3a6ec3a53e4e7e11ad964ccca745016254492c6558bbdcac289d9d715b539c15

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.2MB
Sample260926-2ywa7sty2n
SHA256 3a6ec3a53e4e7e11ad964ccca745016254492c6558bbdcac289d9d715b539c15
MD5 4fbc144f8d0ec120f6cfb64c786c9bd2
SHA1 0f5b29fc05a08c56b630a12b3d8a94565df4ea4a
SHA512 a7d1f95e5fe7924a37090d14862abfd0924ab20aa0a2a9157be24558edb9f85545d727c5c6417140eee6293aa3a55b4fc745397e7880e986a60a59c1cfd2a69e
SSDEEP 24576:Muex6YtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ8:Muex6sOUDkzkQtlMBXe27gdbDZ8
TLSH
T19045121135C0C832D67719358A90E7308A7DF9700F6189FB73912B7ACF756D2CA6A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2556	elevation_service.exe
4568	elevation_service.exe
4592	maintenanceservice.exe
1568	OSE.EXE
3852	PerceptionSimulationService.exe
5676	perfhost.exe
1536	ReFsDedupSvc.exe
4536	SensorDataService.exe
5576	ssh-agent.exe
3228	AgentService.exe
872	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28a7acb03a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\LimitSuspend.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0fbbbc80a4edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fab567ca0a4edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b59ff1c80a4edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5abaac90a4edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000811d8fc80a4edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004db21eca0a4edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5112	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	2556	elevation_service.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3228	AgentService.exe
Token: 33	872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeDebugPrivilege	2556	elevation_service.exe
Token: SeDebugPrivilege	4568	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1380	872	SearchIndexer.exe	100
PID 872 wrote to memory of 3356	872	SearchIndexer.exe	101
PID 872 wrote to memory of 2572	872	SearchIndexer.exe	102
PID 872 wrote to memory of 5092	872	SearchIndexer.exe	103
PID 872 wrote to memory of 3516	872	SearchIndexer.exe	107
PID 872 wrote to memory of 3416	872	SearchIndexer.exe	108
PID 872 wrote to memory of 4272	872	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_4fbc144f8d0ec120f6cfb64c786c9bd2_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5676

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 91adf6fcef17a659019a5dd8771597c8a234bcd0fdb49d502e859814e8668e13
MD5 5748f971879b8246c1dd29730f1632d0
SHA1 fad10a827a150693ac2e760c5a4faf4d094ff729
SHA512 4d095e966d93f95e34c3e5bd7dae6b62e45bec463b3c558e5ff0903d6b7aea40331aeafa569c236eb405ce0bbd8af84011eb97a2a6c4eb18cc4e1a7c7742c814
SSDEEP 49152:Sb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnwrOUDkzkQtlMBXe27gdbDZC:03q6tjBzrOUDkYQvMBD7iXZ
TLSH
T1B3D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 a42952c01f32a85bdfd06164141a8069ed239ecea8188b46686c8691c057eee3
MD5 a301e8af054fa819b2bd72d713d3c11f
SHA1 6cc34715d56e68c56ea10c9d7df3b6365a3899e7
SHA512 f248dac14d6bc526a2ee4057e8137a405d97067fdec0fb79b2d54997f0a5f8301599bc145c6497692692cfdd177c6b6abbf5a00fc90b64d46408e8aef2bd7e9a
SSDEEP 24576:BXYfDtczAotOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZa:EtcPOUDkzkQtlMBXe27gdbDZa
TLSH
T1A355012967D408F9DD6B817CCDA2C111EA73B89147A0E7DB03E09A264F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 5ef66e8d47c6292efad18f114b1e404ca2378771d6dbd70b753c3ec448ca5460
MD5 6f58bf5d48a3d577adc0a3e84fd636a9
SHA1 702ea6cbef1ed7182aaa46cfcda35faca2df5eca
SHA512 58d17c54fc862fe2792df5ac88e6c56a3766a2dbeb05bcc78e0c974d0dc81108678ce7af23f77fc4179b93cb5a086a0100c333e3a0cb2c0ac784351379c633c2
SSDEEP 24576:G0Le5ji0hmxWrMTtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZJ:GPji0AceOUDkzkQtlMBXe27gdbDZJ
TLSH
T16D759E16F6748731D073C0B9C5D2A69AED7230815B308ACB4286D77C6F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a1e2e258fe66d32d9558986b6ced030abc8928b7017fc55cd581c939bce71b1a
MD5 d7e86962f37422182c7a978cb253e12f
SHA1 2869a6a775230a32fcccbd27bd2a6a3ffcd4da4c
SHA512 60da6697ee6108d5be4482ee3fc5e73970b838e8f1e3ec6e5a4a05d38a2d04afc395e9b67bb6e5e83fc14737f3b6bd00c7df94288aef9ef1392e71e884cd8da4
SSDEEP 24576:Fa7/ezSC6vUyDZaqgrvWx6q8wyuFtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZs:M/ezSC6vURPvMHjyKOUDkzkQtlMBXe2R
TLSH
T1D1756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 362c9141516b6b1fefa06670fbeb233cc0b5bdc27f171c95626576e0b2bab86e
