cd7a8493f34b7f3547c296e20d13397c1069fb3099ab9ea2214389376bf89711

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-cdwnsscs6k
SHA256 cd7a8493f34b7f3547c296e20d13397c1069fb3099ab9ea2214389376bf89711
MD5 000470a91fffeb8ff6b9d54ffaa9c656
SHA1 09c37fbaa7de8d6ed58aa7deac21782188765fe2
SHA512 9da449581489c31b1503d55d342c23ddf3b545919475fca57c5781d6b07a44873ea2dd13952d99f96778fe916f9b60d5087ced22162b4a0a35cb7f4e45a84cd7
SSDEEP 12288:+UYJ9bi5N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:vYJ9bm8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T12BF4022072C18473EB73153259B5EA719A3DFD714F1089EB23907BAA6E346D0893DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1480	elevation_service.exe
1444	elevation_service.exe
1652	maintenanceservice.exe
3692	OSE.EXE
264	PerceptionSimulationService.exe
1748	perfhost.exe
2688	ReFsDedupSvc.exe
2892	SensorDataService.exe
5628	ssh-agent.exe
4916	AgentService.exe
5016	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\221813e88f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c026645eb17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed638785eb17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5555b46eb17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003574a685eb17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e87dae45eb17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040246585eb17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060d0b544eb17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef89d46eb17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4916	AgentService.exe
Token: 33	5016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5016	SearchIndexer.exe
Token: SeDebugPrivilege	4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4488	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1480	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1404	5016	SearchIndexer.exe	100
PID 5016 wrote to memory of 900	5016	SearchIndexer.exe	101
PID 5016 wrote to memory of 5388	5016	SearchIndexer.exe	102
PID 5016 wrote to memory of 5100	5016	SearchIndexer.exe	103
PID 5016 wrote to memory of 4864	5016	SearchIndexer.exe	105
PID 5016 wrote to memory of 6088	5016	SearchIndexer.exe	106
PID 5016 wrote to memory of 5068	5016	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5628

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ba3458ce8f4d047383f8789bced208bc22f9456d039f8d3620679c4f758e015f
MD5 debb575b03f8b861cd1d565847006a90
SHA1 c8bb109798fc0f6a9a5142d8307c31a5424c3dd9
SHA512 9db3cd9e1863e39e61f9f2b9b761ebe6cdb702dde55b884f81d93e9f9009f9f40fd91855ecba91d31df57ddb4c8ba2ba8875ab651305ed19970107be5f5e1642
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQ8U7twh0gYUub:i3q6HjBnbpi0gYz
TLSH
T10BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7d0f706ea213b3e189bcaeaabc44111ef4e0fa0e2c25581b7248994fb5ef777f
MD5 59a38bc05c482ec63a45c496ae2547cf
SHA1 14917f320074e2049af3578a57525876549c439d
SHA512 f8c842afd3ecb1adb19103810e1165d5b29c89e085e0f3a46bdf09da5fc1e6c229ab8a5aedc9ffcfb0c3b34924595ee8806bde5c8269e9d1c081d6df716a7e02
SSDEEP 24576:4XYfDtczAj8U7tTK3VnChd4Q4PQpUcrf0FGDQ:vtcC8U7twh0gYUub
TLSH
T11905F128B3D108FAED674239C972C511EB3378554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8df551b26e981377660f186bac97eb718a9b010b6d85fbb15fef616fef850397
MD5 551f51ffc7fe57367a41ab72c2299f87
SHA1 83905d2c9e55017f1e40bb058885cb7250c03dee
SHA512 fc46b67ec2cbc948934c36bb1e04465c92b6014c2cebd64f535a272504e9ffe47e34574df94622f88d294b2d66806782280a8960e439a4085f14140afae24994
SSDEEP 24576:n0Le5ji0hmxirMY8U7tTK3VnChd4Q4PQpUcrf0FGDQ:nPji0Acp8U7twh0gYUub
TLSH
T14B359E15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d3423da708145c0f41352c86df3143b68996bfaed8fd4fc490049f4cb2195431
MD5 85d5e62882c04fa992894141acaca35a
SHA1 3d704cbbdc23246ef94ae9da62bf659f9eb2f40e
SHA512 fe090784a5bfa66fc47a93218d5f3bdfdbaaefb1c70926a12158c89b8323ba1797e0a7e636bf07c6aac9ed98021873c988af34605961f91c703d303fa8b78149
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyuS8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Q/ezSC6vUzPvxHjy18U7twh0gYUub
TLSH
T1F1755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3e282287fc1d2ba0e133ed95562738d12d27e31e892d00855aefbfcac885607f
