dacc79b4f27a9b2b27d7197ea6707e195f276be22a42fee80aa21130cb4abef6

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Size 1.5MB
Sample260930-bbxmmsztcs
SHA256 dacc79b4f27a9b2b27d7197ea6707e195f276be22a42fee80aa21130cb4abef6
MD5 53ed4f8136657ef933849dae232d9c80
SHA1 508d1963788ea8708c71be45e3708b5af7353a95
SHA512 bb644d99db03a3c1ace4cbecb83d6c0de58c14ed85e0cc2f1ab4936c11ada7099dce346717578ddda88996e04094c68fade07457e9364fe3e0ab7966337d62a6
SSDEEP 49152:udbOGlTR0X9fJ4klKXnN7/GM4EkeiqEYG7rKau:ulOrfJ4kr7EqPb7r1
TLSH
T1EA75221670C0C4E2C81155B51DA6F7308A1FBE6F0E269E8B7F832E750DB8691663936F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1988	elevation_service.exe
5524	elevation_service.exe
6004	maintenanceservice.exe
5956	OSE.EXE
2616	PerceptionSimulationService.exe
6044	perfhost.exe
268	ReFsDedupSvc.exe
4724	SensorDataService.exe
2764	ssh-agent.exe
5184	AgentService.exe
6124	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbdb7cf69600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3536-0-0x0000000000400000-0x0000000000724000-memory.dmp	upx
behavioral2/files/0x0001000000009326-40.dat	upx
behavioral2/memory/3536-43-0x0000000000400000-0x0000000000724000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065fb4e2a7750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5fa092c7750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c491fe77650dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef795e77650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000845908ea7650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000612ef72a7750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002944bde77650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b73d92a7750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
5524	elevation_service.exe
5524	elevation_service.exe
5524	elevation_service.exe
5524	elevation_service.exe
5524	elevation_service.exe
5524	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3536	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	1988	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5184	AgentService.exe
Token: 33	6124	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6124	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6124	SearchIndexer.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	268	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1988	elevation_service.exe
Token: SeDebugPrivilege	5524	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 956	6124	SearchIndexer.exe	100
PID 6124 wrote to memory of 1724	6124	SearchIndexer.exe	101
PID 6124 wrote to memory of 5548	6124	SearchIndexer.exe	102
PID 6124 wrote to memory of 1228	6124	SearchIndexer.exe	103
PID 6124 wrote to memory of 2996	6124	SearchIndexer.exe	105
PID 6124 wrote to memory of 1036	6124	SearchIndexer.exe	106
PID 6124 wrote to memory of 1912	6124	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6044

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4e06e408911e23e6f4025812767c15b0a14c1fb09f2ce49a1a53c061988dc5dc
MD5 28414f5472156806e8299c4a31af401f
SHA1 bba413c275b507b468c23b89b57113e031616dc6
SHA512 9cd8b9d7e10a4ff01f016204e040f21b17a6dc0d4d2ec9c69c24244727d77cde0e7f48d2c486a491b74f433ffbe92ca60367e1f99e7762f00a9fbedd43cf7b38
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnyfJ4klKXn3:t3q6mjBFfJ4k
TLSH
T12AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 99b554106ee3f1f066e8618f2772a127f08948321843b4547e09c3204786f35b
MD5 51e812c39ee67f76674c4e26ba9a93ed
SHA1 7a5a4b332643ea15ddece4601b4bb353ffb16fc1
SHA512 b1a60c4213fcd7b78a19c22fecb6361fd7746835fd064bb2f2f8eaa686ec4eaec08d1f541d9d03635acc377ced518f75b2e7bf73d3caff3657c6c2a1c47857bb
SSDEEP 12288:u1XLsswWkxy2lRq2czAZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:cXYfDtczAZfJ4yL/tNCJPXUQrPq
TLSH
T1AF05F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9a4d212fcdb91fbec7205a94f6964d772e2b89a2a475ac2cc856d9b89f4ac943
MD5 56ac5888259f088f8987dce0970c0879
SHA1 ab6387f4fdcd30d482e094aaf40bb2542fcb6c95
SHA512 060e7ba62f2f1e5b1ac6cfdee3fc117ec502c6893292ce2779e5f0b321d4fb31198297a2d5e7ea4fd6b84a1f36f2dba9591da21431eeecadce1966130e58a54c
SSDEEP 24576:j0Le5ji0hmxhrMKfJ4yL/tNCJPXUQrPS:jPji0AzTfJ4klKXna
TLSH