MD5 389927fdfecb5251915941425c9b54e1
SHA1 b250a58c6960788cbfb9130194e756716bae0515
SHA512 05f7728b9d17cec51870018d53e56f80e6e74e097d4fac5192aa57ce5bcd1322b77d80e6533bf5c7c6e33be3c230442949efb7aeb50317c39eda9abaa55b4678
SSDEEP 24576:4VbqPb88hv/lV7UtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZK:4VO88hXlVUOUDkzkQtlMBXe27gdbDZK
TLSH
T1A355AE66F5748331D073C0BAC5D2AA9AEE3230415B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 14007b33713f30838ccbf0d2d816f755e20d90c0d5bd8d24b3f2dadaa6487f0b
MD5 86e146474e6c47499c0657f0feb2818f
SHA1 e8282611d6e3c7037cafd605b85a20b019763f9d
SHA512 bc37dede9f2f0dbfefb1dc139fa74737ee95cc2cdd7c4d94cd868e716b9d93ab5f29045a358d5faabb26588384c3cf3e59c2cbec7329f63e804688ceac38eb3e
SSDEEP 24576:d+/tOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ6:oOUDkzkQtlMBXe27gdbDZ6
TLSH
T176352352095C0C42C7AF45B5DBC1A2318876DDF09AA2C07FAAA1B75FCD7E4A2D4EB134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7cdfe2ad0ff7b622a8f11dd9b30bf7b2b7904a4507351b95d92e8e2106f84b8d
MD5 8f26933520b4d43793a462bb4e7edc68
SHA1 e64211d2a3876b56854352777a8a81740ac3e5b0
SHA512 6fe60e4c945db27d926e24e3793c8357a4ec5b446683851ceb4ea97ddbab0f06a025c813cf1d1de5b87b42ce0b91d05975cba86016bb2b96985e08684e161584
SSDEEP 24576:uJIUstOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZO:uJIUYOUDkzkQtlMBXe27gdbDZO
TLSH
T12C65CF7B9E28FCD2C27E8DB95B918200D77274704B6293CBE165830EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 01a0055ff9c5ea476ce97a7b5b08bf9dee438bbe940ee4ebafc91f5ad8aa9d3c
MD5 b36a2ebadbe0522564d287848eb587f9
SHA1 bd1fc975e07e278fcf2101c5503b42d324a5437d
SHA512 8a5e91b9458e1455b98a7898fcfae6cdf197f9e2353a78265ffdcb37d3318a6fcdff1c44b652b7b69a6622ea45f67e69a3c236f3e6c74ced2a7b6c55e1eb56e9
SSDEEP 98304:5QvGAdlCEL8c/pRNw5CvOUDkYQvMBD7iXZ:GvyEYc/p3w8YVX
TLSH
T17C266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 796c012fc35d09ad91295e7f14b3cd406eced652d8d01fca561f4ceada160548
MD5 76db373db554fda6e225f5aa1dd6e301
SHA1 df47c8d5a7af4612339a44dd246c9e20fbd2e6ab
SHA512 e8036762b2126cd265a12749faf38b792341327799280168f0eb8827159c34438485840e655ab84ade5216fa84f860217ddb55ccc6af415be0ff1b531f5ace50
SSDEEP 24576:tNewsAjGtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZa:TljOOUDkzkQtlMBXe27gdbDZa
TLSH
T17B65E031EE74D432C3BF0DB21B66C316547DB9604B6119C3E3E88E9E89742D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ae0724b732e3431fd32bcdf2948e3e0677c3855ab9ef735f16c82e3aa9dc405e
MD5 84473861fe1a462bce5f82e905aa0e69
SHA1 3abfa863216ab0db22e0332c760f0c45fd158e41
SHA512 e51112f1855e00955dc0c0367ad8115203a0416d00e2e8509df44a19d373f8ab23bc029c42a1ca4d40162aa220d0c218ec2961bfa54c90fb8fd7386a69e69cbf
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH/VX:UUEtQevvqc2W1cpV29I32p
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2f7d96b0f74a00c55989e369f766fdb47993108ed7f1c2233e92517dd3de5ef0
MD5 63961c7161d77ad7a7d746caca4112c0
SHA1 bff335caa975c0dfb9b9e0ccd36bc7abb4b803bc
SHA512 e822c5aab6c0f289d27d4976e761dbd59a320201db0a1f0788e0488a07886d664e344e305c834cc87d7683b9423c972ad8cc1404b212f1ef06d0052d1584e63f
SSDEEP 49152:/CbRquA/m2yL5zifFiV+XenmE3/zuOUDkzkQtlMBXe27gdbDZh:YoqHVjnm7OUDkYQvMBD7iXZ
TLSH
T1EBD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 793eee6780d2eac09c3f634458e0cbf146de6a6b5d53169ea2adb0915905008a
MD5 29eda06abfe9ee3f0b946b66a22d9f4a
SHA1 69e521b052e650ea0e54c2c6247543f6eac5fde4
SHA512 41ec316a9ce539944a7950bd14445002b5cf8f4a548aedafdd2a52e22d968bfec7e128f8cd821803ae23ea7fea7f20ed4e1c0e670dbe0d081e1b0754aa16bbde
SSDEEP 24576:7AhGLmIFoiwtA5l7S53ptOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ3:7AM1Foiq5rOUDkzkQtlMBXe27gdbDZ3
TLSH
T127359D81E7F945D4F5B3AAB899B69170EA76BCA55E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 c79469c21902c3f5b4db7d7fbfc60eed1ba755e7892eba82b5610a0ba56e519b
MD5 a5974a2107aa5fff79e67989ffba1faf
SHA1 67a0854df8476981fbbaf83210acf2c78162f805
SHA512 940d366b1738ad4b8131feada9fa37dcb2ea87374eeb3f94857bf7a59eed7655a8afb4f081ac4daa60b851c20c0416cfbb73b1c83e1235262a511ff8f4490c11
SSDEEP 24576:NwufOWatOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ5:NwIOnOUDkzkQtlMBXe27gdbDZ5
TLSH
T16055F14626A80CF9EA678139C697C136F7F2B8512A21C71F1760C75B9F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 b1bf9abee35f78f78aa6ac2ac14081ec50ad9b9dc493a50d822c2b75f60a6913
