029a70b58dd8929ada3e2cbc627f65f12ab6f1bf09dd04b66f393a9eed065226

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260806-lr81qahk21
SHA256 029a70b58dd8929ada3e2cbc627f65f12ab6f1bf09dd04b66f393a9eed065226
MD5 d8ce9f1d8ee1e0847496f90af633bc8d
SHA1 7cbbeec38c6cafd34b258f1e9f6fd8d4ced9eafd
SHA512 984a8a9807d7b7fa1cc4bf7df9460cb0914fd8fae6c18c8ff644ba0580a2df198b891b68c535462700bad1cc92b216fbd76e4a8562e4f207180c54c3f4e2c822
SSDEEP 24576:Huex6umb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:Huex6Rb5+Pl6bJTIZ5jdgpN
TLSH
T1BD75120176C1D072D5B71A3588D4DB60EE7DFE308E556AFB43A8097BAF303C16926A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1896	elevation_service.exe
1796	elevation_service.exe
5832	maintenanceservice.exe
4064	OSE.EXE
944	PerceptionSimulationService.exe
2152	perfhost.exe
4344	ReFsDedupSvc.exe
5600	SensorDataService.exe
4608	ssh-agent.exe
5828	AgentService.exe
5960	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7d20d777e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937d77998825dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000053e7589a8825dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000559b6c998825dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000761d11db8825dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1400	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	1896	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5828	AgentService.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: 33	5960	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5960	SearchIndexer.exe
Token: SeDebugPrivilege	1896	elevation_service.exe
Token: SeDebugPrivilege	1796	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1400	2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4408	5960	SearchIndexer.exe	101
PID 5960 wrote to memory of 4784	5960	SearchIndexer.exe	102
PID 5960 wrote to memory of 5288	5960	SearchIndexer.exe	103
PID 5960 wrote to memory of 2236	5960	SearchIndexer.exe	104
PID 5960 wrote to memory of 4168	5960	SearchIndexer.exe	106
PID 5960 wrote to memory of 5892	5960	SearchIndexer.exe	107
PID 5960 wrote to memory of 6068	5960	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_d8ce9f1d8ee1e0847496f90af633bc8d_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 3.3MB
SHA256 dac44ea8d3919ef48508f01ac7a4e6d30584c80c30f6925f9b153e9c70fe0801
MD5 f586ad2396fb6265d4701292a0f3d25d
SHA1 6a909b37ba560d9e9e494e9f7131b425e2d0cc5b
SHA512 4443f4b19de70a229052d8a4052ade65cb35a8215178c88fcd13b9fda94b95bcd5a6175832bdda92758dd43212eecc702a1ff8f6e80c9f2fd09a57605f18ecc9
SSDEEP 49152:Lb+632BuPkFKRrdE6ohJstBhuXjfS4LWxnnb5+Pl6bJTIZ5jdgp3b5+Pl6bJTIZQ:Z3q6OjBKslgJTIZ5BgpLslgJTIZ5Bgp
TLSH
T1B0F5BE03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 1aeaf78d8376bcd33657b3abff12f8287d81fbd1aff7644893c10774209300bd
MD5 c5b6a2d1c52c2d564e04d5918ba89ee1
SHA1 0b9c45d71c0b811e751bdb7908a5699407f8d0cd
SHA512 ba9f37fd0e98a1ef70eb31735ca9e6d0e94c87a5da4dac121aa702f9b26d4f672a84cec1bfb3a9dcb5e0831942ffd0acfdebfbef22d24e06c2f718e069c22d3c
SSDEEP 24576:0XYfDtczAMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:ztcyb5+Pl6bJTIZ5jdgpS
TLSH
T1C785F11967A504F9EC67823DCCE2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3b41fe9c31b23730e62f639f998c745eb676bca759839710b44f61d2cafb9173
MD5 e27e9244f26b49295aeb79ed8c09b8a0
SHA1 b1af97c7b0ee7eadcf55274155ee16a55dc27435
SHA512 3dda5c4fdbbe7e8d80dc4db3b54202baffaa0136ff901116cfcd06c03c36c1106c7d127e8e70eecd6fa5f5240e05336a00cf64a1854d686f151d72af15c01d4d
SSDEEP 24576:r0Le5ji0hmxdrMVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:rPji0ArBb5+Pl6bJTIZ5jdgpf
TLSH
T1C995AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4ca863ba5ccf5a993c04aca27ed89ec3d07a5bd310b36d077ad3eaa51520cc2
MD5 bb3af76a115e9079f70e31088d296b8e
SHA1 ff7d542efa9d167272a274594e722a81cde63daa
SHA512 c83acc5a21d1dcb14448a6778e54ff013286115d4dd672bf471cd9e934a0ef8b12933b574827a863d8ee0667fa642706f51a6a203a44f8c15048f3b2e7a9576d
SSDEEP 24576:3a7/ezSC6vUyDZaqgrvWx6q8wyurmb57GBiOl6a8JTth/RWZvR6wQQ92pN32:6/ezSC6vURPvMHjyNb5+Pl6bJTIZ5jdZ
TLSH
