51d6bc7c34a709812b836fffeeb833182c2e0b36dada5072413df1ebb598cb29

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-av97eacx4z
SHA256 51d6bc7c34a709812b836fffeeb833182c2e0b36dada5072413df1ebb598cb29
MD5 d2b60cc59ed6451a59e34e2921327f84
SHA1 7e561e6ba114099c15357cd4746f2a7e50f68d02
SHA512 df68648a3eadfd6b8db57e214d48ebb8f483ac864093e8046331a0ea1127fbaf8a6c842f6e42a02a42bc2046ae5c0285e97559f882239d8795f7a9b5a8a72e2a
SSDEEP 12288:qUYJ9bi9N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:rYJ9bC8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T1D1F4022072C18473EA73153259B5EA719A3DFD714F1089EB23907BAA6E346D0C93DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5816	elevation_service.exe
4176	elevation_service.exe
1712	maintenanceservice.exe
2596	OSE.EXE
5528	PerceptionSimulationService.exe
4892	perfhost.exe
4296	ReFsDedupSvc.exe
2560	SensorDataService.exe
2844	ssh-agent.exe
5888	AgentService.exe
4952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a1c59fd83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a356f62df17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000046d72d63df17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c09f8c63df17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce30d464df17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbeccc62df17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000867877a5df17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5816	elevation_service.exe
5816	elevation_service.exe
5816	elevation_service.exe
5816	elevation_service.exe
5816	elevation_service.exe
5816	elevation_service.exe
5816	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	5888	AgentService.exe
Token: 33	4952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeBackupPrivilege	4296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4296	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4824	2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5816	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4504	4952	SearchIndexer.exe	100
PID 4952 wrote to memory of 1036	4952	SearchIndexer.exe	101
PID 4952 wrote to memory of 2840	4952	SearchIndexer.exe	102
PID 4952 wrote to memory of 4932	4952	SearchIndexer.exe	103
PID 4952 wrote to memory of 5972	4952	SearchIndexer.exe	107
PID 4952 wrote to memory of 4780	4952	SearchIndexer.exe	108
PID 4952 wrote to memory of 2568	4952	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_d2b60cc59ed6451a59e34e2921327f84_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4176

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2596

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42706b2e607016439ed631490a51a7cd06d0d0dfd4022a475c192534d0cb873e
MD5 1510cf1b010682b49190ff9c0b44beb4
SHA1 e6c1600c4f2d25f43a6fb9227c08d720ba34d63d
SHA512 56b4909ac84438198dc40605178d67fe9117e422f35ffd9ce9b8e4d1a47cd70eca51df367a7203ee8421b84f9705eb7490ac98491c13dc9ca5691b6e95c29b62
SSDEEP 49152:1b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnO8U7twh0gYUub:L3q60jB1bpi0gYz
TLSH
T134D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4b31f4dc85899c420ec99a99e523862560879e0f08428215ba47bded70494fa2
MD5 853c5ec873483fec7d152734bfe715b0
SHA1 a413960765e7a4c23aa144468b0dd94cdbffc222
SHA512 d511e83f4b2162bcc983eb891ad8dd46eec8e089d5c96c2e618a5d40a9bc61365b06eb8271a4bfe9b363d341cd90921e9ae231aae0c95063b072cee1e7b1bbcd
SSDEEP 24576:FXYfDtczA58U7tTK3VnChd4Q4PQpUcrf0FGDQ:QtcU8U7twh0gYUub
TLSH
T10405F128B3D108FAED674239C972C511EB327C554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 eb6a91137e30a27dbfc28b26dfa1a2e3df87f44d3e134571a10ccb5c6044a941
MD5 72e75e903c7d28def3181d7d09c36945
SHA1 18671852e389c888924d2af19c179574e58beaf4
SHA512 9df6ce82bc488bc269905af9564d7cef6f280acb6c4afd3d91cf1f235b90118505e2263e50430752cd94cfbc22ad0664bd47b72b396f2007a45486e3b3b8c6d5
SSDEEP 24576:s0Le5ji0hmxNrMW8U7tTK3VnChd4Q4PQpUcrf0FGDQ:sPji0A7D8U7twh0gYUub
TLSH
T16D359E15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 950bed7e414aa1e1cafa217c02a8b1d05d7dc683c87afd163feb564075441891
MD5 155f625fe38bbc99a608a899986b51ce
SHA1 b72ff543af0dead53b3707dde0976d8bb7e818c1
SHA512 d6647bcc7bb0b9da5a07138488de7036cddf3ff6b29cbf11a6b36af3c29cf9384396ddc2a2db6d33f0fdb3f625e96b659890992962233211c316fecf65a89931
