61268d379bc151facdb99f71cf4c03fd1281cb714f7155be20acce7b279a2a66

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.3MB
Sample260812-p4vkmsgp8z
SHA256 61268d379bc151facdb99f71cf4c03fd1281cb714f7155be20acce7b279a2a66
MD5 c2c3be3c41ebcb63c941470cd1ecc94a
SHA1 eb65a1cc2e71400ba8ab8c98217c431089770133
SHA512 b24e5170ba389acb0b096dac9aeb6f40f0fed90583405f704ad64113aefe5b321717c298274fc0c8bb1795f037ed3ca5009e327070c0c1e4fcb6c79f6940de8d
SSDEEP 24576:YuUjXfYdbrtjrKKFJELMY6U0aGCXTeSKsyd:hqXAV5OKF676sGCXiXsy
TLSH
T1BC5512603DD19072D4B734311670DBB0AD2CFD301EB4DAABA74825395E35AE1A934ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5008	elevation_service.exe
4200	elevation_service.exe
4900	maintenanceservice.exe
2000	OSE.EXE
4244	PerceptionSimulationService.exe
5592	perfhost.exe
5700	ReFsDedupSvc.exe
1868	SensorDataService.exe
3232	ssh-agent.exe
2460	AgentService.exe
3288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4bcde7d8e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a29dd59d592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006009fedd592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ea6389e592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000918ce59d592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000721352de592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5700	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2460	AgentService.exe
Token: 33	3288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeDebugPrivilege	4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4436	2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5008	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 6092	3288	SearchIndexer.exe	99
PID 3288 wrote to memory of 1508	3288	SearchIndexer.exe	100
PID 3288 wrote to memory of 4152	3288	SearchIndexer.exe	101
PID 3288 wrote to memory of 3688	3288	SearchIndexer.exe	102
PID 3288 wrote to memory of 4864	3288	SearchIndexer.exe	104
PID 3288 wrote to memory of 4944	3288	SearchIndexer.exe	105
PID 3288 wrote to memory of 2332	3288	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c2c3be3c41ebcb63c941470cd1ecc94a_amadey_avoslocker_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b4d2b04f4dc0a7555c6b28f2d88b7a48c794cf2e324837dc5b1b7197e7ef8cc7
MD5 a02d2084ef6a4cb33d37f4d0de70fa12
SHA1 d3ae3383de3b223aedf6f0dafb23a6de20b3e2ec
SHA512 816d729cccc96babbc35d3c7e56f1d4ebe9b5d55bd710fadfe6e02262ebc21abaaaa484e182be0e884d702e509f2d50116c68a1e125b3291c8b01ecb9ddb1a2a
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnv5OKF676sGCXiXsy:23q6HjBYOK07JGCXicy
TLSH
T1E9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fb2818591692289d59acb30a8d1bd8aa79ea3ab98657d74ddec54d667e1d283d
MD5 46b2bb90428d5ef13e9f6c2a91c3a789
SHA1 2f6184733a4e7a166f6c742bda4bc066473b2f4e
SHA512 f7e151f8d87586045a4885b0b0503a56325aa061c59103fb6e52727f8792f5208dd3b5c11dd649f85fcc41bccd16646d807741e651e37ce2f6a07b03f2074af0
SSDEEP 24576:OXYfDtczAobrtjrKKFJELMY6U0aGCXTeSKsyd:NtcB5OKF676sGCXiXsy
TLSH
T15A65013867E408F9EC678239C9A28501EA327C5547A4E7DB03E499391F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0d24adef6671f97b4efcef83e95bbd26d6855279ec68e2af0072694526cc4f82
MD5 7d401015f71dff678544965cbeeb61d6
SHA1 70a6e694de061e9ed36ada2e23ba34bf5e251aa3
SHA512 158709d2470b2aaffe8df781f790e130c93a1195e50cd95801d26db6b6fa811065c14950306cd4d570387a1b64fe39881150fc561676e9522cacc33e5e96f034
SSDEEP 24576:P0Le5ji0hmxirMPbrtjrKKFJELMY6U0aGCXTeSKsyd:PPji0Acu5OKF676sGCXiXsy
TLSH
T16E859E25F6748335D073C0B9C5D2A68AED7130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2750625d1053f302f978629af75ba076d1ed92daa6345eb4d574d36e2ab061c
MD5 b0fe811c9a6b593f66658d1b7a6cbff9
SHA1 c636f7dbb119736aad5714b7d2e070b5b08411b1
SHA512 69527dc64209a7e2e42ed699e71d6fd30fc6394c387762b45adbae98f3656249a448656b456c33294cee155b8f58e1fcdb1bdaf0c91bb23400cfbe01743478b4
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuxbrtjrKKFJELMY6U0aGCXTeSKsyd:+/ezSC6vUzPvxHjyi5OKF676sGCXiXsy
TLSH
T108755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14256c49ca0dc4a1c0f22d9cbcc7a2748a3d3c1b155f9437c1a5ace9b605dd01
MD5 fee7ac4de62b4b7c399ebab956dc47f3
SHA1 e3552749e374d7cca380f7896e05fcbbc1d78015
SHA512 ba2abf6df6c5ae3b78d69802eaef3fe87bdee242b4230958135e2204377e4845b09db3521eeace9a751fe8037e0caba849bb4ce2f29a7af27a54759fbb373a19