MD5 d4ae03178264b4974da4d261e3aa51e2
SHA1 4792757e3b6ef4f9dadf24f5043900177fedd325
SHA512 215cbe45837434186970b36c64f018e14aeab553cc67b61d88fcff8b28b85aa60a4acf02b0c703228240eb01d9d56fff1b081f5218630c48c4b6ee3cb7dea91e
SSDEEP 24576:TVbqPb88hv/l+638U7tTK3VnChd4Q4PQpUcrf0FGDQ:TVO88hXl+E8U7twh0gYUub
TLSH
T16B559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cff87f9ac7165450aab554295638881627e3a89a8daea1db728c8e8a74f4e699
MD5 a0ba4aa0078c4e1a045ceb09859c0296
SHA1 f596fb0ae60056bc1d4ac6fe617b323c65bee9d6
SHA512 cfb9b3db0f4fe8fb604d02248ee0399de195383e0599466ff80b60c11c99050cc988645b785c2c59ecbc28ffc52f7e9ce595930a29de6652493040dc76b74f7c
SSDEEP 12288:mRaN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:mR88U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T111C42320A3858817E3662B33FA37E9A4EB115EA45D44CE251460BFE46E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d0e9c3b35be5d49367205fd8226b3a383bd4389d9e28f76879b46fbb3406961c
MD5 3145517fb8b830889599aa2ac5daaad5
SHA1 4fe1fae0eca89f0028ada5854bf373e9153117f9
SHA512 86fb8072fe440a8f33e6b85693253e43f2e6c2ad395cab0e3f15d8be48d317eed08bd0d0a1abd7c0bf8420e7bfabef353a86e9315fa646dd7c582793fd295b3b
SSDEEP 24576:NJIUf8U7tTK3VnChd4Q4PQpUcrf0FGDQ:NJIUf8U7twh0gYUub
TLSH
T1BC05CF3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE239E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f09d0f3143eeeddf984b15183bd7041e9a94559975af518a28cb9a9a7082dcaf
MD5 919c43e3ac8b0c11a86b50c97c52e950
SHA1 8bb8c210004a3657ce2a5ea2960d8e3ed3021722
SHA512 ab8bf245fc6495736eec7778f4da54f74159214348a430e811e412fb68eb344fe3af10857d85dcdfb915e096e1a5b20ca96762a3377a800894fd44d8430583e8
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THn:GQvGAdlCEL8c/yRNw5Cibpi0gYz
TLSH
T199266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dae5b7e17748dadaa1dcdcbb9557c190d8dd15cf2d07956dd2fab870a2afdee0
MD5 0538b5f7400b7f016a751affe3881755
SHA1 5907120d620e8eae489f9d91023ed049f89d9c38
SHA512 92f569d0ddacd70dec942ce2278f0d6f048495d087653f2ce838a43b189f794169624a0ab14be748998e668c474bd21237f0995140d5671c384704968035d2b1
SSDEEP 24576:WdewsAj58U7tTK3VnChd4Q4PQpUcrf0FGDQ:elj58U7twh0gYUub
TLSH
T19615E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e9edbef425ba4adb4e9076a65767062e3fd56e8aae41d20f83f3bc4f6a6406c
MD5 ce41f4d9454fddcb17ae4fc6a58d0c4e
SHA1 63ee162ce7a6193912a4d2fbe41a5158f988564a
SHA512 60e6c36856d40124275d3ca0088ce7fee2b0c90615b0b2cd42e5b92e2719d88b703c715177e8cde0ce4c1e6c5386b5051f59e7bb82c40a9356a3127836c6f4b3
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGH:hUEtQevvqc2W1cpV2EI32a
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0e8694ca479e8c0c9eaa592f416c14ecb2caa55b8aea30c35484024414dbe640
MD5 b86f29bb806391fa55254eeb8f18698a
SHA1 3fd5de236ea7972500c0a8070f7a52fc6630653a
SHA512 c3777e8790447e3d52f155393cc8a4bd310a29a335be93ed621b52f8fe2bb066f278c8b8d9b955fa20db4be4d62580ae228d8762b4e4b75de3f7d0c9e3b6e313
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zZ8U7twh0gYUub:RoqtVjnm+bpi0gYz
TLSH
T1FCD58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ca05b16f1c5df99505b909125cb3fd94809bc798faf472d89bb1e52b2e9a1a3
MD5 db7567aed02d40691cb4499313b4f004
SHA1 64d1412fdb6765fb596ec995ade029d716dea4f2
SHA512 6ed50b4850de0d1eac8ba1b1fd901ab92d5b4f826b389727f8763c6e84a0d7f2f2fb7176f00e62592ec644b854b12c85a973f42756e7fc11a8afa8347404114d
SSDEEP 24576:hAhGLJIFoiwtA5l7S53e8U7tTK3VnChd4Q4PQpUcrf0FGDQ:hAMyFoiq5O8U7twh0gYUub
TLSH
T1EA359D80E7F945D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7864cb1a79787fdb793863354a20bf27e6392b970ee800627042bccda3b3edb9
MD5 4c03cc699e0bb5c22fc8544ae3038e2b
SHA1 2d4ff85edc6e40c4f0aaeed08396c52f7254d438
SHA512 0d44a3393c95d94697cc329732b75f73747c35fa39190ecdb00eb1b9a2833a76c319171f4d0a609fda4d0b9c8d59b928f5f08fd0e8f4cd0fd3cd260783690bdd
SSDEEP 24576:9wuoOWV8U7tTK3VnChd4Q4PQpUcrf0FGDQ:9wDOa8U7twh0gYUub
TLSH
T14405F04573A40CFAEA675239C567C536F7B2BC112A20CB1F1760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d519af6e049046e49f9df3b64835e64a3e4bab0db8dd5775f8a198717a1f4a44
MD5 236df6ecd054213d7187d1d1fd766c2f
SHA1 5c1adfb5b35f04e811654a389051d7cc68423839
SHA512 60f118ea763db6f7e5084c777c82ee8cc18a12709a7832afc36fb31d5579a826c97fd6d6347a76cadef29e01fc8d8adc722c0bf22efb31587fd61b3fda98188f