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWr6q8wyuE8U7tTK3VnChd4Q4PQpUcrf0FGDQ:f/ezSC6vUzPviHjy38U7twh0gYUub
TLSH
T118755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8fe279f1ad6375d0cccc72e0b960f51b409858593a7d556cfbb813935d8b2b29
MD5 6971065f4143c3c46d272c2610a82a36
SHA1 6dee5878a33eec93d0aa2c1a9d3bf78f93101863
SHA512 808c5d20439a704021cff517e397d634f382af9a59762c993e9bcdc98229bd20e90114024be805aec5aded310ef4d500de650ae69f75bff1afeb94979e3836e2
SSDEEP 24576:fVbqPb88hv/l+bl8U7tTK3VnChd4Q4PQpUcrf0FGDQ:fVO88hXl+R8U7twh0gYUub
TLSH
T1DD559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1df022d7031842628e2c10bfc56d0591b0d6fab4e5aa509bf502a1c6e652973c
MD5 28c73cf16f9a22565cc0416888bde1b4
SHA1 3b896e47702147f8bbedbe471b1c23a9b897dc63
SHA512 904761e2a873f7a5a3a68eb14d5036246953f3245be480cfb894cd3ac094d181f0951fe3cf847cfa1729c212b97249969968ac5e9aa390aab2329d41b9c013f2
SSDEEP 12288:tjIN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:tji8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T132C42320A7858807E3662B33F937E9A4EB115EB45D44CE251460BEE4AE3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8287b0b699b689b6b28df73d2054b8c4b1b4115c7eb6ff661e1f384a10310d7a
MD5 344d4a833bc047094fb8a41f23a85cb6
SHA1 891c1780c26ed96151768f02ba309bcfa5c22201
SHA512 7b0c4a42ff206b9ce520b491ae00d4f0992f19d463f3be1a535217438effd2d5738e5e479b4d02992a47a0ae8c909b664d77f5ef00a0451769d2241c0934af1d
SSDEEP 24576:WJIUt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:WJIUt8U7twh0gYUub
TLSH
T12205CF3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 52a4a03dd8e0fe1594e86b717e206e87531c958dcfdaebfed8b3c1ad8386cb8f
MD5 8e9bc58704263c18199647b7e9dce508
SHA1 d758abc5fe83aa479da01b828d13be2d9a245313
SHA512 1f20f024008eda64f881f7207895c7e293c3a22d3d315da1e0dba1be12a0ee8a05dab7c8847bf6cbf97bb76c46bb3433b96a5465dc7cc7e561f49bb86cf13119
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THV:1QvGAdlCEL8c/RRNw5C0bpi0gYz
TLSH
T143266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e27c12923d76c636ee16d885abd6b7acbdd524bd9cc05e8b6ca8e8402dfbe2c3
MD5 dadd625a1170e7b568eaabccdc79c309
SHA1 918a683cd59c4c023d5235012b87430077517d75
SHA512 0f7bd88850c6c64c6d0b10d2d80af5630f44548c4f3e4129b89ec91604afb1ddf97335bfee389375004705fc46296549727e9d2e8e37af580e7e5791356edab0
SSDEEP 24576:sSewsAjz8U7tTK3VnChd4Q4PQpUcrf0FGDQ:/ljz8U7twh0gYUub
TLSH
T1E315E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 627a34f7284d47f16a99cc9713322383204453c5a172a54f0d6f8e733c49f25b
MD5 4b8b424fdc7d20b4c2a2543b3aedbed2
SHA1 236b5e7d9374679c5990e6dec79ad15632dacfb3
SHA512 039a0f8a92b41f417ed758cb726ea2f5c279f54e3d656db8c2c82df27908e944713aa974c616baf78ab8b808993ed04f1b5329cf40fe077daa662946993e6a8c
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH4H:0UEtQevvqc2W1cpV2RI320
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 711ffd4c1e61874be356fca8b4d1e18b9316199aa73816c3b80603abbfa8c2c5
MD5 fd5fc66e58ed6cbe42190252f36d4f30
SHA1 40de72ab0f1a4a8b1a935b731f12da2ea944d281
SHA512 7d126530de4c8e5d4a03b987a7b1e405c432a1db38bdd76fefebb35978441cbfec77dacc0e2941ae9ccf3fd74ac35ba8d82e54205adc55de8f44f09566e8413f
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zT8U7twh0gYUub:foqtVjnmIbpi0gYz
TLSH
T158D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0e51b69942d69662d2c967796a956bae4bccbe7f8fb4263491eae0efa61d62d0
MD5 fd6c54e8d954a6575f8678365f67edbc
SHA1 63fcab33997b0a9cef1da9541a425f3f2872fc3c
SHA512 973ee54b5be8fa89dde4987c909556cfec31e1aea18ae06e2c374aeb215bb1d3fef6fc6cdd6d1b001b2cd68be9a1d421e0d467e01bc61ce0239033b8eda07bdc
SSDEEP 24576:2AhGL2IFoiwtA5l7S53o8U7tTK3VnChd4Q4PQpUcrf0FGDQ:2AM1Foiq548U7twh0gYUub
TLSH
T141359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5cfb95b84624952e86fb81fe80828919c3c926e6d0c3131db86e806474bf4dea
MD5 e136a97211ca34e01998addaaac657d8
SHA1 72401a1553ec8821165c19fa335cdb6ea773f6e6
SHA512 f0f6c325a7a16e591394f82c3c959f76dd361a269ca6710a341eb10127701bcbf5539512cda28c28485c01212bef7c6cd1dfe0a7c4d567c5578ad79eaf76adde
SSDEEP 24576:TwuXOWX8U7tTK3VnChd4Q4PQpUcrf0FGDQ:TwsOs8U7twh0gYUub
TLSH
T1DB05F04573A40CFAEA675239C567C536F7B2BC112A20CB1F1760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 84f674f9611a4b89510e9ddf778289887605d3f651743b52b8f45a72931a5582
