7f2b3c65e5bc2ddc4f346fb29d745788dcdb4a15c5fdaf2cc507a4165efa6db4

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Size 1.8MB
Sample260813-sd7dasbl4w
SHA256 7f2b3c65e5bc2ddc4f346fb29d745788dcdb4a15c5fdaf2cc507a4165efa6db4
MD5 a59b884c9fd6fd070a0f52014ab171bc
SHA1 87c163e630866556ea05a76a9b158672e978eeb4
SHA512 e9905cb5a4b37fefd319bc09b41e68809addb9dca66ee5700070399307dbe9942ae0fc7d5d873f17fab985136d9a74feff67e39584a2ca78977f63f57842e043
SSDEEP 49152:OWJE2ZctEafitmGYj+uYP4D2VPrX85kk+QT+ghmQGT8g5dP:DE2ZBaqaj+uYP4srwzaghmJAm
TLSH
T159952311B1D69078F5F61A359879D9B00FB4FC304E648AAF63847E391FB4980E439BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2212	alg.exe
5172	GameInputSvc.exe
4492	GameInputSvc.exe
2816	elevation_service.exe
5244	elevation_service.exe
4692	maintenanceservice.exe
1060	msdtc.exe
4480	OSE.EXE
6088	PerceptionSimulationService.exe
1976	perfhost.exe
4196	ReFsDedupSvc.exe
2356	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1fa25c48f8562d1.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_th.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_vi.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_ml.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_sv.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_te.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_is.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_ta.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_sk.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_ca.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\GoogleUpdateComRegisterShell64.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\psuser.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_gu.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUME11F.tmp\goopdateres_ko.dll	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	GameInputSvc.exe
4492	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5504	2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Token: SeTcbPrivilege	5172	GameInputSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2212	alg.exe
Token: SeDebugPrivilege	2212	alg.exe
Token: SeDebugPrivilege	5172	GameInputSvc.exe
Token: SeDebugPrivilege	5172	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 4492	5172	GameInputSvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a59b884c9fd6fd070a0f52014ab171bc_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1060