SSDEEP 12288:jBZ1IyTN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:NZug8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14CE4125433D460BAE363133AD9B29A45E7323C62673483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6335561a67e3d94552dffcca0215e1b90e2a855e0a62fd9873bcc02bf9ca419d
MD5 ae1c177f1de9ff206c6d3f5825721c27
SHA1 4a97afff74065a7be0e9b2fd59e223995926734d
SHA512 483a9ba679ba69a44280a3f66188c4d0e0285178ada2c05e6aef5e7cacbb2f7451209f6e6a5a459359404f3d61c22502f732884d0faee1cb0fc0e96a303c8174
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3Lbpi0gYz:LQyiKayX+PNoH
TLSH
T10D666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fa420cc4202037c5f8e04c42b76d32428864dc82cdd5f6fa52128cdef4c6fdaa
MD5 366c2e3bcff1406c87a8996b1f2b4767
SHA1 23fb6aa50eeb8cd8dba7d171b0bb5633c06f5147
SHA512 49284de76abc5f59b1a7a2d0b3c290e2fe4697f5b3e8603b0b8977919576d1aaabb71481ab0e7fadc5ebb5e45b46f7e5cae29a51deb20ab09baebb182b0e3578
SSDEEP 98304:DQRQyi36YOcPQLvw2gAf+PN3Lbpi0gYz:SQyiKayX+PNoH
TLSH
T104666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba94fabe7990dcea9dfd08fed171e7b002554a0232fd6673651fc76fcdbcdc47
MD5 6c18b2937a99887fc0bac11e61e1e76a
SHA1 db9e14cacbea31638a42f0a41c1dd9a58a935cd0
SHA512 9eac54942bc2c9e3c83bf1752e43e144fc00bc4f9d40bfe96ee29725784cb86c7915aa8cf9284e65fa58d9335b3a4f29812d6e1e7e26d887a995347f432b19d1
SSDEEP 49152:468Qg55nhheWu7PNU3/p8U7twh0gYUub:CthWRc/pbpi0gYz
TLSH
T130B54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c254eb745c7d437e8a926324d88b11c1d4d9c5383cc04d256066bae66770ca7
MD5 5b194565cb75e168c84ce430a9140972
SHA1 5a5f08254a6cf4b94d2a75e98a95557f482a0d42
SHA512 115b9401ad47faaca6e2618dbc6bbb4ddd3e608eadc31c35a9e4b16690f5d40b959d04382811897e85fdc5334e84ed63339010b81c645eee5cc53a824d9881eb
SSDEEP 98304:ly5112gYy5azzVvL69nLKnhZ8bpi0gYz:ILIHmWh7H
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 11bc60244c9e3144f1c035886ce870c2b979c2f98668f022931fc0bf4eb0f88b
MD5 0def0c37d4c4f53dc94396ca5d90f770
SHA1 cb71943070083c1a4223091ee558d262688e372b
SHA512 b9cac576f2acd3c8a1bd88c48be1956405f47cd03e2874f886722a54c02e864fe3b0249259109a5ee1ca6d595a17f87e68e4971a3fa0d4b8130be37fa001b875
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glT8U7twh0gYUub:iu6JmVxd2dTbpi0gYz
TLSH
T1DBD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b27d8409c4ad6487f5532a05c79e6ea3431104d671ec2abdf1443f3af2e7538f
MD5 51fb5c4a9568ce3d363f8de29f739c40
SHA1 2c5f140a3156b6cce4bfd0be2fbe8ef09564f2c8
SHA512 c2ab81d8c36fb01aa6fc819028baa1f2be2acdd3ed19618b94d00075b26509edddb6b400d017c0b0b516ff4939f03650cae22d2d633e22d249c0547e246bc3dc
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4x/8U7twh0gYUub:YmifPbR+bpi0gYz
TLSH
T1DCB5BE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 753b84801f6928a2c48038a943f226428c7f3b639aedc606f2e74f9097dd4207
MD5 ce5ab006fec4538bdf44397455d565ff
SHA1 b9e1d5001efdf0061b46371eb226344d422733b2
SHA512 70bd3098963ca349b1098d0ebe077fdd73e11048ce6bea2e7b8b9bbd0e341e144bdf98f4b19e5b1cfd2407f19dc607270770fa7ed6bb21aff39141c0705c1185
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqg8U7twh0gYUub:k5dKTi61gbpi0gYz
TLSH
T12CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9c9ac0d2d301c2427d0e3a2c8046c3db4e17b61ee42c52380bf49ae2bdea2f27
MD5 0255c733deee5c464171b9edfa3079be
SHA1 0516a9ac249cb9782b52e6e36274c59625860427
SHA512 91eceae5bb42bcffc444a6394fdb4279eec47e82eb548838e4b27b74b2306b9ffae9a46b3dd09a1fd3edd0aa1db99cb88f43c539a69142c14e8e4ba7b8ceea28
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wj8U7twh0gYUub:3X2iyph6bpi0gYz
TLSH
T13995BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 50b6298b1b3b49f710ba3689ccd8cddd6ad2979a9098295b214bfbaa1ce0cb56
MD5 a92771093c0b5a5aa853bcf1be6e291b
SHA1 e9e72a1c1eef4d8115acc40d37d227bc042eb30e
SHA512 730e72d730022017a14309d608d0a99f774fc8204d203e9b107d5c1f0fbaaa3d254b61644260c8c44a621a52c1faca6604b72e4287846c2d6a3668c5ad44b619
SSDEEP 12288:aiN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:aE8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D0C42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a8c37210a4356a335f7d00c6e1893ab68d5ac0e7ff0be2300737857b6da96714
