5780df7f872f17b4dd68f8f15ea44a12713d9e410255decec7bb412e761a7f86

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260806-l79beshn51
SHA256 5780df7f872f17b4dd68f8f15ea44a12713d9e410255decec7bb412e761a7f86
MD5 35815ed40749e794968c545726826c46
SHA1 9993cbe346d0f9e0d583950ea3e307504088ab62
SHA512 b68ce01e0898955b7147b17b05476fdf12df27d5963e056146e06aa0f52981fe6dffa3a2720b67c4bbc3187b7050171b65e7ce4a0e73cd80987124acfcf17613
SSDEEP 24576:quex6umb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:quex6Rb5+Pl6bJTIZ5jdgpB
TLSH
T12975120176C1D072D5B71A3588D4DB60EE7DFE308E556AFB43A8097BAF303C16926A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2816	elevation_service.exe
936	elevation_service.exe
2712	maintenanceservice.exe
5532	OSE.EXE
2776	PerceptionSimulationService.exe
1420	perfhost.exe
3900	ReFsDedupSvc.exe
1756	SensorDataService.exe
3532	ssh-agent.exe
5132	AgentService.exe
5824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b29713f7e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031f129038c25dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000894b34038c25dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000137d23068c25dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000121454468c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bae899468c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e717fa038c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac34ee028c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e4ac59048c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000248af0038c25dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2816	elevation_service.exe
2816	elevation_service.exe
2816	elevation_service.exe
2816	elevation_service.exe
2816	elevation_service.exe
2816	elevation_service.exe
2816	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4836	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	2816	elevation_service.exe
Token: SeBackupPrivilege	3900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3900	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: 33	5824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5824	SearchIndexer.exe
Token: SeDebugPrivilege	2816	elevation_service.exe
Token: SeDebugPrivilege	936	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 3756	5824	SearchIndexer.exe	100
PID 5824 wrote to memory of 4312	5824	SearchIndexer.exe	101
PID 5824 wrote to memory of 3616	5824	SearchIndexer.exe	102
PID 5824 wrote to memory of 4756	5824	SearchIndexer.exe	103
PID 5824 wrote to memory of 2876	5824	SearchIndexer.exe	105
PID 5824 wrote to memory of 2400	5824	SearchIndexer.exe	106
PID 5824 wrote to memory of 4532	5824	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_35815ed40749e794968c545726826c46_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1756

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2132fa0d8070d1dfdf9183381d6f59e381699c7073b120308ed32d94effa3084
MD5 6655f0a20da1d8978e2512f21c5815e5
SHA1 cbf727c324abad6a55c8e7b081ffc756181c11c1
SHA512 025c1b04796df49f53e8b0fbad5cc5302781bf32de29c506e265c2af0aaf4c7ca5a8e2168c53e11389f936345811a48c32603f303afb7165d8b4c05d5f9147ba
SSDEEP 49152:Wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnVb5+Pl6bJTIZ5jdgp3:I3q6tjBgslgJTIZ5Bgp
TLSH
T1F1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 88d211d423fa5a4fbf5f08977704c5a446cc6f508cd49bcb653b0a9ebfb4a869