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 13efb3e68799d7460799aa22183f77367e5aca763f8830acf5cd156c3344c31c
MD5 ab8c7ba9062ff664808e7f557ffadb94
SHA1 2a7c9a70e237481ca617eae5c6105c5c4c4b47be
SHA512 becbeb7d67ccaa53ea7913bdfa77da7898165be7e553c64cd73f55ac019d190e1f8efd5e16e273b13da312c7ffb20b5be707a52ba5c74c673e900941f6caa16f
SSDEEP 49152:bJ4632BuPkFKRrdE6oh7stBhuXjfS4LWxnA5kk+QT+ghmQGT8g5dP:13q6gjBVzaghmJAm
TLSH
T1B0D58D03F2D900E8E069D178D7469533EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 fe3c24bae40552af9536700f71a8f8e2a8aaf5a59851ddc09b03eec2f361c320
MD5 80d98b08f382af373454f36d8d492564
SHA1 0b1b730813965c238e1302f7cb932118709abe55
SHA512 1bff773808e09f012d64cddadd242ce49e56190d517cd16d7d4a0ba9ac009d5160469afc441de25126671224cb6763ed3b7580d1989c1ec2fe2bf1ee047be189
SSDEEP 24576:gXYYDzczANqo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:Czckq5kk+QT+ghmQGT8g5dP
TLSH
T1A605013963D108FCEC6B813DC8A29512EB73785647A0E75B03E4DA650F237885E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3148e077e79b4052930c91aebeb45569ed41c1bd305c4ed066c176b8d1c83c66
MD5 be99d8200af38cdf15054838cb842ea5
SHA1 c414ce6b4677b1493f3fa7b394e0be74dd669eb8
SHA512 068b98ad1edfefb95d37cb42e856c43277ea5810685b4116edbf51974ee35a1191620cd76b5ddc1a3552d24f664a310496e79b442d23cfb7ab3835897a8789dd
SSDEEP 24576:o0JeVSQ0vSxOrMBo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:oRSQ06oK5kk+QT+ghmQGT8g5dP
TLSH
T12845AF26F6748335D073C0B9C5D2A69AED7130825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 463879502eb2871728aaecac5d47c917ca3a393edb8014e7837aff502d74801b
MD5 75c096e60193fc07f318c33a197f063c
SHA1 f9d0d7bae31bbbbd0e674a4587672434102474b4
SHA512 a635516ef379577f38fbca1985bf72d5f46c60c3b137b87c0d6b824a39781fc1f51c61af6e69113ebcf43ea712f6e87ba5c04456d92856808f4e71f299aa8dff
SSDEEP 49152:5/ezSC6vUzPvuHjyx5kk+QT+ghmQGT8g5dP:pezSC6v2XuHuzaghmJAm
TLSH
T1D7756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 1380e5850491c36df8f928f77b4b84f1084debc8ba55d025b752b50a82f21370
MD5 8080f76d87c3ec31df048b7115b26d51
SHA1 2145f9ecb325f432e62698935e6d34440413dff6
SHA512 35b53688a3c6cc28c8023e9b9b94d6f2f7e1f56d9292d64b3f85d7360f2f62ac2a36ff20b204ee4391718671b66f5c5e5bb2aed9f4ab6a2b2aaf01643d402e9b
SSDEEP 24576:KabnPz/hsv/l+dWo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:Ka3/hsXl+Y5kk+QT+ghmQGT8g5dP
TLSH
T1EF55AE66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 430edb4da0b9dc7ad9ef9a4355c15fb917fba7c5c72ca861c805f925447d097a
MD5 1080cdbff50aeed4170315aa30b6551c
SHA1 7562d32f06884643b3ad0f69b1b5fa2811b06f27
SHA512 24e1df1e3ae167174efadaeb2b6a0e83815103fa2d1676680c87ccb80dadd106f6bbe1263b3dfaa70ae8f8cde0cb9a0f1e710898c4e492f03fb1ae065a1d7d45
SSDEEP 12288:AAaoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:AAao4Rytq+QT+ghLqC/05E3yBOHz8W8N
TLSH
T18ED4233283C3306CF17D2035D52EBDE26B812F665D95EA2063A3FF9948B6545E0AE14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 e703ffaf7030cdfe0902c92761360474313c95c98c69262d84d55a21ae05a870
MD5 a274cbeac68705fc4a0280b2c97c30e7
SHA1 2cbdaa79afe2c1166024697ca86678c9e54b9b8f
SHA512 1c12d8701bb9c72f44c690617f17340c58ffa61cc763d3c6effecd2a93cc24b7702e6dab3181c1aab5b2df022fbae102af6042a74174d2142f0d8c05dcdfe7e8
SSDEEP 24576:i6IU+o4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:i6IU+5kk+QT+ghmQGT8g5dP
TLSH
T11F15CF3BEE28FCE1C27E5C785A518640E76278314F62A3CBE265C30E9E235D15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a4120fe37cd375dd5f0682ab187aa49df15c517f6e76cab18c30cbfe9cefb393
MD5 0ea277d433a2c544961ac8b69c0c5445
SHA1 92484fb9ca2c358669e08d4b396a1532617b8e8e
SHA512 35301f227250ff0c437a959b82754427aac16062e361ee198e32a50a71b6aa436fe5bd15fb7a81a8339f5efddffd2c7aab7eb0246e14d0abba3dd99afbc1844e
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THd:VQvGAdlCEL8c/9RNw5COczaghmJAm
TLSH
T109366D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 d967152a206ff15ad2a48bd7d7a51247a48535feaf6c3b681a238df229d479c6
MD5 390117e55b9e72e7a049260a0e481125
SHA1 5de8ecb102cc61ac3adade9786cefe70f86f96c1
SHA512 d91ff5f440ad289f345795ccb3a9b25b360f87b2cebf0d8e6dcb9df2514f95e99bd5b0598733e2934397cfe78ac96f98c91986908612ccfa15e1e60c20a4c77e
SSDEEP 24576:TmewsAjOo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:qljO5kk+QT+ghmQGT8g5dP
TLSH
T1FA15E031FA75E036C27F0DB61B36D716186D7A204F611AC3E3E89E9D59702C22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f21fb0fada8423b349e144b58ab86ca311c3f1478c2fe85fdd458dd946aff2b2
MD5 9138e6d26b77266b8c31a4ae31a4c03c
SHA1 c1d433eb7047b0151c165a472e12e8f0942e32bd
SHA512 786a65fa0729eb6f7f444ff8d45f5194be546ffa63bea2556fcf52a1a603217c427babd4804ad4b7962b6f58a2a28694dd1b3db4241ecd34b0a12a7c9e0db8b3
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH+aap:HUEtQevvqc2W1cpV2XF32+aap
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d022aa76212cb0dbb9ff379f7998622d8daef1cece694e0bbfeea9a74880a5bd
MD5 92cd4cf566dc4126c39a4f09bf14cf8a
SHA1 12622ee19485486fdc9177484721bc696a41f8d1
SHA512 fa75f0463c484533a5c0386e34c42d8cf6d69476fac347cf0b5e86efd71fb0cc2efb86880c0720956e203b8e2c552c67336efa897fc670ba0043ffc81ae074ff
