178a035e0caa09688795e086db7e7423e6cb213368e8d810154306864e0ef949

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260721-qv56fsxbpg
SHA256 178a035e0caa09688795e086db7e7423e6cb213368e8d810154306864e0ef949
MD5 44ca1212cd2a0fb177a8fef67a770391
SHA1 f4407023eee8acfc90949a4d46275723ae665f1b
SHA512 5c536fb82dc4142aa417c4f01e884c05e5e5f548664b3c7f8823126d2f27087b5e24620369f20ed3ab1b6fc843458570158463c0eda151777aa098904355a7f3
SSDEEP 12288:RUYJ9bixi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9w:qYJ9bOvwoUQ8qrgohJ/rciJljHQeHw
TLSH
T16AF4022075D188B2EEB745301AE4E170A97DFC701F2149EB63A57BAA5E302E09D39773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5192	elevation_service.exe
788	elevation_service.exe
4076	maintenanceservice.exe
4240	OSE.EXE
108	PerceptionSimulationService.exe
2492	perfhost.exe
5984	ReFsDedupSvc.exe
5704	SensorDataService.exe
3392	ssh-agent.exe
2248	AgentService.exe
3884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bec3e25d238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099d1e12a1619dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008bd42ea1519dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dcd20ea1519dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c598a4e91519dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000734ddd2a1619dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5192	elevation_service.exe
5192	elevation_service.exe
5192	elevation_service.exe
5192	elevation_service.exe
5192	elevation_service.exe
5192	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2248	AgentService.exe
Token: 33	3884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeDebugPrivilege	4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4792	2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5192	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2156	3884	SearchIndexer.exe	100
PID 3884 wrote to memory of 3740	3884	SearchIndexer.exe	101
PID 3884 wrote to memory of 4836	3884	SearchIndexer.exe	102
PID 3884 wrote to memory of 5460	3884	SearchIndexer.exe	103
PID 3884 wrote to memory of 1652	3884	SearchIndexer.exe	105
PID 3884 wrote to memory of 4588	3884	SearchIndexer.exe	106
PID 3884 wrote to memory of 1164	3884	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_44ca1212cd2a0fb177a8fef67a770391_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:788

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2824 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2824 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79013f284e2d888e93b641b473389e9684e49ef50aa8352ca71108ad21e5f950
MD5 af05c20470394e03bda46f01777a8541
SHA1 390ab4583d4a24b37a1cd7a7021498724de9622f
SHA512 638e8bd67dffa237acc3ad47efad2f3d660fcc5aaf3d79e96af031ce3156137bb0298f965b7f6a386574d671199e96066eef5d21a429265dcfc6eed77f33c0b4
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOvj8qr1JzvwQ:w3q6HjBf8qRJTwQ
TLSH
T1CBD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a9beac3f5b09af04113d0fdb5629b46a71dfbe7dc6922517e6a59e86c1b49a76
MD5 67fc5a15572ab11d71607c153f13eb08
SHA1 577fcd333fa73bb4cf769fd5854aa0b2d7e037c9
SHA512 6ec1de267ed13784d4fd71fb3ee3a515a36fb50f62626902b0b8f758ccd644c37af8430e406725e6c317c2c024be22255c30c968a4eeeaf21727d19a69904906
SSDEEP 24576:8XYfDtczAHvwoUQ8qrgohJ/rciJljHQeH5:7tc0vj8qr1Jzvw6
TLSH
T11805F128A7E408F9ED67827CCDA2C411E6737C504760E79B03B499665F332E85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 dd062bc0c3343724ec96de66b72e3607f644d0b9f2199502f6f4f4c46059d398
MD5 f6a43d7e82cee10a9af3a7852c51c8c8
SHA1 0c44333ee0323d85d4df278326eab903a1d486a5
SHA512 bb50e4f62813054c3ed100c2b69557e968d9feed5987944e23c007cb5832907fbfaa1645ceee14e373557e2a9200a449944019e6012795aab683adf9f835bc39
SSDEEP 24576:j0Le5ji0hmxirMGvwoUQ8qrgohJ/rciJljHQeHb:jPji0AcBvj8qr1Jzvwc
TLSH
T1E835AE16F6788731D073C0B9C5D2A69EE97130811B308ACB4296D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0c8b1146eff23c5b8613bab2f755f7a994d0c0275bc685de0b78d1c90c6ca38
MD5 ebdbe1bda87e740ea18cc1ab36b674c1
SHA1 60e0a7815d3f92d26cf1c42535cdf1798f41c54f
SHA512 c44f1caba515303d011dba43cc25d1d99bc6d3f087ba145c1ad6628dd93681cbf2832ee37082f7fc4a3f5efef6757bb106067e11a9d79a4ee6c3de3b83d86fdc
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuEvwoUQ8qrgohJ/rciJljHQeH4:F/ezSC6vUzPvxHjyFvj8qr1JzvwP
TLSH