MD5 61acba039b579bcd7a58dba68795f697
SHA1 eba87f3de8782a9eb24ef8e22b524e34c6f3f43a
SHA512 1921bac8acf9d1e7af5df6e5504bb19c17cf8f177a5053dc143be56c1da9b69c2a02f2bb0380da7caf781a0983a1abd2717f58d98e2eef241f81454fe00205ec
SSDEEP 24576:/XYfDtczAOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:KtcAb5+Pl6bJTIZ5jdgp7
TLSH
T1B785F11967A504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c6bf1d0f682eb157a21f55241614c4c8e09940f69f5d2492d8884a2d25c96d37
MD5 30269571f38e02823b8bd599a77a361c
SHA1 011923154a5538c5a0563b1e4d6b1f05a3a6bcd0
SHA512 75136b7e89fa6fe36e65bcbd7b8d20da38c88b4a8203cd8769763caa8a40fe9532330c1686e50aa379c3179e4bc5c441a684aa4f6a01364d520b4492458d3e2f
SSDEEP 24576:z0Le5ji0hmxdrM7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:zPji0Arzb5+Pl6bJTIZ5jdgpz
TLSH
T1D695AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6ecb26b2aa91355d43063ff32b943b83842b2769ff9de5fada20597ce8d51a01
MD5 32a32ca6b9ed37a1ed0ee5c7c4df61d0
SHA1 e5f6c166fc1ccfa48751c3a4ac70ffb4455097eb
SHA512 015b8d53dfdb5f0de70c76732ed83a4e0dea43be826540586f88660c00fd170d1fdc626bc7a2953f85f0fa0aaa2260f80494528fc8c9e2b7de8b052a5e49dcda
SSDEEP 24576:ua7/ezSC6vUyDZaqgrvWx6q8wyutmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:p/ezSC6vURPvMHjyXb5+Pl6bJTIZ5jdP
TLSH
T1CE756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9b00fdbbbfa04d38d444f7ed699ed5f5f029d4db948fd3d30c8d2fdcf155766e
MD5 ebad6e9d3ea580422c71781a979d88da
SHA1 7f6407f979982a82de7decfd3640185ff30e057a
SHA512 3e953c865970a7454fbb813a40fa94e4f3e9aab4d5cbe18256cbe13750342a6965353e88648652d1b88fe23edcfee08c1d0b8dae5ed7bad7b1a07062e8f7fab1
SSDEEP 24576:UVbqPb88hv/lV7imb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:UVO88hXlVZb5+Pl6bJTIZ5jdgpk
TLSH
T1A1559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fc15e758a19ffa062273fbffc952bcf10a1a82750d10f9bd0e38a97d3f2637f1
MD5 2381775eef372ac2926e5ccb579ee690
SHA1 01ba2599f461041ee6db042a9ee44f26d8fcb68b
SHA512 40fecd3623501149399830bd040139be3ed8fc72b9bc24f02d499e90731a84d1de4418d3641d2248149c7e90404ae6f5b48fe6494df3526013715a04106f68bc
SSDEEP 24576:lF/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:eb5+Pl6bJTIZ5jdgpT
TLSH
T11E6523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 363f50d0f1bd82f599ba31f7e7f36aa2141b0c37f13a84034539144bd65fd82b
MD5 cdab88f6be261f6183103aa8eb4e1f26
SHA1 34bf09506ce437a6d99c7b4b73c4b9d4106a1b57
SHA512 cd6490df626735f0234332e90b4e925377ef8973e51138e5b1f03fcd073eb3bad73d75725d6a2b3a01dd33001bdd13314a86db68e0402c686b4fad62921ba656
SSDEEP 24576:FJIUamb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:FJIUFb5+Pl6bJTIZ5jdgp3
TLSH
T1CB85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b26541f658274feef479db9e7a4cac3ad0fb193c1b787e82f8fd8fac5674a23a
MD5 7e0ae7086c8c0f9cb1cdc1f6ffd537a7
SHA1 95db5b7b2d4a7562024cf76a49b3e2ac0c13c71b
SHA512 6cabcddbba78c51799f3f5ec2d4aafaea3ec60538abc27a82845668676ba3e0c55b09e2f2ea2edbe7fb678628b0f492b0222a74b80b78c5fc3565100af0ea018
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THj:DQvGAdlCEL8c/pRNw5COslgJTIZ5Bgp
TLSH
T13D266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 f111c5fcc855f78fed68fa8b4b66e444b56f94ec9b26d4027ea8b5b09ec41fc5
MD5 e489ffcc617e9168eefd136dfe716700