MD5 f353c8ac58e0465b3ca0e2f1cf3730b5
SHA1 1312da94fdba4e80364beb80d15b8bbc68b83355
SHA512 1f23b23983e3732701670f4734b013e14573120c8b58ec49c58ae3237019bb2af115fcfda9d6875887c93c4ea369cb90ce3eccf29d6d8607ab17955e888c6c1a
SSDEEP 12288:1/Z1IyNN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dZu+8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T171E4125433D460BAE3A3133AD9B29A45E7327C61273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8ded716c6808c8f6459e187160a2b73aaedfc535414ad7512f7a90b6f26ec7c
MD5 81fd2e14bd80c68d473afe520b1bae01
SHA1 4b0074ace08a54965658649a1ed405985841e7e0
SHA512 2dd5ebf9a83572baf2bb8f85f16c88efa0690ce3122234b3b7e5756b315280c71948780a7e0e61b5211cabed20f7d1728612170d357c8add7f53fd333bddb2b9
SSDEEP 98304:KQRQyi36YOcPhLvw2gAf+PN3Bbpi0gYz:hQyiKahX+PNmH
TLSH
T184666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c5f8296079bf1362656f0c8f157f61b9699d6aced0b4cc9dd502eab2452d53e7
MD5 634198157ffcd6b90d1ae2b64c11917a
SHA1 5966cf076e72ac6cbf4f0e8fcbfdb2b6e8ffd782
SHA512 0cdd7821449cf7b33e0d9cec1935d2465df0db345d2b45ab34cd587315f08094ffc37175fb871416b180affd7869656068c611c1fc9aa2801e92788781afe752
SSDEEP 98304:BQRQyi36YOcPhLvw2gAf+PN3Bbpi0gYz:YQyiKahX+PNmH
TLSH
T1E8666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 74b9fd17bc8341144d5faddf267a37167ddd9306bc6c2e4560091f9f38aca8c2
MD5 9036f857aaa74ee3a995aec99824b0e7
SHA1 28c00c5b48998649bde3bda73df109fb4ba110ee
SHA512 22d33b487b0ae55752884625d080be4b056b838e49066d7230472809a25849aa2dabbbc5adb9d9a24c1a1fc27a1fe4b50e3f95de756440b3272a99e72c471651
SSDEEP 49152:j68Qg55nhceWu7PNU3/D8U7twh0gYUub:dthLRc/Dbpi0gYz
TLSH
T197B54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 35127c4eb1b1f5c8efa2e3b87b1cfdfa48bd6fefd104bfb6554e00412a72379f
MD5 fba28e274a7a3fd1e6970265325251fc
SHA1 8436417933f9dde9583e8e6f49e16d82859f3757
SHA512 8b87e5ffbfeccce06f994f70f300017a2a75a7b0bba1c8de341151e1ac9617541c3cbbb0d00ffcdc6b4a960c2ae36108462234c737bf2d72d860e0e115772985
SSDEEP 98304:Cy5112gYy5azzVva69nLKnhZibpi0gYz:LLIHjWhVH
TLSH
T180167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3f950562ccb5d1c8ccecaca9fb3852d50352654db1d4864012d3661d45e442fb
MD5 ae49b9e3ea1ff7feaa7212d95e9013ad
SHA1 12f5ecd8389e0fd0d24523143f4e0e01199743a7
SHA512 bd71e25e271441c2efdd8c869c97cfc7508125c975ac471d5c2baf5f63c9e6990836ca784bfb7cb4c456e232a73c8c9634040e0f5bb61af6a1a9c2fadc467a03
SSDEEP 49152:vB+taZ3usBWOBr4tEG20bqx0z+n217aau1glJ8U7twh0gYUub:Ru6JmUxd2dJbpi0gYz
TLSH
T16AD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 153b1aabb2cdfdd626c7fb4a5771582e39fa20e9b66172b113a16e164a7aa75a
MD5 d01feeb1dd9486dd5451b3a78be5d805
SHA1 1f71983f66574908336c9a684c2856246195d2fd
SHA512 2f60bfb87b69f8b54a6796a28c0d3506d1858c4511694e7fd528f9688798304788053f78dde4bd139c3367613b4183757507dcb7a489196e1d52e7ab3d379884
SSDEEP 49152:J1hpsNoJpF1A6BU44CwH7R4xN8U7twh0gYUub:JmifPkRIbpi0gYz
TLSH
T101B5BE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c89a2d0300b86f53348d158d3e4e494b1221d62c155512da06c135ab1d45de4e
MD5 cc7678bc1c02f6a365557452ef4af1b1
SHA1 65ef6e5f8b4ed6340213160d559c773c23bffa8c
SHA512 e4675a941bf12555ced7f1390c7881b1e41e4c6fbaa412fe0888091427214d96c2ce14a1391ae76ee51907148ff8b1f899058f0dcf5c8db0a957077f4ebe1551
SSDEEP 49152:oSuZQIY0Be2KNRVtOnks6NMHq+8U7twh0gYUub:y5dKvi61+bpi0gYz
TLSH
T1B6C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f277c6824fa6eec95c1b0f23a9e835e2c9fbbe01d1eb39ee36df688db27f231
MD5 b6a92eabe1c54fda60deff1c46eaf56f
SHA1 3db893979eadfce78dfca0f197c3639ee86c0c81
SHA512 74dbe61f892d18b9f0f9df270e98ac5768222aee3d21bee40473e9a9883102785681f7a66161e5954e2cb104272f8a826e8cdbf0b20bc389b881e9d62ffe57be
SSDEEP 49152:6htSn8EApI0figXgiDn0AP5w58U7twh0gYUub:7X2iyphMbpi0gYz
TLSH
T10D95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d1a2e5d328eebe3a2b3a247ef43e5f7239f1d2d6fc96d27346cd37b5644c86e1
MD5 ef82c867b058d73d2ab3dec3274dcd08
SHA1 647dbf604db6f345d73da239632b8d0ee366bd9b
SHA512 422d3f3cc90d67f5e1a2e68ae7644ae2b342dd50a4ec3953e773c80abf322796ec82e22de291fc4662acd5143714d3d97bdcb4536d3496d67842c3a8af6dfd0c
SSDEEP 12288:qQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:qK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F9C42310F7964C0BE3112733F537E9A4EB141EB5AE4489292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 379fbcd1f1c9a46cf02af005065619f76eded9a5749324d24e6903ea9db96c65
