed13c9cc969e1182ed96551e9520fd4596107ad901dfdacf2
MD5 a4406cd19ab9021c6e22ee0c5f51a9ff
SHA1 26a08ef28b84a881533426da3ab6193f82fef6ca
SHA512 b51b01d3d84ddc9addcbe7b05fd359f2bda382a4bca18d3059c1888f20b6bfe4b9107f1e06375a1e21dd449f6323d35176fa7a7536b1b70d976f386d842160cd
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYN+fJ4yL/tNCJPXUQrP0:Sgb4mBIBhGFrfJ4klKXnc
TLSH
T1D465AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5b94c495edf25c87eba68d8339df16299a3caa9e6402d8281c262ef0e9dbfe3a
MD5 eb29c9906e96176e37fa57cd381e519c
SHA1 7c36503a6a289ba827d203aae159767d753c44d8
SHA512 9062a6b7e08b731c382c4d6ffb745c9413755bc91a8701790f679c686cd2784c97fce99a489f8467018544f7c975d20ac66c5c390048c09762e6c1ff98558a0c
SSDEEP 24576:RG88u8FpJqH1vzria7/m4+fJ4yL/tNCJPXUQrP5:07ZFPqVya7/QfJ4klKXnh
TLSH
T16235026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 25334d0a62b434793011b7b3b3ce0c571321b88e55566d9b94dd1105f23fa700
MD5 3e58a77c57bd2d4f3df503597d9726b5
SHA1 1cd2209606bc616652617005bdb8ada94164bfb2
SHA512 1db115e1530280ffb204807305153b3635aed3914405531563a35e4b5d229fdcee7609b7c223417290f443230f856497d5bace910f10af1d16a8867a8d267836
SSDEEP 12288:GHvUrBFrEjwaQ0+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:GPUr+NQ0+fJ4yL/tNCJPXUQrPy
TLSH
T1FF05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 04ea035d3e9c9a35181e81ea9fd84349f6d3cf1085fdb5350d7edee8ef3412cf
MD5 743d36d590a0244975532ec79af38a8c
SHA1 babe823c103c7ab7ee976801be55b8d2ef0c57c5
SHA512 f31101f6557f42a382572cfa50476bc94ad6f3a4c5301fde04f8a9cf4aefaf4f0845ccbd22c42f33cced37870cb1335c8901ecdb28b1284e64e6c5d60dbb221a
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPfJ4klKXn1:xG05lO43bCfJ4k
TLSH
T12DD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cddc658087edd03dc485d95d153ae861669470c3a65a53f33e9d92780d189e45
MD5 28e380821aa9a13d23d32e45b42af752
SHA1 a22101bd4f9b7ea0fc2f08aacfd7c799e6afb15c
SHA512 d1197cf10bc9b39c3bcd0bf6ec3b010339eebbb6304ad17ca2c2140d832177438f69c277ba21caf8cf26aa5f4fa019dc5e94c0c6c22e0598ef84aae71aac71a5
SSDEEP 24576:Mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidna+fJ4yL/tNCJPXUQrPa:Ua5POZ3lJt2pasx2+mnfJ4klKXnC
TLSH
T10965BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 37e7a7beccddd170fbe4c1fab4b77944fa880b1ab602f1c524019da10fab768e
MD5 3cd112bc478964a49415ae6e9ff3bffe
SHA1 e6bd984907b692fb1dd45b227e7ea9ef580bc870
SHA512 ae83242d4380478887aa8a4e44de0b08361d090acd64c31523e56bf8d554f8b6c04ff38421c85cf16b5e87e2807c7be18ae8f324c405c2b844f3850833e0e7ea
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fkg+fJ4yL/tNCJPXUQrPA:SNc/zEOVHFwfJ4klKXno
TLSH
T1B5858B2623E901E4F5BBE1BE896B9546FA717865133086CF0291851B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 23680214bab62a82c6d58196993c223d23ab8695c25178a5ea7b62b32d900c55
MD5 d97ceafa2483afe2fc1ee79d07ce1449
SHA1 c562811a278701036e59b7b131944c0a7addb091
SHA512 be607a753e6ce91243590466482f3f8694ded00d6a4fdbbc25acc603436fae832c59528e7b93226cc5ff42b121ab871b68aaeb8b3727a299b09c7a2f09329a8f
SSDEEP 24576:BzkNvNnaFeYhJNtmZBmO+fJ4yL/tNCJPXUQrPJ:BzMwBtOmVfJ4klKXnR
TLSH
T15C55AF6EB6F845E4D1FEC6B48E238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 57f9a70659cd66e0c41a607e039ba832b66c87e4ea297cd60a02531ca35478bc
MD5 93d04dcc35c774a7692795a7b04d16cb
SHA1 4418e433a82d3a5f998767b3bba8d65c31a2058a
SHA512 5ac505ac140db23d5c1ec8b46f1569324c9e4c1d79470525034cb160ae88e2781cac75594eeca243b32e9c3434d0810b0dbad651aa7e0b6cf56aeb9737eac4ab
SSDEEP 24576:RD3FHshBIYQgAT+fJ4yL/tNCJPXUQrP4:RDVHeBIAAyfJ4klKXnw
TLSH
T1BE25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0C1B62F6BEE42D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/468-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/468-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/468-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/468-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/468-108-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1464-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1464-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1464-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2848-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2848-78-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/2848-83-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/2848-295-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3060-404-0x000001EF72130000-0x000001EF72221000-memory.dmp

Download

memory/3528-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3528-67-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3528-73-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3528-283-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3636-268-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3636-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3636-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3636-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3844-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3844-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3844-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3844-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3892-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3892-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3892-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3892-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4612-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4612-20-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4612-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4612-14-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4612-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-327-0x000001C85E740000-0x000001C85E83C000-memory.dmp

Download

memory/5108-328-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5108-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5108-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5552-64-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5552-1-0x0000000002360000-0x00000000023C7000-memory.dmp

Download

memory/5552-6-0x0000000002360000-0x00000000023C7000-memory.dmp

Download

memory/5552-7-0x0000000002360000-0x00000000023C7000-memory.dmp

Download

memory/5796-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5796-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5796-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5796-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5796-100-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5988-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5988-59-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5988-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5988-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5988-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download