T1D035AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5e168abe9f5dc063ae97385cae15b820d8b1afd902187a487027a0fa81ade525
MD5 43ea67ff2da65aaf5d0d7e41ff8ad084
SHA1 92a52d5c0a9159935638b4c62f060043dccced36
SHA512 d117c6a644e1c3b5d9f41f88e1d5d205ed726426bb4046d2635ca9b33558ef5a66e49014389b05b79dc25ac56660df2f9adb3383b29be36990a07a63cc47a994
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWj6q8wyugfJ4yL/tNCJPXUQrPU:v/ezSC6vUzPv+Hjy3fJ4klKXns
TLSH
T13E756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ec7cf38849b29c95bb115e6b381e8a2bc8898197cf5a194301076e1d58402e57
MD5 f8d13073ca928044c202030395ea842e
SHA1 6c237d8084c5dabf28406d9e1826307bc9bd4451
SHA512 672626cf444f24aacbc4e5c86ac669add9cb91c0d7b64ff034f56f342d184b0d81d2f1ef02f666b9e86bca1d159271e8afb538273550ef8bc9f1739d05487630
SSDEEP 24576:7VbqPb88hv/l+BVfJ4yL/tNCJPXUQrPC:7VO88hXl+zfJ4klKXn6
TLSH
T1B055AE66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a3459e48d8203a2d222c698604e777fcb163bfc47b4cd11c43d4bd12e0dd087d
MD5 ac347e005bcd86eb65581b2ac7c7d990
SHA1 9384fee3a9a52d9410e8b45577b8011d1a999ebe
SHA512 cd5230925d882b4d07cf45fd60383fb5683d8fa7b45186d39cd08dfbb0480d15957b028f8367ae25b5042ffd137ec326819441cd2fed9e6cec3098a4c84837d6
SSDEEP 12288:TGGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:TGGfJ4yL/tNCJPXUQrPx
TLSH
T1FCC423E751909086DF6687F82A88F001C704BEC5562FA2E6DE42BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c325d332a3142926bc830245a4fd4c11e6cace3333a97a471247e0a527f225a1
MD5 e2d7482aa4eab3cfa9b83c881eb88d3f
SHA1 f2fab221f5d8f4f9aadcd40914476fa314863ddd
SHA512 6c772a5686720d7fbeae538781b87662d71374bceab3e6f6c7b500d1ee2c378de9a36648869ba6a59dd468316cda12d77e46423a5895d24315baaa8fd7677f7c
SSDEEP 12288:yeBNUbTVO86UNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:yJIUNfJ4yL/tNCJPXUQrPo
TLSH
T12B05C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4073da3f476bb608b59f7ba7e3f8b40040449919ebc1d655c8e7ebfa9b364ba6
MD5 74d13a722869fc542ae4f1870f869577
SHA1 aa259624261c7e2ca3b6206ac010af6755fc4761
SHA512 a56140a2d1b938e4f8bdd1f4bc1641403b9db5db9949225a2851524efff6dd20d5606027056c176d9edcfd98789ef2de14805e1b3401227a238ae375720a0014
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THa:ZQvGAdlCEL8c/WRNw5CwfJ4k
TLSH
T198266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 03e7a2b17e78e224680f9f21f3e0a6ce991f6cdd4aee3584bad5fc3c3413e18d
MD5 84bddf8542a5c9188e3e6b4879b57f1f
SHA1 c80c486f33c49ed13de2994ca266d54ef9b9e59e
SHA512 ab50e34c55870624f081e0226b294f36576cc6c07522b4714f455512b3ed4df1b1a9927aa347b7783b93c8ed5fec6662bef9e7d5868bf245e58e81df17776710
SSDEEP 12288:8AwSfxL/2Dc3mDLLmt0LDQewsAjjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW/:hfewsAjjfJ4yL/tNCJPXUQrPB
TLSH
T1AD15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c6f52937070edf2ac4e9dd7b655cb558d3b0b110b546a2fefc25fc479eca64bd
MD5 7d90d0b81d94ee1c6837ea5888fb524a
SHA1 20f9a68918386b98b141ec092ea8f027c14fa782
SHA512 3b159c63e863dc5a25cf52ed8c12c4f203664624ab07250fcd640f506735676c23eff7859b361dabe762f0383ec2c684f573d84efc0da0f87e8b862cab6e1fe6
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHrfJ4:NUEtQevvqc2W1cpV20I32r
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d3aad77ef3d39235225415c412792fe337e0eb7132d869987184ec18e89b643
MD5 c9d3ad24b78afeaaa36497595bd6ef2a
SHA1 6236e1a839b3871950a974d5e760f7ebaffd141d
SHA512 4f7ac2095065a0d0e7e3c635cfb762a94bea50249c08d28e10fc600cf44326187b31be765d13140e5300991d2d519faedaf3bd3cbac99b5e3857b5b9f50ee37e
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zDfJ4klKXnH:+oqtVjnmEfJ4k
TLSH
T1C2D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 34b7816c49bdc56ae3ab581d3b57e6f6b7d4fef414437c5b4b284d9dca4f1a95
MD5 dc37d36093cd40d300caa40e6ecc7597
SHA1 be76092499fd86b9aae13c7d3ee4628277b02637
SHA512 34d81ab23deba2de307755722328b194d74f450f275f794eed8b8ac00f65c60a34bd54ce3d350e469c05331e0dc4b646a38c0d4b0d54f82c6c267ae57c5e09d7
SSDEEP 24576:9AhGL6IFoiwtA5l7S53kfJ4yL/tNCJPXUQrPw:9AM5Foiq5UfJ4klKXnI
TLSH
T136359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 141ebacbe81a3fdeaffb89ff4ff022e7d10797644feaf8205d1cad2bdcd299cf
MD5 103c6954be61aa4e851444aa5b50eb2e
SHA1 7d27cda65f84516a167f64aa22a2e6b80988af9e
SHA512 5ce329b2abedf913c5044f8dcc7b61e706da38f1bbee9d95d97827f50998b8e977a5b999cce55aebe0c9a869a091bba2d7c9a2506a7401d9f1b01c8aeac29a35
