22c1a2b1bda3ba0b414f4ea507a3d6d2a946c92da7eb28c29bc59431e7ad7444

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-by89ysd18y
SHA256 22c1a2b1bda3ba0b414f4ea507a3d6d2a946c92da7eb28c29bc59431e7ad7444
MD5 463acceb7bd26195a88a6f65de36be3a
SHA1 90968a4e99af04860c4d95f5ba47b6dcd66a10dc
SHA512 8a371c157c78663cc14bd531cece920da185997408ae919dff21275eb75876ed7ca684827c26a101d0fcc7564f1ab0fe1ffb41c7cb86a8ff47880256a5c937df
SSDEEP 12288:DUYJ9biuN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:QYJ9bV8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T174F4022072C18473EA73153259B5EA719A3DFD714F1089EB23907BAA6E346D0C93CB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5744	elevation_service.exe
3696	elevation_service.exe
3260	maintenanceservice.exe
1860	OSE.EXE
1404	PerceptionSimulationService.exe
2784	perfhost.exe
3328	ReFsDedupSvc.exe
5336	SensorDataService.exe
2732	ssh-agent.exe
1816	AgentService.exe
4716	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6539c52fe62f061e.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006949ae31e817dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc46d23be817dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074e0b0f3e717dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015c32cf0e717dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df095cf0e717dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000039765f0e717dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b01a131e817dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac1e3cf1e717dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	1816	AgentService.exe
Token: SeBackupPrivilege	3328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	ReFsDedupSvc.exe
Token: 33	4716	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4716	SearchIndexer.exe
Token: SeDebugPrivilege	4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4452	2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5744	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3320	4716	SearchIndexer.exe	99
PID 4716 wrote to memory of 4112	4716	SearchIndexer.exe	100
PID 4716 wrote to memory of 2944	4716	SearchIndexer.exe	101
PID 4716 wrote to memory of 912	4716	SearchIndexer.exe	102
PID 4716 wrote to memory of 5680	4716	SearchIndexer.exe	104
PID 4716 wrote to memory of 5672	4716	SearchIndexer.exe	105
PID 4716 wrote to memory of 1256	4716	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_463acceb7bd26195a88a6f65de36be3a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5e9424c16c245c3c75a64964c26e1318fa8d82e40d5de1b63ba63a7796185a62
MD5 c848d968d9276ae4b6c49ca388de59a5
SHA1 e649289dc573cd36995a7f49fb6008d17a444dc8
SHA512 beea7951ba0abd2cc80706dbe6df2fef0e6d7278c1b90f9df0e992579052d91e6d94de960bade8f6c4e85e70f2f862c86f3e6faaaf59dad415ba4f7abb38a82d
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnO8U7twh0gYUub:D3q6HjBlbpi0gYz
TLSH
T12DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 60835bba1539701608c648c231070e934a717364fc98a74f9143f0843ce59ac0
MD5 ac452f9ae388f343d1f0ae1bec7a015f
SHA1 260726c9a9c7395f4493cd555bb889904f221d9b
SHA512 a1a120f2fd135f73d6b59f64063c8245269e961758bd118e92f1cef146b2c86e91be9013072e95d0b2c4a0fcd1c1d0effab6037c638982791fc09de4268e5ba7
SSDEEP 24576:1XYfDtczAZ8U7tTK3VnChd4Q4PQpUcrf0FGDQ:gtcg8U7twh0gYUub
TLSH
T1D705F128B3D108FAED674239C972C511EB327C554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9e1ede5582ae976f038816b952f35d80c226a5a3aca92ddc5a2153f6f23367a3
MD5 1b2818c7b41e0273da2b52a662212db9
SHA1 c6f9ca8922d147127de950c7da4c806e98011d6b
SHA512 7df17d030a2a594f1be3c321c30419dfcef882f078a52c2321541fb41f0c3b75c3345fca31174611365d6fe36b4193de1473c120c9ba934ac32b2c00a946e8f4
SSDEEP 24576:r0Le5ji0hmxirM28U7tTK3VnChd4Q4PQpUcrf0FGDQ:rPji0AcH8U7twh0gYUub
TLSH
T1E0359E15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 df4b30731a0d8ba5086ec18b6332dd0fb04a2df92ca15acc9fc03620b8f513f0
MD5 05b74dae1b075fbf936d7aff84cba17b
SHA1 0199484c39d95f51f8de355a948b9594f024b4fa
SHA512 b37029194eecc9508e7e217b1f7ea7f1ed2671f0a59f901958b6dfd6c34d63404d243a6723a96fa25f56778155be8efc916cd5e058706eb1f2142c4f65b5f50a
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuw8U7tTK3VnChd4Q4PQpUcrf0FGDQ:T/ezSC6vUzPvxHjyL8U7twh0gYUub
TLSH