SSDEEP 49152:DV6RquA/m2yL5zMfFiV+XenmE3/zh5kk+QT+ghmQGT8g5dP:goq1VjnmszaghmJAm
TLSH
T118D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f5b5de4288a4fc1f5d2371bd1e3f168a91f0f02a14ddcf5310f1805751aa870e
MD5 d17caea456f232f24b8f257ac61678c7
SHA1 0c4d9ae600554c396562f0facf6e39f58c431166
SHA512 ab969ba30a616ddd7c513a4382e9e2c42200ab1cd8b15d31f10cae7b1840bd7d033ee9f38caa450e6ed42d6accaf840907cba4481d9b0480453a7e245c4e0846
SSDEEP 24576:RAhGLvVFoiwtA5l7S536o4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:RAMZFoiq5K5kk+QT+ghmQGT8g5dP
TLSH
T17445AE91E7F951D4F5B3AA7899B69171EA72BCA65E31C20F2250D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 1f58aa27dfd04b97638d866a047f94c1f34ffdf94fc8aac2eab92faf16b53e4a
MD5 66a84bca1caa648a49de07f8f32e8aa0
SHA1 09743ba9129113ebf5b9bfd921905003166f6358
SHA512 f83766d2df57d8e6844a4dad4c865580a686ffe76b3e6f22a6a07a7d828a5414f34583eba64e2df47f52edefdf0209cf5d30f41f8c64a2acda342485e45718e4
SSDEEP 24576:QwuuOWwo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:QwVOx5kk+QT+ghmQGT8g5dP
TLSH
T17505F15663E518F8E56A9138C55BD532F7F2BC122A21DB1F13A0CB5B5F33211AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 33bcfffe9e6b1da2b4ce8ffdd8a20f7e9325f67e2e24924dbff87b67e61dcd7b
MD5 6c593d62189c748066e46f0377d1362d
SHA1 e5a6af79845eaa9bbe3364a7c436b25b6b9241b9
SHA512 c8a845b255984854994755d72f5ba5a3b5872049afbef0115b301cb9d90eab879d0d2d2ce1d02ba8b4d9349f013970f8a8300ea81a15e6b573133f9724f8a9cd
SSDEEP 12288:KJ61IZtoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:U6u/o4Rytq+QT+ghLqC/05E3yBOHz8Wq
TLSH
T1BDE4126623D530FCE0AA513CC9B56A45E7A238632B7683CF13618B5A0F73AC15D3D726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aab0d351399fcfa32f9ffd18118f72e5c8c7cf3f3d83a31e361d57057c4e9eca
MD5 21d1e6420c4df772f047e2a5a26b4fb6
SHA1 4e2c19fdab23798a575a2140a7032fe042c7988b
SHA512 e0823b7d6c1c56ad784c9ae134efce83a3103ede68fe0dc2a6b4cc78a1bdc4b3fb0ff4d42dc5e1b95a97c2d094c3af74160b2d25395a745876ea4fccb0ec5b1f
SSDEEP 98304:iQRQyi36YOcP8Lvw2gAf+PN3yzaghmJAm:5QyiKa+X+PNaaap
TLSH
T1FD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d405fc93f35a0aad80012eab6a1764970b1c2763ea9b8fd4530a93c473c89c3f
MD5 db865bb1b70a90b467a2099ad401d3db
SHA1 b088b5f4f38c7853ed019716a160f22079eb75ad
SHA512 3515c3cef2b5aaf34d73fdaff712273da0f1d2ba5ee5121e177af0f3371085e638607e679ab75114ec861ad6248d99cc4196191a6c663e92d26c049413f228ad
SSDEEP 98304:iQRQyi36YOcP8Lvw2gAf+PN3BzaghmJAm:5QyiKa+X+PNdaap
TLSH
T11E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 becb13acce109612edb3dc6a37892771f2e3fb55153897bdf149329027f53ce1
MD5 bd3bfcf100b060c96e10fc8cb22d87e8
SHA1 bf2e3d753341aff42d6599ca9a573280c7279035
SHA512 e33b5496f64a5df37dc66480d728b56b1bc82e643f7e4308304869ae43d3ab13157e36a4fe7b09f4068979be99990d361b2542fde342bfd82a2609df48c82ad2
SSDEEP 49152:M68Qg55nhMeWu7PNU3/85kk+QT+ghmQGT8g5dP:GthbRc/gzaghmJAm
TLSH
T1CCB55A33B2F200A9C44DE1769F4A973196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 898e18a4d2d73729443d3c01c451c8b53f4bb343947739d6c29a5a23373e9eeb
MD5 64a49d90dc0e1d3256071377ee11096c
SHA1 d2f24bf533f146bd2b75093455fbd9a1960ce0a4
SHA512 b68b471f7c4a2adbdff0cf9c4a64d7ceb76c40e2269c4cb697ff99a72fea11adb619e08b00abdbfe0c1d0c8174968a6679713a5d33f6b42fd4fc468e6f6ddbf2
SSDEEP 98304:iy5112gYy5azzVv569nLKnhZMzaghmJAm:rLIHAWhOaap
TLSH
T1CD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 adae30dfbf5cb156491a5532d8e3c25e99c0b83c95ed2deb4b0f78cb98c1ac17
MD5 5a0cbbb44f02405ee907b91af8e377db
SHA1 4667ea48cb733e90966d02f5d219b8c117c2a1e4
SHA512 e94dcccb65de2ba6803a03aa74af2aae3c1915babb1c8f7763a6038ef5bc20879bbafa699a0b980cac8b976b4aac806691073c60ff5b3de6aabc898a84804db1
SSDEEP 49152:Cs+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl95kk+QT+ghmQGT8g5dP:Nu6JmTxd2dJzaghmJAm
TLSH
T18AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 79dcbe86138d80129ba22d0267d085cfe9a0c6e0a5cdc1cd77e91531ad2f50ee
MD5 937f2ca9a64b701d8e754137c9593c17
SHA1 e4944f50a12ec258e28237b59ede23bb1681f740
SHA512 0ad85ab240236f2f7e55bc77b8bb12d000c2ff7961b23d341daa9a1e842bdfc740e0c7c35f862f19535122946f9a1bacef3c12104e86c03a7a49a3a8b5726342
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4x85kk+QT+ghmQGT8g5dP:gmifPbRfzaghmJAm
TLSH
T118B5BE13F2D900E8D06DD178875A9632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e3f49bf36740308b389ad8fd49ca58ada0ca1dbf86e23474606c0ad3d4c6816
MD5 bb4c1a2dc4169c94b7e8e4d101f624fe
SHA1 786eaa05b750dd9991e79890cee3ba601731bb49
SHA512 5b91740ce858f316d61b75bd32f432c43477773da9ae09d85458046e34bc009c981a2ef72304e836d8a4d302e2dee8188515c62964428303a6124e90af8e1db9
SSDEEP 49152:qSuZQIY0Be2K6RVtOnks6NMHqt5kk+QT+ghmQGT8g5dP:05dKoi61ZzaghmJAm
TLSH
T1F0C5BE13F2E900E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4313ea3bc2b5b3bf870e9f62a6eb9f1827c75cea5ce399d2313ba8b2a93acb68
MD5 0750a8618510f64b45a3dbc6037a2fbb
SHA1 e157c533a06e0731da0716e2cf06ab86c93aa82f
SHA512 ef266c4d79073e79084f5c388c92cbb256fe5cc65f3d9b4f757df79bb732233bf8763f6468eeff69e33bdfe61a71980f996331f551530464cc09479563cef8d1