SSDEEP 12288:+mw5HEjsChNEBFgl0WDm+CAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTm:XwuROWXfJ4yL/tNCJPXUQrP6
TLSH
T15F05014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3b306cd75f791bc6923c3690f728bad2ee256b98a3b1995a269e09bb4f7111a0
MD5 71fb23a9605cc1f872425cb31c5da002
SHA1 e596bb4d74828fe41f9830af77a2b9902236d612
SHA512 352ad5c46a0dd7fff21963ac5275d2c945d14e47e25bef9c34cbed0831dea805734c9fb87fdc32da3e6d49c6e295c598edd9b19f128e3285868b84f4dc8808d8
SSDEEP 12288:syZ1IyzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:RZuCfJ4yL/tNCJPXUQrPr
TLSH
T174E4129B32D460F9DAA782BC89D4E101D3217CD2273A43CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d6af48c503862d2760c74400656df8a916632bcfbfed7a2a4fc549f2340e8e3
MD5 80ed604d8c895f2f7332a2741b8924e4
SHA1 8741de43ff5cf7978342090817452afbcfe55710
SHA512 bb2a8086d426f9682cf58d1d10475a17859766468dbc4e8019c29648c8895acf724670994b00b71f95b32693fc98d840825d0187f031132d935b20aad233ef99
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:UQRQyi36YOcPDLvw2gAf+PN3RfJ4k
TLSH
T14C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 04be93e85eec00cdf41151e572961c567930eeda3260e120ef4af094f7a41e15
MD5 f41a48bd72868dabdf6c82c771a55ba4
SHA1 8920387ac3dd22d62cbfca323ae8fe7ff51f2a40
SHA512 71fad4c4384a1ce7bcb3cf200044e7701c2ee98b7e132cd722d08d14817cb0e9b6bb60665311b4cf3be73b4e95b3881b1ca88a0746407a159800eca889aa84b6
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uq:iQRQyi36YOcPDLvw2gAf+PN3RfJ4k
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2ae7be458f87fa1813f736a4a6527fdd2966d7e85a12ef97dcd6589162ba05de
MD5 52a27497790db99d0ad3da0aa029fe75
SHA1 a97ead404127852bacc0bc34b8a48673c37ef495
SHA512 9a43f7a139e1b1543d398cfccfe0746f88683ed4226b087526fc84b1cf6934a5f65e87393da3c1c4c51bf41314d971d9e5aa44a7ae8b1dffc7a766ff02d461d1
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0yfJ4yL/tNCJPXUD:y68Qg55nhkeWu7PNU3/TfJ4klKXno
TLSH
T162B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 502eca29e8f5d9b0e4c02330b21d8e5f2909729d1f7aa1fb1554b0869d4ddee5
MD5 6ec457e7747c93881c92faf045d16050
SHA1 3f4d562a5c18143d495005b9083c2ef3183bcfa0
SHA512 9fad01d116b317c2f73be379534e85cf486829d144052ba9332a9835be020ee7eef4a6eb183ee40bbbb29378a505a06cf685da88299a6567cd667f114f89ffd2
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99o:fy5112gYy5azzVvU69nLKnhZGfJ4k
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 84681e095f1650ed13dd6d125d0cc0626975c608628f3d349db13bf03509b1df
MD5 2c3833bc6f10c56d599a7a9427664af6
SHA1 f662b353a0793c67d9111ffc10e67e9174563bf7
SHA512 c70ca6f2b379a8f04a548978587882a47684b096dc7cb7208961bddce9182352bbd111b44e80084410023354dcf2cea984d33fe4aa2bbf2ec7d7596f9e3b12a2
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+fJ4klKXn2:bu6JmIxd2d+fJ4k
TLSH
T195D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 16eeadf152aa0812750c750c1a8053a493dde8e483a8a42ebe6cfc36f303d659
MD5 02cdbcf268e0d517b27c2a1f05013fff
SHA1 c290eca8173b4f745719f13e5dc895131bddfa1c
SHA512 5f27579fdaa5a78ef11ceff95243d5dc97f2f1e4e80ae54fc679dcd4310cfd4c7ee7ba7bf2d14fc3083f9892603751e1b45c71262e06f837b0dcb34ba5ce7718
SSDEEP 49152:O1hpsNoJpF1A67U44CwH7R4xtfJ4klKXnC:OmifPqREfJ4k
TLSH
T128B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9046ac873a6617dc7f07b6313be5861e393c246973084bd6212cb604aa0b5667
MD5 f27954f850344ee67eb48a834a9cbd51
SHA1 fd3b01fb88043a85d81f073f2b0ab05f9c23e44b
SHA512 45dad71625bf5b8d513484fde67f88f2826d20cfa95e9716f7a98a39dbda6567a52f2fdcd8d6625df90fd2043388667f27a9a15acd88b6132d43c8fc7e6fd507
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHqCfJ4klKXnD:+5dKqi61CfJ4k
TLSH
T113C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c84c357320d7141b41e67e5350ec5577e70c58f4e70b36ae6460458c5933e90a
MD5 0382777f3bcaf60cfa22d067d65b548f
SHA1 78306beb8de41166d0bbb65c4fe56f31cd49106d
SHA512 980d5bc4fdc86d4ac6349e4fd26ab7fb4cbd528abd27d0d4f13e59fd4dfb03b14a1b96118f7584726c84a0143d2f6fdccead1e0cb5e0615793d04563002dad39
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wZfJ4klKXn0:oX2iWph4fJ4k
TLSH
T1DF95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0c0301444830196bd7ec68baaf153f5f1009c1acd8094612f898fd1e3c2f41d4
MD5 1df124396e82988cdb6e94d4d04fa4b0