SHA1 add873bc46024c9e2170649531646c35d5e7f1f8
SHA512 8f671b011df20d6034cb338f4cc3d1a0590d389f8c64945f1a7d2e5f4e1ab93e02b162ba94ccb83336657f5984c0f19fd257b4bfb1a354373bb9c3aef14a5af4
SSDEEP 24576:cBewsAjUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:cljjb5+Pl6bJTIZ5jdgpk
TLSH
T1A485E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b895fdf37ede10471c7ec9e2b6f3baa8902ea50ceedb49c1484849552cbe98ce
MD5 475592271077ef4263dee1be92b286d0
SHA1 8bb8962e7f5d92c1cb26c75364c8452cc54a3fc9
SHA512 58cefc003b3710e2ce64cbaf54225fca4988bcdeb67fded120c5b0f9ac31a11d42ccc7a9471363a4b316cf9a3b591e4bd313569bcb30ece1ea5c4d4d87a3a1f7
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHfsT6p:7UEtQevvqc2W1cpV29I32fs
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 972539295bbc23c254b9958be7d5b52c9fc60d87c7d03ca6dd8abc4ad3ffe58c
MD5 92ccf6676f1596dad3384f1317dc011f
SHA1 49f4cba050ef1c410391f3756fde246ead5622ad
SHA512 37332323634b2ae25b1760d80ff0b5842bb4ec2eac5d2e9f9819ecd20125a5d1e985729a3bd28fe670e7bb373a020e4415573bbee4faa913a652a9508be9842d
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zDb5+Pl6bJTIZ5jdgp5:noquVjnmCslgJTIZ5Bgp
TLSH
T19DD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f6c945cd1429278d2c6e7e592b21df604449050893462864c4787f84aedede3d
MD5 06cc96709d1a2c8fd9dbba7be6222b85
SHA1 327c90ad7186d6bdf2454846c3aad434b396f03f
SHA512 3f5d8a568180d0c5858996d7fb2cfb0e219713a20a55e1a0644eaa1a3f1bf4d197024444a482dc5c5159d41ee6711ddb562b80ecd7822c1479dc7c7c0fa1f97c
SSDEEP 24576:DAhGLmIFoiwtA5l7S535mb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:DAM1Foiq5Eb5+Pl6bJTIZ5jdgpU
TLSH
T1D0359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6af9b809cb1f52c960ba76c5d34064fc44b10b39ea5d01f76f1b4a9fdb570013
MD5 2f91cf1f922873c3894a8951cba0caa5
SHA1 9967a1e2ce72da63e8e9edb12435455296d7d47d
SHA512 cf6b6dbe26842070c1841bd4fd91484cf7b17a5cbd3109a7547a5253ae6f2b543941c848a68e3a6ab9ac70e5868bcfa9e1f7f145ab9506bad4c2e58a8fe38d4b
SSDEEP 24576:wwuYOWAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:wwPOob5+Pl6bJTIZ5jdgpP
TLSH
T16675F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 dba2ef60ce287bc54b0362f95db02c268e979c061f115471ce6e8cbee4ea25a4
MD5 ae36241390df2c1e7fa8d5dd713d51d3
SHA1 c325370e1c8594c4485cf7ed3306ec3a6309413d
SHA512 d9539559e44ea72abb67296754feae843915b09915f5aef875dd99cda6c68536b0c54ec9967a930d785b6c50ca21fa273ad26c0dbfc5017b7c37173f69bf52ab
SSDEEP 24576:MZuzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Mb5+Pl6bJTIZ5jdgp4
TLSH
T16965128627A830F9E0A7533DCCE58B01E772B8529B7653CF4675056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a8c5af0dec96c08fbb8ce18380f9b29d9240f710cd457fd9f4f545299ee5e85e
MD5 2e63ac982797a318c194ccfb92e21ff5
SHA1 7e141ab17d2e465ab2fbb37ff7954402cf0c8e46
SHA512 d10f69fa8e5ee6b6ec3220a94016a0596fd3fd3a203bb19e6c97b98d98f8411ce869fa8bcd4600e303aea56c656e5d432dfb25d2dce5907d1a01bf9e6148e3d7
SSDEEP 98304:kQRQyi36YOcPuLvw2gAf+PN31slgJTIZ5Bgp:rQyiKakX+PNlsT6p
TLSH
T172666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9b0e511279ea95cbf5f9af04239af34627f021e73788c27c22ec42bc781524a1
MD5 1dd79872fd55585801f60da371aec17d
SHA1 78720ad648e66ec1dc621e0bf249b9f037d958f2
SHA512 588ababe42935eeedc3742b761753f2b3c86a5846479cc4f48666d97de33d106f6a4970c8fa96d8d56cd8edf2705875931c3aca4353da0e329e78fb1dbd0cea7