SSDEEP 49152:AT/Sn8EApI0figTgiDn0AP5wX5kk+QT+ghmQGT8g5dP:1X2iyphMzaghmJAm
TLSH
T1CDA5BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 00eabce04789bf0d0e449f349b86e573d02e45728e284005845f2d3e9ad2764a
MD5 063c9b811fc8ff5d71be44c8844b5428
SHA1 d2284bd61eba456d7b62bf069028f20b1a51cc06
SHA512 d049cb2d36f5627c4c6299fe359241842fb79b927b647a46da72ab7e278dc9e6cca9bdb4e0c4b3a5db4e817fb0396e1b98dbf92d9405974523678f6de8e29698
SSDEEP 12288:HvoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:Hvo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T194D4233282D7317CF02C2075C92EB9E6AF813F676D96A6207393EF5509E394520DE58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 1311838c870b1119e64a7d0d3026f037975c0fd1468de5aaacabb02395dc4d3c
MD5 48b59c6edf1e549e3d74a277735b1e94
SHA1 5dcd36a95fd6298eb5303b89a33357369b2780c0
SHA512 0bdf460c0f6639b4e5dbe2d34ffed7c11e3c60683e05f26b5fde028e91a45029d6a2434838124958e9a9eb0580bd34adc46ba8c9f327e154fa70c9175ced55ba
SSDEEP 12288:hpoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:hpo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T126D4233282D3316CF02C2075C92EB9E6AF812F676E96E6307393EF5545E3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 f9362a2bd88e7675fd788c2b5943390b27177db58995297e30afd1b840b76d9c
MD5 3b81070c1731ebfcadb4fa45670ce00d
SHA1 618aa292d80a25370ef40cde285ab46199be68c2
SHA512 ac613f7749ed0489990ec7b8be8cd7d2c8662be8ad188594a0690ddca491cf7e131b8f8963ef67f21c1ac50f45ffffecaf1cf4ee982c778f598b615a85abb33d
SSDEEP 12288:PIoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:PIo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1FBD4233282D3316CF06C6035C52EBAE2AF812F676DD6A7307393EF5509E3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 287665c432cc2db6cc14720cca3ce22ed39a8b383839496daa35879983377081
MD5 d3b346a9a6b3476f3711b97afcf6fa26
SHA1 fe1ec28103b97dcc66c8f3efbad562de88d10ac1
SHA512 516564d4d2f78fb1e54d4d3e5a9aef9e6a1ca3101694a206f4d6687991e83a4f8abc073bf287c213139c48fdaa2a946e7e27eabd81e417b3ce1c80a8e4909837
SSDEEP 12288:8laoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:ho4Rytq+QT+ghLqC/05E3yBOHz8W88GP
TLSH
T1FED4233243D720ECF07DA034C93AB5A2FBD13E576E72D72A63528F490DB3744646964A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 71d3cca4ee9dfd37eb244164183eb9b02ab88788de8cfc458aea194309a16432
MD5 b323819ed9ca2078d6eeb193e0f294f1
SHA1 984b90ce640f986926bc835bf71f2be5e2d6abe5
SHA512 4ebe17946f4370b10359befc4ae075fc36eb713a2903d4a1170062f32b3b318579ae3b1f88d05eaaae14b0d1b5ddeb49d6707b66854c0709405f6e114dc2c1ab
SSDEEP 12288:eioSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:eio4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1B1D4233282D7317CF02C2035C92E79E6AF813F676D96E6307393EF5549A3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 9f1ff0c2532836b550bcbb4a39b803b4be5709aee1f066851a1e310959c8c6ab
MD5 ca4d5569682a28242fce3d0637c52a30
SHA1 0e0ed4506e503cebc2bae133ca09d2ad41ac77d6
SHA512 ce486f202d23e95f34a56badc09d11945308116c1d90f9bbd4e54a9d935b4eb9a373f24bc96ad1d51caffc2df6dcf12715c9876a426f2ebcd8979f46ecd5d72c
SSDEEP 12288:VyoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:Vyo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T170D4233282D3317CF02C2035C92EB9E6AF812F676D96E7307393EF5545A3949609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 455b4017231e9be964c866691876f96fe03aaac36c20e0c7a81c0aaac4f4f718
MD5 03f7d846ee5e19b9509f7355cfd813b4
SHA1 6a81081b79796e98e2cd0e9918e4399c2976c119
SHA512 06db5db347478b57a0b8a574a17c0eef69329465a8ff4975e4425d2eae6d47c68935adb4d8cbf2814d5c75e3756421a3391dcad18635427a2f34f5068076b65c
SSDEEP 12288:eSoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:eSo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T165D4233282D3217CF02C2035C92EB9E2AF812F67AD96E7307793DF5509A3949209D58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 69d2c6f218e6512b8b43032303c512e96cc3b9a6c3bcab0caedb42441a7ba683
MD5 5a44c7474ca3a4ec1002b27c19f26a24
SHA1 07b9036b08c626f239d5591f89d4a0875230678f
SHA512 68a863dc1799078067a9af93ccb7f7b4b50ad1608da568ce4eb0535dd97cdc08682e9ff771c3eb81eb7c8905fa92e005e0702f602a7a8a88c6e5f0b77f07b65b
SSDEEP 24576:RZMWzFVS5TXo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:RZMWzfeX5kk+QT+ghmQGT8g5dP
TLSH
T1411502A5B39118F8EC67813EC9259916D6B27C5A0B70C61F13E43B670F733911C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 f77bd4bf4aa1dd84bc731189cfe1482308b4fa2ce00258fe65c8a70c7ebfb707
MD5 b91eff7365cb1cd664e3b61b504f4fca
SHA1 df920750dc37db526ec01501df4266bed55a6b68
SHA512 f69f58cb362c2f2c2358888f9ae525cf23cd192b4669b5c3ec6aa3b7c78b51ba7ab5efea388618830325691533ebe82f51b1954da55f09c444e5734b6c057d88
SSDEEP 12288:lloSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:llo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1D2D4237282D3316CF02C2035C92EBAE6AF812F676D96E72077D3DF5509A3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 e329c91dcf4c55d2e1292b8c9079aa9e20e6ade4cf424fb6e5facbe5e69c4752