T1A5755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b87e78d845a996dcfca0377a73d219affe9476daa6371114b05424d6c88ff305
MD5 14e0f934c971b166c724ffd1678b1152
SHA1 6623bb2e6cdd0fd5ac4436f5ca71e59d259ddcb1
SHA512 00e11900a21021e8226af5e99fb056f4d5ebedd991251a3c7695c7844ce07789e8bfaf2989767a98935019335af71ffe92326762a9b8b2a11e364dabc7518a6a
SSDEEP 24576:5VbqPb88hv/l+618U7tTK3VnChd4Q4PQpUcrf0FGDQ:5VO88hXl+a8U7twh0gYUub
TLSH
T11C559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 05f48caa67717417b880a38bb7822c38d6ae881a6e35d907758add1164c033b4
MD5 867668a4ab5d0345b3344bb9d363ffdd
SHA1 85af3ff23ef89be18e047091b967411f0afac82e
SHA512 8492c11c5b71085cd1a91941ce0e6ceb783b7c022f0211918a2c971cd8ff2119d2229934da460594dfd04939b313d321f7152c862699c347b1a48403a39513d4
SSDEEP 12288:TRYN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:TRy8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B0C42320A385880BE3662B33F937E9A4EB115EA45D44CE251460BFE56E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7589a11f009423b8229f44f221ccdabc2d45d68fed9abafb6ba3577f21fe1ef4
MD5 55753212c5e6fe36ade771bed6f77e9f
SHA1 5714e914167a36b3ce903a2d75811802f1bc9a86
SHA512 82022b0cf223bbf04f713df578432c7f4ca5c128052d0a76f4ba66085cfb23c151aa9ee2024b9e7aee868ba840551421ef1929d38f591ff69072510d6e8f7988
SSDEEP 24576:WJIUd8U7tTK3VnChd4Q4PQpUcrf0FGDQ:WJIUd8U7twh0gYUub
TLSH
T1F305CE3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f7c2b54599a202c571dd8d0fa369240a166f54a479683c478acd751e0d55ec33
MD5 c9c9565fce45454f0cf479f2196cadc1
SHA1 95ede4d25dfeacf9791f78d8855cd09c79d38dfc
SHA512 545ab18d335ccd98093f64ccdb75583114a5875eee86eb8af7ca3f646327c68bbf7e854216ca26d81c9c9f926ef92b5e299db35ea09ac76b58fa3b877448e70a
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:mQvGAdlCEL8c/yRNw5CAbpi0gYz
TLSH
T1C4266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 84b6f689ad40db44cb4ac665109034c312d4db9e24e0f368d26a78d48ad0da1d
MD5 ac5ddab272e245d1d85ea972ca1fe564
SHA1 0061d5166dabd27d2e4c10bfa9dd8bc4adba4f80
SHA512 595903ba4d630fad0f67b42e238383193b8be8ef1fedb0d6bd4160bf4c7048a4c2f3f258272ed3a52618cfaf87134ec8a193983994bd6c56bf698e5b4f7196a2
SSDEEP 24576:KdewsAjX8U7tTK3VnChd4Q4PQpUcrf0FGDQ:6ljX8U7twh0gYUub
TLSH
T1B315E030FA74E436C37B0DB22B36C716682C7A204F511AC3E3A89E9D59346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ded6e5e6f37251736c9eb609df55b3f63fefffb9947e6ae435b142ffdc59f44d
MD5 1140911e561b473f05eae1c71652551d
SHA1 1789e2bc7c3f71010e3c7858b74eb0e139d23c28
SHA512 2a8751adc38b527f0dd3bb94c56a27dd0bed007fd8d467e46bec0c78800ca553185253e8006956e62410b4e42ccee423d907931a5ad993ca42e407b3f6092aaf
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUH:ZUEtQevvqc2W1cpV2EI32o
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc8b3af399fddb6242fae666081c757cbc918c63f31caa8d8dcaea1251ebca96
MD5 890ffc5168573bd91e5cd0d4b9988216
SHA1 2de468407c843a778b89eaa83ffe0aff0b583768
SHA512 ff7b903eeb0bbfce8dee0aef00be606a25a57b1b45d096e79e1583bb94ce10e793e714ac899071f1613429ce51a7ac9090aee6d6e070675074e3780a5b4ef041
SSDEEP 49152:fCbRquA/m2yL5zQfFiV+XenmE3/z38U7twh0gYUub:4oqtVjnmkbpi0gYz
TLSH
T1FDD58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98fb561db5bb133a8c01d879a136e3feab58754e26bb97a8f6dc0216c97e9f07
MD5 668698bb707869a3eb50a7f4ed0f2eaa
SHA1 778349803dcc2afbefa3716c88f595e0288ebc9a
SHA512 997cfc1e53a33896d0118e0802c71788c883690d0cb0961bab57aa1128d6959f573bb2c2ce2d500bb26bfebefd7a4378482ea0d8f8131606be25d99324684289
SSDEEP 24576:KAhGLJIFoiwtA5l7S53E8U7tTK3VnChd4Q4PQpUcrf0FGDQ:KAMyFoiq508U7twh0gYUub
TLSH
T1C5359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 65e2eb1b388acd8deaba6c41077f4fee7023aa09c70ed8aa8c5d03951f4091ce
MD5 a1b3e13eb586588ad63b5ee78c7a1dfa
SHA1 f2eff0e264b455c895023f7dc57357ded1e6aadf
SHA512 f8a6ca3e3570da8173a7b86bfafb764cc19b0c21e6ce71264f3faf9a396ff5ba2fec0d13e6396927fd83f392c9917d610c9db3faf8ecd288cda1d4a4c49ee0dd
SSDEEP 24576:9wuoOWr8U7tTK3VnChd4Q4PQpUcrf0FGDQ:9wDO48U7twh0gYUub
TLSH
T1E505F04573A40CFAEA675639C567C536F7B2BC112A20CB1F0760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c4de734864f0c4caee3aa833b5240b5f1bc169938fdb80c70df1143bc8a31540
MD5 ee8edf5106fbee94bd696368d7f8f5d1
SHA1 3876992ea8b964ba54f57f6eac659a9c430caa7f