T140756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b14f5148d1a1a667bd114d3dc4f3ae8c835cd5a99da90e6cebcb4af2755c1d42
MD5 3f2871fd799562566fe7e8aa1265ed4e
SHA1 9330c4fe880b86198ddedc59fd7654bb7eda5668
SHA512 1a32bab6f6d342493bad43bf99e801e9cf9ec1ff02d6bbf52cf37cc08b5d2eba0726fdaba8cc286d9066e05e125a0e72136578243f2b80f8dff19bd9a8eed587
SSDEEP 24576:wVbqPb88hv/lV7omb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:wVO88hXlVjb5+Pl6bJTIZ5jdgpt
TLSH
T114559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 65e149daf09bae8c342685ee605d1f88b1d5201df9ec70c857417241dea48fcb
MD5 c68b5d465862ea7aac49114c00b9cb8b
SHA1 a1ab64b4284cbc7708d64315eb66086c3c98be88
SHA512 c75b5d542686996ac80627294df48c24ad8c636bd43ca18b84912a69f0765cb426942f803629a90568b052319e5101aaee44602ab04d6ee0feea1b66c4f26943
SSDEEP 24576:SFRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:Bb5+Pl6bJTIZ5jdgpo
TLSH
T1836523834A6A30C5E5AB1739D9CDDF00F87AEF55CD866BB6C575282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 180547f58e65e0fbb1e279fbb08d49d16c25b9338979837c8a33ce7282c8055d
MD5 8c9f9ebe7f428788f8627214e9ba5bd5
SHA1 871173fcd142f0bc0efc6f40a03a7303b65a47a6
SHA512 9c12dd8576940a099874e2192dd3d745030435b2da5eed59f86018d3dcf2ba992bde0bee2cf0245ea0fb2f7fbd9d14c25cd37b6719505ea6821f1bda8a0b7c66
SSDEEP 24576:aJIUgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:aJIUXb5+Pl6bJTIZ5jdgpG
TLSH
T1E485CF2BAE28FCD2C27E8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bf95b77dc10849d922bf401aa983f981fb2dd56bfbc4fb2315580ba4d37de2d4
MD5 2c61d5863310c98a744896f24ce501f0
SHA1 c428f17df852d62214d13fd415b1c4036caf718b
SHA512 0d88a627d05fb7a429746aaebe315940d283130efc265c00a6d4e9b4919258868a2b05aa105364b4146b3926ad96f30ee39ebdf54f3774efacce1aceada5d39c
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THP:WQvGAdlCEL8c/pRNw5C4slgJTIZ5Bgp
TLSH
T10B266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 2147382530653af0d4a1bba11dd70b040930167cabcd4c4d4ac06722deb767fe
MD5 9caff5738d655123defeb26b3442ef65
SHA1 0f32a8893ee6bdc96c5dc4669b2ae340e3ff6d73
SHA512 09bfbe389149bb0f1fca4623d4c54181f64e648830f2c1723bc106b7a35947c202f58acd10f9dac489da08d16980421a0a35d6e3c504777b39df5a8f376d3233
SSDEEP 24576:IBewsAjOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:gljxb5+Pl6bJTIZ5jdgp4
TLSH
T12E85E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 807a75cc7bb0cf48b49828f6c43784cc1f890ad9d7c9fb08d3cbfd787d235372
MD5 c1565e4e525fa572b6e3637e1413ec9f
SHA1 10ba24082c3aec3171c9e42484d68883c41e6236
SHA512 3e67142729100164ef3b2958496f2bd3be28cb4f0862996381f23c4c4585dbeeea3c95aa617aaa2b892d21c76afbbc37ea381b25b48c6e9f938b29b33a0497ef
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHlsT6p:MUEtQevvqc2W1cpV29I32ls
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8ce0d5cb4a12427196a91f2ddc6a3677c0002ab1d3ce1064a62cc2de802bdc24
MD5 31e44cd4627f024746e4478056349604
SHA1 1408388ff1fbb67e7cbedf11e8f76bebf57e307a
SHA512 73b87162bb8702fea8f9562341232154490cbf3315b39290f273757439e72b20b569472860eec59437f0a178fb812ca28cd51fe6b7cf98213318b27db7e2f962
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zRb5+Pl6bJTIZ5jdgp2:yoquVjnmkslgJTIZ5Bgp
TLSH
T1DDD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3c999c1631acdb5052903cf778b39150a3211304445e6e67c05e65d253d64710
MD5 f0faa77f0db18064cfd956dcf5b52e84
SHA1 628fe2a539a00fb5bdaf50b3b26c0e16639f79de
SHA512 55bd15ba1286e476930971ea94fea2c3a7753e0224ebc029f0133630b509117cd527078a89abe0e8aabf23535779f16c5f7777c4ec732b5f242b04a2b7346edd
SSDEEP 24576:WAhGLmIFoiwtA5l7S53/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:WAM1Foiq5Ob5+Pl6bJTIZ5jdgpM
TLSH
T1E4359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 aff1b886fb0e633e8749b75f3ae50f687838b9d2602db26c7847b39b5abd4a3b
MD5 5c0d657b878a54b083ead48d5a9ced10
SHA1 9e922a93217467146aa03630564a1a8912f30ded
SHA512 1feac254124de51ea78faaee90bf08f5d4d63fe5ca741842d44f6bae15d25878b7de89987455be169b7ed5f6e5032ef6ee8f00b3354c74d106356c9894499240
SSDEEP 24576:7wuYOWimb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:7wPOab5+Pl6bJTIZ5jdgpl
TLSH