MD5 38a1516868345f9969b9ebd7552f9d35
SHA1 dd613a28df9c147837ad0fe3a36ab67f27c8f2df
SHA512 6868fa9334813dbc02a193fe09363e3e1ea81f31117c9fc49ce2ac6a0f70c8fb479f6402045bec0aabe71eb6b416f0e91cf81957b0ebde384323fec281cbf5b8
SSDEEP 24576:1ZuLtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZC:kOUDkzkQtlMBXe27gdbDZC
TLSH
T17645125602E824F1D3A7427CCEE19211D7B2B4A1677283DF2661436A8F77AD29D3E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 678b931c5088de737eb3e49fee802b17ff0cdfde50fe20cc6efc440f43efee04
MD5 ce31f8a0d6538bfb341b50a9dcf2d490
SHA1 a06162c47e68f68e6e28ffc4289d889c4bed18c5
SHA512 c1732934afa70b409711fb84da03dea7b0fe4d0e57c4ac05290493fbe4445abc76d2cd202bc92dd1a8bc35616e839cb062a7ddb64c6668a5aa21f516fe1b5a72
SSDEEP 98304:ZQRQyi36YOcPuLvw2gAf+PN3kOUDkYQvMBD7iXZ:QQyiKakX+PNJVX
TLSH
T1EF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 15ab9721ff7a67aa5b18104ffdd1626055ae0aa1edcebf954a8c687d9b6eed32
MD5 7deabbd2aef586987cecdcf948200dfb
SHA1 fb8723adaf1b90e1c248f5da49701edd9bd82de0
SHA512 0aa5d2df26324acc884c5e7640c32dc90ba2ed68e59b5bdfa0d27371e10fa90bfc4ff320c89174ca7f2d90ad4a89f8b45804c008a9e2a034bddb527f3e22cf0b
SSDEEP 98304:yQRQyi36YOcPuLvw2gAf+PN3kOUDkYQvMBD7iXZ:pQyiKakX+PNJVX
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 270d1b93bb0ce24fe00caeea00638be84bee4a9b4670a3a6078382fda145bccd
MD5 323af0d30a2d08fcef7aa124d8b46f43
SHA1 cb733328bd28b370a745fb18a8111c100a403fc4
SHA512 14fcc14dec410ea4fbb262aac63300fb69e671510ae74efe1ab0983a09e6a9d8f8f1485b44d3ee42007a855e91f6c1ff618234e890d94d9a442c7739d92ba5cc
SSDEEP 49152:C68Qg55nhxeWu7PNU3/eOUDkzkQtlMBXe27gdbDZS:AthGRc/eOUDkYQvMBD7iXZ
TLSH
T136B54933B2F60099C44DE1769F46873196E27C718FE1E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5bde62611b8b9e0e1e8af34da2a6ed03e99bdddf1dfa0b3232b6297204118425
MD5 0d73dec32090477ad2446dbbbe60d327
SHA1 9aa532e48b6d11ad64bc87140e22ae6129e4ee84
SHA512 6744fec33ac54a953b172fd66612a9116f84d784b8521d721fda5e7042b613d859b3a34b6517c1d8043816bb1ae2b37eb0d08374d748708117a8e52937f6e1cb
SSDEEP 98304:py5112gYy5azzVvD69nLKnhZ1OUDkYQvMBD7iXZ:ELIH+WhcVX
TLSH
T17C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f514c01faf261563c5af808313dfc861dfd1337cc1cd5e3f97960174830c0226
MD5 244430a049b8d03bcc5f27561ba8a902
SHA1 d89d309756fd59fdc92c89544cd4d2ecf2386d5f
SHA512 cfbf6d456cbf6a92ba77eeea8345ca3548a3257c7a46faf6f558376a1a7bf8a42d9d410dfb100b67f43b8c3da51baed0e6e3c5e5a93243e7ff4b25f3a3d87fc7
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/rOUDkzkQtlMBXe27gdbDZ6:lu6JmQxd2d/rOUDkYQvMBD7iXZ
TLSH
T108D59D13F1D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c11f54349f3fa2c0aa3fcfa6f40725bd3147ad90a0a205c65b726ac8b8196ec
MD5 47454670df37a101e99a8c14e3689e56
SHA1 1e766d2f3d8414b6842d5cfd76c412c1c821f6b4
SHA512 c49095bb3aed318fdb03515c08c08147da71a60e4adaf55736234911d9665712a70b7cc05531833e1c377b7738d92ca7d49edee86048de7ce676963d83c8033e
SSDEEP 49152:o1hpsNoJpF1A6yU44CwH7R4x4OUDkzkQtlMBXe27gdbDZ3:omifPVR7OUDkYQvMBD7iXZ
TLSH
T17CB5BE13F2D900E8D06ED17887569232EA72BC450B35B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3b1277063fee29e304250d83a229acd1075f31adca0d3b09df382739ccd8918
MD5 cb4ab8616515beec4ec64e622cd3774a
SHA1 ff2c14e91b84786504ba952081eefb86fba27309
SHA512 5e968cfbb367c367a93c730615555f71f2065fa78abb3d1e70c53d95da15215f828fae3cfdea0a10986af529c61bc88aa89678598f15d460fde1e22f528de573
SSDEEP 49152:xSuZQIY0Be2KIRVtOnks6NMHqZOUDkzkQtlMBXe27gdbDZi:f5dKOi61ZOUDkYQvMBD7iXZ
TLSH
T117C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3660f70db24827e6dd2e2fb2f440e0a355eb032a312e854d264c8bd827173be0
MD5 d6cfd9a007433fc548950bb103346a9a
SHA1 f523102a467474973e662707c6298527ac157217
SHA512 c410639ba5959479e080dc343e8c229e02d72983813936d92a339ffd060df4ba6a4f03d385dfec53244c7126d4eef9abec87f55d96e62de978d6b323aa613a0e
SSDEEP 49152:PhtSn8EApI0figGgiDn0AP5wcOUDkzkQtlMBXe27gdbDZa:eX2i/phHOUDkYQvMBD7iXZ
TLSH
T10995BE13F2D900E8D06ED179C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 3e5c3d332a59fe842994308453523f31793cfd46f9b3e27128c7d9054eb158ac
MD5 c840c8097e0aa4e0b8562a2e7071ba0e
SHA1 e90b54c3de2df833d1b5b54a019bcbc59da3bb65
SHA512 8d9f93e871b49516c361d717c02c1306f026586e8560cd0ccea84d30a17a965b532e3bd556fd347f75914517cf5bba6d8e8ae257405c6960608070933ddd1320
SSDEEP 24576:I3tOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZX:OOUDkzkQtlMBXe27gdbDZX
TLSH
