980ff1844caccc911397097c780481e66ee68b625f11789fb03b7ef822f57e48

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260710-znk2dahv2k
SHA256 980ff1844caccc911397097c780481e66ee68b625f11789fb03b7ef822f57e48
MD5 1dc04978219e391fab32a29d7147d90e
SHA1 6db348ad59db737fbc1f48b5986d58a82878a9bf
SHA512 d13f34afc3773ee0158ef627a390797b93620fd2bcfab00e2e2671203a5cee3f5a919697c2c70ed19343934ca0ca8661ae355e96638ee6b1b5de88a61354aa69
SSDEEP 12288:qUYJ9biyTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:rYJ9bB051dckw+1MCO6Wm/zLPFGn8W
TLSH
T130F4022576C18472CAB3493109B8AA71567CFC714F3449EF27956BAF5F302E08939B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2420	elevation_service.exe
5496	elevation_service.exe
2640	maintenanceservice.exe
1520	OSE.EXE
1248	PerceptionSimulationService.exe
4796	perfhost.exe
1972	ReFsDedupSvc.exe
3616	SensorDataService.exe
2364	ssh-agent.exe
3852	AgentService.exe
5844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\907c2f4723e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ff48c01ae10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003572ddfead10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ab6a1fead10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052441301ae10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a18a100ae10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058d04000ae10dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f305e00ae10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067c50603ae10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d22993ffad10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a1e33eae10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	1972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1972	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3852	AgentService.exe
Token: 33	5844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5844	SearchIndexer.exe
Token: SeDebugPrivilege	5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5008	2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 1236	5844	SearchIndexer.exe	96
PID 5844 wrote to memory of 1988	5844	SearchIndexer.exe	97
PID 5844 wrote to memory of 3392	5844	SearchIndexer.exe	98
PID 5844 wrote to memory of 484	5844	SearchIndexer.exe	99
PID 5844 wrote to memory of 1968	5844	SearchIndexer.exe	102
PID 5844 wrote to memory of 5980	5844	SearchIndexer.exe	103
PID 5844 wrote to memory of 2384	5844	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1dc04978219e391fab32a29d7147d90e_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 82050cb8cb7dcbef1add0b01e69086e8b0544aab42fddf5c79e2347ee281a6d7
MD5 9f0389563e89716ca9893a1c08a9e25f
SHA1 e4411d80f8f81cc6094d6b5821779f6c8155502e
SHA512 6738a561ac6891d86e3ba5040a0072ada87d99403a7355f60b5f4e5b6892aa49bcf51e95a3c03d58a53581a83620ab72926f2e461f25905514979fb70bca0a6f
SSDEEP 49152:qb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn30i/+K6bxW:c3q6tjBO/+K6b
TLSH
T1AFD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a8c4a3ba90d6658c871382fe55ebb6c8b5bc49202dea290e3a01512f49b7155d
MD5 0965cf09f15dbae604ea6570e1ef5583
SHA1 b2001189a96d3b916af46e1213423ccf25b26286
SHA512 baf21faaa2f7090d5d459597ca605e155e898251e6b43db81f21bdc579e1de092985e211ac17658a671cc954d73bbcef6d8a625d2ac8a97b0e08d942fd71ffcc
SSDEEP 24576:gXYfDtczAw051dckw+1MCO6Wm/zLPFGn8W:XtcB0i/+K6bxW
TLSH
T16F05012877D108F9DDA78239CCA18501E732B8A54770E79F03E49A6A5F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0f978d9818d13d4ef2cf79107d511a16ca113642c119910a66df9d544d58ba92
MD5 dd5b36eda7fda2611596b0e5646b22d0
SHA1 2e3b0d1c98105f674895347ed20983a7b2dc97f1
SHA512 02d5f2639d8bec794736e8f4d48a2c7ddb90c11fa09ac1bbf76cdd71f742240a8a6adf19808ebc5e439a728f71091abd322018d3fff4ff2f1c7666d774514407
SSDEEP 24576:50Le5ji0hmxnrMP051dckw+1MCO6Wm/zLPFGn8W:5Pji0AxG0i/+K6bxW
TLSH
T12635AE16F6748731D073C0B9C5D2A68AEA7130865B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4300a0932fcf93c6f12eda99b6b0b682129887af2db66bacc7d40a4657ebd36e
MD5 b921c4adec102fb270314cef527d4ffa
SHA1 f3554e87d04e1855652baa60057402278ec3e37d
SHA512 cbc3e49dd64d106153ba7707cfb0b989a9efc563bdbfe1f71fa7fa13c2a3cccf24d33a74f9ef949007c836c4d75e000e35d11ebefba03bbae76041efc302d02a
SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyux051dckw+1MCO6Wm/zLPFGn8W:K/ezSC6vURPvMHjyq0i/+K6bxW