MD5 d66527a6ee409b834fc5a3c2030de3b6
SHA1 1559a7b42a3b675ca65a1e1f38e11da83849fd74
SHA512 1a09a23b2d17366c5476a2e81ef16c12fc7e5dcd410481fb2fe0019db4ae83c5a217a83ec40f268f3d9e77cf98995f14d99df027f63a4fea2e210c695dc3d44c
SSDEEP 12288:0nN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:0N8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14AC42320F796480BE3112733F637E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 140836c27799010d07e58614e0101cdd56307e3b77fb28e5ded6eb1c13b4f698
MD5 cf20726c525617d282fa5c2a055f10a6
SHA1 16371693d588400ac78a798e37660a6ad7608d41
SHA512 0a6efeb2c0d988c5d2828677f4cf4a7531dc417b59ef5f0b680f51368770ae3dd4c1d99b0e38793e27c56db95d6834beae363c829bfc45db8fd9463e725af29e
SSDEEP 12288:qRN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:qn8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1FAC42310F7964C0BE3112733F637E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1e9bbf7903f2f4de2cbc59230a0ebfdeb1c23aea74f971eae4b99f554dd134e7
MD5 838661a3aff0c24161304db53ccbe33a
SHA1 214cd37b25bc380d4f051ba12bb8f8216a743876
SHA512 aea10add92bc0c366f05d9a59d23c68bdebdfa4529c9c8c3613a518a56adf451b4d644dcfea6dee300baf0704c5b75170085921a6f7bf759a29baa2751edb603
SSDEEP 12288:DVUN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:48U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T127D42310B3964487E2222737E933D564F7217DA4AB108B6F19107EA52F37F9C9DA8F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ee4f6955c237318c60f0f06cba01bc035bf3724c86b388c10b22af7973f2e541
MD5 0e646fb8827996cd787cb5988017e63e
SHA1 d2d92381c3ecd9e1bec970bba69658a67e74bd2c
SHA512 f9e9c50601d3a72914ee3633f337efeb903c21df8669e2217639750e6d68af54af37997a97acd6b6eb53cda62202c10eef37e1e18fca8a5d658bbe419dbe2c74
SSDEEP 12288:fMN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:f28U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F5C42310F796480BE3112733F637E5A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 be5f521139a5f64f2cab2243de80120be469173fc08c12aeeb61bb44b0f1ff0c
MD5 e6275f63b18d4984127fb480c5ef41ee
SHA1 7f73164a85a8b62897c665bb357bdf15bd4f2d37
SHA512 7affb266432929c8e14e77c288dfa0171a2618a7b3e5e0d4098c0270c0fa27ae3ac1c4138da72d17abc7592caa0d704fb9086f16605e330a99813a73354d16a1
SSDEEP 12288:JrN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:JB8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T154C42310F796480BE3112733F637E5A4EB141EB5AE448A292550BEA17F7FE5C89CCD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ef3e0578a9eb4a1d80128e1c728cbe66821e27d15da9922118e5af733659d441
MD5 088e0c6e2bc384a265e272604331858a
SHA1 91b40cd785f8841cf74e1d0031998eb81d95d582
SHA512 8d16fe4bc5a35b23b85d92fa2dae656802799afd177c9d85bf3d9492f334d5d62f1ce9621b8b6880ed592c66b00693c1c7926056cddef52a7ecca22974c7d83e
SSDEEP 12288:rfN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:rF8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T168C42320F796490BE3111733F637E9A4EB141EB5AE44CA292550BEA07F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e4100e36dc2d08fd25f21b501ec548094a5a77a216547f27f73b5cc03a0d82f0
MD5 5efec828348c49190a763dea500e639d
SHA1 62e3332967f5156d52defa868936f2c1cbf61674
SHA512 92323becf3f1d3fd2f2196a5add1d289cddcefbb1740811b9628d3ec6c2906f3bc2ffe5c4e7dcad41ec38f4fc88803f6c2ae75721ad4036075d0b967970fbe2e
SSDEEP 24576:hZMSzFVSOt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:hZMSzfR8U7twh0gYUub
TLSH
T1AB0502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 795a5867aa38122497bc49879734fd4b3ca1430411763ae166404e1506d25c41
MD5 d43d18b56adea33f9b085b0980e661f3
SHA1 0d2d3359d1c326f3c926e2ab8e93bde47ea98f6c
SHA512 543f403638993ee97d63d96962e8a74a83336a5bf6b57d121ca7356f823558bcd3ca040cad2328044bd0b2eb6123324ee9a549b356541951919fe292aeb3b473
SSDEEP 12288:BeN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Bw8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B0C42314F796480BE3111733F637E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 be957aa10776dafaf0d215d49cf076e3443f8e14a4965f31e072b1c3f5bfd7f9
MD5 1f339a0fd05723282f114198888c8544
SHA1 f9e50e52999febe85f4576b095133c771ab365b3
SHA512 f3f04d930205db643e0c09a458fb63fc06ba0f3eeabc4aff0d64845edf5346ca728e2c3f97bbca9e302c068de28dd4b94b9fcfe55b629fdaee7347ede84eba3c