MD5 2034efbf45a6e108b57db804f092fac3
SHA1 e27dc6bc1641a4baf967ca360eb7f23f9bca595c
SHA512 130e98f5cb99ebba0f80979927a7b7a4ee5c0b4c0dd3803dcfcd4626060e616a87cab895802241253ca28f0bd9d9511783a9ebb28db24b9f751ca8935533d94d
SSDEEP 12288:h5N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:hP8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T192C42320F7964C0BE3112733F537E9A4EB101E75AE448A292550BEA17F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7f60b19652703ec88ac2eceb31466278736082a31c7f56851044a693c2e18772
MD5 0dac832cc83ccbd7e79e75cf5d5fc773
SHA1 28bb96d549afb1fe64a12f4c2887cac079de9183
SHA512 9d388a9413dd815e61a7cb6233dbdb71f62724fefea7c3a61bb29a3c7a6d0efdc97966507434f556a0c35a74c9a5acbdb7bde037e8054cf2a7818cec85485d21
SSDEEP 12288:HPN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:H18U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T150C42310F7964C0BE3112737F537E5A4EB101EB5AE448A292950BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ec5d56fe20bb9ed6fb83ad33bbcdbdf7d247bf25469410be41ae7a5376609c5b
MD5 7a8d57e26976c9a70e3a981067730519
SHA1 8d48547c8fdf6e8b7fbfbe3feac6eecfec02fad6
SHA512 900da05954bf25ec45f9c001a5210bf5106e328eca382b4768493cee4c0611c783bc7bf7f9ef7d97e8a2460cd72df70cad902a0f94158e7ece70accd7fc71b2a
SSDEEP 12288:fVWN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:i8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1E3D42310B3964487E2222737E933E564E7217DB4AB108B6F19107EA52F77F9C8DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7fd2fb019dd61dbafa81f33656af2377ce20c5e4c23939a5e9a5a04ed8c541ed
MD5 2ed46f734942b8e0b8db6cc779829d22
SHA1 769caa7e2471c6cfd38d93f2f0ddefb4db47a324
SHA512 22dadba6c452cab790a252daf71acfd538c9d3156a2002a8d19532a72fecdb65cd16f4fa10357c445863c8c8c966f9bc803771aad9a1519d0ae3e85479b6d8ca
SSDEEP 12288:dON4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dg8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T157C42310F796480BE3112733F537E9E4EB141EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 73c3aef9297e06fec5efc16a6c981f0e352688be3c89f430b5f0830046e54b3b
MD5 f02b1b3823bf58e0c5920928be5966ec
SHA1 a30b7ece69bf42e9b48d3f9fa6804d45ff54af82
SHA512 db6ac0f0f52676043e859e60e8111d2cc97c909b47f46b617340ea2928ecff38b6617efcd390e30384b707cac5721cddc380ecf5797d3dcae7bda0abdbc09177
SSDEEP 12288:ZlN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Zb8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T142C42310F796480BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3e6f00956fec58d1c8c5c6613ec3465879a357e60e85f6916ffb2601b6963f5b
MD5 a502df7fa5ed4e0fa3be2606402c49af
SHA1 0f349d64501fe073d34771651d2ae03639861ecd
SHA512 18aacd780bd9bdb68e232eaa6f6c3db345afd46310097429142840b5ee41757cfb0280279296aaf171bb99345c8490b10d7c904af0f434eeab42486613cfc5b5
SSDEEP 12288:WRN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Wn8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14EC42320F7964C0BE3111733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89C8D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 80256e8a683d1c1fdf6f6e456b04286d1e86c6461db19c1c445a046499bd6ebd
MD5 a20ff13af82601c393cd05ea1ae6b02d
SHA1 3c6e656dbd8057c2492844feb9b5486bbad6a0cc
SHA512 82b04601c003e5881abe6019d505f911ac6866aae355af3adde348f62cfeda96e738175341b20a491f020a65cb41967503ef2bed3a7b41793e14c32ea63f45a1
SSDEEP 24576:5ZMMzFVSOv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:5ZMMzfL8U7twh0gYUub
TLSH
T12C0502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 281c9e0cb416de657c0f1698cc0a63e108587b7b3204fbc0a27e347ee2f27cef
MD5 29481b44eae9d7991266750dd166ece4
SHA1 140c3931254dc7c09fd608da28cd9b45d401f0ee
SHA512 e6a7795685d92c77db5bd656405423dab6ab6ee66bad233e085c5e8911537785f1c18bd3bc2a10c8e1b6fdfc8abdcb69ae47eef0108592932ad341f44682eaa0
SSDEEP 12288:kEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ku8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T17DC42314F796480BE3112737F537E9A4EB101EB5AE448A292550BEA07F7FE5C89CCD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d82efef516d809087d46b30d28dd939f12057bf694f588b3887745286372df98
MD5 d910092f523f8fe920a33aea1adff8ee
SHA1 a2a00aee78bd96aee3292129f5637f6b7327580f