TLSH
T12E756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c934fe49d7625d551c1e8457f982fd48b744b5238c00b00ddf2b2bb90cf7ca08
MD5 20cb8cda0e7b7d18159843bacea923ce
SHA1 e723d6ec16e25b658cbc84e811f5405a948cce8c
SHA512 e36eb96407a4a8ae2eee0f2618e036fa22f0174e6589db86c30e568f10f7f69edd2fcfb7cb671e6c2c879e807d921db2059df93c729143e81aca192495d4ad99
SSDEEP 24576:dVbqPb88hv/lV7M051dckw+1MCO6Wm/zLPFGn8W:dVO88hXlV40i/+K6bxW
TLSH
T1B1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3b19adf33821f9d9808232a973ac9412cf1b632966a190dcf2bcb7e0d82ff9c2
MD5 45c84c00c140d956b4dc9a46f9e0733d
SHA1 007963a3828a633e737efea0ff1b35d3e4fd1a25
SHA512 1a1dbaec60dde9b251053536045b8a00d914c1ec466b781b4dba4dd81dd87ab1ba40754b5ba716863693ec08d264d5e0c6f9b49bf39e719e43da0c58d545625d
SSDEEP 12288:kG/TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:kGL051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1ABC4230A9F060961CBEB8A320C78BD813394CCBD5979563F0D69BF8FA37D93A8502755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5d677261e087051cb962f7c63be8461ef9d07e92fab4c4c4f939bff4f23b3dfc
MD5 8b6f531d021f16fb149c88c6b950f478
SHA1 7bbb56df85b5c6eec684d3b777f848c52a0e4ace
SHA512 a6d5606f6cdd221ba647dbeb8cc14a8714881f7d83be17cdc68b49c7bc68612773a9b0b4e8f28f21996427dd29b79cea71d8a165d434f0e5b7b3c0c6485f3005
SSDEEP 12288:ZeBNUbTVO86USTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:ZJIUE051dckw+1MCO6Wm/zLPFGn8W
TLSH
T14805CF3BEE28ECE2C27A8D795A918600E77278704B61A3CBD175C30EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0133a178068313cd2c2adaeb9021f889de2f7573b6f50622183e907604a03b6c
MD5 2ffcad5dbc71c06347d93677492edec8
SHA1 8e765563688662ac60709b68a5a67a67f2d90e25
SHA512 43a4e09d004755d903f9df4f6e539c1b32e891b7274b719576b53cb472ccdc28e48dc74d546d624e8089cdebd34ab8e8a60a2013a143a9a692ee7e713b86e18f
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH6:KQvGAdlCEL8c/pRNw5C1/+K6b
TLSH
T18C266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5574636512ba72da32353d7f4369d28086204f16b9f02c676c02269f3792b5c0
MD5 31b49536ca210e074542cf969796f186
SHA1 51bd1fdd975ee3835354a31179a75d13ab2ba1c1
SHA512 d5782e7f6bb13f845f197936407bc95b0146bcfd271bdeffc5743a7f64fef1dd4f45fa6f9808059d1fef3d104a3a22eb3c696eb513b540834b33f8b96b96f68c
SSDEEP 24576:uwewsAj2051dckw+1MCO6Wm/zLPFGn8W:Xlj20i/+K6bxW
TLSH
T1F115E031FE75D432C7BB0DB21B35D716246CB9604B611AC3E3A89E8E5A342D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e0b88ed72574a81aa3f1f2cbb7f094bef517f792ae9d8e17cc6ded41fd9f8a9
MD5 862b5b96722ba77fe9c6497f492b516f
SHA1 be8542fca602f2c4d200c8f0f67cef48a4549851
SHA512 3c044115f4ec643f340f4ebb67a7112fe64dc2d439e07e3207d36e1a466741327f1879a8aedd4932161882444526390117e184caf6c755087a8a4ed64bff57ba
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH0+Ks:+UEtQevvqc2W1cpV29I32
TLSH
T173474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67ede0505fc3c6a00f0fb91b95fcd9c1464ade10ba9758d04fe4a26b6d338996
MD5 109a8d231439c7f14cd0ec6ac42ebf45
SHA1 7b8b4944787520f6c02f2eb394e59a5bc98cdb62
SHA512 d4ec56b92440303bd61353cb8d832b9a9a8ebbd888d147600cb2103b1e5695e143b2e15c5e912c4b4d5a29b0c02a3b26c3af8dafa5d7a4ebaf314d3effbfc365
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/zW0i/+K6bxW:FoquVjnmx/+K6b
TLSH
T1F8D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d41db3804390769bbeb3abac9bc46dbcef283e5102280d96556a0a145a705a2f
MD5 55bb988d27f14270b864c51bc7d275ad
SHA1 9cd0c11cd416e3bcb8758c9f7598d1bb359b5e35
SHA512 0caa38662d375ed0ad16faaaed2a1b36b48bd146a26846c2ae365c207ce5c2425355ca4963741693efdfc273d806dbb1912cd28f5695992c2e5e45c91e16812b
SSDEEP 24576:7AhGLmIFoiwtA5l7S531051dckw+1MCO6Wm/zLPFGn8W:7AM1Foiq5F0i/+K6bxW
TLSH
T14C359D81EBF945D4F5F3AA7899B59570EA76BCAA5E31C20F1160D20F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 76a6cf79d56366e18549bb4e37ec343e0b64af46285aae1ed7bd934819fcbc71
MD5 335732367deb737c3a62e8710f3f1fbd
SHA1 e43b32fafca7a0d47e72b9f2aecdafb840803d91
SHA512 efe10f0bbd145802e190d3d984f7a6edc7b85aafa45f9d888291dccaf42b0568edeae57c3cf54bfff7412a807fc0433b25cc0a4f0d92ad86329cb777c171cd3b
SSDEEP 12288:Zmw5HEjsChNOBFgl0WDm+CxTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNo:0wuXOWK051dckw+1MCO6Wm/zLPFGn8W
TLSH
T15405F10A77A40CF9E9A782398957C532F7F2BC152A35D71F0760C65B6F37221AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 358131b645216e30e13d47eb45093627ba7ce7ff00cfb3f6bcdb7848d251b17c