SHA512 d8587cb33b2ebb9185d3d5afe57a83f86e8ad19edf65741a826ab321bbfd783b41b700d7c8b4638a2f34a8e74fef08f8be6b07c40dc6daae6fb6e7863ee88c1d
SSDEEP 12288:zBZ1IyRN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dZue8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T179E4125433D460BAE3A3133AD9B29A45E7327C61273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9524085a650c384b3335c36a14ad72566a3e88b5bc6613ceb8641c17c7e74437
MD5 f6fac810b63dfdaccfca43dd6b6b4de4
SHA1 15f54432fc3a9806a8ef5e2996af4b63d4a1cca4
SHA512 17523dea99230faa14aad082321d9d022ca27e148691b90847358e7b71aee460c834496c7e7e19bc5af07ec22eaa7a9cd902880c6d92d3b8269236181c9e3c55
SSDEEP 98304:bQRQyi36YOcPQLvw2gAf+PN3hbpi0gYz:qQyiKayX+PNmH
TLSH
T1B5666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1b4df32188ac44dc089430e64d32ba44533075e173f7807222299f83834f12e6
MD5 74577f9fd083edc7f63d34a0e453cecc
SHA1 bffc691fd10771940cb832ff0c4f7869defaa2b5
SHA512 2115de928ce33d02f75cf9da1a1160535a165c88c58caa78c1ff1c94659a32a1cc0445c98ffcf050b41b84c812bb4a799ef22f2233367eb617f4dd36aae262c4
SSDEEP 98304:UQRQyi36YOcPQLvw2gAf+PN3hbpi0gYz:7QyiKayX+PNmH
TLSH
T178666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2d083c5ef2dda61921b2ea093e15a6fa0d0341ab8f3e83791b92b7469edc266c
MD5 92f9dc4304769e303c3fe6abbd42ae1d
SHA1 ca4399bd43c81b429d99856977b4e99a449c004f
SHA512 a893fa541573850823c377ced6b80700b6c20f87cb3e5fe480f7d2c1ce969c88026e7dfde557d56cddca5aa6e1f968af0599d2276e755d8d44b8022b6da72fea
SSDEEP 49152:c68Qg55nhheWu7PNU3/H8U7twh0gYUub:WthWRc/Hbpi0gYz
TLSH
T138B54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ec1457dcca87386c0d29af0e0d67cb74c1d7fbb4700be767885e728578460417
MD5 33cc6e6c56d47c52c78aa636b39ba7fd
SHA1 5eedb867764a18a2b134d55e68750c5fe5d68ed9
SHA512 b407d062db6bd86a40a90127caca0ff3b140a74dfa6537de65c3dd54aeaabbe2e2c63d9dc9e457ef155bb4169a76766bb29cf4abb05d695e891ff3da70ef1823
SSDEEP 98304:ty5112gYy5azzVvL69nLKnhZybpi0gYz:QLIHmWhZH
TLSH
T1C5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 27da7b25eb80a1249535caac9739a5a6fc0dd4da7a9682fc9ee35bb75ca19a16
MD5 c3d4d6d471b7e97a1717cf03b117980d
SHA1 e4b3a26c79f91219420aef5bbeab792baecd814b
SHA512 1789e1eee565d7c3c2ee007939c3014c8955b0d82ee165355fedfb2d25add5514c403f3135cf3617a7a5978b295069e6c8b0c2577db19f99b19c67785c15ec2c
SSDEEP 49152:XB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJ8U7twh0gYUub:5u6JmVxd2dJbpi0gYz
TLSH
T11CD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a281b2e0d7f77abdfed9f719f1eb0c541ddd30545cd0b32a46cc41d0d5853aee
MD5 a96a1348532df167c82f767345df4055
SHA1 99b4096bcc9a3d00cdf096557f63a76a5dcce989
SHA512 a01c4ff87e6c88778673499d0c822d3ce1c53b17c96abe17ad80cd7749ff8daaf7b19c115416f4d77d7010a36f9a0b097c8441d68919a86f01f51bcbd51b63fc
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4x98U7twh0gYUub:VmifPbRkbpi0gYz
TLSH
T1E7B5BE13F2D900E8D06ED17887569632EA62BC450B24B6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbaff7160f791823a72119fee85851ab2baa17d8ac20805d3e553031893d43b5
MD5 39b90f0d978ce47ea43e1633c00a1d1c
SHA1 3338e6684a7162afb5ed5599bf9a1d2d51437aa8
SHA512 2ec1d655bf3f9ba2a8df987b973cadb3693121715f4000c10a96cfedaee75ea3485395ebcc96513712da96c384e8241598d85ca55877f0921300d5da672e2880
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqe8U7twh0gYUub:p5dKTi61ebpi0gYz
TLSH
T19AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ffe0bca006c5f04a63fd88f8c1f78388e9e3f68d5343f615258fabd423d0681a
MD5 21507934f48c77aaebc76f8408d398ba
SHA1 4d2e6d55feeb2243ff8ef3aad39d10f1a37ba089
SHA512 3b039406dcc073567f0d48c16edb9d25479030135894ce223cc08d165ea82887ba96eda133c64d6c1561ffbe85082dd2a3c80053c794c35659fcecd10a4f8c0b
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wZ8U7twh0gYUub:nX2iyphYbpi0gYz
TLSH
T19795BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b477be60974755d4c63eedaed42357ab83396c2bf358d54e0c0b3178a3a12462
MD5 0596ad29cb52738056223788fab2a0c1
SHA1 afd35ac6c1d5ddc9a949cc85dc20416d3dab553c
SHA512 c2c793372717f1be1777a93129736b085732b73cf98c16b98db69255d309bf2e288db0518518ef9eff72246e9d17b801a365701b1cbdab4759ec54e9c57ab226
SSDEEP 12288:HgN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ha8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A1C42310F7868C0BE3112733F537E9A4EB141EB5AE4489292550BEA17F7FE9C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b123b747b3703f0d4b8689d5c41809ec207a85ebacd4274efefafde4b08103c3