SSDEEP 98304:zQRQyi36YOcPuLvw2gAf+PN31slgJTIZ5Bgp:iQyiKakX+PNlsT6p
TLSH
T168666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0121fa4fb299ec3be7b2698c5f5996087806ddf75cbea11e9943b3dc60f25649
MD5 abc5f8cbf507d2beeb7aef069aae0667
SHA1 92ded373719956918aa99141e1e2df0023b57fc1
SHA512 ac66c909e718df66c12c1cf705c2872e1b34322197111e803a956365471d516f003d34f0dcfa788c06c53227d243bd3bdd804ace6614c86a6c70dcf590471c03
SSDEEP 49152:968Qg55nhxeWu7PNU3/zb5+Pl6bJTIZ5jdgpQ:7thGRc/3slgJTIZ5Bgp
TLSH
T14FB55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f1270d3dbee1941dfc011079b7f8e26e32faa4f3c422dd9b28b87568f1eacfba
MD5 5cd424026c9513a5525b612b325a0c7d
SHA1 fe3deaa224c2d02cb980bb56945c7bb9ebdd2c88
SHA512 fe687a8fea9b968924f018f8dd005bbbe4b95283afcbc6611fbb4a61d3f12501df1ce451a738b5415bbf112b9923fa3d80944ec24b7523574a052de988a680d8
SSDEEP 98304:by5112gYy5azzVvD69nLKnhZEslgJTIZ5Bgp:2LIH+Wh6sT6p
TLSH
T1B3167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f6866ac5fb2f606181ef2fe9c727d0419eee2f6bf57d286ed29e49199a9c9421
MD5 048dc1256461ffa19e40555f4073ee08
SHA1 f97db87d29b7e2cb8f42ad28c1c5e7ca6f13e945
SHA512 ef5ce34e4c1667e241fc1243ce6e9e643a931ab71d93e8e319e88b2c0519000e57f384741148b198178764e81957301c9319210c0e6af06c22014ae5a2db9918
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmb5+Pl6bJTIZ5jdgpi:Gu6JmQxd2dcslgJTIZ5Bgp
TLSH
T1C4D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fdc7968b1bc89c4cd3e50a166a8154d81d4d77c09c04af6d22bee8898aff03f1
MD5 946f8fbb98fb704ac1f765193734bd12
SHA1 fa11c46554157e44b268dc48c330bdc7f4ec0149
SHA512 b408d04f7b753a2450af75638060f3bee5e36cee6dd210f8edb4b6029ced5aa081fe46fb848ec3d3c6aa0a2d528937ae62a4c8f416175da77fdfe28791dc7185
SSDEEP 49152:81hpsNoJpF1A6yU44CwH7R4xlb5+Pl6bJTIZ5jdgp9:8mifPVRCslgJTIZ5Bgp
TLSH
T17AB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 603b0d3872a7ad911555d393a5de3b7d7fedc7804775d62ee3f7615a3546736b
MD5 3966b8a69ef2107bd0e99cdeaac217d1
SHA1 df7dd197167f2ce3d8662b193d29ebdc990d4f1c
SHA512 2119498292576608cd65933fd521e3bd3574ef8688de662541d6ef182d7cb71cdb245c0a8469ebc03671d44436f7ed945f6c6a8fa61ec63b88d8ffb79189d649
SSDEEP 49152:9SuZQIY0Be2KIRVtOnks6NMHqKb5+Pl6bJTIZ5jdgpR:T5dKOi61AslgJTIZ5Bgp
TLSH
T1D2C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cba874d2988741d035bd7f8ef1522f0fe090832cc61d1c7fd007b1bae5469faa
MD5 ea90f6a6cebe562a727cf05d05652db4
SHA1 9e452cc8e5d67410a73a408de2265d28e937b9fe
SHA512 2341160d0d825aab8e87ddb028672cd47f3864a7748eab66c9e86a88a3505e0ea0d584e1cdbbe1be09737ce0eaa4d6f634fdc3910d0774869bb3d92628cdc27d
SSDEEP 49152:9htSn8EApI0figGgiDn0AP5wxb5+Pl6bJTIZ5jdgpc:sX2i/phGslgJTIZ5Bgp
TLSH
T17595BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f2cd659a539e12e5f08442d6e80c5283d2153f27ace28db4f8e68f363be7f9a5
MD5 4ac383bb1505513012d14beb72e21be8
SHA1 66263db611c1a1702f2db618da7657c9077e5a7d
SHA512 57bcdf41a788ba31ec95b9a83dd8f8ce51809e31a566772c3bb77984e2710776094ae31eddae3c59639c8bf44363ddba09de86eb0cb1430248325f36ffe4cbe8
SSDEEP 24576:k3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:3b5+Pl6bJTIZ5jdgpk
TLSH
T10C6523424A6B30CAE09B5779D9C9DB00F87DBF96DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c3c3b77489256b68737d3f53127235ce82a4c317e5887c591d6a1d3f960d3019
MD5 5c0ee03e25d6a822a0d0a7a6f10855d8
SHA1 fc455bf2b3ebcb7ee2f40545b300a72c32864b55