SSDEEP 12288:6qN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6M8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T181C42310F796480BE3112733F637E9A4EB141EB5AE4486292550BEA07F7FE5C89CCD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6366b9ce1daca22c6ba57aa5d2114117465d0d9bdf5ee703ee6d98db960de0b8
MD5 3f6f91f256aee52254c1bd0932a57920
SHA1 914e3921947ec65bd45eadfe43fd5ccb9660095e
SHA512 647f86518c78dee0c1b3fea11a8d03af06bf1f9d756edc76653b406a60c43981a1222fde00c88f987d1c5f7873a41f88dac5b0dada6d7b772358ecc75e934674
SSDEEP 12288:ByPz5L8TN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:QzyJ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1FAF4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ef804393b22dec7dbb7b563fc94879f88e44c538060082b751d8193b145fd946
MD5 8f04c34f036d71ceb66fcc1d7eb8ad1a
SHA1 1b796a47ebc6bf9269854799bec9aeb82560be5f
SHA512 96a2a903c9d51ca002ce560412b641f1bf3b9e830ed31713f3371a92ddc261b69c3650efcae56a28dda6543d2cfd6c482f3d6ee4ebe408379fec8784813247e5
SSDEEP 12288:qeN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:qw8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F6C42314F796480BE3112733F637E9A4EB141EB5AE448A252550BEA07F3FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c7cc88e4110c814abe0ed63d6facaf00f396547ff567d58ea189ca34923dbdee
MD5 b31f0bbe24878d6135c61142d0b98118
SHA1 6fdb9f03706b52f4f4823fe27bb9e45bdb08be16
SHA512 0b654fce837f50049dc9511337a85ef650bf0ae166c01a0531cd81f378d35d8b1c8f8a3e5b1527fe2970b09d278e2777af95e6495ca2ea962d66b85546027948
SSDEEP 12288:BeN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Bw8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T13DC42314F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8f06d6351e1311194c631fc50c6dd6d90ba3a0cc5d397e88680f00b21a029668
MD5 2b64f6946980b55db14f1786b070b85c
SHA1 691daa0640aa4848b38c2993d31ea3ce642a21f8
SHA512 05b41880211eb3711de669456caa3eac874c39993c28d091f3209cc643223a566fad9327bd8312fb9efd72b417008602946e21fe45db90d915fec69e7f400f49
SSDEEP 12288:3yPz5L8TN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6zyJ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T199F4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ebb29ff32de71d11a6837b3aef2951917450bb1b41f9351391a159aee50d0bc0
MD5 b90141c484d20d745762d02e1b5210e8
SHA1 2ea18c84f8da481e9e7bd236a9c477d94ad3e98c
SHA512 58e03aa32c27b977972e9e09d5a8e5629691b69a5afa838e8c9da2464f6a841efe0d22aba1da624889f8f2dbc529bae1d66f2106cba6957c9dab16daeb2bb8e2
SSDEEP 24576:nTHaLl3z0zDX8U7tTK3VnChd4Q4PQpUcrf0FGDQ:nT6LljS8U7twh0gYUub
TLSH
T1410502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F377A05C2DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 593be48a6ed2f043a113ed65b97973760be3403b9fe903c8d887de0eb88b7ad0
MD5 41e98cec74ee4eeadbdf235c151b5266
SHA1 3d2217f5bf61665f9bc4789a4ff17bbe0b597dcd
SHA512 1e65bc7194c3476516990c70575a0b91827741ead992dda53cd9d4656b7722a9b8c35ee8463aec9be5a8d42e2ec9880a3b3ca2feddfbf65c98d28b5e4de85b0c
SSDEEP 24576:l37d9CHKy7GZr8U7tTK3VnChd4Q4PQpUcrf0FGDQ:F7d9CHKyaR8U7twh0gYUub
TLSH
T11F25CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 66a4719f008ad2a039cd3f8d511088f6e87d6a9a80617eac2a6cb589208057fa
MD5 13df6e35bdfe3dd968ac3029a3073014
SHA1 4366355debc8f2bab2b14d10e13b7de31072d809
SHA512 96d049ccef08a36481160c7c378043d0b87f9ff5ab7b6be0e7c062cb06391f8a64bb34c9a00c0cb148f444b4426db5b1ad6636140de5cecbe8d7b6fb5b80d70a
SSDEEP 12288:+xN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:+H8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15BC42320F796480BE3112733F537E5A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 eec2d4395ccbff38908db3e398d27aa4c1420b26688d25d369e2459cc26dcb34
MD5 41b11b33d358864388955954123c312b
SHA1 3c8bee3bddfb11bd82654a9217b0047622f04e27
SHA512 867bad4d16f76d81da1f57c955bda8c09e3888f7d63f40e7fb6deb3cbabee1919efa371cf76e99d43ae113f9362ef62fe01b4681d9445694211d20b631403057
SSDEEP 12288:4zN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:4p8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11BC42320F796481BE3152733F537EAA4EB101EB5AE448A292550BDA07F7FE5CC9C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 cf781e5d170a6e0375492b2f54b89bfea03291635b4c512f8d8952e67728470c