MD5 f9ef3e8877baf53dce305bf11685740e
SHA1 cd6e4514929bd5fa1bb9b0a6484c8833fd862554
SHA512 4bfd81bfaf750fc9b6219aa95717413cb5282deb35fac76315fa1c6b6a2b8ec006f09359f4475ce8493c4b133d7db85495cdf3732361afd68d215a5c39ab14f7
SSDEEP 12288:4bZ1IywTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:gZun051dckw+1MCO6Wm/zLPFGn8W
TLSH
T12EE4120A379410F5C6E786398CF45A01E3B1B8B6233643CF0A65979E6F37AE64D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b8c5a419b555edcae5decc1e6d68c9dc2f8786ba73238c5d1903062cb43b19bc
MD5 d6a09063f0c940906eb3dca1e0174535
SHA1 cfe74c0329f80cbc848aa5c93e58114f739b7c03
SHA512 f5229ee2892ffb2535c97710a529542a45608f7bc005162bf0024ea442bfade82dec743cf43bcb5d7741500b9bdc2aa6b913c0536c4571743e79f505ec2942a9
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UW:cQRQyi36YOcPuLvw2gAf+PN3i/+K6b
TLSH
T166667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9532e950d7d233dca6a74215f65fa9a95fa0836aabe0518d5384cf0de7ced574
MD5 e64a3c80c845d926e2b25ca79d146d4b
SHA1 430c82601e41cc93d0fa6118be6b127b7db5461f
SHA512 51f5c0044b4e1bf2e08979ae221fc9edadfc5202850129a6d349877135c3399aeafdf2c8cc352159f7590c65f08d283e05df05d81e7ae5d90aa3e30703e48fbf
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UW:+QRQyi36YOcPuLvw2gAf+PN3i/+K6b
TLSH
T15D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5098ebd1643e07bc5153dc366b1a0220218970b514c19514d0ed77b8e4c5f40d
MD5 f49c410fb9f5041d3ee46aaf99752922
SHA1 7e701013b563cc8b208d402c0aa07209026d7cb8
SHA512 65b02e3157aaa110e5e3f49b7e4ffac8e7db719d150fdcd365387588ee86a3f50136791c80ec5c9d01cee5dc4eff538c66a6fb1e126fb388ceb81c8aff00a1eb
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL03051dckw+1MCO64:Z68Qg55nhxeWu7PNU3/G0i/+K6bxW
TLSH
T17BB55933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 479ca3a36644360fd504b97674b24b199878bb7468f74c1160be990c67b240f8
MD5 b30255c4cfbb231dcdfbdd1cd3e38176
SHA1 6d1d499268d7a09c0b308c560f0b4a5b553920e0
SHA512 0a90dd655f10e01e9ff650acb3d1fd8783c77fdd1de6483e0fb11ddb69473f81499d3338492f02977edd2d290ea316d48c45fb32a6287d344d6d070fb7eeade3
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:/y5112gYy5azzVvD69nLKnhZf/+K6b
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 016584e6ee47238e74dd58d1c64b500275d3f0a9c3a2180b39a833bff82731c6
MD5 1a1cf646cdea77787fd448bde30f5a30
SHA1 7848e68affa5004f2870e3c8f30643df5cf66286
SHA512 7913c264d614c455c6708f3922c1112c6cfb0040c6251c6cac48f1a96cf7c2be3815645c6febd73e26908012c2eed3c3c06c341fed74604cb65f4e8a0b777189
SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glA0i/+K6bxW:9u6JmQxd2dK/+K6b
TLSH
T161D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9dcf97db2a611daab419a1a3d6304882952e96c84f32e8d0543750a7eba5afe4
MD5 8863ca9d5ca7abc46a90e159c31b5ed3
SHA1 de46e263988921b0bbd1ed63c7d8491df508174d
SHA512 5ce566db26059311b048c91611edbcfde6cd0c24c6298839fecf8bde126457ec816a357accabbb28e5cd3eef1f73da8888ff1c26a291d40beb6147c1f974d0d1
SSDEEP 49152:F1hpsNoJpF1A6yU44CwH7R4xk0i/+K6bxW:FmifPVRx/+K6b
TLSH
T199B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 97cdb1d6b739c276bbf6e01b5b635e73b8b645173911e5b5f04e007cf604d638
MD5 6f3367df9c6c0c4f2232191937abdb3c
SHA1 7894876a22568647de8c534174917d0bff549b9a
SHA512 ef2b50673ce9898c4880870161c8d06727dea0dc83b7f1ad6f453e0a64b57a923db97f329fafb1658a126ba24eeaecae199fc57acc94657706421da472a41a3f
SSDEEP 49152:3SuZQIY0Be2KIRVtOnks6NMHqn0i/+K6bxW:t5dKOi61T/+K6b
TLSH
T19AC5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6a0ecc6bee25518f5b60696399fd8bdd996688376e87c2f0cf93f338b24e7eb5
MD5 133a006946838ee8e1b90e58bf27758a
SHA1 bfafb7320c68d9f883eadf9fdc4215b4a48ae6f0
SHA512 6230614ce69385e8baac214b48ea8cc0432c2c013670bebd9298f2515a77e9517dc5561756df2a2aeebd2352df171da4d5a7f7cf6c3ee7c0a1939498c41e0662
SSDEEP 49152:ihtSn8EApI0figGgiDn0AP5ww0i/+K6bxW:DX2i/phN/+K6b
TLSH
T1DD95BE13F2D900E8D05ED174C7568632EA62BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 738c5dd78d1490001d5084ec01f8cf6ce5d999a971a77aab73a8625a63834919
MD5 f0b87a5adc7515600e04518e7c5848ca
SHA1 c5a9683e1cbc613045e6472ca62357a806a6215c
SHA512 af8584118a62f55253f58e4bdb302b465f88d5a0dc837dea069c3a402d2e1f8989a42b41413a5a39fb93442ffdcefc5fd280246c79f73c499da705d2da339d4b
SSDEEP 12288:D3TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:DD051dckw+1MCO6Wm/zLPFGn8W