MD5 44fc677f31f7ecc554fbc0ad0b8be26e
SHA1 a071becece110302f0b555195bb5c16aec571e18
SHA512 7c3db98401dcf53f59ef357376d592668e215360908e4c7fc26dc989c51e7d5dfddd31bbf9929d54f0c280772955cbcd5f09f6c704335c7703ae3ba7a2066fb3
SSDEEP 12288:H3oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:H3o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T13CD4237282D3317CF02C2035C92EBAE6AF812F67AD96E7207793DF5509A3945209D58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 3f00d76bc8e49e3d5c2776e2097deff20af382d55cffad634bafa8f73782ee98
MD5 2423e9cdb0a551547d4dffcef669eae3
SHA1 7e7694af51e15292423568083bb72b4359a19bd2
SHA512 e4f97d298b8fba0e6663c42d57b16d272544c8d2197e53da017be677d9f887dd50bbfe5fa453c754a7659ace94f2ad4beae506d55166a23dd6bc6236899dbd19
SSDEEP 12288:vUPz5Lz4oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:szd4o4Rytq+QT+ghLqC/05E3yBOHz8Wq
TLSH
T119F4122763E230FCE03A5138C8662A52F77178374B61DB6F23A04B761E636815D7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 8a05dea7600f9ec72bf23b267a6b2ae45127c8091c1f769dd56c2ace6af2f895
MD5 bd887524ee5997ae8110161ef552cb7c
SHA1 63928a587e1ba6e5309399b7683226f317d6f885
SHA512 a24063d32cf8c4b7bb37c6305155e732f8d4cf288e42201ee2ca25c3e52a01bcb52fb5cf22e5f7354a4689f1e98925304218b58187034968a3fc77f2de973bb5
SSDEEP 12288:J7oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:J7o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1E4D4233282D3317CF02C2039C52E7AE6AF813F6B6D96E6207393EF5545E3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 2c5edde9b6222ea8fa75c8b7ddf771d1ab467eab667a57d6b90b680537bcff7e
MD5 d82d7eb084edc0a47510d347dd65fa49
SHA1 86872d95a20927f32aaa787810a65361aa204ad5
SHA512 6913956945601b9c34b1b26282ffa40c963742417cc460cce14ff8c0ba44e03e57d6c2799155633df3afb863710e424583bb2d371d5ae54ac40cca0496116471
SSDEEP 12288:5foSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:5fo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1FBD4233282D3317CF02C2039C52E7AE6AF812F6B6D96E7207393EF5545E3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 31ff2185adddcaf566a7f54d658d4d1c3d63db8ead653d19347b4d35b6f5ac32
MD5 1d357069bd048c526611bcf4d25e6d4d
SHA1 1782fbc466be09a1cbdf85e527a9f01bf078438b
SHA512 6716f11bde8f1b6f3b1342270afe3504bd8dedf7844edf293991d197474597cbf7f17a520418f21903c9a4064b6aabe9fa7f0df6402b7e5206b63ca9fe4d056f
SSDEEP 12288:yUPz5LzBoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:9zdBo4Rytq+QT+ghLqC/05E3yBOHz8Wq
TLSH
T15BF4122763E230FCE03A5138C8662A52F77178371B61DB6F23A04B761E636815D7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 b1fc466b3dd05c68a56953b1814431c04a85f61a4f4a14777a101d01b0f517de
MD5 70a3d3b91b24654b33f052659a2bcaaf
SHA1 24a5df24398110a13765f65439156b4c3367e5ac
SHA512 47ed3cfbdbfd149400e557e567d0b6a96a183ccf7d818708bbaf06aa79b421927ec26fac1d3ddf4e27199215b9763aede31afdc2f03edeec5130b92e2500e183
SSDEEP 24576:HTuaLl3z0zDcpo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:HTdLljf5kk+QT+ghmQGT8g5dP
TLSH
T1611502A5B39118F8EC6B413EC9259916D6B27C5A0B70C61F13E43B664F333911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 ca99540fd028ac26a90f4b9966ee9a1fb0eef9afdad6548bf2d8c3a80618e44d
MD5 09c1b9d222795dc344bc31d730f173f1
SHA1 fc3d6d35bc38a6492190206daf37ac843c288706
SHA512 bbc7c6d716cb55a2b58189811c55a0712984d78fadc22b93978915c2e1bb3647b270bd1b2556c4472b043468e0fbcf7bcfd24a051e8c51108cc128e10df2f4b0
SSDEEP 24576:R3ld2CHKy75pFUo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:Bld2CHKydbU5kk+QT+ghmQGT8g5dP
TLSH
T1C335CF90F3E410E8F0B79A35C9765512DAB67C5A1B31DE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 75d572ce30cbed6848f9c99620ae7bed86dbd183bc589ee257d80e2035a27af1
MD5 acdc10c9c328bc1ff46e9541a33694d7
SHA1 a880b7080b8c7fc735652e5e8bbef1ac60a9f599
SHA512 0ab09181b4e211cf8eb5f9d9c3d7589b1209ca42e7bdaea2524ef39e0af2890b9d9789d06bedd9b39be0720ed614b7d635483c9890aa57546e0de6ff11730c97
SSDEEP 12288:RrloSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:Rrlo4Rytq+QT+ghLqC/05E3yBOHz8W8N
TLSH
T1C7D4233282D3317CF02C2075C52EB9E6AF813F67AD96A6307393EF5549A394520DE58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 5bc2857bf51aa5f967acc757fcfb854c7316cac65e3e2316aede18a1652dc990
MD5 be9bba939db0f27e7457e65fea60faaf
SHA1 140caf4e597ec7e375fd78d6f72ec299c1d25b51
SHA512 e54cce15d1e8c4dc6d49dd08c7f27f8f7a101096c6cb714c1a7acd06363367ff42934861c8b0ccf55c2fa4eadff7d60d94b42c2d28ea0e978b09e3bf34276be2
SSDEEP 12288:4choSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:4cho4Rytq+QT+ghLqC/05E3yBOHz8W8N
TLSH
T1CFD4237282D3317CF02C1075C52EB9E2AF813F676E96A7307393DF5509A794560AE18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 92643f3f2c6b943af8469c0a3d0477e5557fb026aba2fd73e2c65fa1cef4e776
MD5 43b40769dd29fe9adfbfdd8e743f0a8f
SHA1 edfd8238f401ec4a845be77a39fb142bd13efde1
SHA512 158d6520113f09285e3ee6badc868a8a3008e9bd373d88c89f4ce3bac5d554bd78cb64a9cf33eac731cb0acd6f2d9c1660f4c75148e33997ff086d5dc86e7832