SHA512 ed7f4263dd32d3a229ac54e27b3efa5c863855cfa4adcc143144efd07f5bcd015694221cc045a402df5f1e3dc1e6b1a6ee31a92b7263b1360bcfe7e75ba2175a
SSDEEP 12288:D4N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:DS8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T123C42310F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a2e4b88a0c947484e727df6a85c01afcc058fa9fda3702fa70c1a78565bed8a2
MD5 c3deea280089893b54f65118f71bfdda
SHA1 2224e58a263a8ec37b46c814f1f0c10fc8759036
SHA512 34bb713fdd2694131a4ff85f417366b1c26d2109f769b62ddfe24ccf734b11309f4bc392688580ff070584a9ee4cc45ffb74cad58a31c2cc61bc17859351f940
SSDEEP 12288:yyPz5L8NN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:vzyj8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T118F4021773A120FAD2365239C8225A51F7317C314B108AAF17606BB62F37AD49E7EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9d94d1abfadddfbf0988e2cc0b953e6d721cd147de420f5c19b1750e5c31e56f
MD5 4b4c19b2f1ec8006af0b99a64a9a49e2
SHA1 bdae250ade70ea8b84b3c5b77da83d7cb3aeccd5
SHA512 4139a487f6b431a064d04687308ec1fd429fce67d4628039a424bdd6bbc38c3dcbee7d4834d2f82d0ddc42690df970ad2780a28a38387f7cda7df0a840f2ccec
SSDEEP 12288:fEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:fu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1FEC42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 fd2d27771b21c3aa07720979b7992b54ea2d16ab54a5513c80511be32e5f5c80
MD5 af0885b5419739544cd3ad9df051b1fa
SHA1 4c6be8b8264dcdc5a62988060735f500511cdbea
SHA512 3e4e6e8c1fd936ae3c046efbf88138515f7ad1fc6de8a643a0981b009d97fba427a2e06ea3c4462d050e982aaa50281ab47ebe49ab5369323620e9d8e1e56589
SSDEEP 12288:iEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:iu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T122C42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CCD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 baf6e6ba4ee6464c6d46abc00ddc69a083d9f3854a9c54c26d5dc7af2784eb50
MD5 f219e765b11cee05c7084b0a1c313faa
SHA1 aae7e7602e63048d96c8215a19e9031c057b606c
SHA512 74282cbb035ccdece287648f83fc8fdd6a748c10ea94b115703a9f4f189b93d2fd299907792d28d2aa20e10522b67c2f1cf76c8db97297bd40107ea817ba842f
SSDEEP 12288:kyPz5L8NN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:9zyj8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A1F4021773A120FAD2365239C8225A51F7317C314B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f2c63a34b69aa94406b1e289c6d4fa581e425125019faf1f307eeb38d21fcf70
MD5 34ff9190adc38143b8101bf07772613f
SHA1 e03825324c8d2e26cbbea35a4f1e29798a192931
SHA512 0d1fb902f3170c68cdad4df89cdff41415cf264b51e20a623d9baff55ec4f875ff69f1994ef2d8f126be1831d864bd14c3c6717a9fb3b8038f1d8d0c9d10643c
SSDEEP 24576:WT9aLl3z0zDF8U7tTK3VnChd4Q4PQpUcrf0FGDQ:WTQLljE8U7twh0gYUub
TLSH
T10D0502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F337A05C6DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f8fc9f489bec907b35af35e54bc848adb5df9f211803217b8b37fd7073976a4a
MD5 d526d51a4d897ff80ffbdaed989a79c5
SHA1 f298dd81c2398aabbe510be8f1c4bf1dfae56c5a
SHA512 6b48859b319b17dea1b5e0e9eb3b6390e2dfcd9d0d38aafb7ced6663d82c04d9ac541914bf0ad795c4ae0def8b3352f6cc3cc081a2adf0a54135815a819fb069
SSDEEP 24576:Y3td9CHKy7GZh8U7tTK3VnChd4Q4PQpUcrf0FGDQ:itd9CHKyaL8U7twh0gYUub
TLSH
T13725CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4e00ad8706a8cdcc5098cd547a0e136f02969c2aeef8d94ef5959cf0bd8f090e
MD5 a58e4c7c0ff6a364f93a3ee466417781
SHA1 3b8e3af850bae976cf08142f6f67576e0d0abb7e
SHA512 7673512adca50adbf98647ae509525ee8d1605ee845f415ff6d5f5eec5e220000f5031004fcf372c9dd9383e3cb402ddff905f03ee437d7c1a3b9b99d28d4337
SSDEEP 12288:mvN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:mV8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C5C42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a3cb9a62884d2ce37ae508f5455144e33c4fe35b09042e2b1604e7922e4b3a8f
MD5 601fd3f4b4ac978793f5cd0127658f91
SHA1 d5862601077d5f7ed037ac4504c1da7429ab9d17
SHA512 5e760e063dfe35dfd1feb3fb1ecba1fb88953116de4ffee8b3a243248f57196052b507c78ef3e206cedd3e130aa4c74d1babf2e4485617673c985415793f0bcf
SSDEEP 12288:ZtN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ZD8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T16CC42320B796481BE3112733F537E9A4EB101EB5AE448A292550BEA07F7FE5CC9C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 76fd0ebfb7d02489e7904f92428e22b121010220a4943e80a7b0045ad4c812a4
