98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260730-vrabtswxev
SHA256 98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474
MD5 a7f967f27870fee9b9f291d31f393236
SHA1 f398545922dd05d90b2d6c8d157876c75a2cd714
SHA512 aa99e1de603f141fda51e17b9c46fbaa2eeac33ac7cd1a353c9d339615105877135a58fa74eeaefb2313e9d4280e7d0afc93da15d58d2dfecaf6527cfe12b9ce
SSDEEP 12288:qZmdbex678tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:quex686mctvE/BT76+1NCE
TLSH
T11375120174C280B2DAB71A710560E3B1DA7CFEB01DA51DD773550A7F9F302D29A2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4596	elevation_service.exe
2000	elevation_service.exe
2740	maintenanceservice.exe
3728	OSE.EXE
3764	PerceptionSimulationService.exe
5892	perfhost.exe
3384	ReFsDedupSvc.exe
3408	SensorDataService.exe
5600	ssh-agent.exe
2580	AgentService.exe
2824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fccdef00238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f3fb6f64620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f7a2eb64620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a585eb44620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4148	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	4596	elevation_service.exe
Token: SeBackupPrivilege	3384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3384	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2580	AgentService.exe
Token: SeBackupPrivilege	3384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3384	ReFsDedupSvc.exe
Token: 33	2824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeDebugPrivilege	4596	elevation_service.exe
Token: SeDebugPrivilege	2000	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4148	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3292	2824	SearchIndexer.exe	101
PID 2824 wrote to memory of 2836	2824	SearchIndexer.exe	102
PID 2824 wrote to memory of 5796	2824	SearchIndexer.exe	103
PID 2824 wrote to memory of 5608	2824	SearchIndexer.exe	104
PID 2824 wrote to memory of 1276	2824	SearchIndexer.exe	106
PID 2824 wrote to memory of 1436	2824	SearchIndexer.exe	107
PID 2824 wrote to memory of 3644	2824	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3728

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e2887312ccf5cf24ef0880a2f68bfeda7793f52b2aa8b5a542613e6c12c463c1
MD5 2f6a7ee945fb4bc6d1c0138e4bd35011
SHA1 5e65529e0ca557e68b4332335bee948bc1aa98d6
SHA512 a53676fec6379b711f88dc4c023bc58177d5c274762a3481f4f1ec84d35d668a33288eb101c616a4c970ea6b60440c8aaa788b5a57a3a768786918a971f5f098
SSDEEP 49152:Vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnX6mGvKVO+n1:r3q60jBcXeN+1
TLSH
T123D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d26b5e1b1e9ff7b3610fbcd193167d7f0989310ae0fac53168028e4b341452c8
MD5 fbab55724e594f4c6ed828df9cc862ba
SHA1 59ffb8a99e0263eeade38a44737a3f7417c5bfee
SHA512 b6799eea0a093c1c7a6c648369554ed7b11e5ef79611da7ae102ce3639cc8709fcb5c8ac60439e1bb337623ddc3109344c64cae0e48d77c44b093764df4e6f99
SSDEEP 12288:y1XLsswWkxy2lRq2czAPtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YXYfDtczAP6mctvE/BT76+1NCE
TLSH
T1D3850224779504F9ED6B4278C9A2C112EA337C9547A4E7CB03E4892A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 60cdd1da99c3384129c9eda661946ec44687540b58bc0dc9395313f774348ac7
MD5 5415ffad18817e662ca44e50f7ba7474
SHA1 5b5ce2c4308b9bc2f316cf424bde2a250485c6da
SHA512 e1f7a733a3e8b3ce0d7bf53971680364c0c02e35aea8f953dce913ace9ad62573d19888152e23dc3e5f88393b0445c64f023585aaab8ccccd5fe79867a1d39da
SSDEEP 12288:tXZNYVLeyUji0h90ZD0wxpGZIVutrHsctM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:D0Le5ji0hmxqrMc6mctvE/BT76+1NCE
TLSH
T137959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 57bd8f306a72aaba57766071373191ff9cb3fc54aa5bc39e007cfc87db17aaf9
MD5 0f69f8eb2581ac673fc61ce85e178e50
SHA1 f3d4c171532be059e038860dcb8d8576ae5c120f
SHA512 e86764884e0de48706ebf681049dcaefe2d9ff6d8c3fb06e548ac41aaa90a04e69e0d8b7160b2e047788022e75f777add2a0079bde1a0d51bbeb654473d71fef
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWr6q8wyuu6mctvE/BT76+1NCE:C/ezSC6vUzPviHjyx6mGvKVO+n1
TLSH
T1AF755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a6d751d364591f32b77e68ba8cffdf18e267800956bd7d1fecc75052695a269b