T1AE75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3ed9a5d90e0fded55c7b5fb61be06ef54302fff1e2704b402cee73346984cd91
MD5 0e6b1e4ab9dc2063d3bbbe37b6b7df48
SHA1 bd68a90697d9283a1c0d9c6945b106835bc0e95a
SHA512 878b7ee383258493e456fa899bde7e8ef47c5dfeba58404b5603edd1cd168e9987e2a74479e0283159ac3360a976506648ee195cd66aa0170a71be420ae17b8a
SSDEEP 24576:4Zutmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Kb5+Pl6bJTIZ5jdgpb
TLSH
T10D65128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9bb5b8fa7e3fd0b0023668cc7d690fbff1c9c7e7dea22cbbf3e925913c60703c
MD5 7386c2ccb57670ba3d27f20201a44b35
SHA1 599a6e91c6a0a09b5e9ce2ce0afdcb7736ba90fa
SHA512 12da1b2f75a2a6f6d2d2a8528de4066deb3290006e64a4dc9fdb1e9e3941bf07fc4a4020ec620d6a96d889fbbba250b3a32f948ec9bf99e413eefeb23f058907
SSDEEP 98304:OQRQyi36YOcPuLvw2gAf+PN33slgJTIZ5Bgp:VQyiKakX+PNnsT6p
TLSH
T15A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b17488288659b14641f9271dbf46a3a3eb9cf50d2226ed03806754f64ed2a6dc
MD5 32b9370bae1f1903c2afe8f735f4544d
SHA1 8286e54cac27154513846b8b0e7e181031032866
SHA512 2570f8d01da07fc09ca939942053ffa022579e5a72366e6aaebefbdd5ceed27a80167a4caf22692129b0df2ef392304d271512529194ecaa90212f08c3a5ab11
SSDEEP 98304:XQRQyi36YOcPuLvw2gAf+PN33slgJTIZ5Bgp:GQyiKakX+PNnsT6p
TLSH
T1AA666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9cc9619333ee985c2eb2c250ac76d266854f5966f0157cdabae3b8059d1ed348
MD5 f614fbdb8b2c6b7731a5a3c94c071f16
SHA1 b713478e58da58f681aadb58a80f8e9177e1e179
SHA512 b3ce71bb57ed4476cd302c4b3617b844a8fbb0807465c02c385c2ef1883cf4d7f2143394293a7bf9f392cf3fe17d56ba09f332d3b53ff14f469bec714f4f2fc4
SSDEEP 49152:b68Qg55nhxeWu7PNU3/Bb5+Pl6bJTIZ5jdgpU:lthGRc/dslgJTIZ5Bgp
TLSH
T110B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 05b0b1433a046fe114d01f5ea0ba4d2b2e3c7143d3aa1c5126c905304dfefd73
MD5 a0c229e6f94161daae90fedf36679664
SHA1 81c61fcc46d728af15e1033ec2aac84726e81f1d
SHA512 c8bdc11d43e36c4ef515aedf0b459bd5ec4e59c24bb4bb92793c3c4805f14ae0d4eb76487c2e8101270a1c1a45934ba6ddc7ab6c068ebc33764501cfaba97842
SSDEEP 98304:Wy5112gYy5azzVvD69nLKnhZKslgJTIZ5Bgp:HLIH+WhcsT6p
TLSH
T1A0167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 21d4bfdc797578af61c38884dd83bd52f6f314f65dc996a82e723ee7dc723554
MD5 f6c0c74698e4c0532c4f6d662a67dd3a
SHA1 53b84dc680dcadafc2065f31f42000abfc87e4fc
SHA512 7b6808780affaedb49c478a77e8f4a7617a1264dbb52586475c702c68a8963a01538021ec47149ff118136a75162b62c80e237f9d7f690f9362bd7d4bfa20e56
SSDEEP 49152:cB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwb5+Pl6bJTIZ5jdgpY:2u6JmQxd2d+slgJTIZ5Bgp
TLSH
T167D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b9504778244a119e059198c263e304d5556235ccddb0424cc4acb79ed37be191
MD5 ff225a2c628747d0ce6830cc821d5b03
SHA1 47b22a03dc091cf1db414025b92f2c13871877fd
SHA512 c5a79204edacd1b74167b58e3cb560aa8cc0573f761b0b6c0ddb0ab3eb59992e97e38aae1fc9f4380c9abc9b73edf695bd24f7183214ab06a188304072b11596
SSDEEP 49152:J1hpsNoJpF1A6yU44CwH7R4x3b5+Pl6bJTIZ5jdgpz:JmifPVRkslgJTIZ5Bgp
TLSH
T140B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 168f364d5d65ca9b17566d0e4f039f0537d85dc73e5c1433124d84b9272e70f5
MD5 1b4c04617241882f9dc0b65fcde47e7d
SHA1 2b8d24dd623a5ef4bc5b68a4755c635fd81f33e6
SHA512 066ab17719d5c34051c1a7f73bb8c0f45ebbc9a11a98d82c0daea725e254386acd94500eff0a486e35169b72074061de4cca8a4324cb453e34de67d905707dc6
SSDEEP 49152:fSuZQIY0Be2KIRVtOnks6NMHqwb5+Pl6bJTIZ5jdgpi:l5dKOi61+slgJTIZ5Bgp
TLSH
T10CC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2ab8e38f0d680ef71bb7b968656c22604b05c53d3689676c02875adb008e9707
MD5 117d70ce79f35c5ff403520290fbac81
SHA1 0bf04e922d24ed9b07250d77e54613e9eca880de
SHA512 63c5f631ee01b65fc0a3f693139087842851b55b5d213d2afb2f49b61c3b4b3b807e2baa8702b936941893afe3c5a8b9cbfd51c1333bd5d82ebcc266aebd86a3
SSDEEP 49152:rhtSn8EApI0figGgiDn0AP5wbb5+Pl6bJTIZ5jdgpF:qX2i/phQslgJTIZ5Bgp
TLSH
T18995BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 df5d85d9906036b5e4d1a98581cff808c822a323a4b496146ae5667b63d65997
MD5 30ad4a7d4fdc8c5aa7e2eb148cc3a905
SHA1 887a284e55163c3058787a85e8582fcdc84d36ac
SHA512 42ca4c56c22223f76e88dc2cf2cc5a038210b847bc03405a11133e3c5a0aca916aa84b007071aa1b134d97d994987c2dde17a28a3e9560135798422c35209b32