SHA1 99fa19429fd8ae5b5ca4098166e2383ed5e2e713
SHA512 778d6cccb449cde4ce794d309a7062d12a379f0e95f192960cab63966fe3024c1fb095818d6c73a29fde472d65e7063ad1008dbb759a650adef144c6a6d9d3b4
SSDEEP 12288:E+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:E+fJ4yL/tNCJPXUQrPr
TLSH
T1A4C423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a1fa0c09d504b288ae16a27b3144810c01d703b45c130a67591fa0c0a9c8f9ec
MD5 8738dbf8e267363b02d9edaff6c2c6ff
SHA1 8a76e9ac5c54896e2fdade779d23ee32598914b3
SHA512 08fb8332cf1fc4670e3e243ec4b7241ecb06a97e80a76d5374d5db5b0ca26bbab3853879f01e57acd97db50fc2c7b8b3459a82e49fdb2de1e0b95054bc084f63
SSDEEP 12288:2ffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:2ffJ4yL/tNCJPXUQrPr
TLSH
T1C1C423AB60D59486DE1587F81688F001C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 ef8aa1c0ac3515e1740c89878f1a75fb8424ba41e110f8c501cbcc1a37ed4222
MD5 4b8ca5ac94bdc0a4a676824ccce6b785
SHA1 5ca40bbdf47da00ace0009f8a6b2930e25bfce2c
SHA512 e477f3ddf09c9913d934e5ee601357dd2839c5e9e55e3a763acc3fcc22cfdd6371da7172ba8d0f64254a5754583df9cac57d647bfc3326e4522db45c8750e218
SSDEEP 12288:cFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:cFfJ4yL/tNCJPXUQrPN
TLSH
T1A1C423AB6095948ADE5587F81648F001C3047ECA672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fd5a4ee174ef0567afd5350d96f0fe1c45a40d091d3ab8e4937982025aa58eb6
MD5 d90d0673d23d91886545d5284db70724
SHA1 ae9aa7eda4776ceec3c83b330e5561457d197a18
SHA512 2bcb1f89970fa8dae70b9b3de24fcc170f15ae51c2d138b12daae3764fee749ab6981b77d7c573f9bc9a9c7280ca337e046868238d860caae2f50bf43559481e
SSDEEP 12288:vVEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:WfJ4yL/tNCJPXUQrPC
TLSH
T191D423A7219580C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4909bec179e066755449ecf005fb408f78d8ff2ba0fdcf9a253a50a7ac02ea6b
MD5 dea43b0512dd3f1147162766146461bf
SHA1 c268be1188e73fcf039792e539e3376da27a4bfa
SHA512 b00b3eea9010711a5abcbc39f8fcc3684b94e31dcec60818b1367693988fe24ed0873816c8767c636f8574d16555f4cbd04ac4b29551f90d6130b64b0319de91
SSDEEP 12288:hMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:hMfJ4yL/tNCJPXUQrPa
TLSH
T123C423AB60D5948ADE1587F81648E001C7047ECA672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 700722f8b26ebf7aec4bcae0d868f3b1fe8ca380f6d1edbbfce4b60a78d58e2d
MD5 d4bb740a1830fcd498f6840a7158e833
SHA1 dcfda43dc87c779522fa6064bc7dc466c1c126f2
SHA512 d010943dbee44fef914d9fdca7e9b537c1bac7b948e71ce29821b5fe7b0e522a434cb5c17741793460b407488a718754925bacfd2c26ce8a98afbfaa55ec77e8
SSDEEP 12288:W7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:W7fJ4yL/tNCJPXUQrPa
TLSH
T151C423AB60D5948ADE1587F81A88F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4cab81bc7dbd14a0f9fffccd8ff990af4c561778b926046c83c78a7eb232f01e
MD5 c771c5f63c92827f5b2acf2c38a574d3
SHA1 ffddc1f1c3aacf7ea729afbdafa265ad7cf89dd8
SHA512 178bd0272b920d9c8dc055cf44407ce8460c24640647d9ba4d105639a62488e380cbd0926dfc92ab41679e6fde2b28d531f3e3ed64c85de16c1bc2b25ba205e3
SSDEEP 12288:bHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:bHfJ4yL/tNCJPXUQrPZ
TLSH
T127C423AB6095948ADE5587F81748F000C7047ECA662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e2b63ad7789ec8697d8a2b6bd59c6b963f418dcb2c26bc3409831b17e15bfcd0
MD5 29e23c88de3ad6b109aae00588e0b50e
SHA1 39a5277e8441935f75cde29837509aace6ca00c2
SHA512 c8cabee75df15fa1246e860b31bed9e1b582941e47bae12b5b3f1e6cffbb346a12f1e4a12638265b40d6a42ee05a07eaa56183bfc75671fd39a8c3626621ecc3
SSDEEP 12288:7iZwbDzzFEoS2cPvy/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:mZM3zFVSO/fJ4yL/tNCJPXUQrPj
TLSH
T16C0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0f99d6dd8dbd24275221b2c6b5c5f97dfed3dca5475495288874b8bc270d73a8
MD5 79726637e80b937f2457561ae1aa8c4a
SHA1 de67df0ed7218b9a2a85104a0b70d9e49c4e1e15
SHA512 200d2f9455963bd0ab6a69f77ab74296ddfa0846b5c3428e980bed4a17f9e0dcf2bc2ae5c9afbddf1b8db114f0be08a2195075e6db6fd7d3e62782e0e8ef8962
SSDEEP 12288:LSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:LSfJ4yL/tNCJPXUQrPa
TLSH
T1CBC423AB6095948ADE5587F81748E000C7087ECA672F62F7EF43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0a9147d3239ea1ae75a5d1eeaa8bd312031b034c3966ae3309620a79bd71b538
MD5 f93ea7f1019e32497bd855f33225a156
SHA1 ddecbf449c6f4dc2c424add1880747b25af47d39
