285149dd0361482e03934a66b86538517ddc95a71bdfe0677cc2891a915197e7

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-b4khsaby6l
SHA256 285149dd0361482e03934a66b86538517ddc95a71bdfe0677cc2891a915197e7
MD5 2d5c22ac3f4915f11be1fae99eaf88a4
SHA1 d13ffb05147712374a046b2face0d130d5f218be
SHA512 e12b79a1d21662a60f2acbd5961c50361ee421ad1aa65d6f5d33c25b33f0bc3b479f4853584d8d7e59716eb509539c62aeacad95e8a86afb151f4f5f8c4cbc60
SSDEEP 12288:FUYJ9biWN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:OYJ9bh8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T130F4023072C18473EA73153259B5EA719A3DFD714F1089EB23907BAA6E346D0893DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2160	elevation_service.exe
4736	elevation_service.exe
5776	maintenanceservice.exe
932	OSE.EXE
4744	PerceptionSimulationService.exe
5760	perfhost.exe
2848	ReFsDedupSvc.exe
1584	SensorDataService.exe
1892	ssh-agent.exe
2384	AgentService.exe
2800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dae66f558f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be4b173de917dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dc63bfee817dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e281ffde817dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000459e23fee817dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe
2160	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	2384	AgentService.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: 33	2800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2800	SearchIndexer.exe
Token: SeDebugPrivilege	4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4584	2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2160	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 560	2800	SearchIndexer.exe	100
PID 2800 wrote to memory of 4956	2800	SearchIndexer.exe	101
PID 2800 wrote to memory of 3128	2800	SearchIndexer.exe	102
PID 2800 wrote to memory of 4356	2800	SearchIndexer.exe	103
PID 2800 wrote to memory of 3828	2800	SearchIndexer.exe	105
PID 2800 wrote to memory of 2308	2800	SearchIndexer.exe	106
PID 2800 wrote to memory of 1944	2800	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_2d5c22ac3f4915f11be1fae99eaf88a4_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4736

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5760

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e0d39a1515cdb44bdd94c7f3e9302fd37cd1c50ecfe16be04fa23c02e43f96b9
MD5 f9d514a564940a8843480d3b36275564
SHA1 3adc37ee41a48a72f94b6fbe11f4f424f6225cea
SHA512 33d311880f6a7f6aaef024dbde7ad296b430cb87e07dccc7a17a8daa67a34b3ce7643e7d8ed688747d2d5f3f74b74a55b8206c1c6053222dcb57b726a44fa74a
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+8U7twh0gYUub:Y3q6HjB5bpi0gYz
TLSH
T1D6D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f515dba405cc638329e39db036daeeacb35ee4e325aef5103a48f6018ec7ea47
MD5 40d9cf674608389c1a09e5ea554ec041
SHA1 fb4f8dcde16588e0be6c29b7a2b939c01a6e925c
SHA512 b9b7994d281cba277d76683b44c8f3107297a4e9f2de95282372566e521006aa3a7421b2b6ff0d695ad86975947f8042657afd5be6747d2cabdc4dd9a78fea93
SSDEEP 24576:YXYfDtczAF8U7tTK3VnChd4Q4PQpUcrf0FGDQ:PtcU8U7twh0gYUub
TLSH
T13405F128B3D508FAED674239C872C511EB327C954760EB9B03A4AA651F337D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1ffc2c418718db02b8be2705ad26e9909cdf7a37f6f1287d43ab4b9631ef9944
MD5 d6903bd59b889fe9418d6df1fd483402
SHA1 a36afb0c8bba8c5357c89396b7e33051f82ee205
SHA512 333e6459dad1f273807f3b4c2b7e2f8f5fcaf97e67a2fb8d0f2d59eef731b57698e5cbb940824ae26943031dccce80e7b9c65dab11337c87e56ea12e6033681b
SSDEEP 24576:r0Le5ji0hmxirM28U7tTK3VnChd4Q4PQpUcrf0FGDQ:rPji0AcX8U7twh0gYUub
TLSH
T1CB359E15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eeaf1fb6522c89f9353d075891963fada29279f1c9b7fe2caff0a3c74eb60aac
MD5 63d45046cd70d40d4e6fc497de41cfe5
SHA1 04bc29febc9dff870725671f3440a711f96d6a52
SHA512 f6afc613eaded09f6a1fa04e04ad75dfdfbe3088bca1b32c1dc4e17926f050b5bf46059ac55cf25b21cc577bf9db761c815223e72f4334ca2c7d35875ccababb
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuk8U7tTK3VnChd4Q4PQpUcrf0FGDQ:x/ezSC6vUzPvxHjyD8U7twh0gYUub
TLSH
T142755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bb43a74ced76a08cec5bdd3a1ef21a24c28ae339173006e0ad7d8644a8eb4d1a