MD5 6e4c6941bb41f84b5b9dd5cbee1e4959
SHA1 ca23addbcbf0dc4bda71598a3357590492d2cfad
SHA512 36fac499e606cbbb4a78feaeda74f435f57ecc3acefa435845d4bd0ac67606fdcf1ce9902d61844147e15230f745c40273b749d9406862e90c0d027b16efa7c8
SSDEEP 12288:MtN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:MD8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F6C42320F7964C0BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2c1da38a5273f0e2c86bad24ed5c8666d81bc02013c1333080b4571bcd89b098
MD5 f54e36f887a2f0ff8788cbe4fea44c36
SHA1 7ad9fb3fafd6638e22ddc791f22b403ac273f140
SHA512 774cd16c52ae8e811750267dd4a6e69148981b9a9dba56fb7039852a1d6bd59cef9f9bbf7bea4b1bbea95b388d15d8a1d3a64eec869737e0c8741cce5095344a
SSDEEP 12288:l/N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ll8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T156C42310F7964C0BE3112B33F537E9A4EB101EB5AE4489291550BEA17F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 56523d042a62712eeaec532d2bd7bdcfe5b1936860c30a8e270c6a24b77049e6
MD5 9c3dda32c067b3e32e15f9cb2ce7ebe7
SHA1 b820863a39bf0e725d7132aac19a40dbc5863def
SHA512 41a976aea37dabdcbf4e325e1b5b8ff9db273c962813f24add2b9b048ca501b82b98f05491f0c45310748dd8fc4ebb2927d25c9cafd18fcfadb413437165b04e
SSDEEP 12288:VVCN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:08U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T10CD42310B3964487E2222737E933D5A4F7217DA4AB108B6F19107EA52F77F9C8DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 972bc284c0450b5ded2e748e80928356d91af768f35420b7a8c6e4d8124d8897
MD5 12a1c1bddaaceec608f13d4da23174a0
SHA1 3eace6749ec2acedcc8ff1d847d1c6126d7f704c
SHA512 9d5f487e7b27cb0a153420d71423f5576e559e464486830c6c1e3292694a75972cd08d5b5e2350033672c73324741e0f9e074f60903125eebc3c75f78a66d919
SSDEEP 12288:R6N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Rc8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T114C42310F796480BE3112733F537EAE4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 704173856a45f5ba412534dc33e0be02b19bd991b565765e03d570ae7fc9a527
MD5 26f7f5e150db606ed7264ddc71d75a9c
SHA1 f6fce7abe896a1da61a0cf22b77b4d58aa116ca4
SHA512 f3914ee5c46fbd6d1a9f07902b8af5844bbedf63c9c25130655ed0195264c4f86e7c90c66005cf0aee080b012721e0f9f05e4011548383a224709930ff89575c
SSDEEP 12288:SJN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Sf8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B4C42310F7964C0BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c7a2a76cf7e100ed211b00c20b972c651a75bb3d19701877be654548f814f96e
MD5 19668ca26460ad9cfaf9f789161cbdfa
SHA1 f50d2a1a2f44542cf48232e2b89834659069efb2
SHA512 f9f1c289aea5fa45c56aa4e7b3d68f34d0e3722b94849682c258678894d1446570413abcb85b1b11cdeac297cf0d8d5da61209778adfb227a53c6c333c9ed576
SSDEEP 12288:VlN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Vb8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A2C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA17F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c6729893d67be602b3b71fbb4d7f6f7a64aedb9bc422d87a1c1c236f5c1d87e8
MD5 40db645fbf1e43d681b4c4af5b70f48e
SHA1 68f25628b73096dfa9bb0508f40fb3b66f6e5a5a
SHA512 58a614abcb416f018a8239cabd2ed9ccff31ed2a9c22b930eced59ac2f4deb3b031b7badfebb06264678e99eaa17d9a0d7d5ea4eefc9e95f444ed3c0c8e55f2e
SSDEEP 24576:KZMSzFVSOj8U7tTK3VnChd4Q4PQpUcrf0FGDQ:KZMSzfv8U7twh0gYUub
TLSH
T1820502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 539446da1f64e356e3e6ef8d061c8cc1faa269213a2cc3fba7c95c50ce94d975
MD5 5e6e12249e65fb852bf3181a2fb3d757
SHA1 e2030209af1036a47b5c8e776a1ecaf90b756661
SHA512 44b2de22a6efcac07ebf388ee3ca39cb5397951d1bfe7d31b582462a42f892331639fb07e60674a136970bc225ece691d23489163fb8ccd3017713f2cbf7152b
SSDEEP 12288:CEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Cu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F4C42310F796480BE3111733F537EAA4EB141EB5AE448A291550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 2ed2371752aaafb64f408c5ecf275f74855aa32425ece8a6585a135a2a40b10e
MD5 216d7ab27a8a5f871fb7eda226e8bcea
SHA1 240f32677e197f7c026c4d0629dbe18fe4081056