TLSH
T191C4230A9E470A65CAD7CA324C6479807384DCFE667E117F1E6EBB4BE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f10113b23aef955fb40b30b31c54c193b092a3dab47c778bb336375e781aea4c
MD5 97128d78a049598d76b8e3469fe75a1d
SHA1 81f3bc4bc2ef48dc7171a92061232b2a2e8a952e
SHA512 474e02d2a368ac6a3fd8ca358cfaf635ca6959bd8da020bf33cf9abaa8bf9d2d461959485c215c75005feac81f6e818487d628062d00cad3f91e7d74ae82532b
SSDEEP 12288:psTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:py051dckw+1MCO6Wm/zLPFGn8W
TLSH
T197C4230A9E470A65CAD7CA320C6479807344DCFE667E127F1E6EBB4BE37993B0501B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 05a0085f9b3b418acb867f02eddf3f7c483495436ee5fbc5bccb92851f200e37
MD5 54631108e265d40a7a0ad61f645811e1
SHA1 081c7c8874e285a115f050809960db1565e1b09f
SHA512 4cc7dbf81c570d84e9e44dbb01d8bace39b859ad5ccb14ec2258be8a8481845328cf8b1c0a5f8aa279ec9614f54b63198f08a847a68da74eee095fef29c02660
SSDEEP 12288:dqTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:dc051dckw+1MCO6Wm/zLPFGn8W
TLSH
T162C4230A9E470A65CAD7CA320C6479807394DCFE667E117F1E6EBA4BE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f1242296b72c39f8dc015b820b1a331ab0cef7c113b6a7b0ad27e10bde1fb661
MD5 a79244bb958235b5744a49dfeb532dd1
SHA1 6144ed009743e41ebe2922364162daac2ff7278d
SHA512 d55d1fddbc2d779a762637334044274c2fb8b53ee433ac064da85c103e0fa0fc41269cc93c385344bf3d624f8a4b59dca1f8ae4bea6c462b201887d62c342d2a
SSDEEP 12288:uVlTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:2051dckw+1MCO6Wm/zLPFGn8W
TLSH
T159D4230A6F5A05E1C9E7C6328C74A840B3A4FCFDA73A13BF0E156A4F5B7667A0510F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0edce44cd9711087b76bbf9679465847d0c8e977ccadc8926168631307cd09a0
MD5 bce119fbde92ab966b23ac88ada9b90c
SHA1 dc04eb575dd4433476321063d10b1977bf58e2a7
SHA512 8b47ede48b7b29c241f12336765af61a8adec391876c6692fe799cb9cecbe551969f2274d7373d2b2db3506ad16f49faa05070ebdac2882c9cb1b32aa2bc252c
SSDEEP 12288:ktTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:kd051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1A1C4230A9E470A65CAD7CA320C6479807394DCFE667E117F1E6EBB4BE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 86ea6ecaab296dcf7ed6d3aa41cd320aa742dcbf0ad081abf0e226c34ff9d286
MD5 0b18a91989d83cdcfe8891da3c76ae98
SHA1 29266d2e37045aef93023ac69d36856451f3ca41
SHA512 c52abd304275119d0f4e24b31fa3507febc664ef05fed12e6f0cc374700155801bc5a82dcb64d4a76ebd6c4ec13beb9d972eb8158ae0d14008c493c361270e3f
SSDEEP 12288:v4TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:vu051dckw+1MCO6Wm/zLPFGn8W
TLSH
T14EC4230A9E470A65CAD7CA320C6479807344DCFE667E127F1E6EBB4BE37993B0501B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 129356bd5f84e0ee3f8df4d59217bdab064e28f6a018ce0062d8498dc8cf62ea
MD5 48a8561dc14449d384b5a5a28260997b
SHA1 5283112d1d2b4f2857e92adacdba73b120bf11ec
SHA512 6fa81e20db92acd5e9e481e389820093382b870a97ab25de9d69c8ff31a50835664b827b9a86a3be571f8ff2ce43c8a1f34ddcd908599d9daca87983a7ca8afb
SSDEEP 12288:AUTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Aa051dckw+1MCO6Wm/zLPFGn8W
TLSH
T111C4230A9E470A65CAD7CA320C6479807394DCFE667D127F1E6EBB4BE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8bdcd3aef477a53afceae8ae50a9775b46d8533eb048f772cad0e260bb466d32
MD5 2523a55f5896b69cd280195b9f136351
SHA1 279bc4a16f670ddaedd6fb148e7d71f070d13d20
SHA512 f6dc373291e3da493db0a085dadd79954a6f047a787cfd6745d43755e4a81732c595dd94616447bbb8df8f94a1e3691c099436a9da846f0f3b8a179653eb4ca1
SSDEEP 24576:QZMJzFVSOS051dckw+1MCO6Wm/zLPFGn8W:QZMJzfe0i/+K6bxW
TLSH
T1A805F155B35008F4DCA7823ECD659901E2B2BC6A0B70C61F07B8366B5F773A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6ddc73876a9536e04af63bbb1672839afcd1688381df76958fdc62881ec894a0
MD5 514496c3718fc254a6998c14ca870a34
SHA1 ae64c479288b6c05c2a102b667ad1d721cd409cd
SHA512 bf5e9dd961751d090616cc66ee5f7ca00030a1f914d0bdb5329f68e03fa5b4bae17dea6ee1f6d49fdfc3b61ccbd1d4a633824f9c0d9b3b3c65ef74683f2538a1
SSDEEP 12288:97TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:9X051dckw+1MCO6Wm/zLPFGn8W
TLSH
T131C4230A9E470A65CAD78A320C6479807384DCFE667A117F1E6EBB4FE37993B0501B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3b8575042280b164ed6b898b91a0b38bf447a9aab7d2274ec50bb583f1484cc7
MD5 7bb5ef86649dc4788a4605e55e90e759
SHA1 2e5e63143d0019cb740df02feb37c54ced4e7dad