MD5 df5a1ccc3d59f920af19888cd33490aa
SHA1 8439e0818d348427cd9af4403e57c834142b4a6d
SHA512 3ba6c5b78cb93564ea4af22a468fb46deb2ab48e7460784a670ae2ee15696f7464c8c0e1d48203893f9b798f0ae682a3e1f70e7629e5bf931b0cde5e3461a98c
SSDEEP 24576:IVbqPb88hv/l+6J8U7tTK3VnChd4Q4PQpUcrf0FGDQ:IVO88hXl+y8U7twh0gYUub
TLSH
T18F559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3aa8c92ed554dafd52d5dece8afb8905f87b200214830a99f2ed494812c38ea6
MD5 538fca8474b389534d9704a485c05b74
SHA1 9e560b10b94564f059ef4495ac2f6fcb034290f7
SHA512 aef1624be84b7e8337a6c8124a5349c926cd4ce20e203bdb872846a2a757c047aa6c93b09d8fb9f96c498cb1a89ddfc12ea437231a0a7efd2c81585e252c70b0
SSDEEP 12288:TRAN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:TR68U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15DC42320A7958807E3662B33F937E9A4EB111EB45D44CE291460BEE46E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 77a35331283231e19e631ed08a207532f5e9523d8d01076ab50a63223713c000
MD5 91d185343034c36f44cdfb0bbc24a1b7
SHA1 1f2ab7f72eba44c5efce3d9a1b85f36f22d4a0d1
SHA512 d89b189e49a23b06192449c11022e0b75de8c4f88048077d67931feb99c1eb9c1bd290bee345cd8e9d9fa9ce1d6004deb0785dcc60b84d645b5b02f41cf791fd
SSDEEP 24576:MJIUB8U7tTK3VnChd4Q4PQpUcrf0FGDQ:MJIUB8U7twh0gYUub
TLSH
T10005CE3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 302bd3201fbf3206c78c0d5e6b43d39f9799c2881b51a0126929549420eea505
MD5 561ce3408ad63995cbe049bcd16b8860
SHA1 58a1d15e5c654e9621eabdce9440300b24d1771f
SHA512 0d367125dbe746752158a8ca2717fab11007a90abbe76e6485881f5b435441df321009c5642a8e172f8568e6a94337c726dd3a2008d172e85fd25687379b226d
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:aQvGAdlCEL8c/yRNw5C0bpi0gYz
TLSH
T13A266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f71b3dc9b238c78482233b10dd2b71fa3d1d482d199e6b58bc70a374f848c7fd
MD5 cb940f41a02e5abe3e8ca9ab01db4c14
SHA1 995fe34ee24235e11ff7738c57f4100ea08f1b51
SHA512 2c0013c9a2611be584574f5737a3b698c7bbcacbb7f6bdf4393c60d9f55a8dd19013789a620be1f9d9aec3a04affb493e1a3cd5600a03af0246dbfa5dc2b06d0
SSDEEP 24576:rdewsAjn8U7tTK3VnChd4Q4PQpUcrf0FGDQ:5ljn8U7twh0gYUub
TLSH
T18B15E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1a69c9a1623238174460a4c185153c64493f9f3b24744d6d7767e3dcdc9170e9
MD5 0f71390e768c94ecdbc19f16c7a1d090
SHA1 f4f4afd1e384f821bfb3862ef007d76f491d9c0c
SHA512 227591f9ba4a577d2f53fc1be9c739c6d35d401d34dc922c3bfa82fdf4aac1f230a566ff138c89b408f6fb3992ec1cabce69092db1b74b14b4ab504fca6e891e
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUH:nUEtQevvqc2W1cpV2EI32o
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1213a251231591bf49d0a388661fdc284bf845aee4333b366c8c387db20da2df
MD5 6730f060217000258ccb8ce35271dad3
SHA1 a5c874c0b4be94ed4eb72cb32d41c211b868bbfc
SHA512 0eb9b51455fc44b572a45cf25cc92469f9e7022e613fc7443de59aba95f2d9f4f142654aa181bb3474554d1745d69d4ba9b05ba4f7559cd0412867e17fa49f84
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zH8U7twh0gYUub:HoqtVjnmwbpi0gYz
TLSH
T1D9D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fad47710c814a46f1a54799d8daa473c35fe2240d282d4efd104bb700ec5c541
MD5 eb5d9f0a2c634637c4a7e5084f017b7c
SHA1 c8fff3675caac8b161d75ae5665a4da6e6f3c0aa
SHA512 82461bb7c9aaf57e0c97ffac683e4a2a4fbb4224e6e1798061a84cb17a92aa1ac4020cd12f12b203504341eb9cec29ff6e45c0e6d50aadb0d87d1f2309863575
SSDEEP 24576:CAhGLJIFoiwtA5l7S53Q8U7tTK3VnChd4Q4PQpUcrf0FGDQ:CAMyFoiq5A8U7twh0gYUub
TLSH
T179359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 14ac4f6f9c1315fd0043616178641a70f921c77580490928e3e9ff968136978e
MD5 c99713c170df8f69667266bdb4eabc0c
SHA1 873b9c0d539c92038db26ec117748df39a5fe916
SHA512 cb1a864fabe3bce05850f0524d7936e8dd61686dc284cbe6098614c1b82b51ac9ebb8a60877c0b3539445321d490bd806f14db29e7f3f691ac3130428dba5b56
SSDEEP 24576:EwuoOWj8U7tTK3VnChd4Q4PQpUcrf0FGDQ:EwDO88U7twh0gYUub
TLSH
T16605F04573A50CFAEA675239C567C536F7B2BC112A20CB1F0760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 07eb6fcc11d1f016ab8685e4015bef971230d5f3e7c66ca6537d1493ef83e6d5
MD5 43619a8754952dc216290ef526c183e3
SHA1 9287946a1df29f68b81c1d3216099ffb06e4880e
SHA512 0d9ac0ae33966dd10c60a3eed09878fa7cceea14956dbeb5e7de92baf8efe759c6e7b2e7e0dbded67922e874f3ae3dda65dc3902bf86e65144cfd6672d00197a