SHA512 28bd561b930bece9009f191e1e97c90efefb398b8dbc3cfcf8c266376e09e01bd3c28e2f9a4e87883164e1d6a3ff160b798f6553dc68e870a16bc86b4681dd36
SSDEEP 12288:poN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:pC8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T136C42320F7864C0BE3112733F637E9A4EB141EB5AE4486291550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5f4a2c8616914d21af408a83c6fd92f7c4e4842124816c556c905021ea8d0329
MD5 e5cbf7d314b87e6f3082d71519985d72
SHA1 6358f7bd1796a3056bbb6dc5dea17d04026dd2d7
SHA512 c0ba976084be3d195ef440da12eaace33894af12f41794d8315cf18c21f4ae721660f7a5473d6fc36be5c9839492dd89eaec283b1ba307c4af0e6a7b8512caca
SSDEEP 12288:FyPz5L8RN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Mzyn8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T16AF4021773A120FAD2365239C9225A51F7317C314B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 18a737a54d596e87066f69b64519caf135260b2e4c46791d82153656b0deb5aa
MD5 a1a5d87985a22adb77b53483a27b06a2
SHA1 69a9593e690973121f07a4f5b3fa9711e28335c2
SHA512 549773539902e6cdff0ea1ae181d410616ea654c30978b27126ddb18411e46f723b2c8a08aa0ba82d7a0e9d991ed554d97caf83bbf93c0a7e7669d1764751339
SSDEEP 12288:hEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:hu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1ECC42310F796480BE3112737F637E9A4EB141EB5AE448A291550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b105b9bfa987503b449560d9cee0ff773e0e7f76b876aacdf38bc240d9602c6b
MD5 13437426b20b6e6d5da7d538665c3a45
SHA1 e57e16825e4a1f7fb1ee454c1871da60eafbb343
SHA512 239f93b4e70828074f8aaa071cb55486c94b4686d01c555dacaa36b0b5f5f5f5ffc4d5af70e24fa7f1690d96b4ee2fb349e7824520888500f105587dd4e12a9c
SSDEEP 12288:dEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:du8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D8C42320F796480BE3112733F537E9A4EB141EB5AE448A291550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c6fd7d962c33ea4d393b44b5180f73d022b0e91c2abc04ade606f41b461c9c20
MD5 7f78c9c6dcb573bc63abaeb91416cbfc
SHA1 fafe87fd5359033060582e8ad98b9a8b8f37631e
SHA512 21273cfc37ab14d39437dc4d81b71731961fe9658ba0f05fece8da900784ebef9b556d0d90187c16fcacff9b3120210436eb77771b560022b0ff51589fe262b9
SSDEEP 12288:GyPz5L8RN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:7zyn8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C4F4021773A120FAD2365239C8225A51F7317C314B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 da7c1a93ec448d34fd63bd69e0b1e972560a90414b3a2d10cfb158173b3d5905
MD5 04deeb032e8c99559c02de3417ed6beb
SHA1 452d6694f0385d2d2bb65154cf7b67a5ad949de5
SHA512 c741adbb5e31087e56ea8c09adeb9fdfdeacf22fa0aafb89f220918a781f6d8d1b0cbcd60e955ebc4ec7991d6e09e06cba2b272e068c9919cd9d1ffacb01a239
SSDEEP 24576:JTHaLl3z0zDV8U7tTK3VnChd4Q4PQpUcrf0FGDQ:JT6Lljw8U7twh0gYUub
TLSH
T14B0502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F377A05C2DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 da386c3ba25dc4372d6a346b06c2614fd8d6a6b0bec54c9d868f36c2ca3ec228
MD5 e6c19c2aff85ab75e4f9802bc395e8e5
SHA1 c3305b2c0a86958d879b4d70f97883f18c57cfa2
SHA512 d62f3e57d98429280e063e81ab4e57035b4f1914721d8d6371029df735f49e1a33cbddf5b2813e04cabb41a7e23de6838f92a97ea910a532488cd4baac0467a5
SSDEEP 24576:X37d9CHKy7GZB8U7tTK3VnChd4Q4PQpUcrf0FGDQ:n7d9CHKyav8U7twh0gYUub
TLSH
T19425CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c4086dfcecd22119092556f28f56c0bf40f2a9250f34a411d465db38a5500157
MD5 68d32f4ab7d32b649f14da44d500fc33
SHA1 1dff194e958e9194e6546f0b046af1c52f8951a4
SHA512 31839cfb18c2364be8907da5f523526c50127cac4a7a46b58a7484ac54ccb5c439c4ca10861188f67e16a392c8860905d9bf689b53aaca82b51234a49038e5a9
SSDEEP 12288:6fN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6F8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T18CC42320F7964C0BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b60e7c34afbf4bc048bbd6e06c9090a44b2db83d03f1c85618621172d85d8de9
MD5 5ba2786a6eb33e36b68962bed973a429
SHA1 46e979838b4673c26726c904674511521baf0a55
SHA512 51221c91059d09fe021ff5fc65f41e2cc3f87b857f0ffbb4a1ea1352da971b4a63e6c41b4c979ebd07fdb8690d122f3f2484fcff8fe20e7a15c8a50e6d22bbd6
SSDEEP 12288:9xN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:9H8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1FCC42320F7924C1BE3112733F537EAA4EB101EB5AE448A252550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 305b43ba33a26f05a598695740cd52c730cf8b5f8094acd3bb8abcd797da9c48