SHA512 0b5d66a4aba202b5991e18a948535a68b25f5928bb6dfaad75cd11fcdccdef1e675e1bd4fc17a4c0059e45f8859eb79197a70e4ff3bfcd0382c7806dcdc2f2b4
SSDEEP 24576:nImb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:/b5+Pl6bJTIZ5jdgp8
TLSH
T1526523824A6B20CAE05B5779D9C9DB00F87DBF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b9ce53e359a41dfd92f9a42e3fb98870565fb936ec52c8a06e54ec6dd4f72b09
MD5 4dd26c333426e9d8b388c5183f9e6ac4
SHA1 34d439eba6ff11ebae723b9fd12323df2fd35718
SHA512 dd6ce198ce10906716d595b4be0e0df22cd80458dd2a45f9e954dfffc5390ba5d815d769131d762b18f58713f2c4e5da76fa37a22cdddfc9d0a9509dc87faf25
SSDEEP 24576:Iymb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:Yb5+Pl6bJTIZ5jdgp8
TLSH
T11B6523424A6B30CAE09B5779D9C9DB00F879BF97DD8727B6C67E0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 07924b2591d140e6be86e9576ae649ac517797069a3cf169c47c78405994a130
MD5 81870a3dd9c0cd0a72bad0872a3c0535
SHA1 bc3afdafc47a6ca90f75cb0da34c56ea4a0bed6f
SHA512 5a72874ef4358f2f8782099fa1d8934d92c88de9b2c0df986b39565909a8e449a8de9bfb06c35bbca7d2207699cb6a328e9405d52b0a1cebd6a70bf2aa45c6d2
SSDEEP 24576:Omb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:xb5+Pl6bJTIZ5jdgpI
TLSH
T1F26523424B7A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BA931388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 20d27c2f4ddc8edcc0fc68865b0d03e156f9ebc1ac333cd7e655e47bcb93f683
MD5 d4faabf00d845784d44c11119c72d0a6
SHA1 b565cacae7eb2d4b868d7c58fc17be347be5f92b
SHA512 c262b298f33a65660646a41a43e62221035fc5720fb3fb3e7f56c26af27aa5067428a4e26d117684be87ccac2cba4223489b3bec9b5b73ae529495349f1821da
SSDEEP 24576:1Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:+b5+Pl6bJTIZ5jdgpJ
TLSH
T1416523424A6B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67E0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2b8aaa5c17e000cc6b58c2556924312116ffc614e12a861c56071d4e25bff888
MD5 b5a489f869bda13f31fbd38cb8730b41
SHA1 f2663f8bf43276eaec9a09842bb2aa7ade67d9d1
SHA512 8242e05a28daf4ff18f47c747aee18715c4d8ef2e1dcd3f2b7e4a5204d61403f070286b5946fa83f7f745059c8c6db310ef6d68448ebf67c7b628828fa7c143e
SSDEEP 24576:hMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:Bb5+Pl6bJTIZ5jdgpl
TLSH
T19B6523824A6B20CAE05B5779D9C9DB00F87DBF97DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 77dbdc262d1fcc80192c9c7bb4cd3847115d0b2bf9dd2823dda634fb4ee8f258
MD5 29b198c463c2c54db96ce63b70559e6b
SHA1 8f8b999ff2386668a265bd25c33b573e0ba20ecf
SHA512 00533d29630575015a9ffb15e1679a6bddc37e70f03295aac14aae9872ee36f241ae942098187dafb555b08b6e857e9a7d536661e20c1b5d678764d87cdf138b
SSDEEP 24576:IQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Kb5+Pl6bJTIZ5jdgpN
TLSH
T1F26523428A6B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67D0427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 15f5085d5ac064c3c7df63b2b26f3ead8714afd7f28e5855c12af8c80d241bf0
MD5 4c51fb354f541fc022d16c47a341c96f
SHA1 fb93672071eb500cec34d2c6cae5df9375cf2945
SHA512 252dc52593722fcbfb2d1653662064d7416e1d99770c923650f1a9e33221fcfb7fa558b88a4df35966930b73a1dece2ee6f31d89fa62bbf94697bda1eb6913b6
SSDEEP 24576:iZMYzFVSOomb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:iZMYzfLb5+Pl6bJTIZ5jdgpk
TLSH
T1FB850295B36118F8EC67823ECD958A05E5B27C5A4B60C65F03B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4a8776fea01b1156c5b9c2691c6bef423e2f50ea3e8ac203e6eb92e0ed41de39