MD5 1e84d30deb030b1d68a42eb810b813ac
SHA1 7e484838cc21cd2e1b72bc7d4b2445bae1874c05
SHA512 b18aaf313d4a0208a9bd8af3ad42a978212a5646038429899c0b80bdf1861617be11f311ad3a35f614ceed72266af90507053e60e5df86f9edee59229a95bac7
SSDEEP 12288:GVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98DtM6hct28uP18WR/FW2Gb8JTCMx:GVbqPb88hv/l+bD6mctvE/BT76+1NCE
TLSH
T17C55AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 903a81f37caaafee55b0cff23831fdcb62f79d50b20c01b37e34c82c9be9bf72
MD5 ecbbe90a655f0635c9481e0a39dc5cee
SHA1 1d52f4e0d7cdfd1f8065536ecfb623ff3dcdd8f3
SHA512 52a34eda3e6cafed2a41c37f4f22681f08bd06b4f385aa894408fa9c4af79fd4ff042eaecfaaa5833a37d6153b75ed1373ab7c558c2f200ace8b98f869ab0dc6
SSDEEP 12288:oMwtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oMw6mctvE/BT76+1NCE
TLSH
T146652382881B11D0EFFF07F06395E296E8516EF978DA1C81D322991F9D30162FD4B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c05bc464ce4413ba402fd426232684b86f95b81429ebd0b329181392d51890ea
MD5 115518fff36ef120f6b534cc407c90f7
SHA1 1a5ddc83b9669f9136029bfc47168ad1005eb1f1
SHA512 4ceaf3fc2a4925130af1918b24201f0171f1b1f0f07e9bb728bb6df01fe2f8a7c8ee9a07911a73ce489340de0c09477494ba1e8fbbfabb7c1ef73b07c2987614
SSDEEP 12288:1eBNUbTVO86ULtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:1JIUL6mctvE/BT76+1NCE
TLSH
T18685CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d1d23ea29ddf8dde213703a720df25a2456e0bc5cacf9841130a198b689fdd2b
MD5 b7d24ffd569f9141bb104bb375235cc8
SHA1 e21ca98ceede5413e9bd1e8b137a24963a90a2fd
SHA512 4f6714740b18e38334160720db12f20707b9e93bf668ff6bbbec217aaa7cad7062f0dc2135c44eff25266d8f9c663d6efc12a04e9c2bc3362f5f23d5fc4252cb
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THV:rQvGAdlCEL8c/RRNw5C+XeN+1
TLSH
T108267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 16e82bbac7df7811760028ed5cf6d300f386567e882be4723495a42f58032ca3
MD5 6dec2da3241148dd7cb2313e61344f4c
SHA1 6bef356d511454d2de2f14388cb7443873de51b0
SHA512 c233c9aab02d80130d48073ebf5d9f87bd4ffd19159ec5b6355c8b4a227791cb66317bbeb4abfd11b7f609e30d71ed35453d3f0c33136a58671650993fa925be
SSDEEP 12288:QAwSfxL/2Dc3+DLLmt0LDQewsAjVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:lrewsAjV6mctvE/BT76+1NCE
TLSH
T17485E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d632ff9211cb07faf9f06bbc4bfebb4db4a401afd6d7b8f20582c6c0d7f7a3e0
MD5 355c156bea4ece1075a1f1af50b4690d
SHA1 daa6f93d17cca5e798ec50b22dc41cbe9cc60c89
SHA512 9c7dbc7b57bd21b27e2358ade5248d930361bb1695d3dbd7f741070b377c57963928dfe2714898e0b74cf6d8d11fed1f68c03d462045eeb198829ad524f29468
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHtXeN:fUEtQevvqc2W1cpV2RI32te
TLSH
T142474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6c7f6da91f3779a6c4ca4afe19568a46ec2be2c316f85bed942e250b40bb4c37
MD5 8df8b64f74ef609b6a6e50927a1e9c12
SHA1 cf30258a8030510aad33a2cd05be91884e2d7060
SHA512 216bda16b5aafd84a124b6ea831a75e277f6a8ec57b8bce7796dac641f76872ae7eb805985d09524df1c092d0a805cb64231752fa2db2ff342ace9f70c02c65e
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/z16mGvKVO+n1:/oqtVjnmqXeN+1
TLSH
T196D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 75a8cbaf5f3e5b4f12ea359294683041a53582d41f8014bf2385435c742978b0
MD5 3f33b0216438b83ef8107ccbe36b6081
SHA1 81aef0092c4b5e3d9839abd9add5a2c4530af977
SHA512 71eb270961d64204eaeb8078470a4f0d16b1544c617a9d8b08b4043f2f3bcd1eb40474b50a76b72d65f3c98910e0772d919c6dd80dc2c50d70b594b6632ddffd
SSDEEP 24576:3AhGL2IFoiwtA5l7S53K6mctvE/BT76+1NCE:3AM1Foiq566mGvKVO+n1
TLSH
T112359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e80ac1fc0dbe2eb79a5acea7c64c4bc9e64e036c0d77dd31e69568c7d3bbbbf9
MD5 ebce6a46ffd7fd770141deef8481f6db
SHA1 449b58801485ac4e2429f0c78a71e1481996a193
SHA512 78ae53f4ccabebaa200d6b53f86c809a788ec0b824fb1ab1b7daa89847b47e1e7a42d121d4de4504010e8e6e78604bd0198aebeabe29171da9ac2f75bc4acf13
SSDEEP 12288:tmw5HEjsChNDBFgl0WDm+COtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:Iwu2OWR6mctvE/BT76+1NCE
TLSH
T1ED75F14676A508F9E9A742788657C136F7F2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 84d3270b402cd3242f5ad766f78c1e9e94feb7cf94ef5929478eb64fdeddcb4c