T1AC756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3fc110eb0142366b6f40ce3f6fdb49b13fd9d7b190ca628c926c7138268b3687
MD5 b64a752ac7d2fb64c3a4f35ad0ef8d40
SHA1 1712bdad6c2a4397fd9827f961ceac80ffa0c685
SHA512 f27f4e3d0c3ca044e8eaaea53bfd9dcb9119ab54dc53ececeaea0bb2c11b038904ee379aa41412277451962942039313a38420badfa2310149f69ab5e6a6f286
SSDEEP 24576:7VbqPb88hv/l+6DvwoUQ8qrgohJ/rciJljHQeHM:7VO88hXl+Kvj8qr1Jzvw/
TLSH
T1E6559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 349e16a35385c17125d993a994bab4cd33a7af36ebdd943c9a443b1ef069f7e3
MD5 44b3f830cea56569f338cde4db5e124b
SHA1 96ea528dc0aabdcfc98d93b2a8e93def6e08f00f
SHA512 c3e3dc4fd4d889a1ac019890180e7df86040890b4cf633f1ac213749056fba3740065edbc042668dc39adfdcc334a996da2946f109d8f76ea899c9bd0f7c59c2
SSDEEP 12288:rRyi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9m:rRyvwoUQ8qrgohJ/rciJljHQeHm
TLSH
T168C423848D7C1DA1FFEB8234BBC2E0B475C9BCB068A65A374371BADA99311B1DD15231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6adab595c90d59c19fe80cd4f834ced6e222fdca761adea227226e1763f012f0
MD5 4c20ddeb91fecb49fb16205383817e37
SHA1 b931358bce62f1ce65859da81f0c71e81f296b28
SHA512 870e269295bd6741c3cfcfc36288ac4e0635eee62f2d53441ae0cb96e376e4cc8841bc5c79d6536125785a36dc39f3a24579fc1f1674d50cd28259df00b0c019
SSDEEP 12288:IeBNUbTVO86U7i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9I:IJIU7vwoUQ8qrgohJ/rciJljHQeHI
TLSH
T1E905CF3BEE38FCD2C67A8D785B91C200E7A278704B6293CBD175824EDE235E15E75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 67896b91af6cafb312bdbfa6e8eb002bdc9f608e6909e57bcf75c31f6d79c42d
MD5 fd01f8974ac81edd98d4a5eeaefda162
SHA1 139bdb59c77a122a60f712d0c29a9e2459260341
SHA512 66d757c595667cc831c5f96afe85778fcd6cbf1a9df18164d7f7fe1432305c71787e1f2df79c21425b9dfc321813d1224b326efd720032a1675868c857af980e
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:PQvGAdlCEL8c/yRNw5CS8qRJTwn
TLSH
T19E267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8606472e359e98979638e02563badfd4ea2fdbd1f33018e3b59ec795a3438bad
MD5 ca3d620f34c7fd4ada65d0673f1df235
SHA1 133332a02e8bbe05a75f3fe901680e4410793bf1
SHA512 713aa72be0b1e52695e8488dc5ab256ce4f43ab33c6085504401b510e8ebff83a2a92834b8e3a2b123e1cd48ac022d049a40acfe385e5d573e6dfd197bf1d29d
SSDEEP 24576:FdewsAjRvwoUQ8qrgohJ/rciJljHQeHZ:rljRvj8qr1JzvwS
TLSH
T15015E031FE74E432C7BF0DB62B62D316146C79604B611AC3E3B89E9E59301D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7304ad69f8b91d1dc2991cee24e0e203a0c487cbaaf294b3f480f3b1ad2911f
MD5 b6692ca920090b9d7044c1f8c11b0815
SHA1 8fb579f47562268f57736f4c27e7b856855b2f65
SHA512 c0d39d233c87e428cc76d63d0867bf533c8d3e6451805532d119cead8fc73b146d01e4bc5239cf5fd4050ec9bb71e596caca9092e753c8ea55601f3b3af48ea6
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZf:kUEtQevvqc2W1cpV2EI32Z
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 311186de3c43d2b0d8a0222c7ac5497398c813598f3571438f54243849c0955e
MD5 789323f501d3c83b1e1353513fa8a210
SHA1 b134fc15f1ebe095eacbd8e0064aa20c07b545a0
SHA512 e05008636cf6b8ef83b5b7564738208c5b6c467273eae17b00ff4008c2aaef75d15f6a9c29f06d6acf410dcb3b6eb02b8ad3e81766f6b49eea4d539e6780a664
SSDEEP 49152:4CbRquA/m2yL5zifFiV+XenmE3/zxvj8qr1JzvwY:xoqHVjnmO8qRJTwY
TLSH
T12BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2e8d50b377883dba55282664aeadd29935b4cfc16911891c160d4feb83dc656a
MD5 d1dfd818d46071559072e213828ddc0b
SHA1 f092dca52ef4b1ddc1568467b13288eb04b793a2
SHA512 36a9aa5b95089b4617dfec65ed3e382823235dced6cc2980c051cfef3d6eff9eed77bda432dc81619994c6b6c7f34cb35251d5c755493b2b0c7b85f18af0ea8b
SSDEEP 24576:YAhGLJIFoiwtA5l7S53ovwoUQ8qrgohJ/rciJljHQeHm:YAMyFoiq5Yvj8qr1Jzvwx
TLSH
T16B359D80EBF955D4F5F39A78A9B69070EAB6BCA55E31C21F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6d180694c0445cc80cbcf742ed06f5e05971757f2d8479afcd504127de67cf85
MD5 db72358d219f136238dd690be41f2e9a
SHA1 eae5a51b28897de00405c62fba337536119406a4
SHA512 fd607682092c8b8c58122d7158eaf55f4003a44cffc4d71b36cf7fff72c56a313b3d02dc769aec849c70bf8ed2f56df8068f5053ad144114c3b88be884d2a9ca
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+Cki8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHt:7wuoOWlvwoUQ8qrgohJ/rciJljHQeHV
TLSH
T15205F14566A81CF9E9A78238C687D035F7F2BC112A25DB2F1770C65B5F33261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ce94b2f716111846f1386ff7cb2526666d921a16d534e97564b5c5082675f5c5