SHA512 65240d7eaa3cc0a02c3affbd7fc47c08afddb299495b758999e994043ce06a6688ece3faaa1c46c69d8e0342f506c2d58e1280355ab6c68c1e584535a2c049dd
SSDEEP 12288:GWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:GWfJ4yL/tNCJPXUQrPa
TLSH
T135C423AB60D59486DE1587F81748E001C7087EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 483e935efd491999944768e6edaa83382cfb6aa406fad1e1cb09f1783944a723
MD5 a62e1e2faef94d71f68a230f0efc0ecc
SHA1 62bf31a2cea42660d60f0b642269c15ca3297eb8
SHA512 6db4f8cf73e07751a78e1efae855bb2957cd40ab284a6ac14bd6ae4af6f3aa01156021a4013f5f78c875abc2ad8c2acc5951721ca0a1a2bb795017371d42424a
SSDEEP 12288:2yPz5L8zfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:LzyzfJ4yL/tNCJPXUQrPr
TLSH
T13DF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 401de3c46a885ff211450029487c6190f835f44256920ceb46eb0c80bef6869e
MD5 4a28559c8f0296a0144f5860539d5800
SHA1 db04fdd418d0a1afa9689899729ea8618da982e6
SHA512 df557c9ffb41b07bf053fc6cc088a15de76c48acdc98c23288e42222ebcd2c875531700e7847a39dd508a4cbc5a8faac7d8f39751a5661594d2e9971341186f6
SSDEEP 12288:nSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:nSfJ4yL/tNCJPXUQrP/
TLSH
T152C423AB6091948ADE1587F81748E000C7087ECA672F62E7EF43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 80347d460be30a68124c25c9dc20bfddb08e66a2495c98d146e196af1107c9f0
MD5 dd590bad0b1f77955151c33f384558d2
SHA1 3a61082f74c7fd0703da95dd54afb05a607cc34f
SHA512 ce4e867962c28159e0c646f10b197a0ea836ba2df07cb253b2d36c41d9c8b7fe0dfafe8dcbf0d642d7f7161efe4060c5bd3648c589ad5bc5abc339f7b4853b11
SSDEEP 12288:+SfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:+SfJ4yL/tNCJPXUQrPF
TLSH
T121C423AB6095948ADE5587F81748F000C7087ECA672F62E7EE43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a5c3d98c9aa42d8f9b466ed215bfb796875ecd0edd624810a6ae58abb0bba1ba
MD5 3a3ddd1aa475c5e209e9e0a66350605f
SHA1 df6a90c09d2791a671cf22787afe99614456b06b
SHA512 569a5c95c5ffda07ac688a652a7e161cc6b1fa4b6f331ae487a14190b476cdcb6fc64144e274429094b482dc8804fd790d37da3ca9f56db2a282f61baa4fbace
SSDEEP 12288:0yPz5L8zfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:tzyzfJ4yL/tNCJPXUQrPo
TLSH
T1A4F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0d6a06dd88d252cadac2e65e9a0f2045fc65ba9699b1abef5888bf042418c437
MD5 1248e4b60f95b829523290a75ebe1ddd
SHA1 74126d7fedf5ed3f24f91e4ea414d4c91b583ce1
SHA512 6939a1debca83e46043c6d443906468430cf3a32b47d14849d8444d74a9c64878850615fb34b1bc8fc912f6a62839e88615467cfa97f1c24cf2d16117c55ea4f
SSDEEP 12288:KCd91WYoaLHF3z0z04PDvh1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTl:7T8aLl3z0zD1fJ4yL/tNCJPXUQrP5
TLSH
T1250501A5B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e2f39e33eaa8a5d47bded8bf507d5f47769fce8fc45df0b0723ab6df52a249f8
MD5 0ba14eec58405a9976f7ab40e88c55ce
SHA1 21fd4031ec2d0faa2d5d32db956bd6ac1a72f82e
SHA512 a005f2af2d88b2916028c1d815814159d123de6c6ca23115a590229ea29b1aebb82bc54e7918c1c93bdf4cd7783feca239ecccf19b8becb73caabee326bc8409
SSDEEP 12288:vi4e7+RdTfgwCHKy7GLbbdIvIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGI:v3rd9CHKy7GZxfJ4yL/tNCJPXUQrPz
TLSH
T1C625CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0b284c062994acf77b2d3e06d549bc53a3e5e62f8ed7d8ec41d63b32e4378e8f
MD5 f705a4f7cdaf5d695c47d062738091bc
SHA1 46768b1268680137dc4e2712e9c17ed88138b08c
SHA512 ada2d76b3f4655f60ea4014a61751a060c428fb0cdecfebdc23f64372f657d62255d9de0ec7ea212f3a5c67c9a119f66339c61b5342dea3ec3d5685d44ab5697
SSDEEP 12288:AlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:AlfJ4yL/tNCJPXUQrP/
TLSH
T1D5C423AB6095948ADE1587F81648F001C7047ECA672F62F7EF83B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4597299511d349a0da794a5944114a8bac8e93f5f8e29f9e2adf9ab25ec7c7ed
MD5 ecb7a798249e25dede4eaad3e6aa16a4
SHA1 ac8f5b57795164d01e8afb682c1ee62249f7eb94
SHA512 3b6cfc9988a715f369c168f4dcbcfb1a5cdbe700e60ec8bce4fd0dbe69ffdc942e97899d913821c405e4dc24ebe067519bbdb409f5dfb7b1e2789fa7c6f18889
SSDEEP 12288:uTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:uTfJ4yL/tNCJPXUQrPT
TLSH
T1E8C423AB60D0949ADE1587F81688E001C7047EC6662F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7509f4adae88c02bf12c4a9f1933a66e37c15a0c00e5ec0b1cc5c615a31155f8
MD5 ef149a52bd164b04271745a2845dbc21