SSDEEP 12288:zBZ1IyhN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dZuO8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1BCE4125433D460BAE363133AD9B29A55E7323C61273483CF1520ABA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1a41e6a9c3bd3e9d2eb52c57f50cdab68d6cfecab95429e5a1d7962134ceb58d
MD5 418979e38e0e0443598bfa1148647cdb
SHA1 c1a3baf2702a306140c9047221f9e52ee64aa47a
SHA512 62a7df01a3772e2ca9983b690d673bf95461f6a2bd10caf9549acb62ebb9bb7d9f2ea67cdbda8b8c0f24b8f3d5fe6982ea5c1c1738e37c443baf6858fa10370d
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN39bpi0gYz:BQyiKayX+PNKH
TLSH
T10E666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 015d72f5e7d00c683ba35a8f732784142660a671e7ac438fdb40fccd906c8dbe
MD5 fee2fef67cc846adebc4164760496cce
SHA1 d82270207da5828d917499788dc6c543661e1964
SHA512 1d2d69efea88a7cfe5915aaffc9319e08bcbf141fd7adb2542a7da17264b09c694ec02152714cbd92c2467aa4a02b7cf0d619f6c80739ecc9104b114a8219f7d
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN39bpi0gYz:lQyiKayX+PNKH
TLSH
T1CD666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d553fe2c08806df235a31cbebb898bf26c1365b7019fdd13fa6b350d583f2350
MD5 86bae2aae8ee7a2dc51420fef6917d3a
SHA1 6c036e7dd33548419dd672736245c2a73b165873
SHA512 88c3586a6ab6e3b16f318a9ae33b0824ec05cb424d40bbcaf4bf75a04896928389bf525a040047e91aafbf593905a205beaa699c5119001e117607f466186b3b
SSDEEP 49152:k68Qg55nhheWu7PNU3/X8U7twh0gYUub:OthWRc/Xbpi0gYz
TLSH
T161B54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 45780df1dc3138ed099027152a6eba7d59402b7c3978705924420a34f52ae444
MD5 9b107828b9c5d13d3ea85e892071019e
SHA1 6ab1c979f92bd140395112da9e25a5aa088ecf18
SHA512 1188061fecbee16117abc39a50ad589ba3c89e2be248e677d2cc251e1ea367baaebde40e3567a7693d87a82b701aa1e9045469cbd3c4c83f54d7d854028310e7
SSDEEP 98304:4y5112gYy5azzVvL69nLKnhZ6bpi0gYz:RLIHmWhdH
TLSH
T12E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2ee85798c0d16a2a7a49022535a2b4c62f9af8c5a7f0701a4ee512a45d8afd4
MD5 8fb265c7d33d89c077e0028e37d5576b
SHA1 001b1e566994c874d87e6bc208937f597bf849ac
SHA512 f9bf50aff887289f701e8db971d6e75290c3fbde52a316bf7a9ef22e0f42a6b38698e35212bfbe1a3854a3e46f25af375b4c82dab6ff2925058c7ee9a6d44f1c
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl18U7twh0gYUub:Ru6JmVxd2d1bpi0gYz
TLSH
T135D59D13F1DA01E8D06AD578974A9233FA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 14466f844426c7ccd9ffd979743151739284e1ec91110ac130cd0b229e4935ef
MD5 40581688f4f5528e308b7033c07de34d
SHA1 7f7415bc30b3bae45102745751c63f880a7bddbc
SHA512 776e7b8f25af33f28a04212d2f5844ba81f5c764fc283b2e36e12e092f247b40c7e52687f50b1c63b1df175d6d0ba9a42fa99045b58fc80da73c583beed8d1ac
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xh8U7twh0gYUub:qmifPbRwbpi0gYz
TLSH
T102B5AE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ce973d1d31a9e0c4bd95347e6dd4454cf7bb0dc6e673fa79514eb18fd42c1c19
MD5 f47dcbbeae1df849e0b132694ffc8feb
SHA1 9c4af117d1be3a3487666e522e90f142ded023a0
SHA512 e802f2c607895cb1056b51a3653bd033f3df01452940e4abc64e9cde6ac96321abc5bb0b39178952e9348a827486029126a74da29ee0f205dfa1b8ed243b19b3
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqO8U7twh0gYUub:u5dKTi61Obpi0gYz
TLSH
T14CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7a4ab1a8e3e8196f4953964c47f7f736c5fb569d66dddb77b1c5ccdc26146453
MD5 b5b0ff8ef0ec0669e2e15a032c30d2a5
SHA1 137a1da8c99bea6b92ead1af4053f7aa8d34470f
SHA512 3a74c8f30ffd92b5ef1349ca8021b7033498520774d3527f1215b65737bc2bce8057cc50b918e5762c2109e09870dad35fd4db92da04bebba105ee6da37148b6
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wF8U7twh0gYUub:zX2iyphcbpi0gYz
TLSH
T14B95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 86b099af29093d5c835a918bc6ed0a5954eef101f678dd009ae3976c99eaabce
MD5 5ceecdcb900b97c1811dc88b0c9ee01d
SHA1 2fd31d1676501f63df34ab2e13e6d78a41c61060
SHA512 4d7495561f21ba7a5222a1e0fe25e26fdc8df8e021adedc7ddd20348625a32b7db82ebb956e612d32f5cab0a7af8e8368a61bff2558f453bbf6d96d20f84e604
SSDEEP 12288:xYN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:xy8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F4C42310F796880BE3112733F537E9A4FB141EB5AE448A292550BEA17F7FE5C89C8D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 18a1d259e61cd0e75fdbc1b425a2bb41f8232ed492853555821e6dc766997929