MD5 f4ddd7a4dd1c5986b0103d7f70b132ca
SHA1 1e01cf1a6754a8a1cba6f4d1d0773e160a520757
SHA512 2003f96fad6b91524914c3c475007becfa4783ebb2429aeb929baa6dcb1311f6af7c2315e8a9b7ce0ff52e469f8f62c77b2349702a78fae16e767027822eb966
SSDEEP 12288:EQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:EK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11EC42310F796480BE3112733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CCD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ddde7e1bd9ea4d1457b8e4533548e4601cdaef4887374ea695359bbfcc974e35
MD5 d9099424dfd4858a759aea0ee0597a76
SHA1 f93896c30b453558b3f8513371aaeab51fab87dc
SHA512 0e6e749269c2243bb877e03aaf95f98e7b0d9c1785aefbc2c5e71fad9df62860fc30b302026471ad24e56bdca2bc23af35487304b3a469af5d9c842c260dce0e
SSDEEP 12288:IeN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Iw8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T134C42320F796480BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 22e1cb31ecd73b2c83f239bb6ca74d35ccdd77077dc844dc59eedd954916e313
MD5 6101487387d375ea7af1a8d203c1d768
SHA1 e3b122677966a4851cca1602cd245a128e1fa954
SHA512 c1dd693f0574bbcedfe746fb68d2427c61bde0bfc20f59b14d77bad2f270bb8e63aace21f262a7f9eb7c28f29b9d36b617015cd0dd4152d167b1432c6d9cfd41
SSDEEP 12288:QxN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:QH8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14FC42320F796480BE3112733F537E6A4EB141EB5AE4489292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 88c2213d2c99540d27fa841f17c475d5eef11fc9e68350569428535fae907c30
MD5 c2ff8a95d3435d48a4fc61ca382a3c55
SHA1 22638c20166e11f9165d09c48af17691618f2116
SHA512 edf18933361dd8e3e2e298b565f5c316a1a79862876734e515afb314e14375edec8f3862aed6b1b1b4dab62d6c42e08b27858e747c780451cf07a98cce69ac72
SSDEEP 12288:RWN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:RI8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B0C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b82b985f50dbc3b5ac7e18acc0bb797ef437867ce23eb9f4e09b65650be05eb1
MD5 3fc0b2645cd26e3336bf5511d55d5a60
SHA1 c1b4e42c708417aa3f57fa4edbf25f98611a69fd
SHA512 c17187a44fba963e104ac7cd0ab0803c2e77c124711a2ef80474925177551d541ca6df4c9f27b2a035f0331427e99c4f904f95866247a611a766a494d3ab1f98
SSDEEP 12288:qMN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:q28U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T189C42310F796480BE3112733F637E5A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 444d1b8f1c3bac7232c9afd961a60db0fcbe805c8ad828edfc415e38e8e308b4
MD5 ed01fe8af37979f9e1da7fd4c841f6ec
SHA1 ae952188f06053f53ad862cfdc664a7e82ab2dbb
SHA512 900bd8622d1d10579bf3cdd693b22636405618693361014c4d7310b134ea9596fdc7da78cc5cc3b0535afe1ba33fd622fe4014cf6f78b7dcfd67a99b7cd0f103
SSDEEP 24576:Mfwvok9RX6wkyAIc8U7tTK3VnChd4Q4PQpUcrf0FGDQ:sMnYIc8U7twh0gYUub
TLSH
T1AD35DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e4272d3ec812de9b0e84e7514a7d63364da6ec0019fcd01eec852fa9f5de9ad7
MD5 77ebf3ab14e249c6d6feb27fba096124
SHA1 1259cf717e0bb3228ea59f545b293a19c941e6f5
SHA512 312f036f16fc1675badf99513c33c3b7bff0c25f94b59a34cebc5873974945e14dc1d6c75206950f6ccf276c1c627e79c62aeaf367f833faee7832a9d0bc566a
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0D8U7twh0gYUub:QySzPrbpi0gYz
TLSH
T1ED066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 90a40b82c6c8e8aa8b6e3fe5d473e7c999b43a37facb9114d1754f3546698e5f
MD5 f04564987e401e25840d9fdb8b48530d
SHA1 9519d92e555c2d22624b995ac9fc2ea4854770d0
SHA512 8941e7ebb0287e83b0b6ec03a71d9a77ba627e45fa4a7b0bb6299413a13b4fa44c9c59bf0f7cfc36d6e66ca1f5b3ea215a8f6ee6f92697ab43aff3ffb7759ce9
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY98U7tTK3VnChd4Q4PQpUcrf0FGDQ:Z47JUQj1irIhCnDHUPfF/T8U7twh0gY3
TLSH
T174659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0f02fd2556d7fa22e6f4ba573d5ae21e98ff61d77478add0a0683b0cda962328
MD5 023d77f5d69e5357d686eae39e61990e
SHA1 6abf5bb3debbd169371106a33e85dc47037990de
SHA512 90b6dcc2007d88cb30c19f851e8f3b6754b7cbc38b022a53db9edd0b6f11a025b5003a5353fbc68c84b24c51aa4e7b21a90549d0b1110d507512a3da345e31c9