T18F352352085C4C42C75F45F5CBC19230847995F0EBA3807FBB92A71BCEBA9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 698218e32df1a0e970541c608bf3bb1f40e84d5028adc919c71f0fe7edc6ca33
MD5 35d4a5cf73d0d9bcfab46c04817db897
SHA1 6a9762d98e65d85fc775ef1446c0874c708773eb
SHA512 2730f8a183a91638b703205719ca0ba76e5532920c8cdb9f23e79f69912645872f907e42bd803aa7b4a86e5f078702f929d88629f33bc225628ffb211757e224
SSDEEP 24576:JitOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZX:sOUDkzkQtlMBXe27gdbDZX
TLSH
T1EA352352085C0C42C75F45F5CBC19230C479D5F0ABA380BFBB91A71BCABA9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 34dbae155d85ab1254d4035d138da0552e98aad158caa90e045f60ca71936935
MD5 e8cf30fa5ef42cd1d7c8d15e75aca34f
SHA1 e5c2c7570a3ebef010d2e3f3f2efcf0de6ced842
SHA512 e8e4dc1b511d87056538dd4f7d6408c846c478b48377ce2e415f9c6ad25d424dd2832c8ea649761b2b783e876399a4c93ddbd7358c686e7c7d547e33f804f15c
SSDEEP 24576:IEtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZb:XOUDkzkQtlMBXe27gdbDZb
TLSH
T152352352085C4C42C75F45F5CBC19230C87595F0FBA3807FBA92A71ACEBA9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 d3e0316ad14527f7a4bbd6970ea9ad546919f5caa8153381258366691bfa1188
MD5 4e94f640eb6da8be6e5c0607724df644
SHA1 e4595daf0ece0949a113764d616b1574f8ad1e44
SHA512 c3626525a5365c518854f82b7a74f044266493d96ae267b3b854773de339d4a53f868d96fbcabdffcbfa0580963dff6d8259ef15316698fa14e68edbd4bc196e
SSDEEP 24576:atOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZo:qOUDkzkQtlMBXe27gdbDZo
TLSH
T1F44523520A6C04C2C66BC1B5CBC19130D5B5F8F0E77382BFAB51571ACEB66E1D87A634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 97564abcd9fcc7e38fe076572f40e9a0d07db2841c8ddc97e67683db3ba07826
MD5 dfc484b70a4dca2de035f76d9e293aef
SHA1 1a3aa63ff6fc7db50e1e388fcab030e4b125f4bd
SHA512 adc36992d175d0651554c2b67e6c812a40cbd4be220c2845a0e3065de97ae202cbaeabe9875f53c6552052a4b27f5f5e255ce148abbbec5bd5bb61a418b03079
SSDEEP 24576:fRtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZK:7OUDkzkQtlMBXe27gdbDZK
TLSH
T185352352085C4C42C75F45F5CBC19230C87595F0FBA380BFBA92A31ACEBA5A6D5AF174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 e8ce4cc642e68f63ec42f0329d3cb741316baa053372b6b157c0d892d810e5b0
MD5 9ef2e6321b93c8f8921bc192ef8f3e96
SHA1 4ae64f3cb2b4f4c67d9d3cb66aae8bb041078d64
SHA512 1d7f22176912a11980eeaad12c5272a634cb05d7db8739a86dfe2e7aacbbe9fc9924f4e7e0381b3b6cd28cb84d2c67fc7558445370401e46806c906e18463e56
SSDEEP 24576:fetOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZK:eOUDkzkQtlMBXe27gdbDZK
TLSH
T151352352085C4C42C75F45F5CBC19230C47995F0FBA380BFBA91A71BCABA9A2D5AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 2842089e707e058c985e3c29f04f0ccbe84163902fe3d84c6d88c5afb09d0a87
MD5 5c3fa8d049f7c321a9a623851918aff3
SHA1 e1a921a307315f1c3c609523fea8c2786368f23c
SHA512 2c564e026740c0cacf288c0d0afc49285b52122db89d803b310fbd5eb25b07858a61e67152ba0087ca175f2216201b61e1e1cbcd2a9df16fd29f21c8914e1454
SSDEEP 24576:kKtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZk:tOUDkzkQtlMBXe27gdbDZk
TLSH
T1C9352352085C4C42C75F45F5CBC192308479A5F0EBA3807FBB92971BCBBA9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bc394c921f45ca91453776b19ac9d093fabbbfea283c3920416a899fe8494769
MD5 b92e3f1909aad9054eb5e760ee85139d
SHA1 4138c20568e9334c135f88b2d86aaefc40a5b349
SHA512 765e65fbd6c53042a115c46fcef624fe89afd56421d9a330ef8b79488b48f1412de40587941a620632993277e64cfce8b1521e1d713bd3094cc4eab50cf09129
SSDEEP 24576:HZMczFVSOCtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZI:HZMczfGOUDkzkQtlMBXe27gdbDZI
TLSH
T1E66501A563900CF4DD67817ECD518916D6B2BC690B70C62F13A4362B8F733A15C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 e05cedd23833fcca3ad8078f956ef81fc76554765a123674aad9218eb77d6405
MD5 5b237f39318c55ad3c94d51e9ce94548
SHA1 e6fbf89b9aa2f4f9c3b4bc271d6b6ce791b9349f
SHA512 879e80c9ece31795b05e5d291f2b0333c9be58623c2754b5c8d566e4d7c209edaaaaa08e106f5aa8c7fab4e0e8243d53a301d42c7e60b32389b04a8ce57182d3
SSDEEP 24576:CbtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZW:KOUDkzkQtlMBXe27gdbDZW
TLSH
T161352352085C4C42C75F45F5CBC19230C879D5F0B7A380BFBA92971ACE7A9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 29ceaef06887d69bdf9c73387f515ab46dd2d00da4f336cf90424b5b48e2fdf2
MD5 075ee8fa6c52866199eb7b9b6a6c6e5b
SHA1 7f47812e1a21a521383b2bb1a1bacb41909fcb1a
SHA512 8803ba943b2910e565778dba6c75279bccdc0796a42dc720a598204f6dd7bb1cdf48d1b8477e47cf48e4af4bcb6ef341c8ae0fd0a107073a3823d3084a3d2e6a