MD5 48a7e423699ff8510a1ca422828a6d4e
SHA1 f51789c42fdc742e8c98c6271ff9499c83a14d73
SHA512 bdc29ed0f19ce6287bdd8366154bf49e022e78ca7194d7823266516ccc2d7d1c4394fb1e81d1304f7e3f4cf776958ca11334a945d2b2efd53955dce9ba3ee351
SSDEEP 12288:dMZ1IyltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:SZuk6mctvE/BT76+1NCE
TLSH
T1C6651286226520F4E5E702B8C9E19245E77178E6377603CF5221866F6F33AD26D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f58999aaa867ba273ae6ac5059d9631819ea0ba4376650141ce7ccd28bfd0a64
MD5 67be9fbc8bd6e39b7f251cb749c2af8e
SHA1 1559cab8da1c7b75ac8895c27998db89e3aaa788
SHA512 60957b9b21ebef0cf3168362067d380c72be841cae291a2786151dad0b2144ffc727eb6a3e81478607b0b343e15d77617bb996047ca05b5e7cfa5111dfc2eadc
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UJ:5QRQyi36YOcPhLvw2gAf+PN3XXeN+1
TLSH
T171667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d7adcec99b6baefab00fdfeec85b87dc7f45f03695ec0fee77164a8f770f439
MD5 7c694110c07795cb6d88f88bddfe4d07
SHA1 628873c53d93d7912fd381ab73e06f3142ce7cda
SHA512 9b61f8d52a2b3f03240d8b8afee521294b6cfdb7aaff18f61ae054f52159cb18c93be72a4f4dbfd018241b09ad290ab2c6773adf2991a09d671cc03a4b8e8e1e
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UJ:LQRQyi36YOcPhLvw2gAf+PN3XXeN+1
TLSH
T17B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d6021a73dcb0ff43855ec828ea889138b25527507b7fd43360a21c9f26b5ae7a
MD5 87bbbb6d04826f06a3775489055d26d9
SHA1 516330494ed130a24dcd2a812ffeffca05ffc940
SHA512 d4697f849beffed6d43807d120dc3757661820d9c032d15b3caf4fbdc297be9d52fa27b42455f2c92219d493425f35e6cb578fc384b4d57747e71e64986830a2
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0U6mctvE/BT76+13:P68Qg55nhceWu7PNU3/F6mGvKVO+n1
TLSH
T169B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 68a802f759761f8d4dd723f9d03d8e48d162cdd99641c7cb92143d75cd3cbd5e
MD5 ebe10bae50df74cf8b29702774628561
SHA1 7e19709cd871b464c777139dcc8adb9af124fd21
SHA512 7b31edff4ab8cf93b197fedad36a1ff1c960f83da12a66d5505e725bc1677e40a7510b006ac7c92903c75dcd2a828d1a5224c25127598e641cd9f5eec98dbc64
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99P:Ay5112gYy5azzVva69nLKnhZwXeN+1
TLSH
T13A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cae2c0a94808f0e0423c09f66302dfa75cecd839aa07dc02ccdaa4fa0c0bd3f3
MD5 347a8d8ee2d75fc41e257d5539f457c2
SHA1 93d25ecce1af45430490907127e6a4242b28ea96
SHA512 768ee4f4f5d7327c4ceaa28acd5eff6dea7b7eba001ea8576782af658bfd6f945f93f6221a5dda0e616d0d9c570dd07aabeae2afb072fc6ccaa38173934741ea
SSDEEP 49152:iB+taZ3usBWOBr4tEG20bqx0z+n217aau1glI6mGvKVO+n1:Qu6JmUxd2dIXeN+1
TLSH
T13CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 513b66a0ca9efc036525e9856f87d88bcba1371a936127753c682618980bc1a0
MD5 bf8c2d4c45eb31e789f827bd5cb4e8b9
SHA1 26bcf092e766b9c0dc92dfc2076066d0bcb92f13
SHA512 e6b4b89b2bf32fcbfcff51eb5b67605fd1916c9e86031fa40e1a2a60da05dcf073fd99028d075436e2928dd75f74aaeab84672f5362ee568c7320006428f03f3
SSDEEP 49152:s1hpsNoJpF1A6BU44CwH7R4xr6mGvKVO+n1:smifPkRqXeN+1
TLSH
T1B9B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7ec04665410efd1de504e3dd9efbce2619ee5567e70f991e6f14ede193fdf7e1
MD5 e3915ba7c62c06bda5330837dc73f52c
SHA1 c06f8e7937ba30549e0bef2b56b15c3c794a4023
SHA512 a049216967f8443f55286fb85387d8dbe7b9c6ce418206fd9ecc6c32e405f91426e74db66ff3b04586573e0967e884935cf87aa11963f806c0f144760695710a
SSDEEP 49152:GSuZQIY0Be2KNRVtOnks6NMHqk6mGvKVO+n1:I5dKvi61kXeN+1
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 de41fcc62d7c71a69b720e209fb4cf37033a378cfa484a74b0bd934a3da342f3
MD5 a4b9cede4711a03ec71db832c151af39
SHA1 d5559f2a266699b16923ecaf5f96dfc8b452f85e
SHA512 cdfb2e940f7cd0075afead7b4e8813a5ae6904f3540c3d60c6d8117574cf628877b008185fd1d9d87130512b64e07665ab8fc5cb3a840d88e9b3a5865c8bdf32
SSDEEP 49152:ihtSn8EApI0figXgiDn0AP5wP6mGvKVO+n1:DX2iyph2XeN+1
TLSH
T13695BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2eef71b2446c232b49b24414687e3429ff9cf260d19eab365a5decd933bf6f33
MD5 2222b9b188b78dcc5240f39d8c2929c9
SHA1 595b33aae3aafdac0b2b1cfc2cad8247800159bc
SHA512 2c478aaea9c55e95134fbf1e584fc006530c6942977a92eae4a92474066253157f84f750a8c5617761d6378396ecea094bd1fab5a3cf4e7d8c98f9dac7fcb2a4