SHA1 a48ec228df7166e96ad2178631b1e3f8534d0ac0
SHA512 18dc90b58dcfadea0e30466a07c00275c15f139137d3faaad956156b7ee437de71b8d88b5c173799b3c64b18f0397dc9df5d41beff53754c00db6432eb51efb1
SSDEEP 12288:1IfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:1IfJ4yL/tNCJPXUQrPT
TLSH
T19BC423AB6095948ADE5587F81748E000C7047ECA672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3c924462a1e4312f8c64b8a5d7d37d041960f3a9688da9f2f3a2ed3cf14ee2e7
MD5 0c6905f977c18767ba1536e49488a194
SHA1 3ed549818f7b76b3daf4136d1b9a10ff0271e7ba
SHA512 d97f07c72c6a4eafe34ed907061091319d117ff005700298f8c566ca0ef5b443d0d3f19be71b4fba630e7a43f701d4ce377202d30e7db054c5976787902f4152
SSDEEP 12288:gSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:gSfJ4yL/tNCJPXUQrPX
TLSH
T18CC423AB6095948ADE1587F81748F001C7087ECA672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8d1387968259167f11867cd4a1307fd55c0e384819b3244659dd1fdac8f00037
MD5 c7b4a80be206a99ecf70dbe236202261
SHA1 532ce8e641c3844893328b8ec8c1b19b8751b8da
SHA512 fccaae09aa530ba1c76705a408eaa3907116dcda34f4cf44696b5209214d428f55b7c8bcdde44417cc7e7c8218f974a4ab87e9ece37f2eb32c8ab5ccd55545d1
SSDEEP 12288:ilfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:ilfJ4yL/tNCJPXUQrPr
TLSH
T16DC423AB6095948ADE1587F81648F001C7047ECA672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d8aa3ba57f164021af2a6e6f7675138772f424d5ddef460345d04c9e9e18a5ba
MD5 7396ee0c777c160bdd9317f9a403cdb3
SHA1 6e1cf3f9a309569a07bbad07e02a4475cbefbb13
SHA512 f7755dd7306ea54059ab946e01efc7231f132f063a1e1672ec5c91e4be460d0cfe2d3e0b5070375be0e7bc8df596e73d30197825c2e2a99ff7d449eaaad183b1
SSDEEP 12288:o6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:o6fJ4yL/tNCJPXUQrPd
TLSH
T119C423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 639fd65086ccb2352de4e929fff24791673831b2080a9703b8a4a8a8bfd4ac7f
MD5 e71cb6ce9c7958b02a1570aa24b1ecae
SHA1 237bd5374eb020be322b0ae8cf4f5a05b6367457
SHA512 45da701186527e71d064661237910a15343fd6d3dbc906d7caeed974ec2688cc44b5d175b470251158268bddf90a0d444e5406ba2587cfef45d5dc357f16ceba
SSDEEP 12288:pMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:pMfJ4yL/tNCJPXUQrPJ
TLSH
T17EC423AB6095948ADE1587F81688F001C7047ECA672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c03e042f5e3c1fa488575db2351db7a29e0017032906d2956f00c54393eaf005
MD5 3586d19f051c193d670951df7bda8324
SHA1 f5b1e4e5aaf446b2eb2fe43ae157a697a7706ba7
SHA512 595fc2d92317bb2fb1a67475917b7ebeaa344709c491dbb72e5216501ffd7d96bcbb0bf3800a3dfd29bfe86cd57de03c555e807ee3a028046368f645e151c982
SSDEEP 24576:9fwvzk9RX6wkyAImfJ4yL/tNCJPXUQrPT:0MnYImfJ4klKXnr
TLSH
T16B35D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 512ba2a017fa19021b2cc5324bcf4426033435290e098c74d45b29b769a8400c
MD5 180d5ef5d5312662c60a9dbe6c063690
SHA1 f0819af729df0fc8d6d7a17c421984b58f32d1db
SHA512 c3a5c0f6d995cc2fe1adce12f092d576971d3026eb0714dbdc7a7a32752e6bc66c37e5914f5b19b6d427c470cfa5c541f596b8c8b0b3d371e7861af3bafb3d2f
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05fJ4klKXnT:2ySzPxfJ4k
TLSH
T128066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7f85f44bd2a6ea2ced48e8ef560922059b472d8c2b4ccfbb8a92d263dbaa16ba
MD5 bc24c45646e5d31902a6835a233c0f05
SHA1 ac213d47004d9f523d18c647663c7c8df441973d
SHA512 9e8ca35be0dd9771029a07c63163797489baeda340310661a6d8e548065d2ad8b37ff74e40c82780b4669039693b67eebaf1004e3648df75f7c9241c3d2198ee
SSDEEP 24576:H47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYPfJ4yL/tNCJPXUQrPq:H47JUQjqirIhCnDHUPfF/JfJ4klKXni
TLSH
T14E65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 723895a4e5c254caaeb0a8f4771f58170f2decba2690803e8d3c90dec7ee26db
MD5 fd9f08b556bdd4ff4ee956ca3a285c9b
SHA1 9fbf7a93146e39bf413cbbdfde958a0a8e627329
SHA512 a50b682a2d822ae669cf901eb248a83b228908cf445f3b1187fa0bedf44b82a8bd3ebfd7229895a82d56752dc1232a6db0644223da6db74cae335d07b7477d76
SSDEEP 12288:fpsfCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:QCfJ4yL/tNCJPXUQrPv
TLSH
T199E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9c3e3bd7d86a00d4dc488634f1eb6ca0804dd45c37558f5a1edc64db0faeda02
MD5 5bebd9cb02ddba08a9d12a5a2dc96cec
SHA1 f198ccf8a451c0294cff458a10d245397f2c736a
SHA512 8316553bc8c3857e0d72c373ba139972b401256fc75a8208ea8ef08f7dda6d64983d0b15d5f8a0662480a6efe962a9d131a716751426ecaf02c18d877e143b11