SHA512 8188e6ac18731522783e1a69c9a717d365ca4d74abbc07c5faa53a06ffca86e6fdb182749a88b01c4b2d33747958d02d204e33d3bcd87e1f9695857534c3e3a3
SSDEEP 12288:EPTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:E7051dckw+1MCO6Wm/zLPFGn8W
TLSH
T18DC4230A9E470A65CAD78A320C6479807344DDFE667A127F1E6EBB4FE37D93B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6be4ab7d2e26453fe43d02ac4ef296e37ac951127f767722bb0325e65dede939
MD5 a0f335d68d29b13d6062a7c0727c3d95
SHA1 8e808eb7cf01b9ed0ed0a6e8ab465601a74cc7a9
SHA512 3e25b05f77fefd9ea36d69852a52cbbd0f8146d7e571dbd613ce423c390cc34fb4eef10d2fa6b6cd1dd14caf3feb8f29318f0786d25b948b0c99082a5ccb6774
SSDEEP 12288:8yPz5L8wTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:lzym051dckw+1MCO6Wm/zLPFGn8W
TLSH
T14BF4120B77A220F9C5B782358C611E01F371B87607348AAF17A4577B6F376A15E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7a227fa255a373a377eba8bf02d8607d5dc0063d3708cf6231fcf5adc02f26eb
MD5 03618a9a7eb18fecd9c5c854a3494117
SHA1 bcf157e3d89ffd5a0f34d682acf39900b916553a
SHA512 342243a6782504939a3ff22e67ce72c37decdce46753ce1e414ced03ea13d15a52d6d9b3a120bbf8beb654121c894dbc13f4d08e23b8ba160133dab6ceede27c
SSDEEP 12288:J7TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:JX051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1B8C4230A9E470A65CAD78A320C6479807394DCFE667E117F1E6EBB4FE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5d1ca50ac45cb2f74c5839d2cfa97fcce0dffdc903f3e8a5f9ceb927d3680621
MD5 08b3dc243e6f1df567bb09bfd404c577
SHA1 3245f6eb2a01a7114564addad15905d59130da21
SHA512 46c90b3f67a1804e5f3964c9c50645ddd513c43eef6dac03f15f248262c373f2f1315c12818582742c22e73222e0a4dae6a618b2868dbfed3c443c3dff013452
SSDEEP 12288:d7TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:dX051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1A1C4230A9E470A65CAD78A320C647D807384DCFE667A117F1E6EBB4FE77993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b84080f0b612426ba7be8bc55a431952682ccee11c088cc2afa5276f97b2490d
MD5 16c2cbca650f6724f9d57c41d8965f51
SHA1 50cc8a41627cbff9b6544d53fad5b6f6952c0dcf
SHA512 7ef6af8742048c9e24804dadcaaeb328a34646ac646e2ad70c3f80efcac6c336ff8be2736930fd141999cac91105de624f5c1b5721e7854aece7909ac5f89782
SSDEEP 12288:7yPz5L8wTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:2zym051dckw+1MCO6Wm/zLPFGn8W
TLSH
T190F4120B77A220F9C5B782358C611E01F371B87607348AAF17A4577B6F376A15E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 48ae483caf801b8863b0582a0d817ea535c8794dfa97db75c52cbd435fe3d0c9
MD5 27efc8db517c38fefe33bbe83e2a662d
SHA1 76be2b7d939b83a3e3231425a4b4d810a685a96b
SHA512 c6c9269bc7362e2679f7c27875d7b3500483959fa79c35cad7fb0aaecbafc821a95351af0b353c74d128b999af081208e4cfaf71ff5f93490ae4d2d4ea8a4be6
SSDEEP 24576:4TuaLl3z0zDs051dckw+1MCO6Wm/zLPFGn8W:4TdLljx0i/+K6bxW
TLSH
T1C3050155B3500CF8DCA7863ACC659902D2B2BC6A0774C61F07B8366B5F373611D2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3ff4c1ebb3e77e50276c2162f6b554b4c908551b89c21a741f26760a4e7a00b8
MD5 240f83dbf333a51d24d5696e799c221b
SHA1 87f9e620ca7b47b40c9f9ee16af6b21bad6d9cec
SHA512 1a7e001fc817ddf49658e3aae2a513ea89ab3fd6c9f985a56ea8b7e7e607cdc090637a08f722e36c1b43e8389335db00838e255a8ab5c834a61413a5b86843bb
SSDEEP 24576:A3xd9CHKy7GZo051dckw+1MCO6Wm/zLPFGn8W:Kxd9CHKyae0i/+K6bxW
TLSH
T1F325CF90F3E414E4F0B7CA358D755511DAB67CAA1B31DA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a08470ab76f4350813ed5331d018087728aee941372e525ac4976c9a1567173f
MD5 e4a7f58c1f79642ebc7c910c06b8450d
SHA1 99af9521893fd2c2c721875d5f84488c1a837fe0
SHA512 6ad36e52afd8e3ce4496665975d263f9cde8a83e156cd621d726a6f7d6b5ddc5553bf0ef0631a33130215474fa8bcca13864255e6499e7b0f2189a4efd3319f2
SSDEEP 12288:LKTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:L8051dckw+1MCO6Wm/zLPFGn8W
TLSH
T159C4230A9E470A65CAD78A320C6479807394DCFE667E117F1E6EBB4BE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 8512e069c844a21940a7eb44e15407fca1cf1be019fb2fa048d475e78d57d1a5
MD5 8fdf3a9578426159bae763beb8c0b9f1
SHA1 d1e40a040172c54cfea64bb7c6f410b2d447835b
SHA512 8699b3772f33782a0697034933d7089c8f158dc9e7b9b4e76dc4e23b3cd89555163a487146df954a6e140f9f3e7f8cf544df9e6046ccb8e659458294cf5c9dad
SSDEEP 12288:sQTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:sG051dckw+1MCO6Wm/zLPFGn8W
TLSH