MD5 77f375f495bf3f2bf68c4ee2aa0da093
SHA1 fd005db36c8a9e45af2afa97805726f2b3d5f5f6
SHA512 abf334a0c65a846fa2dc9f21f4d79acfabfc07f82d0152eb57748508b077b13a65826a04f5c110a1cd6a885ecb392a4b44cc74c4fc2c3adc03b1a698904d7a86
SSDEEP 12288:gVN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:gL8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F0C42320F796480BE3112733F537E5A4EB101EB5AE448A292550BEA17F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 59bfb1cdce338db651ae1c623d0216ae96343da02201bc16be47ac2789981665
MD5 362998c1adb9f1143bbb491d5cc343b2
SHA1 3113481226a1f2bb681b4f5108a5937d66ad9eb4
SHA512 0695bbab69296b3ce8b82243e183ff215514ba137e1e1e938f9b7fa4255b114c89e97530635fe3e7c993df16e9dff57d8c062861db09fc43517eff39e0f22c9a
SSDEEP 12288:cDN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:c58U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T192C42310F7968C0BE3112733F537E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 099bba9fee591e053326ab00868883785b97f14756d75d6f4653f549acd08b1d
MD5 b89cb2a35dcd76ba583527489ecf5eb4
SHA1 de93c5a340c3bc16e7a8d83ffc1ce9b8f06e38fd
SHA512 767c0a2d54c45b526814d14f549e5a6da3f056e499682d0b3b41fe08e55520c4b16bf866917ce6a654e1a4acbd9e39c3db22389141bbf0adc55ad081ea532c0a
SSDEEP 12288:zVeN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:G8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T114D42310B3964487E2222737E933D5A4F7217DA4AB108B6F19107EA52F37F9C9DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0cedc7bc597072dd59f45bc745b1517a06fc261091f4809f2069af363c6e9de2
MD5 2be0841c250e7a8a5888e96c8e872834
SHA1 ea3bc6cba54f44c75731e3291d39732fff02b8a1
SHA512 89ae802f7f314fd554999f7c9220224983ac60ecde07e2660f2241a698ada27d8d9e7c91e9ed3b828a9076a3ee22f5896445b4e43e255def42b28ad2e096ee16
SSDEEP 12288:7mN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:7Y8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T101C42310F796880BE3112733F537E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e078838f12d4d46bfcea304d0aa026f72eb50359597b758d098b32198200b6bc
MD5 a68493057fbbeb78bc3467460bab0f69
SHA1 475215f4f3f7c369f32d0cf815d70675ff56fa2d
SHA512 eb5500e34eb51b7a4fbc4d08d14cdc2dc162967d50b1cc94485f6b6d7e00b93145205b85e8208c96f408c16663903256393090c1c75610e68b5d02e8c0485253
SSDEEP 12288:rJN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:rf8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F2C42310F796480BE3112733F937E5A4EB141EB5AE448A292550BEA17F7FE5C89CCD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4396b4b401759ff311cbdec2f82a7b97b9296106e741e368d610a93988ad0ad5
MD5 3d1efba922b048825511f6b64bfea86f
SHA1 fe422dc0a971bae1c69c6f40f51cb5f9fa880f8b
SHA512 6f57ba2319ed8ed280794e9cd321ee8042b258b0658ef7f2020d5f3eeeaef6b8bc64f595797d9530d3b5bcd9e7061e988ad58137a27c9cf2fc8e1ecd3e975390
SSDEEP 12288:39N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:3T8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A9C42310F796480BE3111733F637E9A4EB141EB5AE44CA292550BEA17F7FE5C89C8D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 20edec70091e343806ba22e62ede5762e688afb1d20ab3a4a746573ca454b3cf
MD5 e3d0f82872302b5d7890cc37eccc36c6
SHA1 1b455fc8cd0adc2908e3795b45c4176c8bbcf705
SHA512 120445d9569df7d1d9a2b5a8ddbcfa4ca7beae74f01037dfd8ac890721c7f70180e1f008e876d80854f9ccef5df8588dfd9e65904348c341099e5e90a4b45915
SSDEEP 24576:KZMSzFVSOr8U7tTK3VnChd4Q4PQpUcrf0FGDQ:KZMSzfv8U7twh0gYUub
TLSH
T12A0502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0875cc4c10b7622c76e430f3a0367a748b75b8b20939f5ecd3c489479d821371
MD5 77697741cc524c57e313edbe5faef00d
SHA1 8b460696b0987bd9275d7139eccf93a570effb6a
SHA512 b838a4bd904e2abfac80d73c7c5c83293b4a277ec73c9717bdd1e6d5267ae3f216eafba493c0d9ea077e2970e281b04a66d86984a5b158c16036256115ca26ea
SSDEEP 12288:Z0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ze8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T13EC42310F796480BE3112737F637E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 95265535b85a60baaaf703bb5e452cba61b8b4ad6c49862d32e3feef5529a837
MD5 a94bcb55d21829053a25cad22f4adb6f
SHA1 9f4df0ed53aaae13538e751aeb055242aef143d3