SSDEEP 24576:6VbqPb88hv/l+6sbrtjrKKFJELMY6U0aGCXTeSKsyd:6VO88hXl+b5OKF676sGCXiXsy
TLSH
T155559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 57cd67119eaab90b8eb05c109de8ff801a1dd9111582f48c536f62c7879a2ee6
MD5 28ddb6bdc450b6247576525faf382081
SHA1 376b359de9797858bc7ce1fa91b5345b681e016d
SHA512 af09af522baf1806834d4b82515304dfefd0eeaf0ee94e5e6ee22e470ddddd0868b6d7546800486a5c89e94c126e1a8537283c53595fa59d22ab56270fced616
SSDEEP 12288:7RP7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:7RDbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1BE4523704F7D2449E1FA2132A6B35EC4F8083E185CDCC978A865762D247EBEED0685ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7b1e6590d08a40d8ca34a7ad18e2f73f8933b08344fb64a8ea2f048f84939fa0
MD5 d6fee4a7418101d44bc09536135ca4ba
SHA1 490f0e9e090f07419beda834999c8f0728f1efe7
SHA512 a8cf99f3491c71cf55ce6624d639e8c539ada29a86201ec4bf76e82ccc4bf06f781933b87948e5292d5a5c9e5aa6044e40138590cbbaa1d7b84094b1c3bc4f95
SSDEEP 24576:0JIU0brtjrKKFJELMY6U0aGCXTeSKsyd:0JIUU5OKF676sGCXiXsy
TLSH
T16865DF3BAE28FCD2C27E89795B918740E76278304F61A3CBD174830E9E236E55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 187d63c943cf5516f7321be83ccc6ce61532dcb1e4ee0fac68f4171d1ea5dd55
MD5 cd2bc6a6fc20b5df37d4103acba00309
SHA1 a148df4d864c66d7b05a002f5b6151814cd8fa37
SHA512 f2b4daf0acf09e258a51c36c77b82b321bfd0c631958d3a2e314c3d8dcb8477371f5c76898db615443d335329475c55fe825bce80d9f94db704ffe22b446acb6
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:mQvGAdlCEL8c/yRNw5CDOK07JGCXicy
TLSH
T116266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0b923ba2b1dc0e98cfa136ac9f46fbfe2732b252c32deb149ef5d44fbd60e43a
MD5 7666840a1cd0197bf294b43e4f47d62f
SHA1 43febfa9ca7ff80413a029be81a3fcce89c0a32b
SHA512 3798d9ac4f2061c71c5d24c42791c368b5abda89909758d63b9d69a4a477775d9c9bbcb9aa6bd21c788bcdb72013083f121cb2c5852d5b382438020d07e8f983
SSDEEP 24576:GdewsAjObrtjrKKFJELMY6U0aGCXTeSKsyd:ulj+5OKF676sGCXiXsy
TLSH
T19075E031FE75E436C2BF0DB21B36C716582C79204FA519C3E3A89E9D59342D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f4ba9503a0338636fc93f179c4c7802cc808601b656cba3eee152cab85408485
MD5 7046625b83c3d2db48518f00f8249be3
SHA1 bb10fa936e7286e3fe11083de149d229f34ab239
SHA512 346a0b0f1ca8133576145408abfe7616fd7b1ffe4f26c9074ebc6a827f2062bb80ef33e08c583910af41d8d8d77f66bcf829e234a9ebe3e5f3beb618a30323ce
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHq07MU:wUEtQevvqc2W1cpV2EI32q0
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a8c07b74627a609a40b854001159d9a62c1a5e5964be2d10358aa7561af4c154
MD5 eceb5d9f69d319d4fb745e143af61e15
SHA1 1138ef91b1a3d68e0609a74d862ba2a8c6fbcabf
SHA512 278b7f5669936b860ef19ded5e5b95d25ac8065b8bd7aedeab3d8cb271a4ca38e112d13bf020f7bae66d27240b35dfc06c659d6e4931ce048f2e504a59b40207
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/ze5OKF676sGCXiXsy:doquVjnm/OK07JGCXicy
TLSH
T1C6D58D1976B881E4D1F6C37886A2C647F37178154B34A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a5345d6cb0dc55c2e5b4d527a6938ce106ffc9622e1514642b60b32b83ccaced
MD5 876eda9e13ce000c0d6d4d9b3647f029
SHA1 88c5352cd2c2eaab1d2032b8627eb71aae6cdca3
SHA512 7015bf29bc44838ef79b348a692f0ab0ccfb3ee5ff3509ae841de179e6b2054fd9270ce98e76cb118a787bdcd9c83934a39511dda606fbe2117951f057dec727
SSDEEP 24576:IAhGLJIFoiwtA5l7S53dbrtjrKKFJELMY6U0aGCXTeSKsyd:IAMyFoiq5F5OKF676sGCXiXsy
TLSH
T15C359D80EBF955D4F5B3AA7899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 28dba4eb84ed2d4ec2cf6783d4dbdb4d6d7ef3a4de948bde302ad423f1ebfc13
MD5 74958644a3822a12fb152328ef93f333
SHA1 668b57ad4391b603d14f421f3793e09941842ba6
SHA512 ac3b2bebff72426c50c25e603c08034681b9956357eafa948c2b456ffd0876c46368e4ba8a548fb6a7d7723fe3df240a46db4baac3305573fc65d981dc98ba65
SSDEEP 24576:uwuoOWqbrtjrKKFJELMY6U0aGCXTeSKsyd:uwDOJ5OKF676sGCXiXsy
TLSH
T16B65F14536A81CF9E5A78239C657C536F7B2BC012A65CB2F1760C61B2F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d5b228d2d5d24fa899f926dbb8b6b6f29dd0e89eb1e89fcf24daf386e7161074
MD5 aa0d89910215d539e061629f055c4499
SHA1 97a3a61abedebc57486abf78e559bd31eebe31e8
SHA512 84877fbe57c8a8bdfd441c75117d1232b7a61daa20a1c034c2cd472dc1c7a8a655b1b29638a0ed6fcb9eab130d26f770d57d8448c8a9c0d6077eb0a5da0fadcc