MD5 86741698b738d7c2c022fbebceb31537
SHA1 8496f90a5faf774bb542ba3dbd8bcb6ffbd5b118
SHA512 d082f7b7cf705160ca4942c3f1e4216de94487def24635d96f9d390efee02378a43a6ed633e9afea5e6548d89f38b54c2a57aa6088f5abec70151184c8562743
SSDEEP 12288:HaN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:H88U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T134C42310F7964C0BE3112737F637E9A4EB101EB56E448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b07fe9918a65d5e6af8f1e0c7d327daa0199c0d85080cb10a1b718bea522be2b
MD5 696e07c9284fd909458550e63003e41a
SHA1 81c2f2eb172ce4244c4cc9d47aa08643e722c592
SHA512 44049ad2ade8d11fca1bddc1e5c179f12836ed3c1e13d73250414019a6dde6465ceb6493ad8ca68bfbb4d61a2dcf1323fab27156987ac02f6f37b0ab17aa2891
SSDEEP 12288:zEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:zu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C5C42310F796480BE3111737F537E9A4EB101EB5AE448A292550BEA07F3FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d1dc751572cb11aa9b89aa04d23e28f2aa3bbb0f6f6d5b87c9556010aa0effed
MD5 4981b5162a9d0ff49160c06dd66c18ae
SHA1 8c53d3a01a4c038c6d08bfef187e71aa179dc8f2
SHA512 2c200e25bb5e46dfb611158be9501aff81088f01cfe60db36ad096a4f7161355f4e7e486cf3ef76d12969ab718412106d598a8d0b8ab02cff7acbd3081634be2
SSDEEP 12288:+vN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:+V8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T157C42310F7964C0BE3112737F537E9A4EB101EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f93ef86de843c861262ba663e5ca8fdfe71951eb10bf72e9f07e0086950d2a74
MD5 382156b0b88d596dc51cb095f4d4b95e
SHA1 5532bf85d70e09a46c1d9de2246651763fcf3158
SHA512 77dae4a3cadeeb597935cc09bff61da751d650cc1bd4b8bb5f4de52656981b6a0b2170cf4da74bcd3e962be258c3757cf5e3414eb9aab5725dbd5a70fb238bcf
SSDEEP 12288:P8N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Pm8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11BC42320F7964C0BE3111733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5cde4cc9a8f815dab84d4d5228732cdb108c2c69d8ef8c01945a5e662678b0ae
MD5 218a3b477eb4736748ea11c95571b40d
SHA1 19f02448d32dc13d266791b08cc25b2f44034491
SHA512 633d56dc644fada51c152d71e29c216e29a1fa1637e86f7ff401b49203f43b334636f98ddd7b7cc876489e50a5aad5a1bdda57bc5d5a02e4b01d0c7640f5d377
SSDEEP 12288:tON4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:tg8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A3C42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5f8acf52e8d51ea0a804033f84faa83a692a9c284635e48d6c20d2f5b8d3fbd2
MD5 40147c474d1fe0ca048573e20983b025
SHA1 cb229dc25a2579d1587e80277d34d45fa1bf3279
SHA512 3bbef6b0e8a249b16348cf813d01315cda6d800cd9485d87fabd3f51cfa95016aebfb4ee79a29e6a167fad3d9b5c877d909cadd8a96e97464252e3de1aed0cc9
SSDEEP 24576:efwvok9RX6wkyAIC8U7tTK3VnChd4Q4PQpUcrf0FGDQ:KMnYIC8U7twh0gYUub
TLSH
T1A635DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 63e474bce86370c8881d466b8fb4a5b4163636af5dbf42f2fd47756ce244d1f5
MD5 7911224683915f7f179cef1c07f2b4fe
SHA1 b4c3d174c6071f29563b4d417c94a2a385dcfd05
SHA512 47d023777881f1d6e5b57de470a8adac5b66b4a87bea5afa12a0a2da84ee91eaba5076b6bd6ccbda50ed18aa0c85ddb047edafaf94897b958aa3f0f34a3d4ff4
SSDEEP 49152:SYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Z8U7twh0gYUub:uySzPhbpi0gYz
TLSH
T1BD066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b330790c00e625b2cbc90f9ad725eafddbf28284164c8c2f183ad19bc3d3c175
MD5 34fee5d35d03fe11812440d688ed54ec
SHA1 4ba6e5a3b6633811f01d074575c4f455a00789cc
SHA512 23fc393478ad28417d5dbc06d98e2a0252af3816b5024522e68f61bef36fd0f918e58370c40b889fb178ff7951e8fdcfd72f9ab37d97b933ee90800027c6e25a
SSDEEP 24576:Y47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYf8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Y47JUQj4irIhCnDHUPfF/J8U7twh0gY3
TLSH
T1FC659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 af57ffdf79f29cbae3b669aedf06aae499f76d4b2dc85fb53ff0b869ea143a91
MD5 a0a4dcb2004c9a51203e03db5c96a159
SHA1 dc6cdfa9f8e9d866ef65325eb4ce688149f4f5e6
SHA512 a55e6a9d9b638dc517f19d205f3acc32e4b62d0f8d5cb4c657a7d9930800bfbc59aa4308c22f478311a4e3d672adc4ea6a3eb3573b87017bb642d1708bd7fe9f