SSDEEP 12288:n4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:n46mctvE/BT76+1NCE
TLSH
T122652382981B01D5D9DF07F09395E296E8502EFE74DB1881F326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 74a319bd407051a52d04585590a0ee34c8cfb89e7261652bf04ab52f2caab690
MD5 78fad78e7dd65403f6a116aaa5d3454d
SHA1 2f7068123fd1e2902394f9bfd542506c9bd65d0c
SHA512 72fc8bf408dbbad9c9a2f6bbb51f74fa715eeca30754f8e19a27324bde803c31044a7f0b892b15123d1394da56581b0a13acb488aeb8f597252211da60610413
SSDEEP 12288:lptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:lp6mctvE/BT76+1NCE
TLSH
T1FC652382981B01D5D9DF07F05395E29AE8502EFE74DB1881F326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1ff7d3ddffaaf28ea168127ceb805783b53aea830a3d89553442e10112c3a6bc
MD5 465953bf15367b6309092b7bf7ce0286
SHA1 5a78b29dc6b4ee6c32942a8658ce90dea9ba46d0
SHA512 ee52a642b6c6340c10fbb572feb40b6fe6ad74282455d109f2a450bc92843f151d1467138cc97cc3984b2a1fffcd20b8985aad8de619b2f9c78f7f6f0827e1d8
SSDEEP 12288:AztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Az6mctvE/BT76+1NCE
TLSH
T10F652381981B01C5E9DF07F15395E29AE8502EEE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 308c73fc5701dbef9261b5f8deeee0a0aa755222d724e5d9b588bab54780d789
MD5 f1c7ce336df41729e16b9b1be4127f4c
SHA1 b8f5f73ee10bb80d09617f68fd8058514a9fce99
SHA512 931612df7a70f800b14e53d1aee474f9d023dafd820b80c863e7ad64b9b15e3f5b0c7ee46688fd41c5ea1297519b36521eb7b7a6468dd7b16e2fc5a8756ae12a
SSDEEP 12288:4VqtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:D6mctvE/BT76+1NCE
TLSH
T12D652382691B01C0D8EB43F0C2A2D296E5B07DE975A719CBE311491F5E303A17D2BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 db87114111b8e74dcae32adb43c42d041ddbdcac86a581603acd3ca9141ba460
MD5 1db948ef42e636a8d7771fac0968d633
SHA1 45bed7e988a54298382e0fce11809edc472bfc13
SHA512 f07902761c40b39a453ba296d4f838d564e9848901a747416565e61ca37a6b88b06738baeaec217be864c19b08c1d45e7390fd00f20d93bf1cd01324f875cc39
SSDEEP 12288:bitM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4s:bi6mctvE/BT76+1NCE
TLSH
T18F652382981B01D5D9DF06F05395E2DAE8502EEE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f3de5219e37897d22ed149656dbb71f4d7c24fc5ae0f19a92719b861169a0b4f
MD5 ca7bcf1c6747c261ec1449ab22c6461f
SHA1 1fa81d096cc8ac5acc2896961b5cd09da44d4bf9
SHA512 7e0ec2671a2c1c1a34b312117c0d2b24f031ba8a22f3b360b85473bbfe934d237dbe9e2e820323986cfde34ab04f2a874613ffca43a610d2b4d20e28391404c4
SSDEEP 12288:09tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4s:096mctvE/BT76+1NCE
TLSH
T13E652381981B01D5D9EF07F05395E29AE8502EFE74DB1881F326841FAE705627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 08ce23d0590ff7fa44cd5cb18e3cd9ec86f78d5afa34a1f08c28dda04d365db1
MD5 61e305c0f2042c9f5de1347e864bef64
SHA1 67a77e208fee3bb012f16f53bdf9bceb513e29d7
SHA512 ec301e3a80dea3bcee23805d583939faff87127cb4b4c8586c198a4df32aeec17f5553e8994c6d2c69fca0407e9aa959c8859719c862f3165a0c7e93e42cd872
SSDEEP 12288:0BtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0B6mctvE/BT76+1NCE
TLSH
T15B652382981B01D5D9EF07F05395E29AE8502EFE74DB1881F326C41FAE705627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 19712e424eb051e961e8dc4a111528bf680a4c085c38a5d9bb8bf69f137ee6ed
MD5 213a550828ec42bea132c2ed9a5546ed
SHA1 ad2ac36d69059507fc838fba32dfd19bc003c692
SHA512 283834063c0264cba9386663a0a46fc770b66788ad2fac6f6eaf29b6e31cc6fc152fd53bcaf12b36322287411af84b816d21cc7ce13a264f3725ca9b4fa6fcbc
SSDEEP 12288:yiZwbrzzFEoS2cPvyJtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VZM/zFVSOJ6mctvE/BT76+1NCE
TLSH
T13A850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d88a891ad0f5a2a0842507de4211f726acaf1f4251fce631b1516eb1bf15144d
MD5 8d3e62175eb7d7b29ace75f8ed62ba97
SHA1 d8fe4ed1b18eed3e772cb15809b535a407b09ecd
SHA512 11401e859db8e460ec6947db326e622cb035a4cacc6eedfbc0c86a2acefa24591526e1cc3a158e388c519c72b911212de7c9a70d0415611c3490c5baf0393ab3
SSDEEP 12288:G0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:G06mctvE/BT76+1NCE
TLSH
T1B6652382981B11D5E9DF07F05395E29AE8502EFE74DB1881F326841FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c66c26b4e2a67fb1536ad3babc5aeeaeaa1205ff09ad21cff86f9c9b46f95d5e