SSDEEP 12288:LNsfON4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ig8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1CBE4F118E39402D9D16E2236D7269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 36c24b34b0e08c276ab9f7c75fad8927856bca41274bd563d9e08e23a17afeba
MD5 376d4fe9e50ec8463b70fc85543171b4
SHA1 362ad21b58747e9c937461c81ee5a3d8c5dec268
SHA512 ef0f9571e0611a0837ea8bbc17ab16c917d013de7ebfc55502bdbfefb3f7533d44f235d8cd151d3b9a62685c977b4870bc80ad10c4e221e132349be91bcbf56e
SSDEEP 12288:eWu0cU3f/qVbP9Lt0ImegCXkdSgxN0cc266pxR:eWuNUPClv0Hmk0KNrc26oT
TLSH
T11F3529417626C74FC66D80321E32D1CCABB07C11EE44AF0773C9973F9576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d0d7e38d30fda1da6f8694be8ff8db6beb1eac0e5b31df66fe4d3cdac1576975
MD5 a234953ff557020e639e81c687f73224
SHA1 cd4f8ad920ae43e399f7c0ab2ddd57040bac5d7c
SHA512 7d95b26cccf5e09aa5d5172e56e76369b33dc8271c27e6008458cc99f57ab143e9c2c4fff7a4b19b26dfac0b04d71c4662d09972519ffbf6ba65d8f0933a2a79
SSDEEP 6144:WYRZNtBqeERrn5OchkO0Xmd2oGmwSqtMxf+B9AKSqtMxfjPvx13OVD3x7ukS:nNtAeKr5vhkHX93mCB9AFfO9Bc
TLSH
T1CC65F9415137A38FD1FA6072072A5B4D7BA4EC06B6496F26B388453ED86BB15A0FD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 65c4a4dd430ca808a991f5c0e13bc812895f629495e2cabac5ec8209e3fb950d
MD5 f37ac1e7476f73962129802ad7dbdede
SHA1 31637774d8bf6bb6e52bcae58f973816cb63b9bf
SHA512 32a50ea1aaf190513040d0fdf5b5e333e212235b25bc6a10c06490bc0c523334805780fe0e6165caba9b7795538c14f0d08054a84849a077b009be743dac407a
SSDEEP 12288:UM7GN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:V48U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F0D42320A3958C0BF2762732E53BD574E7157E745F00C9A76400BEA46A3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3a2b3a2e20fcb58b18b40263582551e692fe098c614bd99277cbaa8036a5620
MD5 baec0a9bca0fba422720d805b82ef3e1
SHA1 550f99bcbfecc5dd8a3cdd0aa2d372c59bf586fa
SHA512 b88673f8860a5995d2191f00aef56632442f84ade5f0063b12cd73842f49395e2dd1389f2347fabd097521779f733945305a0e62b1e6db0dedff799ece56bd04
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYS8U7tTK3VnChd4Q4PQpUcrf0FGDQ:igb4mBIBhGF98U7twh0gYUub
TLSH
T1CC65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 86173432661db626072aaf0ed9fbba65fe8f81c2a3eec254cfca8a66b3bcc9bb
MD5 3b01badbfaceb1bd1920da2de2444153
SHA1 c7ef016f8491fade7a69aeb86a7b30939b9b9181
SHA512 732f0e71fa5d469db98713145271f8a3d5bd4258c251324ed25a79844395f0765cebca0f74260406e668f8d60d3bb208573b4853b35b32a3a62ac6007eb64859
SSDEEP 24576:sG88u8FpJqH1bzria7/mt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:P7ZFPqVea7/q8U7twh0gYUub
TLSH
T1F935F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 c18cbe400298dd3b89d1501304ec0bcd2197ae1dea2b6647e261c71b752adf26
MD5 d1344ae93fe06efb00b2d73b0b203dd6
SHA1 79da9aa1ca1d4dd430b32b060140b4127702d855
SHA512 5b137fcdcfa9a603507de1a31401d9e8601d3b9067c2890619354ea91d09459932e0173a690a83191e69e98905141b9e500dd3bd9a4713498a5f2a4d879b165c
SSDEEP 24576:zPUr+NQR8U7tTK3VnChd4Q4PQpUcrf0FGDQ:zJQR8U7twh0gYUub
TLSH
T1C805E12E62E91CE5E676A13DC9528719F771B8621701D2CF02A0917E5F37EE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d76a9b663177333c416820f82fa6eed44385afd8be6d8f6e0881e1649caa179a
MD5 c367efb197377e449051252ce0535fdb
SHA1 8250512d1f43e4eb6ecb39f20e87adff1d0e34aa
SHA512 8538beb7cf930d03e606fb1f40f8ff9aa3f1c8c2c961c4e7825f8e16709db899155ea719138c325fe4b3087ddb225e987a54c737ceee12d4d5b90c7829e4a581
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjB8U7twh0gYUub:8G05lO43bUbpi0gYz
TLSH
T12DD5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c08dc899ae90b071552ea8bd81b9ae2d699f99d1a08466bf8fece7d85432ef24
MD5 2eaaeb7659bd3ce3a969c635e6722c54
SHA1 716cc12d5f8948416186ab8570eb29418ee0fa60
SHA512 0d8b5857dd493a1a58695a7334fcaf56da8a7d6e4a06c32e86de48031ef340bfa0a536f324299c1264342a178aa5cda5d8ac9be86930bca74f786f7b1067cad2
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnD8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Ha5POZ3+Jt2pasx2+mp8U7twh0gYUub
TLSH
T1D465AF5DA7F801D5E1B9D17DC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d5f366d5f19ec070e804836f11d6618bb373e91a5764f15f9d388f192ea53c5a
MD5 3e70d7b77934166f8678191a9f05f157
SHA1 50f6fca6e6ae238b5a78d6b3bf04987a92f57864
SHA512 3dbcb738b201779eb1545f14776c6367510542ff8cc17cb9ea17e2371334402bd0224d13a008a2a4bfd5fb136de7a905ae24029d1731cbd6793e8124489b033a