MD5 16b9eeccc97f9810ab655c7179312892
SHA1 1030497ff89b0f8f5696944b4f5487332820ba0b
SHA512 b9d2ed03ea314f05ae1dc4a6d7a401e025a1c3bf30c5c706e7ca1c1f39a613554e15d130128c17d1a1014aeb89163d465a51f2602b3323ea54c4b743c26c9b7e
SSDEEP 12288:7BZ1Iyhi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9b:VZuevwoUQ8qrgohJ/rciJljHQeHb
TLSH
T1D0E4128926F824F5E6E7823CDED19054E7A27C60277243DF027166AA5F33AE15D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ec1b2c42576f8f73c744d910790a7231f9a28c9b8e8009b42612d0529bb9f438
MD5 77048dfa17f1b114f78161bfaa1a06db
SHA1 64dd6cf544e64336b337531aae65bf4ab9cd91c6
SHA512 fa4b032820ffecf761323e5fd2d8b9b6df0d017c7f5cd0275f84580480ba41fef61718ff2b2a57896ab638e3aeb739670c57a603edefdd3436084e9f2e95b32c
SSDEEP 98304:XQRQyi36YOcPQLvw2gAf+PN3z8qRJTww:GQyiKayX+PNzf
TLSH
T103667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6c362ff68d65254c19fd0508d4b7c5edda6e10b16b960f5963638c5cf59060f9
MD5 7ab1af1a96c47c62a677a682caedfc85
SHA1 4135917cc824bceef3e92394b09edc3b0caf2547
SHA512 fe8df1cfccefb34c0577d4d48949099d1fbbd4b09a8a5d732adbb183268b515b00442458c2a78b2ced29220fa42d324b556e4466159858f1558b6c535a441ebf
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3z8qRJTwT:rQyiKayX+PNzf
TLSH
T111667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d32284e7deb547b7857413e603710997c663e9b42b019e2d18088e83f496015a
MD5 68d1786c247dacd439d860a2d164d8e5
SHA1 c66827812d0b68dfcb268587edc5c0f21553df57
SHA512 117d62c93ff666b7bbfc805ec5a01b27dc99654a1094efb50c550c7b305f23d1083d3c22e27be05580852ce4413c52e15382d285b735bdbbf39e94925036b510
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0OvwoUQ8qrgohJ/C:r68Qg55nhheWu7PNU3/Bvj8qr1JzvwP
TLSH
T117B55933B2F600A9C44DE1769F46973196D27C718FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 93037b86c8551a9a49e3f16dbd67a5b8098b198c6b18e45a97130fcb11609080
MD5 e5ec648b09ff97d0ddf40c906b3bea42
SHA1 2b191a5d78a1005bcc3e0a34b9683c1496eb1b25
SHA512 a7322ee7a42871ec9c3adf040f079714118af581a08a1557e588fd46ff4fc47535f8c3d3f2a52214cf3f11b3f117329871081345f4821dd70e821027edfcbf3b
SSDEEP 98304:Yy5112gYy5azzVvL69nLKnhZc8qRJTwh:xLIHmWhcf
TLSH
T1C1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 28e1ba458d839b2b08525dc218bdc779b0dca0c15f374df0ab8efa705457ea87
MD5 82586139a45a2bfd9b428926d6bdf319
SHA1 01a8cff8411135597ecbda98b1fb61a4a4bd08af
SHA512 fab85cd8bf689b63ae804bfd5b4b12cbc88b36f879fae2e54f1353ccf51ae4d1fd5ee28e6a622b0c15bf4344b56104804bc4fe60f0c32fe7e9b0a9449dcfb221
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3vj8qr1JzvwG:Au6JmVxd2d78qRJTwG
TLSH
T136D59D13F1DA01E8D06ED478974A9232F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a0e985c8421de154453f9843c09da5eecb98a4567671d7079ea1083687b87442
MD5 df614e51f36200efe557896a1d45799f
SHA1 3ecd9571276a109b4ffc822092d6ad8c31d0aaeb
SHA512 6871c6b9002a4a7d45d5ae5d57aa6ce7a33390af84dcc382833d65a883c049af588bb8d4031f288047743438709fa298779d209cd875ae2c97a9b02c2357b4e5
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xbvj8qr1Jzvwz:jmifPbRO8qRJTwz
TLSH
T167B5BE13F2D901E8D06EC17887569232EA62BC450B35B6DF0A90B7961F7BAE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f7650e29acb7cc231407497121a28ee910faf907171c09a4f16d262cdd862e6
MD5 62acfbfabbbf4a6e5bf86836083b2417
SHA1 19c86d0176dabe70e65b4912f5f1e02dcfa27b1d
SHA512 08b137f008b1df2834ab20e7df88405c52d0bdfe6e1f09594ab771f966bbd50d50d2773af15b3ae0bad97569c04d6f7bfdc3ca7152998c50a206c816cf7638a3
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqevj8qr1Jzvwx:s5dKTi61g8qRJTwx
TLSH
T1C2C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 af565a094ffcc39335b8fc88dbf15cff217b6621863f9353409cc27998cb4986
MD5 38b293222b892e403ef6b18b6c7400b2
SHA1 a5b2eabb15f6e80002254bfe6747df1b77bc10fc
SHA512 2dc84ef033b0659dc3ab09b9e06f5b5d786d5d78cb82a4a9e45bf9f769a167b4c02bc4ba1da7c3bc6e30deec154d939e419236a68dff6f67dafad4ddbbf3645e
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wHvj8qr1JzvwS:XX2iyphq8qRJTwS
TLSH
T19395BE13F2D901E8D05ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4f38a248e4193830afa3fd7cfda0afa1d4742efff4f47c771c58bd5611e23721
MD5 9a4570bcd17199e218d4b056148e2d60
SHA1 e2f20e56716b201b8bb6ebfcc835e3d07ed70fab
SHA512 938b80cfcb8d821e852ad6e68407c5d133e23cd2506ea790158ee7e183895cc62fff3813012db14b008014ee6d6b641ee9bf54807c0b7e435a89dff1bba06bc7