SSDEEP 24576:0PtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZW:IOUDkzkQtlMBXe27gdbDZW
TLSH
T1D2352352085C4C42C75F45F5CBC192308879E5F0F7A381BFBA92971BCABA9A2D49F178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 92e18271fc98dedb314a16c1bd6430236e028af0e58c5dea4062ce3c8217bc12
MD5 935743229ec50c073632b685393ade85
SHA1 40f51df5f541dd0e511647be416a01884b2fbcc6
SHA512 63345ba0407443bde2902cfb31172a3e9f6810fb521331fd28d90ec6f66cdfc4a192b5ddfce1259df5efb9add29ff3cd0a8631db98473cd83ed25675fb73853e
SSDEEP 24576:WzyWtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZi:WHOUDkzkQtlMBXe27gdbDZi
TLSH
T1F755121322A420F9D27B8278C9921611F772B8714B618AAF67A0477B5F376E19D3F730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 a90d4bc8ba95b218d2ed519d789d86d014259eb6df133888a3696701269b5fb4
MD5 061ed61220185397a8c276b50cdbbd40
SHA1 52c4d603573583301d8b01215b19660b2deeddd8
SHA512 d6af39dbe9713b94208af861acb946bac10e1afc9a85652c4f4d72e6a6a7113975bb5ed5584bbfc924d98fb533a747947e414fc281d07f5abf5dbb5a61766094
SSDEEP 24576:vbtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZY:ROUDkzkQtlMBXe27gdbDZY
TLSH
T146352352085C4C42C75F45F5CBC19230C879D5F0B7A380BFBA92A71ACE7A9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 f09a7dd63a6e309f1e8c208b7b504e0d4468af6fdb351e85e8c002bb040b2f44
MD5 c69aa0f35349edefcb16331fe58c705b
SHA1 8f2fb87df88bb94311dc39ad0bd5a5ceb582b938
SHA512 99d067c2e9d1c10d6bfce7a73db41227d65276d7adea1d74c8dd9942567e51d8f49395ec8aee0480fa0a75c66971e07d60796687576a65510f67539f084a16fd
SSDEEP 24576:SbtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZY:6OUDkzkQtlMBXe27gdbDZY
TLSH
T12A352352085C0C42C75F45F5CBC19230C879D5F0B7A380BFBA92971ACEBA9A6D5AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 221a357d417a8f8d7dffe6539ef6662dc0b1bd6d5320eaca470149aa5462d7f4
MD5 f17672e32feea343987fdbf93775e0c8
SHA1 c9ba38bd3f9e424cb56231c51749ed029d502400
SHA512 114fd4305c562f38254fa66405f45f385715ce39ceb0de6e2502cbcdbbf978e34c212b2338f158fa8443a0c141b12ef3cac42c0d4686a459b65e430105221457
SSDEEP 24576:UzyWtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ6:UHOUDkzkQtlMBXe27gdbDZ6
TLSH
T1A855121322A420F9D27B8278C9921611F772B8714B618AAF67A0477B5F376E19D3F730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 62a1683f26583f41e1c60e1c3e13b0277b5bfcd26140af347cf5dbc6b27dceb4
MD5 0608c05178ed8bd8a89445afaedd375b
SHA1 6307f535fd67db86a5df1d62a2de7ffd0c88bf2d
SHA512 fbeb964eff2297a424303aa5123266761195277403cd9b38d19e0e58b1da04c046b0dc6c7bbb7311696f827353b9c7961f927ecc6afac253d7bc9d3873bad71b
SSDEEP 24576:FTZaLl3z0zD0tOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZm:FTELlj/OUDkzkQtlMBXe27gdbDZm
TLSH
T1C165F1A563900CF4DD67817EC9518516D6B2BC6A0B70C62F13A4366B8F333A15C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 a424e0b6a3b8ddbabf975c06f70de585eba435783ef5faf891f0b663cf5e1dbe
MD5 35d025b66e62379f151311150fb174fb
SHA1 54ad7e2c798ccaf7a0a2d65273b09e1d12a2ebd0
SHA512 3f47e3d651f96a2a68244c74707459a57e562af2204ccf7c269c9b5c52188e8d1e1f317e7845fe7051f7c06a16a8b1c657201e207ed5877560a569332f5b65de
SSDEEP 24576:33Zd9CHKy7GZgtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZq:HZd9CHKyaGOUDkzkQtlMBXe27gdbDZq
TLSH
T1E475CF90A3E814E4F1B79A35CD725511DAB67CA91B31CA8F03A4261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 b701451de095442c4a8d9f9c29de19cca912dfb6479f7fa31a061f440c7886f5
MD5 f5b167cd368511cfe1f5eacca88fadf3
SHA1 21d3340815a95a56876ddb97bb580c933cc73d90
SHA512 74ddacecd8615678f924f750223f2e2e2a4486d603c7ca59cff043900bcf713041037cb824f76d08502574b31480786c241993d9a4ef489b8e22f6383ce230c7
SSDEEP 24576:tktOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZp:mOUDkzkQtlMBXe27gdbDZp
TLSH
T1C4352352085C4C42C75F45F5CBC19230C87595F0FBA3807FBA92A71ACEBA9A2D5AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 5e40d4885da458ced56fe7a5bf17770ccc5871092094a29ffce6a199901ae3cd
MD5 6663fb8eea2b7969be52fd83aaec643f
SHA1 5b0d10067c481c5337f79f46904b312a6f1110ff
SHA512 16283fd9f9c6a643f272f6313db377be9b5e9332a03e202388ae596f7c207e5159e0f142e28a20425e79121c5884ad4665f15593bc473ff0d71c404c40d60347
SSDEEP 24576:72tOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZx:iOUDkzkQtlMBXe27gdbDZx
TLSH
T187352352085C0C52C75F45F5CBC192308879A5F0E7A3807FBB929717CEBE9A2D4AB178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 746773dd7c009fca387f1514d62604403f97de053355c35279c0ae09a936fdce