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk18U7tTK3VnChd4Q4PQpUcrf0FGDQ:SNc/zEOVHFK8U7twh0gYUub
TLSH
T1BB858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 260b8f78d476b62958b4ff1ee7a35cfc1fea1ffb113887f05c60b0d9e25c049c
MD5 6955035daa5d0a0c2514a747c75a7647
SHA1 19dcb11a0b421427c24413d157b12794af4291d7
SHA512 e8730447f4a6f420a3779e9f0e38387562d750c9a582dc6a65782490f6215c00daeae59ccfce112f83af835d01c47b9660702c10b9e7a24db2718e8b459e766e
SSDEEP 24576:e8kNvNnaFeYhJNtmZBmv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:e8MwBtOmv8U7twh0gYUub
TLSH
T11955AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8b33d6774ea5a5d159e3d46e34bb0cbda789b154880ab3ee18752dfdb7d34eff
MD5 31321cf2ded72d0ac6f18fc8dd7fbdec
SHA1 6b7ee64576a220b85d19bf327bd8eb41da132417
SHA512 186876a21ec2592743cffe2225035aec922708861510c8a4f6459e5686f024f6025d35f8f6074397be2d2f4b4b81465469124bf04f05544e0435fe9d13b5ded8
SSDEEP 24576:4D3FHshBIYQgAk8U7tTK3VnChd4Q4PQpUcrf0FGDQ:4DVHeBIAAk8U7twh0gYUub
TLSH
T16625E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-273-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/264-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/264-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/264-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1444-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1480-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1480-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1480-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1480-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1480-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1652-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1652-45-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1652-42-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1652-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1652-52-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1748-84-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1748-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1748-79-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1748-280-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2688-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2688-326-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2688-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2688-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2688-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2688-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2892-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2892-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2892-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2892-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2892-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2892-312-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3692-208-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3692-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3692-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3692-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4488-1-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/4488-7-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/4488-6-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/4488-77-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4488-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4916-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4916-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4916-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4916-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4916-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5016-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5016-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5016-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5016-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5628-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5628-122-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5628-116-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5628-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download