SSDEEP 24576:mJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:jb5+Pl6bJTIZ5jdgp1
TLSH
T1946523824A6B30CAE09B5779D9C9DB00F87DAF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1c0f4b45c4cc503fd3c62ddb2fe7274f33b6b06972018121da8651c2044f7223
MD5 46f407d153fdbe1f2d02e4137469273c
SHA1 0689ded777b954cb2b410d8d854c41e32be002ab
SHA512 0488a9e6cfdba8fdfc40877ec93384c45be98336c104ee42967474473b3d501e15280bb35e3854f52e8efbaf6ad2cc935c1d48cc7ae7858b9b653a1fb97ecc7b
SSDEEP 24576:Iqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:ob5+Pl6bJTIZ5jdgpd
TLSH
T1366523824A6B20CAE05B5779D9C9DB00F87DBF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f1068d06d9f04fa3aa0b6da666d74c583f21845748f2d446356a128b850a7fbd
MD5 475bc6585b17d2361d2997b76b7532dd
SHA1 0d0eae701098e2b1cfbfa2f510e576e70d714d59
SHA512 4e564f6fb2efe9dc317069abd923d369db1c1b0890166d34db7c3ef753109aca3f7bc0068371705b63e7a0f403b5fd5b762a3136e2abfb59ad2f125aa36ccdea
SSDEEP 24576:r4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:jb5+Pl6bJTIZ5jdgpd
TLSH
T12F6523824A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67E0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 00c95ed27738be044de84672db7f574fb9695cac846b2b74fcf81fcc847229b6
MD5 f6d52649be9111acd7f75d46c84b2896
SHA1 ac861eaae100c139f70f4c1df4c68e3e59d34917
SHA512 011ac0b8575516fd830ed9179b3d82df1f23283619775d507c4b09d8d4d84de54f46e49cce0bff10e85219a4f063c3187fac8e037eb9b866a7e86f1be67a44cb
SSDEEP 24576:Zmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:Ub5+Pl6bJTIZ5jdgpy
TLSH
T1F86523424B7A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BAA31388383170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8311e97081e4b016afde02f038d75930d2af74fc52dd33e27ad60aa161a081cf
MD5 befda6f0d0efc97c6f89ae551320a52e
SHA1 169537479f8121afd792956f9a0462e7b45e7e15
SHA512 f1f7dd789c7cd971f25e9ff4b18db5c97ee0ad5de1d0ac1bf87c721de91ae1556cb6b22c26b94b17f76323762f1ce3ef41bd5b0856c336558d0cbf94f1e26c63
SSDEEP 24576:9Hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:Ub5+Pl6bJTIZ5jdgpV
TLSH
T1536523824A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 077275cd954b928000e0fb50f69e71735d9c73ec900c4a38f283f14cbc221e40
MD5 eaa066306698d14ebeb97b3594b177e3
SHA1 8070e2481b434be3b31de4a2ee6325a91f341a1c
SHA512 fd84b19429b5b3240a1bf5f1cfabaeb50273fc5f6c4cfddb54a6522887f2178ee03c8c983196c6f6296321d1aca13c8a4d39878873752936ae42eac667d5df63
SSDEEP 24576:Kmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:Eb5+Pl6bJTIZ5jdgpV
TLSH
T1036523824A6B20CAE09B5779D9C9DB00F87DBF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7b38734eb53a4937a42c539a2c6fbee7e1985caa641fcb8c8ba4c0db8e8f7cf6
MD5 249ff61074d37e9f27d353a827cdf608
SHA1 f0ad65617bd29a71f0ba57a90598531c723017c1
SHA512 7b79b8cb514bce1b5e9a5e42a72bfe1d9eb4ce6cc3a78ba13a8882afd2b446b0e73e4b72ff21d7bed34d96c10e5ff661fbfd175d6043b7aff576999712990a0b
SSDEEP 24576:qymb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:eb5+Pl6bJTIZ5jdgpB
TLSH
T1356523828A6B20CAE09B5779D9C9DB00F87DBF57DD8727B6C67D0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 743fa85f3508ae2fed9358af09b737c6512ef16a16a6c332c035acea9d0e3efd
MD5 af2052687b7421146ec855057ec7c78d
SHA1 90dd9ab73d64b61725d1e017c8a7ba12ae1d119d
SHA512 2ff70ff9ffb2c3ffdf33288a99a0ed5c80d8fdb9e893be8a0935a9113be6273bf0a0b8bd12c86e9e673f0dc095978b9c742fa5c64c50d4edbcaaaa4787d11ca8
SSDEEP 24576:FZMYzFVSOKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:FZMYzfZb5+Pl6bJTIZ5jdgpn
TLSH
T13C850295B36118F8EC67823ECD958A05E5B27C5A4B60C65F03B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 564150ce46b1282a64225a846e006c82d5b46bad66868ed04400a21b95960a80
MD5 d96f6f5c5dc9f8a58b219f35088db664
SHA1 3b5f181fa5bfc6e71f2b25c496ef73ec7c863cc8
SHA512 56999e6489436c129b5423fe19b056a0bb1a42545ebe8de24f159c4128fa5d5ebb0e9863c0b952cb83361a002051d10954e07c27f6f44a495bd55a30fca13a8c
SSDEEP 24576:odmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:jb5+Pl6bJTIZ5jdgpr
TLSH
T1146523864A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e1d9fc13b4fbfc2baeabb424e7a9db64e303748d7d3dfc4c02a11e66040f7521