T139C4230A9E560A75CADBCA320C647D407384DCFE6679127F1E6EBA4BA37D93B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 605e10195cbe418cba03a30fe01f0bf5d0bc1074282f85a91e3393eefd41beb6
MD5 60f9a22e01cb0aa208ca386f3b9d0274
SHA1 48583dd28b2aa194c0c33605c6f9246e0d4d5eea
SHA512 805a7da7c9184ea0466ff24d544e95475942c92f6a59662acbd23f9df53c7876a9f36feef6de981b605e0b9d0a40b84b5e2fdfa71f12b4c01e6f8324c9b46456
SSDEEP 12288:b5TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:bZ051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1ABC4230A9E470A65CAD78A320C647D807384DCFE667A117F1E6EBB4FE37D93B0101A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bc27744815e25f0db5231e59a3aa342f57c4e0eac97847c876ef08b4a4e0e044
MD5 04ea6bd478964bfc456e878edc5250c2
SHA1 6d73d62d68fba7eeabe02e6dadc20e6dc3d21e24
SHA512 5e2e98c37bf073529cbe00dada3252e6f4fa9add32b3574e2f8c5c394ed40c4214b4513ceb5b884ae6909c0f6a9157efcf833f0404a1cacbbafb1b78afd51400
SSDEEP 12288:b7TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:bX051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1A7C4230A9E470A65CAD78A320C647D806384DCFE667A117F1E6EBB4FE77D93B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 263983f7ecb71130c35d694ca9f53b0dc30f67b32685b49e798ab359539cffc0
MD5 0e5f9be9589e88122d43438e55ffbb31
SHA1 b265446f6194a0c270316a094ce549d558e2bcca
SHA512 92e2426f571f25d3c33bcef48182ae1633049ff2b36200a77bc9148fb32a00bce67e8135ce497247d8aed65e6675db5a90e321ad0442ff788730fc4b47ec94ed
SSDEEP 12288:NKTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:N8051dckw+1MCO6Wm/zLPFGn8W
TLSH
T175C4230A9E470A65CAD78A320C6479807394DCFE667E117F1E6EBB4FE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 61260bdf4ffb1cb42444d345ffd847df2e76896ee96d22037e1947a2f76050db
MD5 7a23c73e55fe3624c19694f8535f5fc2
SHA1 81ce7fadda492cefdfe9cbe3875a12317f182efb
SHA512 621df2171204b854f682ecfb029e26a7cd8939aac2b55029261d5d3ad725d096c32e6b4d8dc1df1c83a21aa0fb449c3a4a298273e59311d134c01dcc4d7b2135
SSDEEP 12288:KDTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Kf051dckw+1MCO6Wm/zLPFGn8W
TLSH
T159C4230A9E470A65CAD7CA320C647D406784DCFE667E127F1E6ABB4FE37993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b7e3161daeb9fc04d42d69a6ccbccaef093ae7004a8d6e70008c126ca88c940a
MD5 f946b3f109619861de2b655f15368809
SHA1 167ea981da4f71f620cf9a88319feb7f067e0061
SHA512 502d38605f8a2b00153621267d06b20b35c5bd4c7650c80e3128bab79015d51fb8d581b24d47fce0af6864abeaed5b63ff55af0026ad4199cd9fc8bb39418064
SSDEEP 12288:utTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:ud051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1F4C4230A9E470A65CAD7CA320C6479807384DCFE667E117F1E6EBB4BE77993B0101B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 fd248f341d486e0cbf8f0c76376cdd4662670b1377b673213ca5926db16c0de1
MD5 d008393bb99acc1c06b8cf827afe1815
SHA1 c2167ceaf3add95b188b5b8b257b5c223dcf1a4e
SHA512 56a69c370bb1976335f13b657a47a1f57e62838a8f4e4e4dd38931fa20baf470a6946f398cc158e56b93c69c761b57afeef04684d160889c2a335025329a7bf2
SSDEEP 24576:rfwvOk9RX6wkyAIr051dckw+1MCO6Wm/zLPFGn8W:TMnYIr0i/+K6bxW
TLSH
T19635CF29EBD844E5E1B7923C8DB74606F6B178691B31C2CF025A53AE0E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ac0260d3a694fb394bf13c0c84366a7c356694879fa17572a4c382691e0c243d
MD5 c11e63004aab9b93ec5fa1c9802f5323
SHA1 17ac426659b9de206b3d71c66b0941d9c040daaf
SHA512 283f6146308a119f7ca14c4020dbef6cf73bd07a324c101fb2374eb12a9906d43ca38c6e6311aec8ed4125952453574a845a1300d13b0e0ef37a6af9890eda53
SSDEEP 49152:uYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Q0i/+K6bxW:mySzPC/+K6b
TLSH
T1EC066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8c93bbfb95ba194203b78dffede693f32bcfb8e025f6207cc1db80d8bb5c0212
MD5 12a3290ad74ffb84ae2472981e446b35
SHA1 1f4c3db53c21b72fc19ddd476bc880ffa406c831
SHA512 1499cc0c622804d187b5b7718e037811f418764aff3e11e1c5b3ec59dfa6a01fb062ab205e9962985d1670b1dafb9fef717b103246156e97049893eb8ac285c0
SSDEEP 24576:B47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYC051dckw+1MCO6Wm/zLPFGn8W:B47JUQjairIhCnDHUPfF/A0i/+K6bxW
TLSH
T1B565AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 422f97bf49c6881d5f43fe7acb92cf33b2f0912b9dd8fcb6660decb2627dd0c5
MD5 c29de841c5de563882df7aa3d423b3f5
SHA1 e1ff87d1f80fcf97acae4702e52bae8851358c84
SHA512 2e2e93f069224511853f91623f90dae9425b0ce3b65720c3e213026b43b4ad2291a29c726574be1c1ffd6646ab7584008c39991617c1d1616ce3c031998c37fc