SHA512 baef4a22278e1e1775306ccb3348654d827bdaa5e41618def4081f95ae0720676f5410cc40225a556df35f7e7823522b1aec8293f8962517ee6c2b7733f8b16c
SSDEEP 12288:XQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:XK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T174C42310F796480BE3112733F637E9A4EB141EB5AE448A292550BEA17F7FE5C89CCD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 52c49e9c328e674f84c048af689b8a8fab26122b137a806d70bdfac92ac4798d
MD5 2aeebeda40a74f1bf07d4a9fbb86e89d
SHA1 ce77a183349696efbbfa16139a69581eca72eb9f
SHA512 176e8d7e06b2248e035dfa8c88f4c9cbb9fbfff08d176457fcf5ce256ab305d8d15bedf700979b7291efbdc2960efeefb54f3932503df605b76b9291445a0045
SSDEEP 12288:ZyPz5L8hN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Yzy38U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A1F4021773A120FAD2365235C9225A51F7317C314B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d829374cf37af056ee458e82f9246c9371f1096a65b846c8fce31b1ffb254824
MD5 790b35daeba39ea0185ec9856ac78902
SHA1 cb697a3e97b75e821d13e61e5333bd53023ccd49
SHA512 a9037c90e4bb276cdab25a20b0dd60c82f22ba04ff3e58ca7da7245b6b439d2580b59e4beca9fa0d7439655b35945d536d4aa4832ba5a45635d5c1a3dc57290b
SSDEEP 12288:L0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Le8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T113C42314F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cd6a87a8827f10f19b44495ae4e50a919820b36e3797b86fd2b69f9b95b5d327
MD5 3dc77388f30610eacf3f084a8576bf1b
SHA1 2446149a02cbcb6aea63303332c68883746000be
SHA512 2059f5e93b56c0ddbc5ac74e0c5bd26afbde205c5d5abc88906a105723d9de133b3bae1995d3df45c2fb0d6e1ab21c8c4875447ee2a4eb6dea122962ebfb4f30
SSDEEP 12288:T0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Te8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T143C42310F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b39907dccc069e761cd78f255855f123e9b5474ce2322690efa67100e22e50fc
MD5 81605fa1afffb3e2cf10ecc2f803a51c
SHA1 2d38c171a8ee508c0ed60b708ff348c49425fc17
SHA512 9dd6de3639312bf62660eae6bad96060ec7844a4ba5d1aaf50f30d340bda6151433df00a39c607df2c9eb458c070b4df84ee4e2ea06cc90be54296afe708f4c8
SSDEEP 12288:KyPz5L8hN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Xzy38U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11FF4021773A120FAD2365235C9225A51F7317C314B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 87107b4e22891e5711ede606fe38f89b31bf2f49cf0b1878961b1974cf49f047
MD5 ff291ce62f64761028907fcdf5d2691c
SHA1 0218708711f211f64e826498470305ef2faf28f9
SHA512 dad6ef04d7ea7e666fb28c46415575bb31216fb4aa775f6de19a4fbe0bde5e7110e401dd264e314bb1b0dbb8b5b9160289aaeffbad3731aeae6d30732bd67003
SSDEEP 24576:4THaLl3z0zDp8U7tTK3VnChd4Q4PQpUcrf0FGDQ:4T6Lljk8U7twh0gYUub
TLSH
T1610502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F337A05C6DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1c2da30a429bf6b9cfbedf3000cc0bc5c7226f27696f390b3c0addc71a0dda59
MD5 99df98d595305b1641012c85911f04d2
SHA1 eef1bd4d08533b8dcb658bb6a9584caac4fffe8f
SHA512 6332003a2ee854bc5eb3ca1268a19967e7f8f5e03b4213645022b623fbeb6e8accd4e9d42bd90a5e5b2ec79e06c23cf043d96bc7d8d5734076314de5c27342f9
SSDEEP 24576:c37d9CHKy7GZd8U7tTK3VnChd4Q4PQpUcrf0FGDQ:G7d9CHKyav8U7twh0gYUub
TLSH
T19C25CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4a780d4f06a4677d25185d7ba251f2a99df40d4388df263aaf2f9b97241c84ab
MD5 e6c414ef904301d88b376108c824fe42
SHA1 b44d821ef5a745395720285b56ded83dce88b5de
SHA512 142fc0d527e52ea62040e85ce6f82fba18d3e4a4cce21ea9df70dd2862358e7aaed183ccce3b73604a69978c2139c776bda7af72e7252b144faceab6c62e9341
SSDEEP 12288:djN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dZ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1DDC42320F796480BE3112733F537E6A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 fc347488996d77dc9fe3f6baa701e601d6e4d8536d16cbd8b98a061cc3c55a36
MD5 2784fdadb2b3a1529d102138b073f224
SHA1 25a296a69d21b1d4b36cf34d087912875c92a7ef
SHA512 54029ac73c959398aa0c807a3e0ed1a720c9828ca6041f869d35700e28f8f2369141951e980cd116bd6e6a59d93167bfcf3239c032b19e28fb373b21fac43ac4
SSDEEP 12288:pBN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:pX8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F2C42320F796481BE3152733F537EAA4EB101EB5AE448A292550BDA07F7FE5CC9C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b0476724a79cbf535f65f2cda98f0f5e63bbe3ed4e31ec63df759a09744e40e9