MD5 612c0978ef718b41083a7c3d82832b6d
SHA1 f02f7b44d9cd6f16c2795d7e9b692e635158e8f0
SHA512 b573bcadd469b410f25dee9dbf97bc32ffdf89f80781daa1be3c6bb1c752e002150550f321edda35d30f4bb60b92dd0c5f8ac862024926328d8a2742b58a385f
SSDEEP 24576:QBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:bb5+Pl6bJTIZ5jdgpr
TLSH
T1BC6523824A6B20CAE05B5779D9C9DB00F87DBF57DD8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 bb346d367c3c53cb2c1458e788eab4ef63d26b0bf190637b77f7ff59fce0a53a
MD5 bd26b92c89f79f63e8291a0be1ab37ef
SHA1 324255cb6326aa9ad7224e1afeb08a6c0bcd47f3
SHA512 452d4ba2054f8ca1da3172c5e8cfddb3ae346d54df6f768d5e37ccfb4a3b1ea6b01d4c1fe4f9f8cfaf86b99ca7bd961b88ef25c095f75f58d3e90ea8fb71a1b3
SSDEEP 24576:Lzy+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:L6b5+Pl6bJTIZ5jdgpm
TLSH
T16B75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 af7c044b69af2b5e482b84ccf74bc29affaf11940bcb277b5f9f084783312933
MD5 98b2efe63752382408608e8471ee83c3
SHA1 351f7361df96676b3d6000d6e96f9701e6cf9a30
SHA512 ad8c358b0f0cdc3b1ffaa56f04ed5ed796bf3e142bff5b2128c4a59da3e4189d8c26778c0f6d89736eb65841bfaf1917f317fc914392c01310acd3f45573988b
SSDEEP 24576:mdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:Zb5+Pl6bJTIZ5jdgp0
TLSH
T1466523864A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 3bc786f763a3f7d9c335b465cffb7453c009f93f5c5f3424bef1e5f64346224c
MD5 07efd1a0aa945410f40a2a37cdf1b728
SHA1 19b98fb1a203ea165f8cbf24ea42982738114841
SHA512 a823a71907ba284402354fcc74f4a8ad166fd644f6e9f3cc92772c4a5007da7d2eee63ab6adae8bd6c454c15aabf8e6ef845ea597a4222705e1f27e139d54f7d
SSDEEP 24576:Ndmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:mb5+Pl6bJTIZ5jdgp0
TLSH
T1D96523864A6B30C6E09B5779D9C9DB00F87DAF57DD8727B6C67E042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5e905b8ddcc93fad1add403b6b7ddc2fa9e5cdbf0be79789cbb1855b8f218cc2
MD5 fa3d176c7dbcaf7ec44f896cc80b1a32
SHA1 6b83d0a1b7c4daa97e615c4c3524efee55f3f114
SHA512 6dd6b48efe0275aea81307cf1e60bad386f65ae3097b282513212070d66ec0a67fba0e55b6d01a36e40d8d96a33f6568b9a866220d877e600ff66d16e458282d
SSDEEP 24576:+zy+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:+6b5+Pl6bJTIZ5jdgpF
TLSH
T11D75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e893e53de3142339da0b021f6df0218f856d0d56fdbfd8b18156e154b782eacf
MD5 84f6b1dffb7b2db28f0fae6f8393db3f
SHA1 2d67014ee09879dc4b62af00efb95c3002811bdd
SHA512 46e26ad1d63248f78c6c71317c5a74d2c817178470aa47cd7e10d7eb410078a4c962574c9995d64a2fc2c4dcdf79ff9d97a9dc9b247114eb08e657c51fdcc862
SSDEEP 24576:8TFaLl3z0zDImb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:8ToLljib5+Pl6bJTIZ5jdgpJ
TLSH
T19C85F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 251bd1bfd1a9374db42b12e6afe780d424725eb794fa0fe0102ac56095c3ef91
MD5 4eb526faff4384fd7c4f28b092fdd372
SHA1 304934fec1f88abbdaae9cb292098a7bad8810e5
SHA512 162446f84b82b26f600d3e13dbe4c55d5d023ac051641c952fadc8fe159b65e7b1798fd637a7732df8c09bb38ab226e9ba6b0a0a2fa097b9584d9177127c90df
SSDEEP 24576:z32d9CHKy7GZEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:T2d9CHKyaZb5+Pl6bJTIZ5jdgp0
TLSH
T19495CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 84de8bb0944c8374c6ba1dd1cee20155bc2cc07de8200d87f437cad2d784085a
MD5 f69d7d1077ae8c765a8b705a2c9ba3da
SHA1 8342159e08ac51986b7276c3268cf79c021836b1
SHA512 47634a8a6a90eef73a7627545848ca736aea15517c375ad08332e7c81e3d53282ff47b6440038218c84cb6a401f085bab3a928011dbc634a6cc8159b9bb33e30
SSDEEP 24576:VYmb57GBiOl6a8JTth/RWZvR6wQQ92pN33:hb5+Pl6bJTIZ5jdgpd
TLSH
T1CF6523828A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ae9ea4791ce83f7aa9ed4335b0ecaf259017a3c3fdc59c93bdb8da488ac3b8e4
MD5 5de55874f2a12e17816ce35aaf168530
SHA1 ee519f5e4c60183529643ddbc3aa29c5566d255a
SHA512 3bd69d18ed2d81e356e5b57bb791aea996be6e85ec6be6642531eb365f5be05359c34fc40183a3863b0f079c117b95b89bb51d6a2fb45530897235a8ab3d83dd
SSDEEP 24576:memb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:mb5+Pl6bJTIZ5jdgpJ
TLSH
T1636523824A7B20CAE09B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f7fabb77dffac241bb46346e07a72b2f301b153ec289ab4e9cb50aa3c19f4f8d