MD5 16c932f29d7f55c9b17a9555d26cf034
SHA1 c33f7e8386abdf9895a1c8f219f3e9079e60ca34
SHA512 68050921001a3198b57252e1478f516fe7b82327251146b9dc5b5b919666e75415beb926fd7288764faa938d6bc7a7fa3c9712c1646341b30c14bbd659c8c64c
SSDEEP 24576:PNtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZd:fOUDkzkQtlMBXe27gdbDZd
TLSH
T13A352352085C4C42C75F45F5CBC19230C879D5F0B7A3807FBA92971ACEBA9A6D5AF078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 f773ef3c99b4f2179b0e3f18feaae4156ac1271c23bd84d6666efac1b5ac57fb
MD5 bacc798d5daa39384356783815702175
SHA1 ac56bb66657c9c49817f463e49ce0d973a2c8e99
SHA512 4cc544dc943b571834b67c7c9770f1d2bb2900195679cd93c7a86650245352207dfacdd573d5ae79c9607aa7fc2711cb7b69213dd0eacca17577a09ced303654
SSDEEP 24576:7btOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZW:lOUDkzkQtlMBXe27gdbDZW
TLSH
T113352352085C4C42C75F45F5CBC192308879D5F0F7A380BFBA92971ACEBA9A6D4AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 af55b43a405a83d00676e65c17f13ed5c17ee94e0ebce8c4d0a6d8572024d1fa
MD5 2da49139f1aea2ae56408aa5bdc04822
SHA1 c27b4483b1869e5e1d62e117f2f1b65e98e59465
SHA512 ddb3d9eab5b6f90e421381d5d3bce0c6379dc990999bd464acf3b198176a51cedb78f554228fc2e40d322ac642daa434d9354e5d017e95a3b853e736fa1d97a7
SSDEEP 24576:wktOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZi:POUDkzkQtlMBXe27gdbDZi
TLSH
T1A7352352085C4C42C75F45F5CBC19230C87595F0BBA3807FBA92A31ACEBA9A2D5AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 b84d805b084019be5195c948dca83ed28ee2404d12eecaa22a9c991730fac4fb
MD5 7951d80ea12f4935a0bc385483c294b5
SHA1 bd0c9d19da54e83681b33a9181138314f563d095
SHA512 833f467ac5307fd99e0c2ee4017f32683509572e5fd1f1332ec1ab796a5737e2caf2f787be32ca5554ef44b6ec1ef50f0ba46f6192f4221a98165b5d287f3c7b
SSDEEP 24576:xDtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZW:3OUDkzkQtlMBXe27gdbDZW
TLSH
T16E352352085C0C42C75F45F5CBC19230887995F0B7A381BFBA92A71BCFBA9A6D49F178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 14dd3495b6f41b8f78d0b262c24eae63f71e420ad605ed456680fa7f20f5183b
MD5 566552bd054286ff6e03cd3a46751785
SHA1 937346f4c72845ebcb4d22a964dd630ab12ed6a0
SHA512 942782f8764311d4e30953d553dccf2104322d73083489ae8e29abc59e1b73033533cb7b0715ac9b4ec89f48c4cb157f524da9c22ee536d60fb5bb394a02f97f
SSDEEP 24576:IRtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZT:SOUDkzkQtlMBXe27gdbDZT
TLSH
T18F352352085C4C42C75F45F5CBC19230C87595F0FBA3807FBA92A71ACEBA9A2D5AF178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e4aaecb779927140a7da4ca3078e60b3522e4a04331f015655727104e16995f0
MD5 75b70e112d6551dc48d7aa90d1cefb27
SHA1 7f5b25fb48c899d03b929e020e174900470df7f7
SHA512 2d27f9e4ffb92865580116d651519d08c029d266731ffabd3e47879de599dd577643c915d413f5176a5815f18264a7056dabc54eec353cfff449f8f01e6dba8e
SSDEEP 24576:7fwvVk9RX6wkyAIftOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZl:EMnYIVOUDkzkQtlMBXe27gdbDZl
TLSH
T19375CF29DBDC44E1E1B7917C89E3460AF6B178691B31C2CF129A536E0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 42930481f473ee791917bf8bf78613d496aa4090aaf857577ec4907ba4c572e5
MD5 836dad4f511dc356df4e95f37e81bca3
SHA1 0a8d0df5c97869306c5e509dc0c6cb6e66211ef8
SHA512 3a48bb3bb3203e4f0476452abff57fadc3fd606c4bf21e5dce10dc8322c4d2422baa6855a6abe7ef5645346b94f50afda65ba1021f0612f6eada2b123c8b4e6b
SSDEEP 49152:3YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08OUDkzkQtlMBy:ZySzPEOUDkYQvMBD7iXZ
TLSH
T10F066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 03c7f4244ea4e41a6b6295c1ad8542366aa817f81dada769504fcbf40b71f664
MD5 9a3eabb594a835319a9feadb287165bd
SHA1 e375e46bd060df9884929b789dbba73956404915
SHA512 bbdd43c3a555fd4fcb9cb78ae7c60ad2bcc568693be0db010da64136f4ee9120648e5538f650ed6e17d52656d19c63d8d09aa759909ca68e7228ce8b61592f26
SSDEEP 24576:G47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYStOUDgF70c9xmQtlX8kA2Mje27Ni19:G47JUQjairIhCnDHUPfF/sOUDkzkQtl3
TLSH
T1C165AE1EA3EC01D5E1BA927885554A1AEA71742D1F31CACF2270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 d09111a6bdf9dbcac31e19a064428ec92090b76f60d21d0fd391c46a9422581c
MD5 457f42659c9d9b5d02dddf6edb9ff2aa
SHA1 a47b879efced41d7205191fcaf66a2128e318347
SHA512 de3e64316d8826800781eaa2f237093321656c0730c1a9865355e191e2a8e906f4377bd4aa8c65b70e92c69f93f733006d4ead5479c792e988c183798ab1ee0f
SSDEEP 24576:mLtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZ8:OOUDkzkQtlMBXe27gdbDZ8
TLSH