MD5 a91772c82ecc93ffe92af7b43648481a
SHA1 c4f28cff4c9b37c64dd26a25bd1b2243a9c542db
SHA512 5e1aca9cda8a2cb53c3c4cd9a631acbdd5282a067b0df94a253e784984ff912989d783e4a6c52776034471e136a0f83c28af7fa23989407c21b51410c28f1039
SSDEEP 12288:K2N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ko8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T145C42320F7964C0BE3112737F637E9A4EB101EB5AE448A251550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 02a7f655eddbb01e4ae551ce7f976b3fbd159ea949b73a8c131ffa4f5ba5e190
MD5 31ed32627f6973572198ded8d4970dab
SHA1 a67c107eff93427881c52f4762ee4750207ba17b
SHA512 a7ec611ac01694815ca2e0c5fe00dc33f82e9475c8239bc72cc7ff39aba00e973de580d5d5f18ac0578c91503dfd93370c1e6683e4748905a278782b25778362
SSDEEP 12288:ZEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Zu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14EC42320F7964C0BE3111737F537E9A4EB141EB5AE448A292550BEA07F3FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 23d816ac8ee2a3343c0b14dd11d2bd55bedc8ae8ec7bdcff3d5b1c9b8b37b46e
MD5 e994de51103d40401ba189b473c6e65a
SHA1 4a8da2de7b1910a18a437a06fd5be3fc49499d5d
SHA512 c9300370f8bf2fb4b3d99d50ecb1f4ac5ff3a28de7700f6a7f2aa9749b55fd9cf1c8cceb32841f2b7ae3ec18d38d4eb1117b0acbf1c2a938bf0202caa5131ff4
SSDEEP 12288:kfN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:kF8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T10BC42320F7964C0BE3112733F537E9A4EB101EB5AE4489292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 b8f7140116e72704513cf012e078674ce8471a99f72f61baa4c59fa81e643dee
MD5 de1ab8d455fafaffc7d47eb39b836148
SHA1 d1381ef856c1a3102f26f5bfc613b3e7f9f31500
SHA512 19cc91d0a1b84588c69664d3a6927b33b3f0b6abf9b6f5a1033a1afb8d7d5f8f21beb1db88e98837fe5e420939dd187fc1753d1daf0b2a6f411ba0bb1b52605e
SSDEEP 12288:P8N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Pm8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F7C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA17F3FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2d52c9fb86dbbfca28efb7db48f89741df715edd493157b92e4ad5701d685bb5
MD5 2ac6f4fdbad4bcdba37f18646c6d1499
SHA1 6ef26a341c9959cc802f578258fff4f26d527128
SHA512 5cfacd09ccc8f81fae6451b3de3ce3f003b7dba0f916300c26ffbee6d2e5d827e92d4cd190f604e01613a0996d046bf342b4603eed9d09c47678ed2a28cd01af
SSDEEP 12288:/6N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:/c8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T101C42320F796480BE3112733F537E9E4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 016efa3777e617f4c12d9051434ffbf003387b4c79f272906efc8f14b0322ce6
MD5 e0b3c7694f03d29afbb2f1c2cee6186e
SHA1 a6f15caa8e9d16fd26b4435a52d0792b68a8e3b7
SHA512 6252c718cbb3877bfc55b9de56d24471a4a816e27e509405c8a5a309a5c56eabee82721d6ecd67583c947625d24df14df4dbf34b8c43f6727d8f379d70192019
SSDEEP 24576:9fwvok9RX6wkyAIS8U7tTK3VnChd4Q4PQpUcrf0FGDQ:7MnYIS8U7twh0gYUub
TLSH
T18935DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ea4176ba273a7c979efc76d6d915c0690c255ffbf531952e996c3ea43f538dec
MD5 3dd7d73de4166a38ff323b17f4026977
SHA1 538c575203c94cefd1337eb49fa5564aad9afec1
SHA512 8528c8c3a9256930f554605ad0ed730b28fa64c4d84ce4facc12196e5d81728fd776f323d5a9a4bb761b683c91e4a6796ac10c6ead655c61bf649e71a126dd61
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK058U7twh0gYUub:XySzPBbpi0gYz
TLSH
T1AC066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d64b5aab65947cf635dd3d453753cee639cb1a57732ce197bfe0bb07cf628b5c
MD5 83b02760521d7c3daa9bc228967799d1
SHA1 206e9f98ed2acbaf597ca27567c8a43f977049c4
SHA512 091fbff83e06979458880add7c1f388c3e736922c1b468f9c0968b1787d69f70950194702d0e2605c24fe6ef1a91b32a257e035909cb246e3e05a3d7d4c44b61
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYz8U7tTK3VnChd4Q4PQpUcrf0FGDQ:P47JUQj1irIhCnDHUPfF/J8U7twh0gY3
TLSH
T120659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f63217447afcec9c8d914d39931e35a4495bd71b633b33a0f04772eccfa678e3
MD5 e86359ff482c5a6a0a739d5ce2b8adec
SHA1 d9898fecbd86d5af4d70b99fa00afd011408774c
SHA512 73cc2f1e8037df16009426cd43495eb2448d10760b537aa4aa12d28fc2a40a5a68ce98d0702a058652657f411d2edfbdd7197f57d0f58814f432520bf3a8a8e5