SSDEEP 12288:VksfrTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:ln051dckw+1MCO6Wm/zLPFGn8W
TLSH
T1DFE4010AD25802E8C0AE9235CB555A40B3237C6983F1D3CF16D0F63E1F7A6A55DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c86864519f645fb2d2acf95b90465dd2ca5fab53c7c508eb6225e334ea7f577d
MD5 be0d827195af15958cd2ebf31347734c
SHA1 8b3303c3f97fa86703c2f783f2df9b9739333050
SHA512 ab8d3d4d87c145c03a91e41c53a973aa3219441cb36f83540fd8647ce79cd39d92e517c51321ad71fa0d23aafb67607d49a7069cdec4ec01321844415517c5e4
SSDEEP 12288:99kfU3fj7T/hme7sAs17Zw8FLy7wBs+zZ:996UPjRLUO8FLuwBX
TLSH
T1EE3507417666C74FC66D80321E32D2CCAB707D11EE04AF0373C99B3F9576659BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4d24c6258cfeb3fe32ce4085ab820d730d1a19561212af74949e97a1e7e8929e
MD5 39bdd3b5aac370978b1263a26586fa0e
SHA1 1b37def7c304ab6d1fce6a1e4ef217c55e29c703
SHA512 a49423f9d188bcdc1fb49b88c9958529e0aa6cb32e10ad0cd84fbc579e2e1e51001efa588d4e2abea733720e2e910237535d2d689addefca5d4ba8f42afc4aeb
SSDEEP 6144:+DO7DgDc3C6nwxMSzD9tMxGLMYGw423S4lM5cwD9tMxcOSsv32O5a9h1SNrdSF1:e6wqa5Kh1SNro7
TLSH
T1E665E8416537E3CFD1BB6072072A6B8C77A4EC06B7095F2673C8453AD86AB15A0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f90bf77f9c1ba2add1f0c910589cd2ced02ebc6d1b09bbb43490659843ab07b1
MD5 dce3f27ee7452b77cf24e1910342129a
SHA1 dc1bbb75785b825af63a9245b04b39f788eb4ca6
SHA512 3ef30abbf1b2ab8c66238e4fa46aac3e2763249525e5b3fe41c00ac795ce2c8ee5892e831e80475d3cc0c0232dd32847ab4583cb99fa8fc9a288d8f8af6f8dfe
SSDEEP 12288:Q07zTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:dv051dckw+1MCO6Wm/zLPFGn8W
TLSH
T168D42306DB4A0D21C9FB8A310C68A9103348ECBD5B7851FF1D19B78FA3799FA4D21B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1409258ed69b73619ead8855ed43f4a20f80229fd67dcf32fa534d57cbe5b2cd
MD5 605ffe396364787f41ecea15c0c5a7c1
SHA1 fc66d68212f4a338874e63be7d503f28b563c833
SHA512 2879042ab0e0bc9a376f3b6d9facd1d0aee1994f5e6b0b90dcf0fd5851a226349a351e6a20dce4e77f0f47ec36b07bddb01138f23a8c7b72d866d42bd7e8f80a
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYx051dckw+1MCO6Wm/zLPFGn8W:Qgb4mBIBhGFC0i/+K6bxW
TLSH
T13B65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 86d4b899e52f71232a0c3f74a9f7cb93775bfa0f58313c9179fbc183bc739432
MD5 664a78f83c9732a9527439ea3406556f
SHA1 c2bf312a8bedcd6d519d7657fd96a904f221a349
SHA512 1d716253568ffd7fe1270f0b2c8d7d09e8f034839003fa29f76928eb8ecfdca057f27a96b7af1e25115469ea23e3cf0b8e344142ef8443db7f1a263435d068b3
SSDEEP 24576:dG88u8FpJqH1nzria7/mS051dckw+1MCO6Wm/zLPFGn8W:w7ZFPqV6a7/50i/+K6bxW
TLSH
T19535F16577E101F0D47BD13889864663F6B1B8250374EBDF0BA88B561F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3ef69b3d5ab9926bf22889e37bc0f8bad97d40f936eacc621903428007b7c8a6
MD5 eb2337c113f5fa881d258914584801cd
SHA1 b38402d3e53f7ed0d773c619c9c99a7b7b79e92f
SHA512 78ebe4862fbb8a5a566f3cd2811e69dccab2dc79787df8fbb5264403041066f4b2dec8c532fe232111d5be17ff593d51b0963aab87d541ff6aee97ed0939ff35
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAju0i/+K6bxW:gG05lO43b3/+K6b
TLSH
T168D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23825033556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ca85261cb5b171286b346fa5945a1176c0e26b7abc3e2ea1ab16a73e38baab8
MD5 43a8b6d448e8a94687cdf92b71b0bd9b
SHA1 296b0687e151c52d5d5bdfc8574d7c888d7da999
SHA512 c7798a254b61bbc5a674eddb7fa57b68823073b71a05dbd2a561b74a1809902ab0c59b9166cdb9ad87a208a4fe698fc594d7a616c0b0e94ed795347f95eeb387
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnQ051dckw+1MCO6Wm/zLPFGn8W:ha5POZ3hJt2pasx2+mG0i/+K6bxW
TLSH
T15065BF5EA6F801D5D5B9D17DC583460AF5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7c1a78fea8754b27dd18d55d61e2b3fc50bf6ae1604821a4eb18a74f8cd90e8
MD5 863ba8885af5112f3b8488e728b768f3
SHA1 a749d565481200d10fa840ca9d35353690ca412e
SHA512 ec0219402f9ef16d0dbe7c600049cc462a198757c721f19d3307189562f21a366166c6927dab8d0605a7039cdd3c559e20d7f2eda6e0bd037f7a473482ffba09
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fkq051dckw+1MCO6Wm/zLPFGn8W:ENc/zEOVHFZ0i/+K6bxW
TLSH
T12E858B1623E901E4E5BBE1BE89779546FAB17869133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85c4611aa02656ef5645863bcdddb6e8c5b3a61311f91af747c91536ce915cfa
MD5 e502e932abaf986ba81b3b8c9f7031a8
SHA1 c909fb6a129b853fc6a7cf3c0ee72b26fffb8d7a