T13145F01AC29801E4C16F6179CB829611F3737C6097E2C3DB66D0F63E4F7A6909DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 773fbed4fbf1cf648a8cd4cff83acebb96206f54f12e52050b4cb73ec85affab
MD5 1b2a64be3c5878776ca562cc30858a13
SHA1 173e2b0bdbf8bff4fd7c00592986b7fafd3266fd
SHA512 5f99ff8366d8d008bf5368ecbf3dbb9a04cc3764bd1af3f296e186994de04a2b737748f82852016317668ff70f78cb7ddde8e7dc3b7a0443ef75c64a2c28834f
SSDEEP 12288:g/cSNJBqQUhYJ5KTShKsZa9nHi95vNKEZsRNqmh:g/hJ5YnpsM9Hs5vMEZsrq
TLSH
T18E4517107626DB4FC6A940325E33D6CCAB707D01EE056B0373C98B3FD576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 92052773b60fc1db28baa3bc68587e8c7f5c2727603daab04800ad476484be2d
MD5 419e6fb3b4e6832a580265f38a0d16a6
SHA1 9f80f31bac24325d3bf938b818d490fca46d3806
SHA512 57d40b9f87803e377be8b20b083cdcfc8a5f154c0f741c37a936709a54eb94f418f879a45cea5d6c980be28a66b00649ee446b3c557f8c7494722c86eeb63585
SSDEEP 6144:7UIQQjlGhPwC8i1M2bJKDeoHeJKDeoHTTwquRxFxiSQL:7FlGhPV8i1M2bl2T2sSQL
TLSH
T187550A809537A7CFD1B76032072A9B8CA764EC16B7056F27B3C9057AD86B745A0BC3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 2fb30ba9733e5172ee22d83fc8601f5da2257ec4aa09649f479e011190f79d32
MD5 a8da832cb52a9b7ab621fdc3305f664b
SHA1 470438a8a094e82600d050027336f483839131be
SHA512 fc22e505225530c3e31f45b13b89c5ee6c6889a6de2d74f6b89e93c0a7c6c9f9239a5daafe3967b7174174500eaeae23a9532a22de1415aa4d59787d9d46c126
SSDEEP 24576:iztOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZC:iROUDkzkQtlMBXe27gdbDZC
TLSH
T123352322065C4C02D67F55B0CBC6D230947AF5B09F61C0FBFA51A35ACA7A9D1DDBB228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 71eedc1e5199b68f36cbbb3862cac6a4eb6d367ee9aeed5c9d76def86e0bfb2e
MD5 4d54f6007744dbcc52fa1421a4fdfeff
SHA1 2e564de7613d2d293fd6bc436ade0a549444715a
SHA512 856f05b7e1ca22518c0ea6213328b3443cfe79746d0df9850c34262483422224091c1207e304273f4a7aabdde06949a7486b68cb8d3b6072f0d72b816cf5bcfd
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYFtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZL:Ogb4mBIBhGFSOUDkzkQtlMBXe27gdbD9
TLSH
T16365AE1E22EC02F5E1FAD2B8DDA64417D6B278160732D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 431b3cae0e9e7a2ecae9e4c8babce5c4ce78e18e8832d0e6b3df2304445b0a55
MD5 ac7354493435c6d8a4a32ca3d327e626
SHA1 65b79f792b0fea67daa458b62f0dda63e0782840
SHA512 d6b3d83547605d9c7c791ae072651b846eb44e6f65991cadd414eae84d8449965f60cc5ac994e76a57bd1078f308d675cfbbb9e2b8c0e8fabc5eb505f23312d0
SSDEEP 49152:X7ZFPqVva7/XOUDkzkQtlMBXe27gdbDZq:XtFGa7/XOUDkYQvMBD7iXZ
TLSH
T13675016566E401F1D47BD138CA824663F6B2B4211364EBEF07A88B551F33AE54B7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7e6b0548a2b03c1f87a974a30ebb90da9334563dbbf4fa147958e4ca7d51a4c
MD5 83ef7a562012ada520f4959e1eb910f2
SHA1 5f32a3ac3e9a755c9672fd240fb67c540ac3c569
SHA512 0923ed2f04955626b31ea550ab9fe3b4060d3057127fbc254e2e6ecee0026f70b95535121d288b583666861fbdd9353aeb67106795071914e2de663a6e99ec34
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWOUDkzkQtlMBXe27L:yG05lO43bNOUDkYQvMBD7iXZ
TLSH
T1B4D5CF6A62EC11F9D1BBC17CDAC6460BEBB23425033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dfef6ac36b52db812cf859b959a121f0e0272734d2b58a823e585445fed85a9e
MD5 502ceb7cc1f979dbf0c1ee42d2faedd5
SHA1 3d3d6df81a790dab078b811ff62fe49bc3a5bf1d
SHA512 34c6d7aa46e718ac82833c8eb29f7d89b2e5b40156bf9aca23281c9e18865a9df23da2af06c7f339dd5a10d42e57408c9eb59a457ed2ffedde08d41c7bd17893
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnItOUDgF70c9xmQtlX8kA2Mje27N3:xa5POZ3hJt2pasx2+meOUDkzkQtlMBXt
TLSH
T16D65BF5E96FC00D5D5BAD17DC583861AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f1dbfb04f6ddc76a2321ef070612a5d2e3220fca5ea2afd55485946b161dda36
MD5 90b9ae5fb704722f6568b86997207535
SHA1 2a33858c2635eb940167a45308262320dba7e053
SHA512 6f40d73e942728d7220eb81a8e820760c1012ac2b1c0dfd8d9b8b4f62075f1802f4bb2539c5e791a90a627806a7b28caecdf5bf28929601ba383fc217094619b
SSDEEP 49152:lNc/zEOVHF3OUDkzkQtlMBXe27gdbDZq:wIAROUDkYQvMBD7iXZ
TLSH
T101858B2623E901E4F5BBE1BE89679546FAB17865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29d1446feea783a4bdf653cccb9d278ce8ed5ae10fecf8cf5b945c0f5a53e773
MD5 c382ddfb2c9275407a154df198899481
SHA1 c3039813f9b93386966c96c997ea834514234921
SHA512 5af1e7280879dc0632e401f6bd6cbde318608d5075573825b983ad1ebaad2dd3ef1504c21097be49ed0178b69c3b79a175862490435ba96833e78ccf41de7759
SSDEEP 24576:U3kNvNnaFeYhJNtmZBmLZtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZG:U3MwBtOmLrOUDkzkQtlMBXe27gdbDZG