SSDEEP 12288:TKi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9E:TKvwoUQ8qrgohJ/rciJljHQeHE
TLSH
T176C42384CCBD0DA5FEDAC274BBC2E0A4B5CC7CB078B6167B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2f1e8af53f12e15459432a23bdf95d4106c737336dd353b490840bd51c6e16aa
MD5 31e207d453e80efb01616ea3a61642c7
SHA1 3738fdfaa8e7635dee3af2e47b6d7bba303817a2
SHA512 d6dff29c16f5ddece95d93095d629c494f6ecd2746dd689542e7987c731c0872ddcbc81bff1df8f741870459987221577441ace74abcdc719e43553a1774edea
SSDEEP 12288:bNi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9o:bNvwoUQ8qrgohJ/rciJljHQeHo
TLSH
T109C423848C7D0DA6FEDAC274BBC2E0A4B5CC7CB078B6177B5376B5969A321B15D06230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 11cb97fb2651f4412a6a8fbc0b7d49f97c72ade4a583d85c95b1075ea2a2f40a
MD5 28291285422c760e0b26fe5f6af20b6e
SHA1 e4295a94021ecb24aec3c43817df18937ac5d5c9
SHA512 8a55458ccef073f5e62d18bb703d750570efcda57f8cad02baa72ae71ac1ffe2a1e6f90ae31908900d78a1648cb6b6f0549c6963163cdd07219d77ea208ae115
SSDEEP 12288:qzi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9o:qzvwoUQ8qrgohJ/rciJljHQeHo
TLSH
T10BC42384CC7D0DA6FEDAC274BBC2E0A4B4CC7CB078A6167B5376B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 584475a3b93f28e3f8b28a86fcec4630ca744fbbddeb2f3de7c81d337fde30de
MD5 331f4f9d213a4821424e435268bdb673
SHA1 f4a06bafbb4f2ad8e9e1da01cfb93a2c6315faf3
SHA512 81ca5fb7412c8959bfd4bf1b8b427f4c4cf7d502058be126db03492062d1ad23c75114c93975d34a6f565b6e01b7c26e72bac1838649ae1ce0ff80052020e498
SSDEEP 12288:GVIi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9/:pvwoUQ8qrgohJ/rciJljHQeH/
TLSH
T14AD423844ABD08E1FDA6C278EAC2E064F2E9BCB0757257BF5371759A4E322B05D25730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 173bd5d237e4d7a0ec9be378c2a1307be8348016bfcb9691800bafbcb0921b58
MD5 a6cd86091668c2f017b1af0f09e77a9a
SHA1 294f5ac7d5c8b0e07122de441435b8c82ac08d03
SHA512 d731da776bc5cd14b340f94746f2e6017d365bcb240bbc90b891ddbd31bb90d37982f17abebc6b44f2f0a4d399022ae862695ddc433ff6bc41dd05dd5c4b1ad4
SSDEEP 12288:Pwi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK95:PwvwoUQ8qrgohJ/rciJljHQeH5
TLSH
T1FEC42384CC7D0DA5FEDAC274BBC2E0B4B4CC7CB078A6167B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e41ea9648c744cd8ce64828e4742cff3dbd98b39267ae484b4c4beee580955f9
MD5 704f7e911e2d0e3a5374c66ff7d200a2
SHA1 55b1983aa867894b5ca2d71ad09ba968f26e0c5f
SHA512 71aa367ece3b9b51bee93fbf2c95e6690b3c60d58c4d1e558586d64218d63317a25a225b9886d47bca5852d699374fd7ecd16d8471cc2e3c73d14530fd60b49c
SSDEEP 12288:eJi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK95:eJvwoUQ8qrgohJ/rciJljHQeH5
TLSH
T15AC42384CCBD0DA6FE9AC274BFC2E0A4B5CC7CB078A6137B5376B5969A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 8ff6482f8c856994aab5df160a9c725ee058701898f9884e3436d12af912a6a5
MD5 0b09122070d176a4b96eb2ce5720ac3d
SHA1 acf7de570594607df7ec782673cdb9e2a636a9a1
SHA512 434b501e11a7d1d12f0d0fde3ea1b63a84e46a53e8f2258ed37c8bbe46469ba3cc7eb8d5ab3f997259509ea3b1da750b6d3a95847acc50eea2ce0c59e91f677c
SSDEEP 12288:kVi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9W:kVvwoUQ8qrgohJ/rciJljHQeHW
TLSH
T119C42384CC7D0DA6FE9AC274BBC2E0B4B4CC7CB078A6167B6376B59A96721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 02dbf13eac638de2ae59a09a48527729efaa6ec2181d0cbc90ba965d05e54dfb
MD5 ede280bf2712f3294090502416664a68
SHA1 b2c29c17bbeae9b7c345d0caee195be5ff8762dc
SHA512 8a457dd7304c6f2cdf29198561aa598ef4f0de5820e7d4ee942fb73d15cf3cf7b579b6d2afa572b26925dc7d19dad05200841b3749fb47ca73c45e24ace86e49
SSDEEP 24576:dZMSzFVSOtvwoUQ8qrgohJ/rciJljHQeHV:dZMSzfZvj8qr1Jzvw2
TLSH
T19E05F194B3A41CF4ECA7823ECD529815E6B27C651A70C62F03B4366B5F333A11D2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 4ececefaf9084f99a1dc425fb2d3bd7843595ad6cee5f139679e461343908c72
MD5 bb2d318d4d07196190c67902eec0a768
SHA1 97e5dba88701f0549269e0f453563a2dfaa7bcff
SHA512 96ec493da8ef39094f531dd81894281ff5cd024e67c32584bd52003a000000420baf9990740c23e75a8f45b1f53f3be149c67627e1bfa4d4a184e9c7db5482be
SSDEEP 12288:Oui8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9R:OuvwoUQ8qrgohJ/rciJljHQeHR
TLSH
T140C423848C7D0DA5FEDAC274BBC2E0B4B5CC7CB078A6177B537AB59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b4cbb348bae0cfd23d785ef5ca768eff99409ead928e7dbd98139101cd038154