MD5 86783b8025e55ba6ffc384892f62dae9
SHA1 7aff6f71e7cd28e3060091ebb757fb89b781f8fd
SHA512 b9e11528025d3454aa71301ae413a6eeb0ef144f933542f573feda12ac6b3547c010fb88b32debf930f6e5592928c6f5c5cd60727cb0ef9822e2e514d7015ab9
SSDEEP 12288:HKN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Hs8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T124C42310F796480BE3112733F637E9A4EB101EB5AE44CA292550BEA07F7FE5C89C8D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3dd9f011a94bbf65266c4c74f54fbbb938cec403c1bf55c11e1aef739c16ff02
MD5 78a0fab8e4ffaf8fd3a5a9ab4f4a7322
SHA1 a53fd5264f9202f7e06f4e6c42f497cac6f28637
SHA512 d93eb6f63e05c0a527537ba0b983d6adf757fed77ffbbf022cd593ba4ab1c09308a38ccfc4f190cd55ba1f9da7f83dc599b9e6a677dd6f0bbdcbf2d98ac4a0aa
SSDEEP 12288:b0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:be8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A8C42310F796480BE3112737F537E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 0972ebd2ab717a015b5d1dc52237ba60115bc1610253003b92b436cc134375fe
MD5 fb4c54f5d7d6543967ba3909306bda3d
SHA1 cb7bfcf2cacf2e31094382de7536a84b77e2ff8a
SHA512 4ef0564edc181be44fd1662e0e71041dec7f776e8994f495332622083bcb63595ba81f629cfeaf342acd99c28c1b6cb7cf9b6a7dfa24757c7b99b3626a00c067
SSDEEP 12288:DjN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:DZ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T139C42320F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 fba15e7cbec481d394543ace3a52eaafc873bad871953314f37c95c2977c6430
MD5 5e3384bd3ccf1a1337b802bf31cc6c1f
SHA1 606256afb33102d2c28341e4abb3f6bf14327b0a
SHA512 f31fb30276f2b36a768822af9619bf446ebb5836ee12104b0fb4cecb20141535dd83dafa8ae7d2105111c888d0612af5d37cba73c319e8cfec411ccd2a23a018
SSDEEP 12288:78N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:7m8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F7C42320F796480BE3112733F637E9A4EB141EB5AE44CA292550BEA17F3FE5C89C9D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7b49eb4331ef28b9f9fb2f1b235c2e14d9732168e69c56843f9c900189e42f95
MD5 df293a87672f830405b60d0b57507ffa
SHA1 bcbda120c6d619f9f9742348ff1351fc251a0dba
SHA512 c7bc3c0f3aed165a76f358c6c6f1304f6fc3093062d109295ab2e365dfdfb65844d47d4a89741a256a87e99893b330a43a0bef89eb5c30d1265b52d925407266
SSDEEP 12288:0mN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:0Y8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T192C42310F796480BE3112733F537EAA4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ec450b3b73bba2edcc850977bdd61500fbf9697986fc2c1b2bf544175ee42691
MD5 a48e062d413ca8f048507ddc9fd56287
SHA1 9f95c76f2c73837baddeccf5128467046dddca69
SHA512 73d80baf3b64335d5f1ad4f59a08c7427f5f9eb5771017052bf2f3b664348dc01fecc4038a1f696016ecd5b47265ab51f2312a7c792df1a5b9c7cda9f92eda8e
SSDEEP 24576:Ffwvok9RX6wkyAIa8U7tTK3VnChd4Q4PQpUcrf0FGDQ:DMnYIa8U7twh0gYUub
TLSH
T18535DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 740ef147d0ab39fde8e3ecc6eca40b10f4263be04ce8a9c50e4ea047953c6f91
MD5 240bf0b7fba10309fd28c4f1d681fdde
SHA1 620c944d15597335c67223bf0cf0c0f1891c7634
SHA512 da44584726c0fa973e295c6e333a0fb6e60aedc3381c24cab942d1867c71afe72bf116791f7436271bfd54ca8e35e39535a1d50ec940d7b53507b3e8e9a3966d
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0l8U7twh0gYUub:RySzPdbpi0gYz
TLSH
T1DA066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 79e2c0c3cff18074dc1fe5976e7abe75d6f8273be28168825a7526744cbfe1b3
MD5 bfda427261924b564da5381807993db4
SHA1 2629d3efd13e5f119e78f38c3efcf94f14ad70c3
SHA512 72bd68dff136f7278e0f49a536a4109633e66ad6263f5ad313783dfcc1c9a0dcb0208d79c28ebfa5af15af010a7cf00adc843f7c6ec8872afd1e9b424d9ae301
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY78U7tTK3VnChd4Q4PQpUcrf0FGDQ:147JUQj1irIhCnDHUPfF/18U7twh0gY3
TLSH
T1DC659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 9f3c84a2a5cab41335b2e6c1abfe56649b23e22bfa828e732685864b70f58a52
MD5 acef29e58f816ad0d9c08dfb2cae40d9
SHA1 a7d95f07c1ec5f1ed7b730c371f40dfa35843716
SHA512 1fc2fcbf3a1a54a804e4991b208fb785e978b2bc643701eec26a64dd3be1cdf74fabdb148554f309e1f3e87cdecf9e5a51182b296936885e1cf988cf79edf173