MD5 8a4ccd4cd8ad7f54b8659a6c2ef32317
SHA1 76e0cde0083bc6a3e41a89825bb4f7470e0ec3ef
SHA512 b1946fee7f6fe29efc39bb16f8ed6ed7d7df358743a80a43b30eafb91b42d9e7dcd1d38673ff26cf12ffc30dca89a127df0ace34bf4f989e6dab59681a7f8e22
SSDEEP 12288:SAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:SA6mctvE/BT76+1NCE
TLSH
T178652382981B01D5D9AF07F05395E29AE8502FFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 be9747c22e3dcb136ca096ed8f6a4547ffa1cb1670da21653ff2d42f7a4ed483
MD5 34796da4a2e57d9ce0055cdaf6887f7a
SHA1 8718f995684468fc6f2bc211f236be61c54560ec
SHA512 8c83a6207a0caeb0fd504da3179fb56a996a8f23c3dfe346b2abe2e2811a2513cc9904966928deb4a7ed66480b55649649f440a2a3264842a2c94e77a64d6c67
SSDEEP 12288:DyPz5L8ltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uzyl6mctvE/BT76+1NCE
TLSH
T1FE751143726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 73d89baa62028381994367803c2b7ab79b101ca4000a4bdac226878c8b8533b5
MD5 b74c82029d65af0f8ca3d9846389158d
SHA1 01fd9a46db8e0b77d77f6dd56e47f8a1254d8100
SHA512 abcacb9f93b3d7222360891570b2432f7d03ac73ac28402cfefbd9c6322727388b6a35f77e01e1bdedab53988d6470872c64b3e00543860a39fb53c9b5a01bab
SSDEEP 12288:Z0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Z06mctvE/BT76+1NCE
TLSH
T12A652382981B01D5E9DF06F05395E29AE8502EFE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9c2a45e36f51b39fe9c8fb569e6503017e59ddae39f32789dc78b8b4ab90c996
MD5 88276576743241a9b53e1f7a1ed7af02
SHA1 951681c150808060b307789eb80f06cfe198b326
SHA512 0057a1c103b7ba3b54bae38651cdd116eb90351523a576427535b9135816438aba4db72e7e0112e23f7279d8cd30fa264d36d61c841bd3ad7b9973228f35ca6d
SSDEEP 12288:N0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:N06mctvE/BT76+1NCE
TLSH
T125652382981B01D5D9EF06F05395E29AE8502EFE74DB1881F326841FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 39853d26d9329b2fe7004662092c204cf03964ceaa93b9c518178b9d2c7f4458
MD5 90eec79daa6b30199b58f1a1431e2ef3
SHA1 5120c6aec94f34ef5b06da798bbb1d2bb32f7378
SHA512 3f1963dc9b01d2f9bf3b7c1a941b90b917815f2a9eced74f4c38987aaeff6d1a6263383f91d0183cc96bb3100f67629b36b05917074b87df56cf7040c1ef01ea
SSDEEP 12288:FyPz5L8ltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Mzyl6mctvE/BT76+1NCE
TLSH
T156751143726630F8D57B4274C9A25202F77178B62B654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2db6ad0db181b5ae09f74245d5d6c8ee78d081a203a048db15edd3b5da4688c4
MD5 9202c5246adf0e92cead12d7b9e02f3c
SHA1 2b75dcb7c48a22db031b7e7f7df7716246b3a84c
SHA512 c6f0eba5dcf52f44e271802ed5b72335db7b07e98d9bd4471fb701519d5241784f29c072a4a272054310b710a8a095e1722712a41638172b38139f567779ac1f
SSDEEP 12288:4Cd9NWYoaLHF3z0z04PDvhjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:hT0aLl3z0zDj6mctvE/BT76+1NCE
TLSH
T1E7850295B35118F8EC67427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d98d48e5a7ba363ea3b4a2c4890a90a11f850b9b1bb3202b713aab1cf2c7f3e7
MD5 0b8923a31820e33f38430bbefa7ef27d
SHA1 d77397890f03b10d5769d68f03ecb25bee701c31
SHA512 19f15e1850294cfbae3ec184f3bc85809640afe66d6580949313ab84ae069639744adbb5cc3386e1d4deb8a44c86687b9ed03a1a2d9a5364b6a6bf7402b776ba
SSDEEP 12288:Di4e7PRdTfgwCHKy7GLbbdIvGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:D3Id9CHKy7GZ36mctvE/BT76+1NCE
TLSH
T1B395CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 53498f2a2ee2db76c29f5065443dd1833f5b28dc3ff4c52d068ba61be76349ac
MD5 bdadceb64d7bc29595b7ac2d53924749
SHA1 da55d0d2f5fce78852fa62d80b3e7cc2dcbd01d1
SHA512 af953381ac1691b3635f4a45abc21dd03f3a0bdece7494f8731f23d88ccfbb35468bd2c4f0120534a9f07827936a2754e0db2617ab7e1ff8ac3a592504225d2e
SSDEEP 12288:UTtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:UT6mctvE/BT76+1NCE
TLSH
T160652381981B01D5D9DF07F05255E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 aab00f58b141b26575d8a3e1db43604c09c44127d7bfe97298aede3831baf104
MD5 3420884e03da125eb6f61be0465350e1
SHA1 d8f08e747ced1e4c7d09878526372083f349331e
SHA512 f506b575f66d29112bd799d382d44f08b17e69d44e83db8ef831120f1c5e293c47ef432727980c377991e073d58480db895fb6b16d2a1f322363b43fab2b6f96
SSDEEP 12288:XFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:XF6mctvE/BT76+1NCE
TLSH