SSDEEP 12288:vBZ1Iyc7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:5ZuXbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1EE5512A527A830F9E0E75239C9F24A84E7613C1627B983CF1524522E2F37BD65C39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b89ebe6f8c81eddfa79b893c7e526f96b1b213af2e7fe008a700ea5b962a3db5
MD5 98c2feaced3750b5794d435545e18d9c
SHA1 23a3177d49a0e55b49ce151f049e63ab274eb844
SHA512 515e82b23d04dec33cd95e260078cc1d77f55ddfb2107f33f0b33a0ec271d4ffffbb60b1ec6b45c6b109265fad8768e1d42a27aa9a79a1ff089d1e2d7bb4a298
SSDEEP 98304:XQRQyi36YOcPQLvw2gAf+PN3MOK07JGCXicy:GQyiKayX+PNA07MU
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5c33f481a5755990bc82b78c3b605cc2c000db062e184e681a0e8bb01362ab1
MD5 88b95007829681f86fb598170acc6ad1
SHA1 8faef71a238f38eae87d1ca9be4af3986a1b25f2
SHA512 d3a673c40a7ac0019d5d83112412fc87588cad575012610554d0bc503ee493933bd249b41237fd0a9b1b34b0de49cb3f470225f7a0124d328276441be501d323
SSDEEP 98304:6QRQyi36YOcPQLvw2gAf+PN3MOK07JGCXicy:xQyiKayX+PNA07MU
TLSH
T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9521576fd05665908a02ccf768ad0ebd2b582b15f719d30afc6d2acda6b6ecf9
MD5 35e9070ff085f562f2bbea4c32ab8aa2
SHA1 4536a5fb15d851af65e2b12871a102dc5ef6c49f
SHA512 8e874261b8673c04be40394bc716dbd0ddc760b5176efa532f551869619ba348055e27cde51d3ce89aa72f7da53758b1f81b56130d8714ba162557d764edde80
SSDEEP 49152:l68Qg55nhheWu7PNU3/u5OKF676sGCXiXsy:zthWRc/qOK07JGCXicy
TLSH
T102B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 14406be12b5f7321b2c00881051ed5c89bf572c2775dfb4ed59d9f630d4df35f
MD5 c9d9db847d018d3a6a33bad9642a3cf8
SHA1 a7c3d3f2c2b737169807bca74ac057c2c079d46a
SHA512 0f55b22ef274180520a8e3eca9ba88e6257de292bff0778b77e0c1a5f3ee706d2ed0c5a1b8db4d1b1d537deb7b1bfb3b89886bd1276beae4bd22215711427c30
SSDEEP 98304:zy5112gYy5azzVvL69nLKnhZ9OK07JGCXicy:OLIHmWhl07MU
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f41a7792718136037a3481cff293a49d03f419e80b7fc9aedcaaece8d9906e4b
MD5 2d2e6ee7a916eee4f893ebaff17cf16b
SHA1 525f3e4d715490d9a69cb9e1e0f7f2c0041edd50
SHA512 869ab238fb6062fced4decf2e696fc52b2ef2ec2d14ea5fdca831c5c550de3879f2ec6f434a4efbd0d478692968b771db12ba07e815496c9a7c8fe3477292c96
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glg5OKF676sGCXiXsy:bu6JmVxd2dUOK07JGCXicy
TLSH
T126D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9909847983fa759b9d8a4456bd7db0ee689ff5cd5bd8a8550f350e3a31e69dad
MD5 2027133be98e8e776352d2dfd8ac2231
SHA1 d2443120a7e2923f0eaf52a684d9b454b2e303d0
SHA512 a03c140837586621f4912afc0c62672b7a872edbfaebfb1f47fe9fe34305a91880ce8307b22c02910688b5cd626ea5d86305f650daf6c6d2cc31a271d42883f8
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4x05OKF676sGCXiXsy:wmifPbR/OK07JGCXicy
TLSH
T17EB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5d4c60e8ae6b25b9ef92a15c4590018b40176d8915ebff3ddbf9fc5be8f31605
MD5 8a2915864314122a9dc194c96e4ed4dc
SHA1 a5cbe46f9502cdb90a72308118bb0e7137acccab
SHA512 38c2785e94b514fb1ce45b9bc505a1a25e5a38076a0ed11bdb5f7f602f098f5e8b1628fbcaf7912c0bf16e4c4bb606339e31d81d54aeaf8675923341b464b272
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHq/5OKF676sGCXiXsy:r5dKTi61hOK07JGCXicy
TLSH
T1B2C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 439777e407bc3bdd09fa805dae5187554c10d83335de3a50b5db403a1b1cedae
MD5 c845695300e794b14aa7e5c4d1de2d6c
SHA1 14be5611f8ad451ac7424ddec485a0f49d584604
SHA512 e090bbbfe4f44cbe99bea78fb787623ca4dee6c18b31dc9747cf49eb391b437dc1d99279460602e592ac3c471b154e288d61f8fd5d44c0485255c71804ba3852
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5ww5OKF676sGCXiXsy:wX2iyph7OK07JGCXicy
TLSH
T1DE95BE13F2D900E8D06ED174C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c1128c9c1551ea7e5782210d75bc8d609d18b27b813f448dfa9f21cbe0486915
MD5 289c92dc5b8603343af45b03b282fa66
SHA1 6968b2321903cbb61f9ca6a4250d7f0477b2b826
SHA512 c0b4789b1a766c53ef69cf045b427d93aa9c66312ee62ab4733f1e5617ddcde1787c12f334f40b56ed9442aaebbdf55de62909f12c6d33a861641e6906b0d17c
SSDEEP 12288:Z37brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:ZrbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T19E4523704E7E254AE0A96132D6631BC4F80C3E09ACDDC4B8B969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8f3bf297f4ae52d742bfefadd92109178f1759d0e148a49d7ddbf9ea60f1da5f
MD5 907ed339f496b4c03107fe246ff17778
SHA1 35525c8fbb55238ea649d0ae0bfc320e563e0ba0