SSDEEP 12288:ONsfkN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:3O8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T146E4F118E39801D9D16E2236D7269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b8237e3f4eaac9856a727f3ce6de929d757beb37701c7d86b3a7d9ee266e21c9
MD5 26ffc627d0ea85036a820360c9d8a149
SHA1 3e3008346467ee67577c421f1be8c82fbb0a1e93
SHA512 bc823b94af737b45584728afc0228b3a63303f0d43184b72b626cd5155b8de3345bbf8510728d1e92eeaede721c2984f5b37835a6e0a096c4edc032c63c0e093
SSDEEP 12288:hH0LU3fLXkuSSPX1MDkdSgxN0cc266pX9:hHeUP5mk0KNrc26ot
TLSH
T1B33529417666C74FC66D80321E32D2CCA7B07C11EE44AF0773C8973F9576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 066e61e27e306abebc0b209a076cba259b3c3f10338b7b291bf10d957afd2f74
MD5 bb50b176663b5e185f48de6919ef9949
SHA1 59d055e15837324bd62de9bbf7f21d1797496285
SHA512 507d4a919eb023ba2a81c5d375305a795c080054926a6b07e8e372f829f5e63cf40b913e3c46e4714c3251330d8c0209eec788c4661e887819425bdbdd54b067
SSDEEP 6144:wKA+mQdaUgMxjJ79LHXuTqSqtMxAQQSqtMxBF9+zpwantacjbeR:C+mLU5178TOQ/asoy
TLSH
T14D65E8415137E28FD1F76032072A9B4D77A8EC42B7496F26B388453AD86BB15A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 40e3b0facde49e603e40b9953150f528f0022b3aaf253bb19411ec3d822db577
MD5 00f92635cf1a54be344f6778c81a1359
SHA1 c13eeab6017d179aa179879a6cce7ba0fac66fb1
SHA512 21667a0892bdf642b37c49243a7b123321268905445f9cd8246ee7ed70c406cc7676edbcd5aa8bb3aa9e7a80a73f398140da37b9b3e7cad176d40efcad781a36
SSDEEP 12288:kM7sN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:FW8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T189D42320A3998C0BF2752732E53BD574E7156E745F00C9A76400BEA46A3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 235cf0c0f2c33248c64215c3ff8f8d3b987feb54db2c409392ee06aab021606c
MD5 77bf33cc9c10542a1fb017772bdf1a7b
SHA1 2df3f9f2a20068fe5e7c648b9feb3022e7acf379
SHA512 b0ab5a1c786d59a5518275ce2a457d081925884dd8096807bdaf8a15b808a3393b4789f29b22baf271faf0df5bfdca911a15c05d54aaf7dff5d27db942f55f2c
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYk8U7tTK3VnChd4Q4PQpUcrf0FGDQ:6gb4mBIBhGF78U7twh0gYUub
TLSH
T17665AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fa3821b606b9ac226ba94882da4e280b846f5fcaddbdde380242b8df55f511d9
MD5 8d34d63efb3b2a633ecae82c2e1c040f
SHA1 2926107e41a816cab14b1483cd6db4a3c2c7489e
SHA512 978220f33d62c2f48eeeff245724a4a150881eb99e24c9fd3a3e78cc034a86e8570c42600a763e92dffabe8cabd202e093f977e10f11c6bb9cf37e2cfaabc774
SSDEEP 24576:VG88u8FpJqH1bzria7/mr8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Y7ZFPqVea7/M8U7twh0gYUub
TLSH
T13E35F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7d86483951913ba652547c1053639a18aa6dc61be03117349df3e04ec1ed030
MD5 cc2588df577de3f2f1edfb287e3347b2
SHA1 3b085e5f56e76a76dad5e22c5ef50e825cb90b69
SHA512 1049e4c30dbc407fd384d8ee75898e080ae5812fd5f29174a872cbb65690edd87084c39f6429ecf0594c22868d258c118fcfd1af02772d49c15f3a62f5c82a47
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf8U7twh0gYUub:YG05lO43bCbpi0gYz
TLSH
T109D5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e8be41d480d52b6f6c566149f54af92aabbd56d64aea5b271bb3d1e83bde32c7
MD5 69ec0f7870ebbbe8f10d47d27a0e7b84
SHA1 0c558990a9726fad2eb69005c6d6b3e1c4196969
SHA512 ba916f0716ae63ef409bbe7baa4da4dcfd7c066566997512d4ccfd73d44838ddc3362caed672a7d601923b0f3f91198eb4067f94d8bff7fef752bfe76668edc3
SSDEEP 24576:gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnl8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Ya5POZ3+Jt2pasx2+mX8U7twh0gYUub
TLSH
T17565AF5DA7F801D5E1B9D17DC5838A1AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 49ad3da82732dd9cac987a704a596614a14ab825a45756071997ad1dadcd2b0b
MD5 873501021a01c27b3a9895be24fb9ec1
SHA1 23ec066bd27d0a1fab71a8944e66f02a9a8d93d4
SHA512 fbd347a7dde33a74446295ef5c8629bc5a6dfd05e5625f5ca32a374800830136d02de150bc069ccee93871552a09eac2f61171580bd2967923665d2792200203
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkD8U7tTK3VnChd4Q4PQpUcrf0FGDQ:jNc/zEOVHFs8U7twh0gYUub
TLSH
T143858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e71068014d13cc1ad93bd111a62ac923b2ef6521d097117f28f8201e6d3dc7bf
MD5 f3d628422f2bdfad259254820b3193eb
SHA1 66866233726edf96cfffafdb62ff4f690cc8b189