MD5 c75b598cfb60a6bc1bb21f5d67886143
SHA1 a2c979a38729051542c5a162c9e70fc49d7fd86c
SHA512 7695f97d181dfcbb6031152708c55e41c1f95bdda8c4f2fdc63bd09baed8c3196679304738575793f68f6e73f35def443471a6f40c905d8b8f3561e05e717fa2
SSDEEP 12288:vCi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9O:vCvwoUQ8qrgohJ/rciJljHQeHO
TLSH
T131C423848C7D0DA5FE9AC274BBC2E0B4B5CCBCB078A7177B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 19ce8ae922bb295e4d010cb01e128eb567f602a7e97103017fa1ede6451bf31f
MD5 e9dc851fbbffcc9072772fb427ab125f
SHA1 db8be6bd60a5abc48cfaaec0dfede7511307a4da
SHA512 8350b70af3b4ec854d2d5f03b0d6075c146c1768e8f39986ca5e12ca9ebc11f5ffe586e80a75f1e93e7a8dc0c84b4c209c8883b976988039a3c36ab461e33708
SSDEEP 12288:9yPz5L8hi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9u:0zyhvwoUQ8qrgohJ/rciJljHQeHu
TLSH
T101F4014766B520F9E5678238C9925511F3B5BC701B218BAF13B457BA2F332E19E3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 58c8eddd7cdc7f7a07b823be5a10800fa91bde514dc26bd62a85278278732095
MD5 1fb9b25b17e1dc26eea125f1731f8032
SHA1 6b2b011a6168a0f71f7468de2333e0d160f353b3
SHA512 bfb2741a66c6563ef870c8a7473d657426de6d0d244d04a151182b6537fd7bbb817662d3d31172070a4ca5e54de624021c640a2bbaef7fba9049420504354c9f
SSDEEP 12288:zui8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9H:zuvwoUQ8qrgohJ/rciJljHQeHH
TLSH
T18BC423848C7D1DA5FEDAC274BBC2E0B4B4CC7CB078A6177B537AB59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9e977ffc5bc9cd197ce78d0c674f3f2f6c51b0d2ac0f17e2375624f6ef261c08
MD5 34abf162e013b8b49e7bcb9468b53e12
SHA1 cd27dd86accaf70adff3b577690bd813b36f7b26
SHA512 8746c411321157c1cdf314a17ca1878092c0e67c488536fe070df17ec047c71e3ea95c89512a6799cf2f80acdf6f79768e450fffa42d8cfa9708fa5e6ea970d8
SSDEEP 12288:gui8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9z:guvwoUQ8qrgohJ/rciJljHQeHz
TLSH
T133C42384CC7D1DA5FEDAC274BBC2E0A4B4CC7CB078A6177B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4015ade892bcb0f588f8e3956208bbddcc3362c27523f6b91289e18d2d290903
MD5 6b1dc856e84531602c6ed4e4444295a0
SHA1 670896990d9fa4bbb49313da2295335786f2ba3b
SHA512 abfe2a08c1730d450701fc5a4244bb5d19c74022904bf255654c18bd53992c79cfaf3e4b2e3ef596ffc2682d4a1c029ec3595d013fad9a22acf003a96e7daa2c
SSDEEP 12288:vyPz5L8hi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9G:CzyhvwoUQ8qrgohJ/rciJljHQeHG
TLSH
T160F4014766B520F9E5678238C9925511F3B5BC701B218BAF13B457BA2F332E19E3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1b975e90018fdf015431b8d6ce270f9e403938f1a8447af402e75bda62e174a4
MD5 c0247c4c92556e7b220f85645ff9bece
SHA1 ea3e5aac5013391265fe07c16da26fa17b27c1eb
SHA512 3a42f22667a84f16834918c4f1f5bd27a70b50898b2fd4b32eb66ec43b81220177c646c14016911ecda0b5215be1544aadfe8f207a3c630cd9e8389ec3e95d1a
SSDEEP 24576:3THaLl3z0zDjvwoUQ8qrgohJ/rciJljHQeHe:3T6LljEvj8qr1JzvwZ
TLSH
T13105F194B3A01CF8EDA7823ECD529815D6B27C651A70C62F03B4366B5F333A11D2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8097f14c095d249792d7a5a97abe2969a8df961a3a23a3fa103c38980266d4be
MD5 2fcb07a10987a2fa7d411809e3bcffa9
SHA1 4a6aabb8cf1cbaa3ff7496b24adb7c9cd0be51f4
SHA512 4dd44e2675097bae4014a5d7385ffb6ae0ddbd4580d99de3cc9960e7700004c1c850e97764d1d5991f317a1170afc06c5820f618f6873af174f876ab0db93d6e
SSDEEP 24576:P37d9CHKy7GZ/vwoUQ8qrgohJ/rciJljHQeHO:f7d9CHKyaZvj8qr1JzvwN
TLSH
T13A25CF90F3E814E4F1B7CA358D629511DAB67C991B31CA8F03A4665A1F336E18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e25114db33ae9498fd60cd5c1577c4cec1b4287244fd83ad7e95bca99d64604b
MD5 2fa2593be4174ded2f4ccb689d5f9b80
SHA1 91b787cb30ab2d84f05acdd2cf76edaf3ed450a5
SHA512 4863ce514fb77a7db87863d2cdeb451be94c919984d33624801ded09feb54e8efc5943d6291fa607eb5466069931aae8dbf30f17c300d6ebba0e993cdb242173
SSDEEP 12288:HTi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9U:HTvwoUQ8qrgohJ/rciJljHQeHU
TLSH
T172C42384CC7D0DA5FEDAC274BBC2E0B4B4CC7CB078A6167B5376B59A9A721B15D06230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 51e20f2c6f3750fedbea59e3334e6fbf89efc177d56e34a2b6ab98cf27b9723b
MD5 4db9a1c2a6057dd647504b92ba0b9f03
SHA1 0b96db9637eb8229f5c2d5ef5e1d08454a47a7be
SHA512 7408df60e27e2b01456051970a809ce8c0427ffe007e2f4be1b456608d7362f6ec86010b0ad23b53a6dbddb80b109d74182f30266ea98cf19df517040199698c
SSDEEP 12288:6Bi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK95:6BvwoUQ8qrgohJ/rciJljHQeH5