SHA512 af4c5ebeb123f9d523b204d12dbb9d097747c2e8fdd3987e19867eae95b3d4419b2873deb2c68b3fe7e6247a103beaf8e2997eda1e5bf782f866d2295063f470
SSDEEP 12288:2w7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:2CbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T19D4523705E7E254AE0A96132D7630BC4F80C3E09A8DDC4B8B969712D357FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4e946a76e018dfb8ce1fbe05752b166b6da24d295f77682e495aed51b3e1d0de
MD5 0c09fa48edb554e89d37200666ae2af4
SHA1 d44ca18b3d8c6f36ab9fb900bede01e6b6812d6c
SHA512 3959f4f9e199369b9d353ac38fad18230133ad33eed9d41f69b6b22823253731d86372862fd9fdaa2bb4398c58c9d6f63b8fc15a3feabcf364e91c1b78a7cb7a
SSDEEP 12288:1O7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:1cbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1424523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 47d5e33cfbe342c11d166886c278f53cc04c37c48a4c0ecf808189eda91177e1
MD5 647d8dba64443fd07e0bc08a797f957e
SHA1 e166a62e7db0dd48c5d3f074ee83c5e4c5e740ac
SHA512 57eb1cd0c3df066c311c199b3b22e08ba5814e7011f5de77ac7a62c7ba646e5db2aed747016ca7b7ed5a63a33762b7cc93c17ed596248b6b7b20e22cc942c830
SSDEEP 12288:dVd7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:lbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1CD4523701B7E10C9D0F6A231C6734AC4F9583D18A8F9D6FFA910252D1D7B7E96438AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 be6fb257c72de44a67e9e69c48432cbd0ddca8563064bb736dc7208421a5f6b9
MD5 ad15b648b627a4a124a0573f7172a424
SHA1 7323087a79370a7742f80015e2d77156188f9323
SHA512 eb51a3f782a9c5502711065778e2b90864ba0d8304f3ec9be03f8d7681f8196f695c145a0d33fbaaaa383810ef24f0789c523c533e6c505ccaa08047be7cd5d7
SSDEEP 12288:9V7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:9VbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1534523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 91c05fd1d55a55a4ab7ba0fac441e03c3cb885057764d8a8ac0edbb1e2153ff6
MD5 bc0279315a411799974c8675ed14fa61
SHA1 0269edd09919342f4c6c75e69453ce67bef27a77
SHA512 2d050a2d04bb6566ed8c73d4e7221b10a1b385d4aa7c732945e29e47a9eb7865aef6c975b1f6f97b8bc51fff4657757e58f59dc94ccee4fb27d239fb551fdf59
SSDEEP 12288:I07brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:I2brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1234523705E7E254AE0A96132D7630BC4F80C3E09ACDDC4B8B969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e48ba13c4a7877664a36fa6bdbfe572046c94794c658fec8d0b518880ff2da76
MD5 b7ea8531d9093406fefb4b36ebfa28e9
SHA1 699b7ecfed414312beb73c0ce4b8d49ae53269d9
SHA512 95ce0992116044ea501f3ee42aa3e1bc3ae02dc46f4329aff52b43ffcb2a5679e283bec62eb63689deb4749442ca7c6824a5419a991d4b0eb19a89d67c8fb838
SSDEEP 12288:5o7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:5abrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1654523705E7E254AD0A92132D7634BC4F80C3E09ACEDC4B8B9697129357FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e0c73cfd5c7afe4d3b692880e1a1eee236fb19b917f0a6892166f1f4721132f7
MD5 6d1ebe10beee6dbdfd8793496c8b2f23
SHA1 a09d2902b5a74b2729ff6727c2c65b1f02620217
SHA512 29b2498b9221e41fbf65b8e32e9af2f04ef76c3ad61262f9e700ec0f5b42e2a4b3b1223bfd60b9d579709b353286d79f4c5555372fd0d6ee0941b1ae67a0d4c5
SSDEEP 24576:fZMSzFVSOibrtjrKKFJELMY6U0aGCXTeSKsyd:fZMSzfm5OKF676sGCXiXsy
TLSH
T1E86502A473A418F8ECA7813EC9668945E5B17C190AB0C65F17B4362B1F373A11C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 494d1263c7cd415a069d1739eebefcf8a60067b2b64909e2c5de42abac457032
MD5 8e2740405bd8263042e8d4255e9d7adc
SHA1 d21842ee27a615760edf7bb9bd51ed5e33ee5017
SHA512 88d45906b22e336d160b83181f237db91be54598279e3bf4a7866b9d93860fbea517b26c674dbfb015f0ef7f83f152dd5d31933ff23318d28861690e9f3e234e
SSDEEP 12288:Jj7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:JnbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T10D4523705E7E2549E0A92132D7634BC8F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c8616119d09b5f5f8000d73532121d3007a387e7c1de2a4d4418f2783eaa515b
MD5 9acd38d679a67b8e16e2fa40ef772717
SHA1 4be5fcd3ce1f0ffe50eb0f875f6d9a78a11b9ed3
SHA512 aa8d3400cb4e4557c735b356141f4f31891fd6cb7f98dee65ac29f8a205b708d699578bf0576acc7ae2ff6a03f3544e5d6d8dd643ef4bf2e55d15eb4da849814