SSDEEP 12288:kZoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:kZo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1D8D4237282D3317CF02C2079C52EBAE6AF803F576D96A62077D3DF5509E3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 a0e1263755e441db8fe538a57c129d5941fa811e4b6e8e6c8db3bb3352c14fe0
MD5 15c08a5c2b92a87f7790f598a283ab13
SHA1 beb87a96b70b319eececb6b30f00f91334efcc21
SHA512 c3549fdc0f949fa13239554d11883ae81d799eef825a299e9f9c1eb292d2065c2605eee95e2093e14ec30283f5b890c34cb09e888bafdeacef52e292c9a06a9e
SSDEEP 12288:H5oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:H5o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T12FD4237282D3316CF02C1035C52EBAE6AF802FA7ADD6E7207393DF5509E3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 4c9d933cbf76e55c1a3837f07502179edf46ddcbcc44c3ecf9610abeb4b665e9
MD5 8fbf73934e1b563fb5d87db9555e52b4
SHA1 8ef997da4702a63d1fe2d76f1acfe772bf6a4409
SHA512 bbdc0a2ec4a1c490fff0d1b35a6617ee31c6f5f705b631fc21d679fe3f0bc0539972e32311cdcc90085bcd58de73971224f467d4c455686e08dcf5147501e27d
SSDEEP 12288:j8oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:j8o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1DBD4237282D3316CF02C2035C52EBAE6AF812F67AD96E6207393DF5509E394560DE5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 b1f6ff990f132cc2ad4ba9aad311151bea1e9edc10370147818caddeda604577
MD5 6d7898decd14836d6f4ea1565b50a65b
SHA1 a09bc010f995d970b0b142434c3fb8f553c967c4
SHA512 8df8cf5e2ec93e0e51c578637fe88be47a57e313a1bf404804f846b1028eee25ba537f83cc7da94f52c67b8d4663dad3602f962944c98c0a55330171f0e746d0
SSDEEP 12288:m/oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:m/o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1DED4233282C3316CF02C2075C52EBAE2AF813F676D97E7207793EF5549A3545609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 1c236b24be67298a0ba2afdafae0bcccba070a74c04dc64d39421c9c0de407f5
MD5 cc808956cecbd0f5988e45b1f9a979a9
SHA1 1769ff1e37045d02097d1485767eb8e0eb2a754d
SHA512 0efa3d4345df5110ea4b215aa3a33de44942faa5f116b02b2efd296e7f5c2c3e309ec88af6155ba523227b079cc6099e221668410041345e529f33568f4f4da5
SSDEEP 12288:3MoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:3Mo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T166D4237282D3316CF02C2079C52EBAE2AF813F676D96E7207393DF5509E3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 a390f51c9b891ec2822332ad29ad14cea1b4238fa75c8cd4bf94153ac2fa603c
MD5 f1b791d29ed2abe5d1a13c35af2d5a21
SHA1 649c3637bab98d8d7666e832f90663a3f1f30784
SHA512 9312e862379f29642d6607e56ef87de2e0b3c5a680d650cb40d5f2b05410bcee5c44fa1a7ba5472b7b5cd4a8ea251b358aaac030633c7956f29c849fcadd6f93
SSDEEP 12288:ogoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:ogo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T140D4237282D3216CF02C2075C52EBAE2AF813F67ADD7E7207793DF4509A3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 f0b215a7ce8b4ae7a0134fc77937a01f1aa06b789809305ac3e8fb950be786b1
MD5 96975cf8d083b82b0a764db13d9f036c
SHA1 87456a5bfcebfbedc76cacbf33feaa8f510d6649
SHA512 182236b14379c7bf890df6454fef04f25ac26ad14c5df1ebbd8016fd76deb58d52c34dec2ddad9d0dd54cc68f8b15f943e858a5576fe6142b747ac0b735316b4
SSDEEP 12288:a0oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:a0o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T101D4237282C3317CF02C2075C52EBAE6AF812F67AD96E3307393DF5549A3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 83ab6e8e9f94c21a17028f038fcaa0c6dd462607890110fc4f8915cd500cc83e
MD5 2f882d7b5d2533a21c3f6f7cf6ed7115
SHA1 834e6dc0a27e0e9855ea8fd938c09447f925829a
SHA512 6e69a94c69a2d5729f9292a5db59f6301712bc696f74d87d9120b930adc66c947d19af9d4c9ce0b50ee4520ac9eb21d3040d19a7e60d3bf0a7dfdec75e38aaaa
SSDEEP 12288:QToSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:QTo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1E4D4237283D3317CF02C6075C52EBAE6AF813F67AD96E2203393DF5549A3945209E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 602KB
SHA256 50b32e0509f6de38f0f5cf86eab37c5c219a0469b5492d8971f435d56675f542
MD5 f9492ee199374364a6617b7b2c063ee7
SHA1 02b4dc90cdc8f4ec91713e028cfc45687f7ed5f4
SHA512 3365198415f71bdd11b7717aeea664fdbc162c4114128613dac81556856980f8976dd3fea7699c3cd236a379f68c87c7f49bfee4f81c2909be00e92fdd193184
SSDEEP 12288:M0oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:M0o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T1D2D4233282D3316CF02C2039C52EBAE6AB813F676DD6E7207793DF5509A3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 602KB
SHA256 81b69cdb64c2c8c986859a68e2807cb71b96f882893d5f4b6b08fd48853b6007
MD5 ce70ed67e7c82d819e02db0b020c9b54
SHA1 3e15062fa4971882352ae39ac66fe4074c93cfe6
SHA512 db055c4e27b4d82090b863fffab36b313c62cbb2b36aae74bde9219dba43c01b78e1a2523f3eef455e6be7c96cbb7b30b2b258fb20393330a6482e648dc6648f
SSDEEP 12288:tioSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:tio4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T14FD4237282C3317CF02C2079C52DBAE6AF803F67ADD6A7207393DF5549A3945609E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 a4e9a28d06f1c8512ef2bde93908d770e6a4f5db96addf41d7d3c1a4db6be485
MD5 afa41c07801ea6cdeb2b787b96032374