TLSH
T145C423848C7D0DB6FE9AC274BBC2E0A4B5CC7CB078B6177B53B6B5969A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 cdddef75fad58f4e3da81a2abdd2b160b16e983b7cdb1c34c4d8b5e3c6105370
MD5 be54c7834dd4808126e11c4df534d62f
SHA1 019de7cb51b99aea2fd87e0ac766621cf61dc0b6
SHA512 872bf86c2cdd4d02c385a2d918f1c32214c22938fc801e9cc957b8da29784500011110bfac8dc16f117e8d2484ea9ce1dc8b884cbffc82d8ff793a2f2b0e209e
SSDEEP 12288:CMi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9/:CMvwoUQ8qrgohJ/rciJljHQeH/
TLSH
T14DC423848C7D0DA5FEDAC278BBC2E0B4B4CC7CB078A6177B5376B59A9A321B55D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c6449bd2cecb40e000241724744f09962c7d3b5e3124fc176976c58e2ae87ae6
MD5 aaf2ccc885e704c70cd3f868982defc4
SHA1 89cecd58da6a45e572540c5ba4122e46b858155a
SHA512 55f63e587ec7ecdaa1c2d0a36df39ceb02e10d384dd8b60090193d7b3ec2dd3f5c14b04ef9c0f737cf1eb420d809a7330a747140df3a5e1fbd4b6f8f5089002c
SSDEEP 12288:Pui8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9/:PuvwoUQ8qrgohJ/rciJljHQeH/
TLSH
T1AEC42384CC7D0DA5FEDAC274BBC2E0A4B5CC7CB078A6177B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 12ad86d6220a2faa0e9c992507dae32fbe25b9b8a5df66bf0a114e118831a683
MD5 d91e58b3e45c668093dbbe4eab762d20
SHA1 647f1ca7e2b11957f5058b0803f6dc85603237df
SHA512 50809e3bb35065ff64dd70ffe5566fe4e4b0056b5042d9ae64a9576a0d44f872ab69d30f0ac1353222b6682fb4775ae38f368e5c2d247883979cbdbcce7986a2
SSDEEP 12288:NTi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9b:NTvwoUQ8qrgohJ/rciJljHQeHb
TLSH
T183C42384CC7D0DA6FEDAC274BBC2E0B4B5CC7CB078A6167B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4025a25020a755551d49ab091508163821775c56bf2951a789dbf980be08b4f3
MD5 a2f3af98a4a280063747d44002a3d43c
SHA1 501fb8d3f3dcbd5f3f2c45b1bdaf741c80caf7e3
SHA512 47a9fd22ea647d4135545be80633d10649b05693e7aa9665d32e3cfa01485a5408eb67539becbea67a8f539453c479cfebb738267014762e32163370d9a0735c
SSDEEP 12288:B2i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK95:B2vwoUQ8qrgohJ/rciJljHQeH5
TLSH
T1A4C423848C7D0DA5FE9AC274BBC2E0B4A5CC7CB078A7177B5376B69A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0ce586a50c20f6f1993a47f3d4644428f5182f250d803c89397f3b8d63152958
MD5 488d3fda8c223cb7698c7201d27719d5
SHA1 3947a8fcd2a20ef5d404427af3aa5aa8cf728475
SHA512 64651b56ebcb233574343e06e942033834bfc135eb1e1693765f9c367c518749fa8a89c82a34774e888010a453e920e141e1a411c77f7c858929567fec04a331
SSDEEP 12288:4wi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9l:4wvwoUQ8qrgohJ/rciJljHQeHl
TLSH
T123C42384CC7D0DA6FEDAC274BBC2E0B4B4CC7CB078A6167B5376B59A9A321B15D15230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1a49ac6d6045623cc5356be4db524e2f8ca4cd13e3bc57cf2426ea4aa771cae5
MD5 b9ea1a59539600da362bf89924adef84
SHA1 efa5bb3ae5a662edd6c6524ca610a9c4cb93f09d
SHA512 19a5d33ad04270944d91704ee4c8cc651304412b121b7580afd995635d5df86a40b033fb2703e0839ea769ee76447d05cec98f77a783f6cb72b76ac64fea61f9
SSDEEP 24576:bfwvok9RX6wkyAISvwoUQ8qrgohJ/rciJljHQeHr:9MnYISvj8qr1Jzvw8
TLSH
T17D35C029EBDC04E5E1B7923C9DA3460AF6B178681B31C6CF125A53AD0E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fdaede9ab1606bf475c6b9b5f076c3015f5acb331dcf8900b98b3ea8ba459306
MD5 9e623d676e2da1c50041458113263107
SHA1 c7c0a6cc07a62bf9cc27f9ac92c0be2628af1f4c
SHA512 2bc1a999d4b0e59950ff9607b5bced168ff20a1ab70d5a5884c1f701f7dbf17dd86f660d5c1149963cd704afd673446771977d47442c0138b2a41d4e9216d6e8
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nvj8qr1Jzvwa:uySzPT8qRJTwa
TLSH
T13E066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5dbf211c98ed6689aa7c6753342b9ff1f2198a2ead2c5d2810ae7f23b6efb5a0
MD5 2e7b2fde7a72b5fb0c503f85d1ac6e28
SHA1 fb3813936ca44f8aa5efbada2ffbce097417c625
SHA512 217c112ca63175b5c429058e019efcf7e9c6293cb0455f3c12d06757faed0acf2ad2a46ec490518a69e071967d6cccfdd1983518c778decccdba46c40378aae2
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9vwoUQ8qrgohJ/rciJljHQeHm:M47JUQj1irIhCnDHUPfF/3vj8qr1JzvY
TLSH
T1DE65AE1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8051d6aee0d6920786a572f380854d094ac2e40de3696a6fc4c287986bb84927
MD5 3e1b716f150ee8b9cf64367bda6d6ed1
SHA1 1215460f74f1f46a72007f95fc15550b214b6a8a
SHA512 fe234c20e3c878746e2841f1f468f3f185ab68172d75f38f76f7cfbe4c8e823d22b2ccb2bb7a8eedee26139f699285d8c8255bff8a53677ef89b1a5a05717125