SSDEEP 12288:CGsfUN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:e+8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1AAE4F118E39402D9D16E2236D7269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 4618768db0cf032f9e0025c19ffeaf7fb1194279284b64e429eb47ac71d4b06a
MD5 829121c90022627dc7c1deaf9eaf8217
SHA1 cae8314f6f3a88bb823ad241532970cbb79bc062
SHA512 31c445c4b54fe3afe7f793e7e25ebf3d2a5de84cc60dd013816cf3adaa11d5e9eb78f7578e6e9b62db6ff6fa3b35dc5ba7ed543d7918b3582dee3ccab053db3b
SSDEEP 12288:J7qcU3fWKgVB/bPLaKvMRHKd0rOIB2IHQw:J7HUP8zbPbGqmrhcJw
TLSH
T1C1253A10766AD75FC6AD40325E77C2CCA7707D41EE05AB0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 661316fc15f32b39bc40f2d69f22153e207281c8e2aac96239829d6e653c7d94
MD5 4f9843b131e244cf480029bb380d23e5
SHA1 6327784193beb3089c15a1b9293d85cef766e3ae
SHA512 e1faf5ddaa2fa4741b83733886d13f2892a9ad26b0af5918c82f7e5b05bcd6a2cd65d4632cd102c52933ce641d806806ca78d2b15abc0c3ad3d1de0c3e2e1916
SSDEEP 6144:cFmxF/SYoaOK8eO4it1xUjVgfsHplI8R5X/FotE/iJL2BJ0/4d3WKBueN4evgV/I:6sP2QhPdF
TLSH
T1B255C6815437A38FD1FB2131076A5B4CBBA4EC46B3095F27B3C5053AD82BB65A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 76f5e595ba1710abc845af3d61eb044b637648e4d5a4ec8e42d5149876b6d528
MD5 74428bcd51936baae66cb0a69447cef2
SHA1 360ab24176c4bca197bffa2ab13259787b19109b
SHA512 03d0f449a44597db1b328bbfbbde531626411a48c20838a2ba3e07094d4e71ecec1942ac718abfefa49d3d660967b4e42a9db56ca0ea59c187af0623e39ebc3d
SSDEEP 12288:dM7MN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:W28U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15DD42320A3958C0BF2752732E53BE574E7157E745F00C9A76400BEA46A3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2001a1907087f3510a98c742e082c85dacb3fdeefae4b45f512e91a32954acd9
MD5 729e956bbefb0f5b4cb8b9a4bdf3da7d
SHA1 613febeccd9c4d9ca8b77c65cb0a7c62f62dc603
SHA512 ec2c57ae02fec229ce2cb79948a76d23699f326a5ce7da1c6550f87c2cab5c61277005e8e693318ea026dd7730dbd3054c0a579ca77ff83db9b4142d36a685b0
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYE8U7tTK3VnChd4Q4PQpUcrf0FGDQ:tgb4mBIBhGFf8U7twh0gYUub
TLSH
T14265AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 60a3707d118dbf2ca1dc05abeed981991d21997abc328adb338e4b9793d0e079
MD5 3ba07680f60bbeb5c5c778cab8c328ed
SHA1 f299a64cf411074ba4501bdae02bb2efc1de2946
SHA512 980520fcb1ba59ab1e679d880e010289c5d56d1aef58f7618c04d6ce2d03a4e17eea73e20fc9f5e82bec6f079d920596acd6cbe341833ab184866576ca7414fb
SSDEEP 24576:6G88u8FpJqH1Wzria7/mv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:B7ZFPqVha7/c8U7twh0gYUub
TLSH
T1FF35F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7a96633f293836d2d6eeb5cdbae4425d0428430a3c5b9f510c5cff1edd06dd38
MD5 9c78a1258eb6f1887aef2a3982e3f6a7
SHA1 85fb0a1d5412c84ecec5843c32b75a64f3d27d27
SHA512 2a41b00a22caa23540e812bcd09a8c721b4e66eaff665727848f5f5340e7c556ca1705931a35f1477eb5567441302f2a6371a6f31521a8d0d74ecb6141ca8ef8
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjb8U7twh0gYUub:0G05lO43b6bpi0gYz
TLSH
T1ADD5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2f2bf95f2d83b10378ef28b3556b7fb85d950ffbf740ec4abc8eba81a35c8e08
MD5 b09433388361b5c8ce9f937827e23120
SHA1 6403f9b61e3c95732d1021c58824c1ef08fb10ac
SHA512 55e3d14d4e2ca668ceaf0a4221c3e6f6e4e895a6e3f59426eba7c8ca45c025efb24f72d4ef7a8251179fc8fac1e876223b95c53611417c9ae4f650626c24fa69
SSDEEP 24576:ufa5POZ3dpqWVM50JicR2hG0lasx2+47eidnZ8U7tTK3VnChd4Q4PQpUcrf0FGDQ:2a5POZ39Jt2pasx2+mD8U7twh0gYUub
TLSH
T12965AF5DA7F801D5E1B9D17DC5838A1AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d3364ca7a47f2934e5b45b69b9eb23430d9e3b91da34ce6163f242c1506f5e63
MD5 fa60ee21da0a5fef5932f787c233e1c5
SHA1 b7f8b4ff23a8e518dfd9a1b524dd855d04336e16
SHA512 f54ba7ae1d1cb908a7c3f78914da812b72085425cab423523eb5e726143ffa6173900cd73b8dc90a57abf91c1107b927148eab58a9e977751bb0aa9d7fcd817a
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk38U7tTK3VnChd4Q4PQpUcrf0FGDQ:LNc/zEOVHF88U7twh0gYUub
TLSH
T100858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b092f5ba32f1942b36cad165c7fb2abcb4df72c2bb98d82f4704b75a0a544991
MD5 269c1bef3235e8a5bacfe97912fafb7b
SHA1 292a716d9f1fdf494c152dd8b5576c8533d64c35
SHA512 5e2bdd9480687b89f674b6bc5214dbd86d8d2dac6d3a7308596048e3fb003a23201b99b3f358c34a04c513ea336a144917891393290307c3825127e2750731f0