SHA1 f73a81c4d3c0a43536ec4db4089bb1986a564387
SHA512 64bbbe68b0156638e079ee843972a6d4cc73d357b1dd62502eb414a9cde484f83b1894aa6f4c430fecb555ce07f8046e8fede5e788bda677699c0d55a8e49a61
SSDEEP 12288:WIaf6loSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:+6lo4Rytq+QT+ghLqC/05E3yBOHz8W8N
TLSH
T17AF4012AC29512ECD06E6139C7165A81F7633C2687E1D3CA63D1FA3E0F766805DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 566ca66e66c02e660563aca94c1e42b6b4b3acc434214c2c47a677bf69d1ca7a
MD5 b3a6f997f81205c55ec87c53f94f7142
SHA1 d22e1ff55de7afb3aaa49e51854f31655c2a6dde
SHA512 b9513e421615bdaa2e1bf2b8dd6a7a892616354d70bbc3c76c49d004d6883f2fd1e36b83de75f097424a19131ca5cd30f56a4e1e0ce02d8cbc9dc619490f602f
SSDEEP 12288:Id7+oSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:4+o4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T15AD4233283D7212CF07C2034852EA9B16B413F675F91E6A3B352EF9948B29C558B964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 d20e14f9b704247165fa792aea833d93e97043d2c091a728d60c3b7b4aa3a151
MD5 d13a1a614748daa7befcc6dab319eb77
SHA1 4029f25a55d0130df8e1138f3a05586d93bc936f
SHA512 af59a62a95bf5566ec6d254687fe12d8fdaa5116e8ca7292bf3c51159af2af14a5fecfb4cc464c0022ded65e05264d1faedae141f6f6ca8471c5c2753ca4f413
SSDEEP 12288:EfGQoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:eGQo4Rytq+QT+ghLqC/05E3yBOHz8W8N
TLSH
T18EE4233A52E330ACD03C8139C439A5A3BA913A625F1166FF17D2EE794FA29C0717DD49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 9546f5069b000cc9a7d41dc50a0c88d2ccb67dc36009f05f7809639d06ed8eb7
MD5 104da30de067feb3a5324dbf42340e17
SHA1 cf7e4dcf015bc3ef09c7c650fce14aaa59300a5f
SHA512 6c1a45b0b10a6f645e19167b577c614c8e94d9caef8bab1b86bc4f62d05b2b1439e96c6f13f64da8ad5ac0dbb01abd2aefb11398aebe20d1ccdb4e79065d9577
SSDEEP 12288:GUoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:GUo4Rytq+QT+ghLqC/05E3yBOHz8W886
TLSH
T10FD4237242C7306CF03C2039852EB9A26B802F675F96A7E37393EF5505A79C560BD58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 a27440d1da869be0825b666e41ab72fc82f044b7153d9543255aa61034f8b106
MD5 7d3a7e9a5f5d0bc94c5a935f6d1a12fb
SHA1 1ec2d85676eaadc6930f792505913163912a5aa5
SHA512 78343b5f8bc1ae8935e05b3b005c168531b3c4e8b79c47e4b33b5a77ef211f1a02fa812187f3150a9d69abcdaf26806e054481531501a5566fe2feed548794ac
SSDEEP 24576:oPUr+NQWo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:oJQW5kk+QT+ghmQGT8g5dP
TLSH
T1BC05F12F62E918E8F57AA13D89468719F77178621712D2CF02E1817E4E63ED8BC3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a620e3bc0f05e8a9f0448ab13031f5bcb826bba77a5890eac96ec75a1ff105de
MD5 f5575dff7236487afb401292315f57c1
SHA1 d2b964549b55df617ceea21a028b08b3b33848b2
SHA512 3b5fccc04408be3c9d938c33408d7456e8f7c55bfc836a77bcb4d7961af9b638937b9392b317a3065fd0398361b441ae8c4c96756fe9477ed6e14d0f799f3986
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW5kk+QT+ghmQGT8gz:yG05lO43bRzaghmJAm
TLSH
T1CFD5C06A62EC11F9D0BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 7a7885efa3967124d345452042d2c7c811081127b35559095484ad3f2ab4d3fe
MD5 14b89e8a71cf14ab4f19c798bd4f10a8
SHA1 15e9d32c17fc34ea8c9c05679aba95be5e309a3f
SHA512 6cf200e11cdb3eb244a21d965abd04bc4aeeb1054c842ca819f9a1604c3246cacb6ad76dcac2ecf5c89270dfd72597671b00e8703a5185e28d9c47a84303cde5
SSDEEP 24576:J1DI5o4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:J1DI55kk+QT+ghmQGT8g5dP
TLSH
T13005012D23BB10B8D07B903DC5930552E2B2757187625ADF17D4CAB94EA3EC8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 24b2489c5361325e5337114aef29dfe430eea90cadbb114079b9391c42e7b44b
MD5 6bdba40c2736cb4f5d10d5ac8221422c
SHA1 57dd7e4c765a72f279dad3c42892a2a9e2bc4850
SHA512 e067f788c5f51949608f685874c5d20303e7c0b326101d49066e5d5f3a2b8638b696dd2b312cce28dbedb4f22d613c3c47030a92925f4b37d2f37ea1d516b19e
SSDEEP 12288:hG6kyyoSMfQPRytgB7+QTB8ghLL+C/05FOuuyBOobq7/PfXEWsvz8GJTbpS:Ityyo4Rytq+QT+ghLqC/05E3yBOHz8Wq
TLSH
T136F4122153D520A8F0BD1138C93791A19F617D215F6293EF22D2EB3E1E73BC4A875B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 891af50674a06908816077b70a24d1d502517590c66766863441803a8a3e51ae
MD5 e4fc6eab506261281df0eb45d8055186
SHA1 349a4ea16a82b9ee0afb96a52d46ca27bd74c42b
SHA512 62dce088dcf07b57a0f45a2bfebad9515508d1dd7f7c6b7f555e520f63f3b0f8119d141f57ba38cdd3d99cc76f8a8b2e9aacadc0a23648919d7de95092306ef4
SSDEEP 24576:6TkNvNnaFeYhJNtmZBmEo4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:6TMwBtOmE5kk+QT+ghmQGT8g5dP
TLSH
T14055AF2EA6F806E4D1FEC6B5CD238512EA727461173293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 621b2ac08fa0111a4d925596e554cfb63bc1f0b59db2702f64ae347b1aad4252
MD5 d8d996df9dc2726dcf58d3bc3552e921
SHA1 caf6c2ad02e78b6f6932a08ad7c515ce30830475
SHA512 a0407dd657fb884e694a4c901c292265670073032f32d798e433c6dadda41eff89fd314d7318a0489c9bc0765f00221abd0f325e3b30aa79ec0d3ca0bc119f6c
SSDEEP 24576:J6Uqjpco4Rytq+QT+ghLqC/05E3yBOHz8W88GVN:J6UX5kk+QT+ghmQGT8g5dP
TLSH
T1E2F4122E43D120ECF03D4134D92A916686A17D331BB6A6EF33D5DB7A4B32AC4943EE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-142-0x00000275AEC70000-0x00000275AECD6000-memory.dmp