SSDEEP 12288:6/7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:6TbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1404523705E7E254AE0A92132D7634BC8F80C3E09A8DDC4B8B969712D357FBEE50585EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 90bd81e62a3ffdaae9e5b5f749f803937b5dfe132b870831df1d6d0d740906ce
MD5 cfb36b34618c723686b80b0109b0cd54
SHA1 9aa18eb1636ee557a58acd08e0108d797e2eebce
SHA512 0c85f9e0f35293075585ba947c7c03cdea4889be2d359b137fff81a7a653e16a48db735e57386dbb567daa52029621f6248a54834bfcd3bd6c54862a02d14b87
SSDEEP 12288:gyPz5L8c7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:RzyebrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1F955021327A530F9D0769235C9A20A41F7757C360BA4CAAF57A4033A2E377E19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f5bb348519061f178c05b35d438c79f84df039d4203167bee5bc7020870d6fa8
MD5 868893c5d7dbdf1acf37d3adc0a47898
SHA1 047140fc35c0efff57d247643f6412dfad56fde4
SHA512 b490e04f52b077a5876885bf96b5b32abce9d001020520c01ee5357d3234569a17cc27ad0a97d2fdbca853978ededfb0c17f33a36f9b4a44065826ce5dbdc26e
SSDEEP 12288:Ij7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:InbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1694523705E7E254AE0A92132D7634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2417a5d27f9c5ae94911f92a78c61407e12cad7cd894b9e4ad95b3db27926261
MD5 01dd053fee66aa03eb4a974aa0b14464
SHA1 2585d9ddadb3d7d526f9d20b011c394079e78a41
SHA512 ce2a1c0d390d52f2064f5c682418929670988b5565a5be68912ac6923e5750e0cc92a40c968d694839dd32884fc3ce886527c777ec692515c9098a7a62aa914b
SSDEEP 12288:+j7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:+nbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1384523705E7E2549E0A92132D6634BC8F80C3E09A8DDC4B8F969712D357FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6f1a6782c3f10c9239592bd10dd7509583fa551cce6b785eb9ccdfac2ca2d1f3
MD5 714d14ac7024565adb6445d4fb5e8960
SHA1 5c3e05d338d289c5bfd5c70974a26702a8c194d9
SHA512 f8240e6f1b7faaa65230d9422576d579a0642e2b3130959d7b37f38fa779feabaadec1d1fdec7178d5222867fb79e1c23c9b4d9981c743d1f01778988eab2eab
SSDEEP 12288:TyPz5L8c7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:ezyebrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1B555021367A530F9D0769235C9A20A41F7757C360BA4CAAF57A4033A2E377E19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d95bf76a10c4b4629a1ec6a9193f33fa02670c135c41f6b05b2fe11f5ad65cce
MD5 8e8ae91166759b1e94a05fbff0762937
SHA1 51922aae219a7a7da6f2aa0163e2d5398eb0d7dd
SHA512 8f4ed34a729d6e1febe64eddd9b449b2f332bb67ee952458f3a5091b34cb6accdaa54591a59b010bbd8e9a5e23c074518970e12b22bfe8e25cd26351c6ef3a55
SSDEEP 24576:fTHaLl3z0zDMbrtjrKKFJELMY6U0aGCXTeSKsyd:fT6LljR5OKF676sGCXiXsy
TLSH
T1236502A4B36018F8EC67813EC9664946D5B17C1A0AB4C65F17B4362B1F373A11C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ce13daad809b7929249ff4bf8534979bc3863442402b57913fbed8773753ef55
MD5 6731ad4431daa7e5f036dfb78c18c679
SHA1 73802ab001cedae93eff5ad00a12ebec38449ccb
SHA512 4dd34d4cc47df5c0163dec9c27d87782530ca83d41128b85beea15c611022eca51495793f4cf26a26dfd31fb8a02907ccddb5c93314d1570a7b8e550e38f5c4c
SSDEEP 24576:o37d9CHKy7GZwbrtjrKKFJELMY6U0aGCXTeSKsyd:y7d9CHKyam5OKF676sGCXiXsy
TLSH
T10E75CF90F3E814E8F0B79A35C9764511DA767C5A1B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cde25154134803f7c9b30edc53230fbba7fbdef3763ec7a46999e2e5f5794e1a
MD5 9f8a73b5dbef2d9f43928f0552b74ab6
SHA1 69466bf0b866d611bcbe53aae3955a57f1c6c90b
SHA512 e014d93e0617699bee36d9cb9286f566746fe8f51f2136c87b22300382aed6a2bf4fbe4888cbe279c9954c27a7a71997014cdf2a9cdfef72acefdb99b6007b0c
SSDEEP 12288:/u7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:/8brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1D94523705E7E254AE0A92132D6634BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ee034e4979842f0c61ce9cb1b68aebaf4602c6863996c9af28557824c15729ca
MD5 f3e8a3aad0da18c47abc6c40ba1bd17d
SHA1 b75f0cc9c3fa9372b0b3a8ad8c7d075c62c993b2
SHA512 5bc4c64875ca2d5aacd097c1174e09f5553fc6dda171eee6f91f96950529ec46790b948a3ca30be01299a1ae45388155f021046adf6c1e976369a8b9d007c314
SSDEEP 12288:q87brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:q+brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1654523705E7E244AE0A92132D6634FC4F80C3E09ACEDC5B8B965712D257FBEE50585EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5c9278e4f6032d6ae302063c9133e1169a9814ee92d436ae5d01c8eb92d4532d
MD5 0ee965f4a265fa29fb23b5e562cb571c