SSDEEP 12288:tNsf0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ce8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T161E4F118E39402D9D16E2236D7269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1b641ccd70315d25b43997f4bc5811aea447ee231acd2bbfa8ddcf2d76286b70
MD5 1dc05054e6ffcb10c53783a5999d3236
SHA1 0535e7eb10d913a7f313a25a9054d6111550d291
SHA512 5982738ca1eabfdca2ccadc78d146d727cc8e141cc6585f87bee395544aea7c1b654c77814c3d868a2b727bc54ebdff94b20284d49641643afaeb2073f5cdae1
SSDEEP 12288:Fo1Ad7U3f6G9hK2VC0E5fdTTCfK+zcEXviCcNi/NLz4raRZdergR:FCAJUPD9hK2xfKicEXqCQi1Lz2aRZdec
TLSH
T1E7551740762BC79FC6A940321E36D6CCAB707D01FE056F1773C9873E9476668B6E6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fbd93815245da97460a21c96158fb039cf1dbd59eb964a491ebfc4c63ef804e6
MD5 b9f28c4913162fd9cc3d682ce08cdc28
SHA1 6d136e0cc14d589bd26dda357cd2816290ddbbab
SHA512 f91576ed07647c8847f31bec1ec1b73dc669e7181610760d13d125e85d8074172b9045a3594b35b911b73184e19841c9c64fec4d9530638e4f9e862a372d93c1
SSDEEP 12288:DcNLVq8FvKVdfVfM8Y13arb55l5G5CasuEUlwZ0s6kYTUKvwki2WfuLVvdXY:DcNLVJJ4FV5YYLuFkYMki2WC1XY
TLSH
T1DF652A41A5B7E35FC9FE90370232868DAB745C06BB453B1173448A3C9877A7EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7249e09620221a26c948955750e241eaa074aef7778c6b632f397f0d0c29ad2d
MD5 735a8b375a99fb0652f42e229f659f26
SHA1 17f17b7645be260ea92be7c7e1c305babfb35572
SHA512 d0bb91425d901f1f3c6b4ecfe97d234d709ae0593adde04b420cc61d6ff16885af361471beff408af85e0fb96d2746b611f24922b96a0cc9b990286574f7fce2
SSDEEP 12288:hM7sN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6W8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T117D42320A3958C0BF2352732E53BD574E7156EB45F00C9A76400BEA56E3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f63f5d7e1608cdc06ed16b77d86f140dd710122d32b103c035fe0734c7971aa8
MD5 16ed8803932cfb1a10425f3d6943592f
SHA1 5c1ac56cca9b4226cec29da951be4649dbb4dac8
SHA512 501165cf2959f7b98c1b23b9d477ddc3b1e79534e68e83bb6208375364850af115937facee47d9f00ecdda25944bd380ea27244f1e2f1e9de89cb678baf3d522
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYw8U7tTK3VnChd4Q4PQpUcrf0FGDQ:/gb4mBIBhGFz8U7twh0gYUub
TLSH
T17F65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a06779abd0151ec4443c9aedc60b6af42e9abb324b579e61112e1b3975f710ea
MD5 c11e407ab1a17212cbf166ce1515f79c
SHA1 5ad41b57458036b7c1ec81449184d56e1270a656
SHA512 a24194287d68431f48c65703ac7b945a7f71d79a6cba0a85cf2900e81ac19b67d20d70133878ecaf08cb09d56d30a500e1b4c9cf2f33d3c472e25289c8a62091
SSDEEP 24576:GG88u8FpJqH1bzria7/mj8U7tTK3VnChd4Q4PQpUcrf0FGDQ:N7ZFPqVea7/I8U7twh0gYUub
TLSH
T1A735F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c3f9ff171fcbc75a7b218b746828d6d9894142901c547dd6a80dbaaad204b524
MD5 1adc4efacfeaa426d05e2deb201f1167
SHA1 d9ff74d9b5a0305fc4730dfa558ab233f52ff2ed
SHA512 ccb4284e12740c6fad6af0badaf49dfa868caa6650dc887c9a4d3c43763485cee6100264de247b001b6c521f3fd4ded5fc989aca4e28a17bfcf42a178687064c
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf8U7twh0gYUub:GG05lO43bqbpi0gYz
TLSH
T1BFD5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 53a5761b38e84d217dba5f2e7e3eedfc44386c2b7cc96853c32881fb8f4c7c48
MD5 6fc44657211e01123fd81f22d6a292a2
SHA1 9c727105cad71770a892b32b5571b77c15e7fe5d
SHA512 57f54ded1d2f92bb752f7f74175bfbc7ed7e44c4a3ce1e5f10bc0a9a9903490c79ca8939bff2dbe69e2b4fbef1d9385931f696b75c8136cd6dac03b4a6e95538
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn58U7tTK3VnChd4Q4PQpUcrf0FGDQ:la5POZ3+Jt2pasx2+mH8U7twh0gYUub
TLSH
T15D65AF5DA7F801D5E1B9D17DC5838A1AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 435339be3f81cf177a15b880d59a3592c5ec426957cfdcb696796a5903000742
MD5 fe600b81359e0451c402c1ef6a25c6e9
SHA1 8239de5c921639a01166e440b50d4af07dc78cfa
SHA512 24a65ecb029293b5005c27a3a49c130b2eed7fecbbe74a53056b373f55af1fde00c893f13430ac893bfaa2167a066b5f7fde610c1330153065e7952c7ad4ec37
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkL8U7tTK3VnChd4Q4PQpUcrf0FGDQ:zNc/zEOVHFo8U7twh0gYUub
TLSH
T159858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dfbc6c54b968f9955b908b210aece306b619e02ba058f7000958df26ce21e21f
MD5 e5d7b854d4fc25737c4894e0170fb6ad
SHA1 40ce422cb9ca871d11b32864dc07483aa12b454e