SSDEEP 24576:0tkNvNnaFeYhJNtmZBmd8U7tTK3VnChd4Q4PQpUcrf0FGDQ:0tMwBtOmd8U7twh0gYUub
TLSH
T1AE55AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 bb705fc5160696b5f3f0803f7d2233eb8557d3966c1150d8cd40fead4b7239e0
MD5 4233bea4b47e36562365e9ca22a98f67
SHA1 5f9631f41f4b86fc3c8856c0da3382f5214afd14
SHA512 2c889950f7df968d56bf7271e511f5707b7ad595d5800f19dc83ea98fa904f792c56aec2dc5ca140ee62de964e6a4d30cb02134c40a0838681a4e14e3f55b678
SSDEEP 24576:gPUr+NQL8U7tTK3VnChd4Q4PQpUcrf0FGDQ:gJQL8U7twh0gYUub
TLSH
T1BC05E12E62E91CE5E676A13DC9528619F771B8620701D2CF02E0917E5F37EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4f1b17df56bfc29db8b9564b891e4ac2023dc47426ae96a1413e87300c84e6a3
MD5 445abe647e53292e3d23584acb4c7147
SHA1 31c8623b9ce2a9b806114eefecc600f96d7b2fc1
SHA512 62e6b5470abba3f225c2c8f987e10e4964ec265be7fe7c7092bad38351fc97d7b7562049e69ae2810912d38ca4b0220f76f9b8e36642fed7b9d46adc3d6a17a8
SSDEEP 24576:tD3FHshBIYQgAq8U7tTK3VnChd4Q4PQpUcrf0FGDQ:tDVHeBIAAq8U7twh0gYUub
TLSH
T1F625E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1712-110-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1712-108-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1712-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1712-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2560-312-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2560-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2560-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2560-97-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2560-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2560-103-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2596-50-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2596-277-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2596-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2596-56-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2844-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2844-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2844-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2844-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4176-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4176-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4296-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4296-329-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4296-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4296-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4296-84-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4296-90-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4824-72-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4824-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4824-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4824-7-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4892-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4892-79-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/4892-74-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/4892-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4932-326-0x000001B007320000-0x000001B0079A0000-memory.dmp

Download

memory/4932-396-0x000001B007320000-0x000001B0079A0000-memory.dmp

Download

memory/4952-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4952-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4952-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4952-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5528-60-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5528-68-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5528-62-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5528-293-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5816-14-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5816-22-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5816-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5816-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5888-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5888-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5888-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5888-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5888-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download