SSDEEP 12288:7Nsfei8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9K:4evwoUQ8qrgohJ/rciJljHQeHK
TLSH
T121E4F149C2A802E8D4AE9239DB829540B3677C6057F1D3DB53E0F57E1F362A05DEA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a98adcf712d1924123efca55d496225e052a327fa7e9dfd10450632aaf65e70b
MD5 26b2b9380fc737bcfc97b3e8fe1d6760
SHA1 14d12a62082f375bf78b08242c49ed45ce6c2f62
SHA512 3ac9e2b8e8a6c4cdbff3d480e534ac986c19e53e1a583051067b1e0f72634acc8108fb1c0f8b19c8740c52bd68d902f954b8160e3038227343c3d345d6fe884d
SSDEEP 12288:FmjlRcy50uodcT0dQQ30oOkXLvPhqaRMWoHTa:U7chuodcTMZXLXhqaRMWiT
TLSH
T1D4452851766AD75FC6AD40325E32D1CCAB707D05FE056B0372C88B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1573a87777214acb2e5788f69a43ac6e0f6c390546bd9b97172cccf1552b78ca
MD5 40ab3e9ec4a90abebfcd470fe7ab9006
SHA1 e9aebcd44c50c3998e30963ee0b6d57d0d0f6472
SHA512 6ed2794dc59f82ff35f5cbf3ce71cf077564077fb50e7a5e26455d80141e898fe9634efd3b5941e5751a0d2c020ba0a4d80da4d8845419a4195486f93024d609
SSDEEP 12288:fOCXepGFcJLuOcq12JSkEHt1UYQjHYfsLOeo9JELyIDRWYaCOax3lAZ2l:TFcJLuOcNrx02l
TLSH
T15265E8816137E39FD1FB5032073AAB4CAB64EC0677056F2673C8453AD866B25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 50017990d9dfd0d8320ac582e2991b56f1f6b8a244b6c89aa77c6d381edc13d4
MD5 2d7fe6e1bedbdfaa808acd7e497ee26f
SHA1 305c9ea3edd8e7f0b03fe2d2c0e69c8e888dd9f7
SHA512 9d19b871570d20aec5840b096c6190f15bd168c31998630f5cddd00c0056b72517938900043f0251dcb699be4d5609fa93e75fde232aa340d42166918dcca49a
SSDEEP 12288:hz7mi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9J:5mvwoUQ8qrgohJ/rciJljHQeHJ
TLSH
T1DED423908ABC1D61FDFAC2746AC2E030718DBCB06B6152F7A275B6DA9A315F18D35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 754ca61e96ecec5e816f224c076c761eb9179e0b43069c2e4b6a68f03b4ff499
MD5 537f7f4baef315a580eb4c4c795d481b
SHA1 d9a623477de2708ea9a3757280edbebd98b83f12
SHA512 8e5961bbc520020581374e22c9ee08be02b129430cf2c95720b641a232382e26bb9e00b4069c05f9a19fdf405ee09f2100a0130295558e14ee84817cd1a12a7c
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYEvwoUQ8qrgohJ/rciJljHQeHo:Ygb4mBIBhGF9vj8qr1Jzvwv
TLSH
T17A65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 45d948239697ecf4fce618e1b9df58f69ce721164dc514b40c14de4b605d84bc
MD5 ef141d291d169cbd9cd445c12d3d41c9
SHA1 0d66f0dd104c2216665b2cefcbd8ea53daba3bdc
SHA512 f8672258d5ea2ddde7e8f3b27f6326d06a2e3d1dcdb557001a531c7ea595f9055f1ff1ffcc2167c8f0556d1fa60266959de10bb5905c696459f0ff8d408bdbec
SSDEEP 24576:EG88u8FpJqH1bzria7/mtvwoUQ8qrgohJ/rciJljHQeHI:37ZFPqVea7/svj8qr1Jzvwz
TLSH
T19935F16566E501F1D47BD1388A824663F6B2B8201364EFEF07A88B551F336E54F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2a1e4075cd6868d2a2a6ca465332e6f9d4a475c88661bbafdc6e83fddd42b5f8
MD5 f4a30883622831c453b295013de22f2c
SHA1 29603ad27b0dab3c5aec92e9fcae56754066629a
SHA512 f2dd1d47da5884acedea6166bdeaf7031234ef9be6bf273c2c57361cb59badf6fb63541876122fc8b0703440a19270df3297f63a772911b1671d94cfe5d2c968
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJvj8qr1Jzvwy:+G05lO43b08qRJTwy
TLSH
T191D5BF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 96f99bc10f0942bc26d4aeeb0d1241477c828671413043bce76c91a1de25ba9d
MD5 dfe91d7e64cf0c3fc9db9e909b74e069
SHA1 19c5f93d78ac74e17dc48ebf4081e481d796a421
SHA512 3aecfe85050b0d6b49bcd1744e7783ad0bd9b7cb8cfde505cb6625ec72d1d07b8d9e00ff60a4a04f9f887e84fb63588929ea1f0c70fb6391af6be1822566dadf
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnvwoUQ8qrgohJ/rciJljHQeHW:1a5POZ3+Jt2pasx2+mBvj8qr1JzvwB
TLSH
T18265AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56e15d3cab178e548a412d3926fde861c5175c3a7ac1221c9ebbbd0d38db6030
MD5 5272a77f17b6234a6e0c6c32085e10b5
SHA1 6d2fe9e90162db5bf81e62e90df1cc51ebf84c8f
SHA512 e98236eda83d2cf2aa6ea294b202b0b988e225279e81bc138ad8bc801233c64b0c4d1dc139dcf428bc2b2a092e1d4c39b14503d0ac56183fa6445ff52d25c679
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkFvwoUQ8qrgohJ/rciJljHQeH7:MNc/zEOVHFMvj8qr1Jzvwo
TLSH
T1F3858B5623E901E4F5BBE1BE89679546FAB1786413308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ffaeac8ef3c079f5d2eedc40662785225b5df4b74def5cae3791155225b0466f
MD5 639b65a453c0a81140f2860fc19cc8a5
SHA1 e6b2d7359a7ee1c3842fa057b8f94624947d219d
SHA512 c3950b1b681b323a4a738fabdcd87fb2b5f3e2fec0a1f2df5675f1ca95d259f5866351f6eacdbdc2f90bf3642ba9a98edb33e531949d1e81d472e66c2a9f6b6d