MD5 26c3bea4ab919a42d6a750d0eaf8e41a
SHA1 3e657d9758050f2f868bfd99346ab8d4161e35b7
SHA512 0b084828af7ae9c661173bb816c41da99bcaff397c3e6ef27eca5612777eccdf3a7965e1a88510189dc61e2c2a7b64315491769a6044462654e778c178c80f94
SSDEEP 24576:mTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:Xb5+Pl6bJTIZ5jdgpt
TLSH
T10D6523824A6B20C6E09B5739D9C9DB00F879BF57DD8727B6C67E042BF134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 092ed71f9f0ef39569374d0ab1fd0b566d1e53a01d7a2e7f3d515705be6f5cec
MD5 1663fcc02d247538ef7bb770ea93a63e
SHA1 0b015717b61c9a5d44759f9434ad162e3d7362ad
SHA512 76dc674e75d84bd1235358cebe1db386348298921a58247c83086f213609285e0b672d42a4ccf3c5fdd24101d2cc91ae69d147363c304307d52256510a2f60c0
SSDEEP 24576:Jdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:qb5+Pl6bJTIZ5jdgpK
TLSH
T17C6523824A6B20CAE09B5779D9C9DB00F87DBF57DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 097a47202f1555f7ed050e1fe75da1913382c97d2760195022361b0ce7fe4643
MD5 44ce7c717c98582f2fee9fea5288e74f
SHA1 94add9f5dcd827e2a59a82fc5f0f479fbc560978
SHA512 5c04498f5ba625bfdc07021811c67c3f51ef18df3b561f14d18b098f1fe4fc6e57419be477bbb72f9ba67529a7dc4f79788787d55bf27bf93f7fd994cddb1a6e
SSDEEP 24576:iYmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:ob5+Pl6bJTIZ5jdgp+
TLSH
T1736523824A6B30CAE09B5779D9C9DB00F87DAF57DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d69f24e51cc558efae287df814f86489bf4f0c1d48cfd56631b6928157f011b5
MD5 6827e8b966429183af28bd0d536ce9d6
SHA1 de14e514db387a31b0e966ed03fff85809112162
SHA512 52add792bc690d4d1ebb61ff1de00a5d4aaee4db0c6012d225e1a7ae41a3da8ca913513d1ca513e9d61179e95fb2366fbb046ee94798d03b08d45c0842e11677
SSDEEP 24576:rlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:Ub5+Pl6bJTIZ5jdgpK
TLSH
T1EF6523864A6B20CAE05B5779D9C9DB00F87DBF57DD8727B6C67E042BF134389385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f2595eb94e5980dd0c3712d2c3f5ac0057eaca9d1c91773b5675e0339b712402
MD5 7e4d19d2e33f2a7fff18e1cb12419ccc
SHA1 0bb56b9af10d2d1b2544db7128562ddadac3402f
SHA512 d2138817f2aee60b881621103e3dc854b29dc0cbba63f35b95ceb2af843727b44cecae0d045577d87ff5cbed01fb69e5caea51746a750de10970997522db7a54
SSDEEP 24576:WfwvEk9RX6wkyAIxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:qMnYIMb5+Pl6bJTIZ5jdgpR
TLSH
T1C395CF29EBDC04E5E0B7923C99E7460AF6B178595B31C6CF026A536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 98f42b4685b4d5dd60ba24a9b718dde2da566062ca0bd6c4fc6f6822df75c24e
MD5 c9b9c56b2af6549afabcf5da62dc1640
SHA1 cbe51d6e406cddbedefc3877539e04d320f1694a
SHA512 1051f8240d15b2fec4366b4b0f42c3f9ee6f36be7e06fa61fa48f9f03e0e31fc85e54173d1d90a0decc8dc632aee9ace3d32dedc22bbc158901c97ca5da73171
SSDEEP 49152:/YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07b5+Pl6bJTIZF:xySzPXslgJTIZ5Bgp
TLSH
T177066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0a8799666be1d5d2af9d308afa38014692bdfcbb64215dfeb94f78649b97b886
MD5 f0912e8fd4fa1cc15452bfff637c79c8
SHA1 8d5f1a3fc252a291347268c11e2b8bcab11d52db
SHA512 1d781a5d31db824c821a74dd9100d3bee949591bed5e49810c441f792b4e41be4733f487fdb20ff497338fd2a9fb84b153581188de3ab3be52d2b58de16d309c
SSDEEP 24576:T47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY6mb57GBiOl6a8JTth/RWZvR6wQQ923:T47JUQjairIhCnDHUPfF/rb5+Pl6bJTr
TLSH
T15E65AE1EA3EC01E5E1BA923885558A1AEA71782E5F31CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 f2dc484a4cb617d9ae5ef7bcd39e18e809a354f5fc67f5547aa7bf419a3cc834
MD5 5c1b2b77454192b6ac5f2d1718130912
SHA1 f3b63019191363eb33d30c7eedb8f99a5eaaa5b5
SHA512 15a4e547ab27ff580930d14f68f25c3bf0a82635e4c78eb35902bc8e27d6ec76db1192b27229773a69561254d8a8ec8d52b5841cb266512b3898a53f1a129a33
SSDEEP 24576:+tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:pb5+Pl6bJTIZ5jdgpO
TLSH
T19B75F14AC29811D8D06F6279CB858A01F7377D658BE2A3DB46E0F43E1F356846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fc61fd49dd883876316b3716778bd61b393b5f56ba6f0eb8a28a288f7bf5a866
MD5 1a2962cc1f28ed55fa6e7a389fd9f5ee
SHA1 ec924b67ad65b05e6e3a088c96e6027d5bd71748