T18E652381981B01D5E9EF07F05395E296E8502FFE74DB1881F326841FAE705A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2495d6bea97fdf2e87b880424714d35ffb1cfca625db77c5e549414c975f79ba
MD5 918a31b3de054a03064ca2fc3b5f3c21
SHA1 13f28f1b2dd463ac769b28a60fcd5618eb7664d2
SHA512 bfc93f1f4147b8d8632e183234bc497c01b37dc868caf4f4ecbd716dc137c3a8c34d560ac22cbef894d97f1b21ed2487b798a8c9bd9c1a1143288d041ea1284e
SSDEEP 12288:7GtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7G6mctvE/BT76+1NCE
TLSH
T1F4652382981B01D5D9EF07F05395E29AE8502EEE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 e8ddc2bb6dae254c670660a5e8d7c7b317bdbe2505c33ebed1649b379cfdd842
MD5 a4a646fd1be5bf648430265cb2072986
SHA1 cc14cd25508a50770ea03938855bf3a899f2c109
SHA512 34f87f84ec8f85d4208e7fd15b146fdc896110c2637fa455297f411c678a416feb658a7e49e275a766419f53913d7b1bce8c555722af21c62b90db4dff67d5c5
SSDEEP 12288:+0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+06mctvE/BT76+1NCE
TLSH
T1CC652382981B01D5D9EF06F05395E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 3c41ecfd13db431808d7b091c51d983ce7bc80ed16d5394fdb715cba7ad37b17
MD5 44b7e120eb4a8144cecf0c54c4c3c014
SHA1 9b8ec7d09153a2ab25199704a58f631c61f64216
SHA512 d958bb4a66179f56d02c0db833bf7dd28e3956df16f2422f08ed09e4d2e20a7c991a2b74fb3fc6b3dff4cf2632f3c5307a0c2f9f2ba78c4f9736c8848caf3077
SSDEEP 12288:KTtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:KT6mctvE/BT76+1NCE
TLSH
T1D9652382981B01D5D9DF06F05395E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 74d5afb59b02ac7f1f36ef9b7b18d4474241d6d239231f0e4d293661718ed2e0
MD5 185cafb20c3ec389ad2f9a740125f1ea
SHA1 e5772281a25b598a4a8df4fdf1ef89b4616077b7
SHA512 35d6d78a8b8b7fdc538fb0940afbadd9c23efa1d89a334a28840b54040a275f3eca9d96662406af4811c2b81fe8e24e0431c6f63a73faaa592accd92a4741594
SSDEEP 12288:yMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:yM6mctvE/BT76+1NCE
TLSH
T106652382981B01C5D9EF07F19395E296E8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 807754445b4fb464c7a00bc9c9af83bfa3be1a499da643635eecba8ff1ba493b
MD5 0677b989b7f82f909c39a7940bf94bf5
SHA1 21de839bf47876c3dc7e34f4952e22f12fc6229d
SHA512 0e5f0ec98e73f7b9fb4df4406ded571c2b2c34a7b44e8fc3a486613743632d1bfc9800a7ada76bc9a0c8195561058fe5cd218deb6078c8376bcafdcde4913cc1
SSDEEP 12288:XitM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Xi6mctvE/BT76+1NCE
TLSH
T11A652381981B01D5D9DF06F05395E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3cf069cdafe6f8761c08defeac4334038c724b5947f1d21d376ad0dcc1598dfa
MD5 d794f5005c6438d1a6d213b9da1580c3
SHA1 0be2a4b870fef97c50af4e225abc8b0ec92c9121
SHA512 14236247eb402bb1b12c447410a7e46a5fd5e4eb8aa2d74b6fe377743f4b3401917e4f06afe8ab8cde4a1f1507c23244e3d19a5b938a82bda25dbe11d681eee0
SSDEEP 24576:Ofwvik9RX6wkyAIQ6mctvE/BT76+1NCE:gMnYIQ6mGvKVO+n1
TLSH
T15D95D129EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3aecfaf8469510f860bad1d1fe4fe4bb7c9493bcc4a9dd370ed508fb0e4ebf22
MD5 63c631dc68a6cceccbeca7495fac6d6a
SHA1 cba75c478483e81ef77878db21953aeab87d2378
SHA512 afc4152075df3836985304c0618ec8c0270a17367536d27b61c96bc16fc96debb63bf8fe439ef03669b6f041669016af0048b7d8a753235682a82ea2fdc5cb00
SSDEEP 49152:gYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0v6mGvKVO+n1:4ySzP3XeN+1
TLSH
T1CC067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7c73237cc58c21d683831fbfe78fbccc8320665dd2d7e72ed4143f0a234ea1f2
MD5 ba19cf548e8298843b233cb34c16bddc
SHA1 a1de6afaed16a2f4a6618b97b3c798db1092b0f4
SHA512 1540189c59620dd8b9173115780ab2a6e0e607862ab593238621efead5fdf495611f4837dd0ee232482d1e29ff69412d784fccbcc7109718bf5aabc55c5ff66f
SSDEEP 24576:/47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYZ6mctvE/BT76+1NCE:/47JUQj4irIhCnDHUPfF//6mGvKVO+n1
TLSH
T1AA65AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6b57b0831e1b7bffd294f4b5ab7c6eca974d45387ac30dcb89171ab0ceef7bf5
MD5 28b4c6a6f79501edc212a3abebb32d39
SHA1 adf11508b6b80bae039b264abadb11cdb5c82baf
SHA512 4448ab08ad3a9c13e9f1b123638b2bae32a4b140e533b982c0662459b73292e6ae9d38103d2891aecd9030d3b64468cc9d86981bcec42d7e2b23b67394fed9ae
SSDEEP 12288:y1sfktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:nk6mctvE/BT76+1NCE
TLSH