SHA512 9ab256ee22338bc40d2d9918b1efe8462572eb4eef0a717387ac928b55c96ba389030ed80e0bc72f940bea14b914366dc4de4471c3adc7e9a98689949d8efc21
SSDEEP 24576:m3kNvNnaFeYhJNtmZBm0051dckw+1MCO6Wm/zLPFGn8W:m3MwBtOm00i/+K6bxW
TLSH
T16655AF2EBAB806E4D1FEC6758D238512E6727461073293CF5290C13F5E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2fe3eea23d241d36d7f86f46e9b61d263d3ee6e3bad0daf0692618e67015ecdf
MD5 644d76bc624260e762f1d02110200da8
SHA1 07ce4c041fb60a171e5dd20620a205456fa8eb8e
SHA512 23320c27518dafe1db1f5e309564ed15f8a445a365bc5b79f7a8a25b5faf37300618c2b76c6ccecbe1d20393544bf71b089ca5af39154884b068a64360734db5
SSDEEP 24576:SPUr+NQe051dckw+1MCO6Wm/zLPFGn8W:SJQe0i/+K6bxW
TLSH
T11105F11F66AD1CE5E676E13D89818709F771B866031292DF02E0817E4F67EE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a55bf36441dafa380cdc97afa1d4a339a51010e57c34059c54e41024ca38d96e
MD5 a612a75b12a3714352c44baf77526b4a
SHA1 3c41deea2256dd7d78f645f8776ff9e71bece952
SHA512 fbd1041d06f401aba3c3569cf3ee1e4904a7af3ae3d94b475c80f8a78388af486ed6eda82115887dc8a120e11ceb4ba385d06e5ad95db5ebfbc27163ee064dc1
SSDEEP 24576:JD3FHshBIYQgAj051dckw+1MCO6Wm/zLPFGn8W:JDVHeBIAAj0i/+K6bxW
TLSH
T19825E13EEA5D04E4D57BC17C8A638A06E77138AD033256DB0694C1BA5F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1248-274-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1248-67-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1248-73-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1520-252-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1520-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1520-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1520-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1972-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1972-82-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1972-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1972-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1972-320-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1972-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2364-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2364-108-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2364-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2364-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2420-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2420-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2420-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2420-14-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2420-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2640-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2640-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2640-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2640-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2640-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2640-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3616-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3616-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3616-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-306-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3852-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3852-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3852-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3852-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3852-128-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4796-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4796-288-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5008-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5008-77-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5008-7-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/5008-6-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/5008-1-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/5496-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5496-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5496-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5496-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5844-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5844-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5844-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download