SSDEEP 6144:z2sBC2narM9vD+nOI/4otMxPytpiU3fvkXRmPVQpxYGOI0DYpCNHSErZYLNB6kL7:zz5vkuU3f4UWpKGFbnLCAlJ+jMUJvk
TLSH
T1A43518407626DB4FC6A940322E76D6CCAB707D42EE099F1772C9873FC476658B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 8fae0da7701ac1c0d76253c9d10b7979d622f9553a329a3ee48df24a9ceeffad
MD5 1075b08e1e89a6f89b1b241b46c9d2df
SHA1 9d51abed08d7471ea8493a6ad1adca7ebbab4c5a
SHA512 9726ce35607e4e751eee3e94f2aeb1177121936807927a6aa431884d54ebf02c1cd3d9fb125bf8af8d8012820c61e358fcd9299fafcea953cc3aac79450242e2
SSDEEP 12288:w2T7IKSt645etMu909qIqSZbhCKz0wVLMr19yYA1iTKztB5FxUPHy:w2T7IKcRcOkyfxbhCzrDyP4krXxUvy
TLSH
T1EC854B416577EB4FC9BE403702369ACCABB4AC06BB493F01B345C939886695EB5F63C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 86f181a985d5dbfab5983f269643e3a55452096bf3e3544a487e0bda4756df23
MD5 3349c902dc8d01e27b62afe538f6f42c
SHA1 4b5f46409788aa62c5c28b0b0f5a27de1b04dc3b
SHA512 5048eaf6dd0af36c78f10bd1044563771d308483b05a64e3e86918653354f3b9aa5f475b6f1e85d342b9be159f52f4347a73ecdc1aece44003c1117385a8a266
SSDEEP 12288:PM7qfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:kqfJ4yL/tNCJPXUQrPb
TLSH
T139D423A761D49446ED7687F8164CE000D309BED51B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a55d97f482e64e2f7810346d7f17f8177bb407b5387bcbf05e5ee4ae301fdd5a
MD5 1b40d7f8de4736b313bc1d594f40270c
SHA1 0118f8bac42fa42f02854566256d3eb75d1b8721
SHA512 e58407935653cc79d5e7647bed3597c08c7ea8dc663d285bcfd5ca7a1d92ed641132260f1b1b060952d9ae3b58549e93f90f5fe30a0840424086c788878c87c7
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYgfJ4yL/tNCJPXUQrP6:Ugb4mBIBhGFPfJ4klKXnC
TLSH
T1A265AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0d99a7ed18c092aee965297acee8656b475c352df26258d0b4fa6b964c553750
MD5 c35deecc30e0168c68f04c9e3d93f5f3
SHA1 f811fe1b8006a7fe37f6d5ee0007fa206700539c
SHA512 3dbc3df3a2870bd2e09635e6ca7960aaee9c88e5b16da2d031f8d7156a753f432e140bc5373e91ce5919208ce03eaaac4a035b4c68b27e6ba752ba90a2ef533d
SSDEEP 24576:PG88u8FpJqH1vzria7/m/fJ4yL/tNCJPXUQrPT:+7ZFPqVya7/ofJ4klKXnr
TLSH
T1C035026676E101F1D47BD1388A868663F771B8150335FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6da37734a37d0ee23e39af11a29316377f6e1397b59449dedcd48276eeb5400f
MD5 32ba7a6d52a235b70809af5769e9824d
SHA1 fe3fbef3856ef857122e64f6a55e1b090867d5c5
SHA512 acd9993f97d6e3b4272fd6ddf0c21ce7afed7cab76e313cd3044d3c4d94dafe2aa802c3ebf0cac481fbaaf2f95b86369b41cf5d5c3e361549549f3889e27cbdf
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7fJ4klKXn1:kG05lO43bOfJ4k
TLSH
T19DD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f6277cdfd0a1af83c2106cec7b47314fde1bce62205f9991e751ab7dd88f146d
MD5 06be5854a1218fa2397bec1efc5a7ae5
SHA1 78c0ca1d169a16ef4c58aada8942eb57da4d37a8
SHA512 719dc2f45f356ba99900eef7478ea8f236e62d8613c2060ce6136b3e3226947a7f871ae0853420ac7224ba9d9bbd48a34caaf0c6c4607b1ea49292e47a17c75b
SSDEEP 24576:Kfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5fJ4yL/tNCJPXUQrPZ:Ca5POZ3lJt2pasx2+mTfJ4klKXnx
TLSH
T17A65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af0ac2ffc96744888443fa61155799e0129102360261beaf2567f951c00fa773
MD5 bfe04e2128cd61d2786a393277d20e6e
SHA1 2355058267b6f99d9581b771b08ce68d6c7e1215
SHA512 77e24ea1548f056247c3267c8aae93f99d1a49510e3739ee1004748e9bf7cc8c894cea7f072e238766941cad1c2e836e40a258ba545d97931e61624ec292213e
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7Fk3fJ4yL/tNCJPXUQrPq:qNc/zEOVHFIfJ4klKXny
TLSH
T1BD858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 72fc052cf3dc029d93d13d2c51c4b5cf92b93a9164be237453887ad1595ca81e
MD5 9a5d25726786b39cfcff345e7af1acbb
SHA1 1fbf2c9277e461d2c9d7b53b1906498eb3689d50
SHA512 3a25ada01aa51797b6f5a1112a31e320400e4bef098f3196e92166e3c6deb063be3db635b6a04a5fac44caa9dc05d081d56c5a405f1ec8017ee07543c3129b8b
SSDEEP 24576:p6DIM5b//32zbST44VkeLGqURYG7rYHxoPNZMn:p6DIq/GM4EkeiqEYG7rKau
TLSH
T1D325115C732B11F5E06BE07E96434511E2B2B07187125ADF07A4C8BA4EA7EC9BA3CF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 bfbd5b803b2789b8de33e28fec3f6ded24a305fbf6f5ea07f76f08d0b15c3504
MD5 a03fde5fb7233f25b69c2539719918f6
SHA1 165c9790482a6aee8afbd51fade4fa6b11c0b530
SHA512 b107b28a9c8c757d81811cf3d25fb39156e7d6d5779bec9a0bab02312df562770224d42078b5a237af1ba0323a8ba360eccf447a084b711928797ad9a96d2127