T19A75F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c8cc9d07e5de78889432f7a11323140b55c55bae237cbaf770f77b279abcc45b
MD5 e8374b656be272a1a78b5d0e26d70ac7
SHA1 c44e07b4a45b6989d77f6510beca3e81175a3536
SHA512 8e165d32c049773246ebb94137694753bd346966abebe3a19384344fd341c8dedc0a4972021c1387c3176a6b53b34156fb23bd0cb32cf6f6662adcb7b4a8f1f1
SSDEEP 12288:bjGsSy5TwoGmm47jd5M1s3920wqOWS0jCGtSaRMPHS8C4e3kW:bbSrmjT56L0WGtSaRMPyp4okW
TLSH
T19D452850762AC75FC6A980325E32D1CCAB707D05EE056F0773C88B3FD576568BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 90a54b737ed30dc1c91d7d37b55c5594e2959be1fe0c13d29ae7d8bdc7af7fea
MD5 9328490c6e0e961c4defd8af9612fa12
SHA1 d59269c34ce04af8cf00252d228d9cfb1705ab78
SHA512 de1e8b40ba7c27aa91caa58f6a25b50229a8db83f3187393f08abb9080d179c2c8a04ce642ca24073804b54b58e9a5ee41e056fbf257c2cb42970198775fcdd0
SSDEEP 6144:pHixWjLxUDhp1WNvzw3GvYRK3THdTnR2WmxTn81FzuYMj3CYKDexHG63xBQG6rn5:ExWjLsqNlKpbjyYJQkPNhcl
TLSH
T1EC65D881A137A38FD1FB6031072A5F4CA764EC16B7096F26B7C8053AD86A755B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2ce6347228f026c768a888ac12dff67da9d8691e7cab2e8513273d6e1ecdb4bf
MD5 663a10584652269883f2356fbd8c4694
SHA1 b07f34b941120959b15344d6ca8bca3b7957cfac
SHA512 c36875df3cb0b45a75502dc611940d7885031b4a31e87ff1e16f12849506b44043c55abb1448db5f78430108652a041df135073541f8d387755104b07c38d52e
SSDEEP 12288:kv78tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:C86mctvE/BT76+1NCE
TLSH
T1B8652382991F1184E9FF06F0529AD265E4157EF93B8A08C3F212851FAD305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c17a628f8e5b68e01ce94db41c082794a005d8007259ed1ebd9b84367fd2b903
MD5 e87332cdecffbbaadc94b8323b7ebb54
SHA1 1c868ba4c956aa70f42ff44932a80d7fef72afcd
SHA512 c81e795fb24eb6b4ff7685510ae320540ea49c23db37d81083a5faa83fd450eab90793df0ef30b739d2f1db600d3016e9da7e9a9379b6b7d881b550abd294a2c
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYu6mctvE/BT76+1NCE:ugb4mBIBhGFZ6mGvKVO+n1
TLSH
T1B5659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 bc49cea0df4f271ad19c38c10806cbc1958a1990bcf15088e9a8861253fd2db9
MD5 7e13b11d61c692ba5dbd5b8382e611f2
SHA1 2669853439a58356e87c32e69eff7d3dfa1e5c16
SHA512 f93cc7a5f1b0df7609c393d038f4f1bafa34c1f96b2f152f3b26e808b11a2ebca22bdce9c15f1d4eb71f34d13dc70db9b7941145cfec6875a5c7c062557714dd
SSDEEP 24576:IG88u8FpJqH1jzria7/mJ6mctvE/BT76+1NCE:r7ZFPqV2a7/m6mGvKVO+n1
TLSH
T1D595F16176E101F0D47BD1388A864263F6B1B8651364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1be71db8def89426aeb3e1ef50899c3ac03c1003976bc4a197389c86234b4698
MD5 398c369b2b21c7d947cb4f91a3a16c00
SHA1 0a79da5d59bb19f149461f65bc63344df151d920
SHA512 722013d88c341096e3f9b93691ffdab1bd6672dcb7f2e488138a0a3460ab9f73ec932dd4af5c3911c8aec09fb1d149673a24e516ea7a904accbcda87a4714ff1
SSDEEP 12288:GHvUrBFrEjwaQNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:GPUr+NQN6mctvE/BT76+1NCE
TLSH
T18775F21F65AD18E5E67AA17C85828319F77178A2171292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e49558c9e335e8a49ef8020bb2e2433f1f630747791ffa0910a115b4d64c2429
MD5 8c5ee4a4bd026d386695558c8ee530dc
SHA1 efd1726456f8b18019e92c5df307b242ba11e2ed
SHA512 91233a77775b5377ab5b9db53a31386713d8e75d65272ee74c85c3bea2cdc99b0d3ab7702b41f5028fe1ee28b0ae55a79aca9f6341089012485e593c9f48f3a3
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj96mGvKVO+n1:nG05lO43bIXeN+1
TLSH
T150D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d352b29f5d3b53bdd4f8356f4443cf4edd29307d598f22f0022ea135e36093c0
MD5 c47dafc3a4c251023642ce3a8a22a3a4
SHA1 3f7d153f65f8e73b6d5d020052484297b1d59d8b
SHA512 07577c76efd57a1ab8a1c338d71e231ff2aade7b5374e04dfd00c270008b533d4f2638283b1d9a6079177f1a01d74f386fd024ee1654246f450cb219d174fc1c
SSDEEP 24576:gfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnv6mctvE/BT76+1NCE:Ya5POZ39Jt2pasx2+mF6mGvKVO+n1
TLSH
T16065BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6ab6bec018157d0f4a20edf49c4d39aadc2eda82d624bf9cc8b84702f2b253ee
MD5 51fa887f3af6bc74e79e08167e20a43d
SHA1 78ef6c16efb2404acae8da7f3af8b433898da061
SHA512 395e5acd9802e9df092174e962e5ddf647520a6d33636769b1f883cd4841b542bbd7508b1d859c153224baf45bc736da77ecdbc5b173b925dbf501f8d6d15eb5