SHA512 10c535bda0a4c40899e35447312b57873e54970f8beac45bb512d6ad5f11436205d57541fd6f83c77ac4a44c48c6085ff71e35ee9beafebfe1bc078855fd5df7
SSDEEP 24576:58kNvNnaFeYhJNtmZBmR8U7tTK3VnChd4Q4PQpUcrf0FGDQ:58MwBtOmR8U7twh0gYUub
TLSH
T15455AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 742085dc60d11dc9b3934ecbae65210ef6a2fb9294636e0b2c164e200c592ffd
MD5 8782c18e1b2927e3adf3096a0a769ff9
SHA1 f2d979fc20360908272da5a0dada20a9838fe9e7
SHA512 dd5062562ecaab7f7c04d069704573bda6569cf58490918a1611b15674d05ee0dc9d975b775eb16c145d38a9a832c42b8448fba0dd61de8bf7e1b43df86b74a1
SSDEEP 24576:xPUr+NQv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:xJQv8U7twh0gYUub
TLSH
T18A05E12E62E91CE5E676A13DC9528719F771B8620701D2CF02A0917E5F37EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e9139b033b30a27ad497cb32bc51f81c6516730bb6c4f8ff447eaf1e04895a53
MD5 dd03b0754b9fc0267f8a78bc7e30a1a2
SHA1 6d69621b869a8d417417751fb319a300d03218f6
SHA512 240e5dbe0a3531f42ce6a491f13c9dbcb886524cb8ce23b929b9c7cb47b0259d1dd64374758f11851f3f5aa91919f2996643ece4da2682ac568c95552781c0c0
SSDEEP 24576:1D3FHshBIYQgAS8U7tTK3VnChd4Q4PQpUcrf0FGDQ:1DVHeBIAAS8U7twh0gYUub
TLSH
T11425E13DE79C04E5E57BD27CDA638A06E77138A903215ADB0290D1B61F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/932-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/932-265-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/932-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1584-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1584-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1584-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1584-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1584-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1584-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1892-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1892-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1892-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1892-310-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2160-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2160-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2160-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2160-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2160-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2384-127-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2384-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2384-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2384-133-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2384-135-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2800-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2800-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2848-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2848-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2848-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4584-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4584-76-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4584-8-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/4584-1-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/4736-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4736-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4736-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4736-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4744-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4744-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4744-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4744-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5760-78-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5760-83-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5760-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5760-293-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5776-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5776-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5776-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5776-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5776-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5776-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download