SHA512 74df4e559c95c1974099b36def65704ced2d8af95ad13e81eeadd0922cfd05c84afdddde0b357f8ae0676bb19ceebc48672d49e41e7e4d8a77e28a54887634f6
SSDEEP 12288:Zu1dKU3fivW+21+93mY4KVA+qii1p0ORRx2HhhDc92C:Zu1cUPAW++ymY4ei1p0IRx2Hhtc92
TLSH
T1FD451741762AD68FC5A940321E36D6CCA7707D05FE05AF1373C8873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a967502d9f5c572499e5037b03e39e61c93c9d24e17f22731ed922b976e8a5c2
MD5 5770af8f269d8b295e468c81c87efbd3
SHA1 f8dbe14c8dc84fb7a48f146362113636cc278ba1
SHA512 0e600e70aac28a77c7cceee4972bc52474ef3d9af00758687db2eba53fb435a22f6b8f2829f28bf1df019bb3c531c2297a1f387fbde3a09a0b9a6f4965145a4e
SSDEEP 12288:ZbOONFbLJRUSl6wXmGjSaSWy3+PqmGLP1:ZbOU91ysxxSWy3+i3LP1
TLSH
T132451A41A4A7E35FCDFE90370732C68DAB749C06B7452F0573448A3C9867A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7d92daeec9d3d94f94e6d6edd8f28805b30fb5b589daa5d37906d1a471365594
MD5 a374af9a708fe1bf44f142f35ca89e83
SHA1 017a91f00bdc536810328c0b4955bf42f37866df
SHA512 0bc8d4525f3641f78800ea42a8753d4a69d7ea835d583fe41c75cc6671069fba0d8062f06e96ebc682bc5cb8a40e8f3b633455a5fb3cf9c8bb58bfc61b7bc198
SSDEEP 24576:T1mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:T4b5+Pl6bJTIZ5jdgpR
TLSH
T1C06522428A6A6086E4BB1778D8CDD710B83EBF65CF8566E7C569142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d2f20ec01c2df50afbb13a923dda156dfdfc4b2301a312893b382ac32b6241a6
MD5 26aa2da531258c721c074337a0648af3
SHA1 50a5e3221bedf9c5bd56a17831014c4ee2379220
SHA512 f5d9b966f25f1abbd548181a0033291550078b5ed02516ea76868cb8c1cd9407f0bdd08b2db19f8d259c5997831655a740b226b7b98e45069789579534fb7d38
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:jgb4mBIBhGFlb5+Pl6bJTIZ5jdgpk
TLSH
T174659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 6c987318f30485567ffb23e78bdf217ff0150f1723431a848195ab73ff4068e3
MD5 b46696c6a626d9299d13283055809e64
SHA1 f0111ced0120852a04ce22ee2d168330fa4c8cd7
SHA512 a340b6d9ea13cc6f380f8d5e5d2488780826bab23e7357cbc926bd69ca5e5b61ef9c7b9f2a37c90c462f0d35b099655eb24e8693918f4de35b4e53cfc6b21b3a
SSDEEP 24576:kG88u8FpJqH1Mzria7/mKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:X7ZFPqVra7/Kb5+Pl6bJTIZ5jdgps
TLSH
T1B995F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9c0740a828ceb564d954afb9f2a01535b9067aa3a0274c3ca4902a0d32dc88af
MD5 081f1ac9c30155f5baebdf84bc12f096
SHA1 b6ccff10b81b5aa85013ae738045e4336f3a2b96
SHA512 7e0d2d29c5e42f9aa67819b01d114d00cd2abfdc8805e22347414781a90e54a71b79a68b11d382275194426cd63e0e481e6ec5445d9228ff3e92dc2a530d3bf7
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpb5+Pl6bJTIZ5jdgB:gG05lO43bislgJTIZ5Bgp
TLSH
T13CD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0452d1cbac2b4085a7d01e30c5ab7887ec8634274dc1c72c572da8544ae11f03
MD5 8061c31348207c513019ff802f6a6781
SHA1 514af3b3b7c27e76d6a36368192adcb3494dd139
SHA512 4c45469ffb42ea5d8c13f792fbbb3611179e0ec2a083694bb84b99c6d6e20238c35e59f3e8f5ba24db10307092e933b8c0071d521b89fd146ef3f2cc7524ed2e
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnsmb57GBiOl6a8JTth/RWZvR6wQQq:ea5POZ3hJt2pasx2+mBb5+Pl6bJTIZ5U
TLSH
T12C65AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 97fd6a930fd528426792c97d1af2ba9323c0ac2d2b3f8fc508f647218d6c2227
MD5 493a3b65a584d5116e1f9870734125f0
SHA1 2c4e61192600b142dff22529afe5d18c5d85203a
SHA512 9aa3d5836505d9e52d4cfed49461fc9d5e025da313f0be3a7acac787697f5a44b20a8d65d8aaf231e13fc65af6ac3c033d79d4b49e8c76254b8116689c711c2a
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:ENc/zEOVHFqb5+Pl6bJTIZ5jdgpE
TLSH
T1C8858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8eeccf7afea390cf06a68a49d84743ad10cedeb7f2a4e501f3959cc0410c1af2
MD5 fd0d3657709cec83d6e1ad18cc8d2782
SHA1 54eba81c5f513f0ad78802e60dc054373c993873
SHA512 8e67d65d3cb858ee5aaa50e544c7b4a4cefd927d8047f448c80d08f53d19a04e6618c940400a15dfbb70873da82d5db63b69fcc91d13158a57322daf368df143
SSDEEP 24576:k3kNvNnaFeYhJNtmZBmpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:k3MwBtOmkb5+Pl6bJTIZ5jdgpA
TLSH
T10D55AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0905069b1f7ad79f76979668e8fa3f421c48aa1b8f3e826bb6089f4cbc824268
MD5 69ee8b5a1e0fbfdba36f32656a004fb6
SHA1 53ab4ff2b3e9788a8dcc3864ee7629d326250a9e