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fkx6mctvE/BT76+1NCE:jNc/zEOVHFG6mGvKVO+n1
TLSH
T1CD858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c86e8cfee86cdd476c80f66013b3da0c8515a7041ab18c5a5e823e8cee65a72e
MD5 6161f9f838706fc430d67871b1c8b181
SHA1 902cc9e2309ac3d1049d5233f903a1cf134e26a2
SHA512 3c81a2fd22de998ca4eac5874c2fd41295b5e936e3c0e0246669ae492e8e5347a20e2d3142b819f320c317e4d8a564bc359bbfe6568c271a95a73a043e42b6bb
SSDEEP 24576:KtkNvNnaFeYhJNtmZBmk6mctvE/BT76+1NCE:KtMwBtOmk6mGvKVO+n1
TLSH
T1C555AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2bba0f61106b2d97c38995a08ea2c6d3de0e0fd5f5ac898448287f5208d700e0
MD5 0908141da11c184b830b2482c56d9362
SHA1 3d760bb84682763c50494720f4cdc5ed35ff43ba
SHA512 35c7c0494a354e8b9e56f6338b802b572f446a52eea10ea0ee1408b892fe363a4f2eb315e49b370b89ef608aa2c9c8dfec1ba3ea6c7a5d6686931db9360315e5
SSDEEP 12288:mQcMxWDXN1Dp/fshBItT1IQgAYtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:cD3FHshBIYQgAY6mctvE/BT76+1NCE
TLSH
T12085E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2000-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2580-156-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2580-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2580-154-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2580-148-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2580-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2740-73-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2740-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2740-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2740-60-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2740-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2824-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2824-170-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2824-164-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2824-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3384-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3384-349-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3384-116-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3384-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3384-110-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3384-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3408-122-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3408-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-128-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3408-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-335-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3728-75-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3728-81-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3728-82-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3728-298-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3764-94-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3764-315-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3764-86-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3764-88-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4148-6-0x0000000002300000-0x0000000002367000-memory.dmp

Download

memory/4148-2-0x0000000002300000-0x0000000002367000-memory.dmp

Download

memory/4148-7-0x0000000002300000-0x0000000002367000-memory.dmp

Download

memory/4148-46-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4596-23-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4596-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4596-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4596-30-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4596-31-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5600-140-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5600-333-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5600-141-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5600-135-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5892-98-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5892-104-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5892-99-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5892-330-0x0000000000400000-0x000000000056A000-memory.dmp

Download