SHA1 70c0ae8827e7180fcfc80e06c8df481c53505779
SHA512 a0fb1f94741b397609d98d9b553813480d9ccf0585c93d0dd472b25089ae9bbaaede2cb131236cf0c229e15a9e0cf2843cf1b021cf602da63117249a53e42c07
SSDEEP 12288:Ep7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:EpbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1A74523705E7E254AE0A92132D7634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9a365326c79e737629084573fda3442902a32e822eb7754b34366a58e8628bb5
MD5 a52f72e89e28a859b108ba8ce28adcf8
SHA1 d977dde1a3ac2bb8acb4ba4ca1223336296810d4
SHA512 b26350dbb9dbb452bba1a41b548e50e4a5ae1c04462356f5f6a10515bf81232e8f136eb78c5c453e61116ffb32c18eb58796fd46674eaf22449a2a6ad3270de6
SSDEEP 12288:Zj7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:ZnbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1324523705E7E2549E0A92132D7634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 07cc982250266193254047968d1fdb4527d151637f9c694294c946b3e248cad8
MD5 edc6020830828e1dbfef58f8626d0657
SHA1 99d2665bf43a9df013bcfa8cc3afb1a3b47d0bc4
SHA512 630c6c577ca8d15905a362c62d3c161d708100c648bf66e48960bfa25bf72da82647e3e2d41f1c3c81f8f0890847d7289ed37db038912ec06da94bf8230dbf4b
SSDEEP 12288:6u7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:68brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1914523705E7E254AE0A92132D6634BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3f0269711a9917a377098a41eff742d90b26312cad4f37a9067c288403b23277
MD5 01738114e090dc41a8982f3677158b6f
SHA1 6536676ceb0eaef8c260408457438d18c8aba434
SHA512 563e5b8ba2ac58d5b11d767f769ecb76f2907adca1e32d32487be4d831f36be7ed1c26af4321721fa97da700f089cef6d3c94ef74bcf74a8d6f734f71f150e6c
SSDEEP 12288:Hb7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:H/brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1614523705E7E254AD0A96132D7630BC4F80C3E09A8DDC5B8F969712D257FBEE50688EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7dbd78a939b58736ef566424bddff27f9d97b9ec90facc290fd8d9732566ab06
MD5 f5db743d8c331e45801a26f9968dff8a
SHA1 a4f4b523ce5558e6cee0ba08e728287a6f8f5113
SHA512 0ce1de4884f09dd01becc0d300f0f9a73efe5d1fbd13e81db9caad508d11788044129aad4b89f1ae019bf1e9b481109be0807aa531e6f8373573a6e6938011ee
SSDEEP 12288:VV7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:VVbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1094523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 db3f360da45bbbaa2b5535e1c649c3bac5da2e072ce3c6a284d1049fb9d26158
MD5 76e1515ee75674e3e0002f09aebfa7e0
SHA1 50c092925138c4af8778562a2ec0454d648b1410
SHA512 b52e749bee082b93f8de4f4c217f0de7859603a9d8b03dca45011c3821e4ca950d9236d918e434abb1563f68066e76ba9f6c4edcbaafcd07e97af7aca4b50732
SSDEEP 24576:Zfwvok9RX6wkyAIjbrtjrKKFJELMY6U0aGCXTeSKsyd:/MnYIj5OKF676sGCXiXsy
TLSH
T1C685DF29EBDC04E5E0B7923C89B3460AF6B178691B71C6CF129A536D0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 86f4ee2e88f3f184aaaa5b26e41fda46192847bf41ab0b0f6fdd845ff44776bf
MD5 6af759441c344456b7cb0af7773ee5de
SHA1 39e84eac801c46f6eba38a23cfc62947675c6a9d
SHA512 d3da8c8bf414691bfe8b8f355d502002504b47ed33806465948394e9d8082133f022d11c91bfc860786f8984c06577eb7281e051610bfed17b5c3d5e90d953a3
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Q5OKF676sGCXO:jySzPsOK07JGCXicy
TLSH
T144066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 617747ad814fc45715fdf96470693e5ee83afce96155d2733b08e526d1635504
MD5 bd7b87efc4d2980b81f95fee2d7780f4
SHA1 1878a8d712abeb0704e1cef1e2e7ab646aa848be
SHA512 00a38edc0954389e244ad15ed38a74ed6097fd5d263ac32532f4e23f956ae55702a5064aa8386f4e124f864acaaed69aabc00acb8989ce375d80de0267492d69
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYybrtjrKKFJELMY6U0aGCXTeSKsyd:w47JUQj1irIhCnDHUPfF/g5OKF676sGr
TLSH
T16765AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 59585045ad456f13236982e47e031421943b6af8d06647eb1c131c556bfb1236
MD5 4cc355fedcad32548cbe690ff6f1d3ff
SHA1 d594a353b762e7a3b34beef6d1c7485b03effd3a
SHA512 9471877869e388eabf768ca5813d6b2ed81dd91c1d9d3e25909b0505a7dec8441dc039899d064cb8965d95dd2aed2b246e7d4de3f4a09c333e1a7d3a2bc2a249
SSDEEP 12288:LNsfz7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:IXbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T13A550129D2A812D8C0AE6235C7524A80F7273C2597E1D3CB66D0F53E1F3A6D49DE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1564dc2488b50912bbf33deaa8a0bb862b7eafaced0b02eb6bf26b191f7a1bdc