SSDEEP 24576:X8kNvNnaFeYhJNtmZBmLvwoUQ8qrgohJ/rciJljHQeHg:X8MwBtOmLvj8qr1JzvwT
TLSH
T1A355AF6EAAB806E4D1FEC6B4DD238512E6727861173253CB5390C13F4E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e96948c1c09f7cac29f9010bdbd006d520894cdba46008c7b6f51f26472021a2
MD5 367ca09d54bc7a418ea4a5dc9da549d5
SHA1 a7bad10e29609adc52d33e048c2c190bc57685fe
SHA512 ff05252f1443cb8216a6f67f5817651757571a9e0469d3b300820c79289b9d2e94ef72f9b3645af06229a1f31e5699d59754a53874357c595499f23ebbf4e11c
SSDEEP 24576:vPUr+NQZvwoUQ8qrgohJ/rciJljHQeH9:vJQZvj8qr1JzvwO
TLSH
T19605E11E66AC1CE5F67AD17C89828219F771B861171292DF02E1917E4F339E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ffe18e761b1ac1244f8ef29f17945a8eb0f581294c0472fc3a3bbfaffa284b46
MD5 ce4a96ab97eedadf94432fab77ead2a0
SHA1 b97f862c790c198160fee765a5becfe121243086
SHA512 8a525e1c8222688c57ca09e339c8374e0105b6c6778cc69688646927ce7620768602438b58ed4ef9d61770fc6f5be9788c9c8365f671c365e5a37dcaebd86a9a
SSDEEP 24576:MD3FHshBIYQgAqvwoUQ8qrgohJ/rciJljHQeHk:MDVHeBIAAqvj8qr1Jzvwn
TLSH
T13825E17DEAAC04E4E57BC1BCDA538506E7B138A8033256DB02D491BA5F27EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-280-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/108-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/108-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/108-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/788-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/788-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/788-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/788-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2248-135-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2248-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2248-133-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2248-127-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2248-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2492-83-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/2492-291-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2492-78-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/2492-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3392-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3392-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3392-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3392-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3884-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3884-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3884-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3884-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4076-49-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/4076-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4076-46-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/4076-38-0x00000000022E0000-0x0000000002340000-memory.dmp

Download

memory/4076-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4240-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4240-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4240-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4240-251-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4792-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4792-1-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/4792-8-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/4792-76-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5192-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5192-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5192-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5192-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5704-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5704-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5704-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5704-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5704-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5704-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5984-327-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5984-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5984-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5984-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5984-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download