SHA512 2d3d0a307e164748f11b57dca732a045db1734f677404cd4bd2d695e9a8ca59ae2711bfa039c768619142e1c5e5edac566b6b462d2149d615171eae962aa0246
SSDEEP 24576:rPUr+NQWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:rJQZb5+Pl6bJTIZ5jdgpB
TLSH
T1A475E11F26AD18E5E57BA17DC9C68709F671B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1ac7a92b42b462094a4ac3bee4fdf298802f2f1173714f3242faab0f832731c3
MD5 3241f73c949fac039b5195e2592b67d2
SHA1 c7731f7382cb565ffe69fbc84f932851ac1c8cc1
SHA512 bc0e47a639d527e5caa372e2ac45dfc6324aebe5c5580f54bcc3283873bd741cc93d585b040c8a1e5581d11cf8ff19338ea73f8d50cf31131cd00b4fd3431166
SSDEEP 24576:kD3FHshBIYQgApmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:kDVHeBIAAkb5+Pl6bJTIZ5jdgp5
TLSH
T10085E17ED65D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-322-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/944-89-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/944-87-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/944-95-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1400-0-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/1400-8-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/1400-45-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/1400-1-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/1796-155-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/1796-56-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1796-50-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1796-49-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/1796-57-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1896-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1896-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1896-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1896-24-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1896-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2152-324-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2152-99-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4064-75-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4064-83-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4064-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4064-301-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4344-344-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4344-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4344-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4344-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4344-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4608-128-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4608-135-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4608-327-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4608-129-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5288-342-0x0000022A01BC0000-0x0000022A01D8A000-memory.dmp

Download

memory/5600-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5600-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5600-122-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5600-116-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5600-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5600-329-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5828-148-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5828-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5828-146-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5828-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5828-140-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5832-82-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5832-73-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/5832-61-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5832-68-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/5832-62-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/5960-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5960-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5960-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5960-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download