SHA512 bc56a060a495211685e043d74c22ba24b8637f17ee776d7ccaa23ac9b8ba1dbbbb896320efcdb7319c81289ffa2ab1840789be745f2b460497ee3a7861059711
SSDEEP 24576:o8kNvNnaFeYhJNtmZBmt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:o8MwBtOmt8U7twh0gYUub
TLSH
T13755AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 c99b4fe285136ffdf848027ea2ac766002ae5d2edd89aa160feebcf4f3cbf394
MD5 5d48180dea68997dc02e519da402e20b
SHA1 1634417ec3ade66e21b2cda7a318ccf196702085
SHA512 c27c7b66a1bfe738e0e0c9435a1b7e1065c4eaace85c3132f1775debee02f158533be92570bfe2785310a6c76b22888b40058d8c5de5d0d37242ad73757b506c
SSDEEP 24576:YPUr+NQv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:YJQv8U7twh0gYUub
TLSH
T11005E12E62E91CE5E676A13DC9528719F771B8621701D2CF02A0917E5F37EE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 312ad492efefbf6d70c35b78707e67a978e41dd670d096004bac734db7c3cee9
MD5 6e15f9ea3a6b0be5f14623447a304abe
SHA1 25d3d8a5896d0f1529782dd6342e9627d8a97bac
SHA512 65493129eab900428daa8f9b9ee5384773d573ff042a9e9fecfd2db2e956a80f859d4bb10d1c93495511987b34a124fbde6e2433ec2fcc0dc84f089d5637edea
SSDEEP 24576:UD3FHshBIYQgA68U7tTK3VnChd4Q4PQpUcrf0FGDQ:UDVHeBIAA68U7twh0gYUub
TLSH
T15525E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1404-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1404-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1404-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1816-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1816-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1816-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1816-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1816-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1860-281-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1860-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1860-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1860-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2732-114-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2732-120-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2732-124-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2784-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2784-79-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/2784-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2784-84-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/3260-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3260-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3260-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3260-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3260-50-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3260-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3328-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3328-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3328-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3328-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3328-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3328-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3696-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3696-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3696-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3696-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4452-77-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4452-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4452-7-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4452-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4716-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4716-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4716-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4716-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5336-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5336-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5336-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5744-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5744-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5744-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5744-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5744-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download