TLSH
T1B755AF2E6AB805E4D1FEC6B5CE238512EA727461073293CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 9274ee82f895acca3cd34cc58b514f963b0cd1d805857e71a0861a45986e55dc
MD5 34f99dffc6d6bafa66a42866d3a06c95
SHA1 e5e9348206e38d176023b938f6dbb2f40124b7a1
SHA512 c70f03209b082f811019f72ca1b0d40108df183200e6dfa496454ff6b0ab42a70dba4a5d391d74eb5db9744d372c13f3b34b4996e5681182e84d11e8f47c9afb
SSDEEP 24576:JPUr+NQutOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZY:JJQGOUDkzkQtlMBXe27gdbDZY
TLSH
T18F55E12F16AC18E5E67AA17DC9828219E771B4611712D2DF02E1817E4F77DE8BC3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 5992995775cbf28088beda64ddd51b9f9c08726d670739f8333f973772daafb7
MD5 028d7c1eeaab4d14af4e3fa33d64287d
SHA1 36124a87c2ed64874fe7887b98dca50d13bb1b2b
SHA512 e9e190140ee526e9a7a96d55c41528864eb97450dbee32b43d04b969abf95a851a204bb1389d7eefd605cd6e26324c557979b7cbde4e5aa2872d2454ba767a8b
SSDEEP 24576:6D3FHshBIYQgAXtOUDgF70c9xmQtlX8kA2Mje27Ni1JFbDZd:6DVHeBIAA9OUDkzkQtlMBXe27gdbDZd
TLSH
T11465E17EDA9C04E4D57BC1BCCA938606E67138A8032255DB16D0C1BA5F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/872-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/872-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/872-338-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1536-108-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1536-107-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-114-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1536-353-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1536-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1568-74-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1568-81-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1568-75-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1568-309-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2556-131-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2556-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2556-32-0x0000000001030000-0x0000000001090000-memory.dmp

Download

memory/2556-40-0x0000000001030000-0x0000000001090000-memory.dmp

Download

memory/2556-333-0x0000000000760000-0x00000000009A1000-memory.dmp

Download

memory/3228-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3228-156-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-154-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-148-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3852-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3852-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3852-85-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/3852-328-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/4536-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4536-335-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4536-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4536-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4536-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4536-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4568-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4568-56-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4568-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4592-60-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4592-134-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4592-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4592-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4592-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5112-46-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/5112-0-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/5112-7-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/5112-6-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/5112-1-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/5576-132-0x0000000140000000-0x00000001401C6000-memory.dmp

Download

memory/5576-141-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5576-135-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5576-334-0x0000000140000000-0x00000001401C6000-memory.dmp

Download

memory/5676-330-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/5676-98-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5676-97-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/5676-103-0x0000000000960000-0x00000000009C7000-memory.dmp

Download