MD5 b8fcc41bb15a0e952ab9be99bbbf9956
SHA1 0bfafdc38b7551a951517e33da55df16a5d2becb
SHA512 63e72b9aefe7201094ca787086598a3586a56c3a87a1af8774020f44631909818e3487a166e7e851f6d0b269948c9aea2b9100ccd011381d3590b93c134edde0
SSDEEP 12288:MOsH+LU3frL8U08lT/N1eFGhg5m5paaCJbx+JU1:MOkoUPPtN1eFGhgypaaCBAJ
TLSH
T114352900B66AD75FC6AD40325E32C2CCA7707D41EE059B0772C8872FD57666DBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ddd6f83b72b24bd72bba0a775dc8f6639cf9fb16a261707a0cb45eff085743d5
MD5 ccda2c008e8bed6b46033a0319818194
SHA1 c3c2ed6274a90ec12481afa0ea64291cdbab6734
SHA512 291f0ce58bdb944fb153f483a5f68144d55f1af65c4a040546ea74eed36e841657986c16cf43ed3762025e28d08da0813bf7cef1cefd11af1d68baafbd938586
SSDEEP 6144:vP9DuJ3vqzu2qGVhdYA5lZcgg+2u31nB5MI5x6RaPzv/W29+HdH5zSDvhVLeXz2U:vPE3iDXhDr5N6RaPLYHJ5cvXSNDyXyLp
TLSH
T19F65D881A537A3CFD1FB6032072A5B4DA764EC0677056F26A3C8453ED82A725B1F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e0aa23f61c2f0a1d6bc65cdd545fb675402e42c02ad2f7df1869d79d41b07341
MD5 33f1a15006b94ce25f7636d64f76dc13
SHA1 4d344bec69a7b00e157c4f024ec9061f91ef4d50
SHA512 af97f365821b726edbec4ad7f2aafb5522c5da19eff062909592d15a8cec249fbabf1c8638d4ce46d72a17ab16a2e68fd62141f7cf91f6926d8a41e663626455
SSDEEP 12288:g07r7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:NvbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1C54523704B6D2909E0F9223196678A94F80C3E185FD8C4FBF815722D247AFD99C78A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 74a4da127b9cd89bfb71b129609cf4adfd2110e8eb1e361c1ae443cfd6ab33c6
MD5 5bc1401c0e87a5e946af59810297423b
SHA1 469074fcf5d441c5cbd2d5d9fd386676d6a3bd93
SHA512 b81b6d6cb77d97d251894914b32b3f520b8ec4a8e8aab0ece5837d7a12275317192ce844f8e328943202fa6774cf38777404c9461f0242c4a949e4f0deff9d78
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYxbrtjrKKFJELMY6U0aGCXTeSKsyd:Ggb4mBIBhGFa5OKF676sGCXiXsy
TLSH
T116659E1E22EC02F5E0FAE2B8DDA64417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5eaef118e017ca0d83e74e7aa1291ba86875c17d7568f0c44a17e629d83a841b
MD5 679d24ac6cd14c0099f7aef44a3a809e
SHA1 914be2c07b5ef6e1f2f67379b814d6001fc17ef6
SHA512 eb0c9675af7826665395c807841c0d28ad19987ae97aa51878b7d93aec18651c8306e610dcfea68e909d071854e2512e3c8dc6a923856e43e65e3be183034498
SSDEEP 24576:0G88u8FpJqH1bzria7/mibrtjrKKFJELMY6U0aGCXTeSKsyd:H7ZFPqVea7/Z5OKF676sGCXiXsy
TLSH
T14D85F16577E501F0D07BD1388A8246A3F6B1B8250364EFDF06A88B551F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 238e4b7d62abb064e693a51a67d61fa94a66a95b3df238b476f1cb24c1f10a9c
MD5 bb130fc9c443805ca4f281f3ce4cd558
SHA1 a66dc6760e283b0f5195ae3645aa9f3cc0629051
SHA512 68a63ee771fa92d13e55f5a9e23eb3a5e085a86d8c37052b7c01a4c10ced1f5e79c7c3c30754c152b988c39508480a02fbde9c81faa8c79736e714d0b7c6784b
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW5OKF676sGCXiXsy:LG05lO43bVOK07JGCXicy
TLSH
T1B6D5CF6A62EC11F9D0BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f876f40bf978988ed30979c12617314fb0489ae6b171f54a46caf4141f5900c7
MD5 cb36b9068ed50bcfe06a86d47e34e75f
SHA1 2302c7963c90a7421c966dfc1d47038ab56c06eb
SHA512 397d4649cee43a78d40f73e87b21d0d39aa853218163ecfe4e0d9e05695eaccbb4388c5c2893e7402bb28cf9960ea5bc17e204a13bfe6f29a2b75bcd8451846f
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnIbrtjrKKFJELMY6U0aGCXTeSKsyd:Ea5POZ3+Jt2pasx2+mu5OKF676sGCXiD
TLSH
T1D265BF5EA6FC01D5D1B9D17DC5834A1AF5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b423031cd70baf72a6b56b1f1021b58e12a43d98a2de2f3e012b075191aafba8
MD5 e3fe76cc539edd3dbb2c66dc08f887eb
SHA1 1b1c9320c6e11e269581935cb5d08c8fe0540e7f
SHA512 c4dd418e98ec554673fe3748369a2dd7da4ae9bff678a797967d6984f29aab4b02ea56afb57cf7f6ead483e1725262b4664215bcd49fa160710718e532512b0d
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkKbrtjrKKFJELMY6U0aGCXTeSKsyd:GNc/zEOVHF55OKF676sGCXiXsy
TLSH
T1D5857B2623E901E4E1BBE1BE89779546FA71786517348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5bef8cf25d3023bd73e851d575a1f5d7b46ea1d6b09e37273facfe572167bd86
MD5 8ffa0e2bbd76a3a7061a253092c1b180
SHA1 8218897b7ec01738dae5c37e85ac7ce0564108d9
SHA512 063bd8c7bbdef4d508b3ae2679ac9f34dc7dc782cb42bc1db658aa5c037e6c3d884e61bbb68318a0fd23b148300a5c0334a79de5be78f2f23b35b25952b591ac