Download

memory/1060-141-0x00007FF75B130000-0x00007FF75B24A000-memory.dmp

Download

memory/1060-214-0x00007FF75B130000-0x00007FF75B24A000-memory.dmp

Download

memory/1060-143-0x00000275AEC70000-0x00000275AECD6000-memory.dmp

Download

memory/1976-216-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1976-171-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1976-177-0x0000000000A20000-0x0000000000A89000-memory.dmp

Download

memory/1976-172-0x0000000000A20000-0x0000000000A89000-memory.dmp

Download

memory/2212-15-0x000001CA10750000-0x000001CA107B6000-memory.dmp

Download

memory/2212-17-0x000001CA10750000-0x000001CA107B6000-memory.dmp

Download

memory/2212-16-0x00007FF667630000-0x00007FF667753000-memory.dmp

Download

memory/2212-128-0x00007FF667630000-0x00007FF667753000-memory.dmp

Download

memory/2356-200-0x000001BA04590000-0x000001BA045F6000-memory.dmp

Download

memory/2356-198-0x00007FF72C5E0000-0x00007FF72C68E000-memory.dmp

Download

memory/2356-219-0x00007FF72C5E0000-0x00007FF72C68E000-memory.dmp

Download

memory/2356-199-0x000001BA04590000-0x000001BA045F6000-memory.dmp

Download

memory/2816-113-0x000001A03EAE0000-0x000001A03EB46000-memory.dmp

Download

memory/2816-112-0x000001A03EBA0000-0x000001A03ECCD000-memory.dmp

Download

memory/2816-114-0x000001A03EAE0000-0x000001A03EB46000-memory.dmp

Download

memory/4196-186-0x00007FF7C2750000-0x00007FF7C2E94000-memory.dmp

Download

memory/4196-185-0x00000224615C0000-0x0000022461626000-memory.dmp

Download

memory/4196-340-0x00007FF7C2750000-0x00007FF7C2E94000-memory.dmp

Download

memory/4196-184-0x00000224615C0000-0x0000022461626000-memory.dmp

Download

memory/4196-339-0x00000224615C0000-0x0000022461626000-memory.dmp

Download

memory/4196-217-0x00007FF7C2750000-0x00007FF7C2E94000-memory.dmp

Download

memory/4480-154-0x0000027BEAC50000-0x0000027BEACB6000-memory.dmp

Download

memory/4480-155-0x0000027BEAC50000-0x0000027BEACB6000-memory.dmp

Download

memory/4480-153-0x0000027BEAA00000-0x0000027BEAB2D000-memory.dmp

Download

memory/4492-34-0x00007FF66B6E0000-0x00007FF66B7A9000-memory.dmp

Download

memory/4492-183-0x00007FF66B6E0000-0x00007FF66B7A9000-memory.dmp

Download

memory/4492-38-0x0000021D36240000-0x0000021D362A6000-memory.dmp

Download

memory/4492-35-0x0000021D36240000-0x0000021D362A6000-memory.dmp

Download

memory/4692-129-0x00007FF62D3D0000-0x00007FF62D538000-memory.dmp

Download

memory/4692-137-0x000002B58BA00000-0x000002B58BA66000-memory.dmp

Download

memory/4692-131-0x000002B58BA00000-0x000002B58BA66000-memory.dmp

Download

memory/4692-130-0x000002B58BA00000-0x000002B58BA66000-memory.dmp

Download

memory/4692-139-0x00007FF62D3D0000-0x00007FF62D538000-memory.dmp

Download

memory/5172-170-0x00007FF66B6E0000-0x00007FF66B7A9000-memory.dmp

Download

memory/5172-25-0x00007FF66B6E0000-0x00007FF66B7A9000-memory.dmp

Download

memory/5172-26-0x000001DBAB410000-0x000001DBAB476000-memory.dmp

Download

memory/5172-27-0x000001DBAB410000-0x000001DBAB476000-memory.dmp

Download

memory/5172-28-0x000001DBAB410000-0x000001DBAB476000-memory.dmp

Download

memory/5244-122-0x000001657CDC0000-0x000001657CE26000-memory.dmp

Download

memory/5244-121-0x000001657CDC0000-0x000001657CE26000-memory.dmp

Download

memory/5244-120-0x000001657CB70000-0x000001657CC9D000-memory.dmp

Download

memory/5504-37-0x00000000005C0000-0x0000000000A04000-memory.dmp

Download

memory/5504-195-0x00000000005C0000-0x0000000000A04000-memory.dmp

Download

memory/5504-0-0x0000000002D70000-0x0000000002DD9000-memory.dmp

Download

memory/5504-6-0x00000000005C0000-0x0000000000A04000-memory.dmp

Download

memory/5504-7-0x0000000002D70000-0x0000000002DD9000-memory.dmp

Download

memory/6088-163-0x0000026BC3960000-0x0000026BC39C6000-memory.dmp

Download

memory/6088-164-0x0000026BC3960000-0x0000026BC39C6000-memory.dmp

Download

memory/6088-161-0x00007FF78E800000-0x00007FF78E94A000-memory.dmp

Download

memory/6088-215-0x00007FF78E800000-0x00007FF78E94A000-memory.dmp

Download