SSDEEP 12288:+HvUrBFrEjwaQLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2p:+PUr+NQLfJ4yL/tNCJPXUQrPP
TLSH
T14A05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 3ae2c454dd02442d5e54075f742742489f3b18ddad643d74de459b583bf40df2
MD5 ab85e6394c616d56e924af2a93b10435
SHA1 ff66487b96a8762af501ed1b6603a172131b704f
SHA512 8310f0a55acad09205645dd041564455b1114eb472e34dde9fe89dfaa77fa10f9a974f0234048bb54a770b2aa07f96b4b55ac53d0bd5a5b2b31a1e548d9f325a
SSDEEP 12288:bQcMxWDXN1Dp/fshBItT1IQgAefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GW:bD3FHshBIYQgAefJ4yL/tNCJPXUQrPO
TLSH
T13E25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/268-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/268-107-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/268-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/268-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/268-346-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/268-113-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1988-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1988-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1988-34-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1988-33-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1988-26-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2616-86-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2616-92-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2616-84-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2616-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2764-132-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2764-140-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2764-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2764-330-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3536-18-0x0000000003170000-0x00000000031D7000-memory.dmp

Download

memory/3536-14-0x0000000003170000-0x00000000031D7000-memory.dmp

Download

memory/3536-7-0x0000000002550000-0x00000000025D5000-memory.dmp

Download

memory/3536-0-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/3536-1-0x0000000002550000-0x00000000025D5000-memory.dmp

Download

memory/3536-43-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/4724-126-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4724-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4724-332-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4724-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4724-120-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4724-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5184-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5184-152-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5184-154-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5184-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5184-146-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5524-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5524-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5524-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5524-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5524-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5956-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5956-74-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5956-80-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5956-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6004-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6004-65-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/6004-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6004-69-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/6004-58-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/6044-102-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/6044-96-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6044-97-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/6044-327-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6124-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6124-168-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6124-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6124-334-0x0000000140000000-0x0000000140172000-memory.dmp

Download