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmEbrtjrKKFJELMY6U0aGCXTeSKsyd:u8MwBtOmk5OKF676sGCXiXsy
TLSH
T17055AF6EBAB806E4D1FEC675CD238512FA727861073293CB5290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 93dbe18bf22234f2837082f9cf6259cb2cd50eca884d250b6d3e48ffb9a04590
MD5 ad10eb1aad7b00618c974afaf85eb409
SHA1 da5230aabc7e5295adea0d7ba9dcc165cb0b96ec
SHA512 5188bd754c2abf6f8dfdd14c2407664e8a461ffe4205cb8102ebb36fbc87eeb215113ab3ce3249b6a40ba27a17bdd7799a31da64cdc9cad5a321c0b75213b1ed
SSDEEP 24576:8PUr+NQGbrtjrKKFJELMY6U0aGCXTeSKsyd:8JQm5OKF676sGCXiXsy
TLSH
T13065F12F26AD18E5E67AA13D85828709F77178621751D2DF02E0813E1F67EE8BC3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2a91ac38239fa6db31ad619157b79d6377cd650f6426c25e19d8bb1215d1d231
MD5 f6081afcd4d4b273f793cd2983b57bee
SHA1 af0d132b808320243cbc99fa0aaa4654126b60fb
SHA512 71e782c6a56af60406664160abdd803c3bcf14b8395464cb05c12587ecc4426e43d7042cae0012829272744b9deeeca86ae719d956c8f4b2543b318513d7513c
SSDEEP 24576:BD3FHshBIYQgALbrtjrKKFJELMY6U0aGCXTeSKsyd:BDVHeBIAA75OKF676sGCXiXsy
TLSH
T15675E13DEAAC04E4E47BD17CC6638A06E67138A9036255DB02D481BA1F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1868-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1868-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1868-305-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1868-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1868-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1868-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2000-224-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2000-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2000-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2000-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2460-118-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2460-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2460-127-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2460-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2460-125-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3232-113-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3232-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3232-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3232-105-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3288-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3288-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3288-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3288-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4200-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4200-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4200-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4200-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4244-66-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4244-72-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4244-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4244-256-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4436-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4436-79-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4436-6-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/4436-7-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/4436-1-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/4900-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4900-39-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4900-45-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4900-49-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4900-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5008-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5008-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5008-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5008-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5592-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5592-273-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5700-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-319-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5700-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-80-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5700-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download