MD5 50aadf5b9def9c9cdbe4afcb5434370f
SHA1 506e3c4b08ca9bf4e6e4bb2af7543c011db6f6a5
SHA512 48d03560cd28d03423bbb4e3fadde56247425121ea78547ee9538e06af722d5a4ec519e4a200678d432989326df8beae892bfb01299ea0254f398e9763ff37f7
SSDEEP 24576:9jmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Mb5+Pl6bJTIZ5jdgp6
TLSH
T1506523464A6B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67E042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 475c7599c07a2432f4c2ca0cfed36e2a9d4554ef4caa737bde6d5313e76e9e1c
MD5 e1cce8633b16bba5639c28b4d4e45e99
SHA1 0354cadea2ff56cf1279d41541560a091a1799b5
SHA512 3cbc70869f70f77d53d52028ecc6416af8e785d3cdef090fe3468819a029109087802887a55bad9ee8f4ca0a144c6cd775b19878b03cdb981b77f17f3efdc2d5
SSDEEP 24576:Mvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:9b5+Pl6bJTIZ5jdgp6
TLSH
T19A6523464A6B20CAE05B5779D9C9DB00F87DBF57DD8727B6C67E082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 c262528a3dbe1e846bceaa38f5de7cd5dc29237c5231df102ee1fea871cfb4b3
MD5 46fe0c9d154e04ab363aa311fcb8da55
SHA1 6a92345e5c6c7c27c180d991d8871db767d4cf9b
SHA512 fc52b722e66195f707c2c5e96249c5d2ed97d9a6411863b32decd1600a87696c9baae2d98958d550c53408e42d14f71d1cd0eb128fe81156d3fc9bcdcd6db337
SSDEEP 24576:fzyEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:fIb5+Pl6bJTIZ5jdgpL
TLSH
T14B75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b2e682784b0baaaa217e1bb74fe066d136c8894b15d3ba64ac04914fb56f93df
MD5 5d8195a2e55e6be6556609e115bf9a45
SHA1 d4f884e4711a8262478bcfe2e33c275e3c7ae9a2
SHA512 a6e559176930136a25345b33050ef0f8ec75c25b7bdf4d298f987156946774b2c43827d88d77c0863b89832322a97a0160f3a3d4552b3d96c7e3f3fcb1479d72
SSDEEP 24576:Yjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:pb5+Pl6bJTIZ5jdgpJ
TLSH
T174652346496B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67E042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 837329247e2be8135b49fc34ad820d811573c09d77bbe2ff711e4f989345ff46
MD5 68604eefabc4e8aae6218557f0eb9dd0
SHA1 05ba189af957851195508b63c52477c65fd5645c
SHA512 39312ffac47859c2bee19d1dfa13a1217aa80e784a8c6b6d2da78b6174cceb5fc0d1361d7e8c9fc2add4cc92f2d94762f3a610c3c6ad746df24240c005a01d08
SSDEEP 24576:Ujmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Fb5+Pl6bJTIZ5jdgpn
TLSH
T142652346496B30CAE05B5739D9C9DB00F87DAF97DD8727B6C67E082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 657e2f10c9890cd29717c11918a5776a405d1e664e630b4499281e3e768d9af7
MD5 bc7079b7686571b691187e3f1e5d8ad7
SHA1 115ddad8c01bdf6df3acd59cb5540ee1362465ce
SHA512 6b8b8575641cf43118eb0c0b6d64f1a2875884f99170b7f363a3c3f595cac8a0761342f4cab4cba1fd49ec507a8d1143e72f0ab880f269d946d280bf259dc4e1
SSDEEP 24576:ozyEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:oIb5+Pl6bJTIZ5jdgpt
TLSH
T14575024767A630F9D0679239C8D65B01F776B8328B619BAF47B406376E333806D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 374172bc43442e2f2a0c9291d2a8d4264d15cab2f8c7e08f5e484b872e37aa43
MD5 f2bd5b0743f4759fae57b89a0369fb5d
SHA1 0d2ab494313046c57853818bf1e1c1040c78b8ef
SHA512 7c0b9ae30217cd3bd0f10968825fbb6a56f0cc8986f3afc23109b37ee775491e882dd01401f5fd1c9d51ee226b4d705e962a5aa283b685b401f4579f7891a1f0
SSDEEP 24576:WTFaLl3z0zDCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:WToLljwb5+Pl6bJTIZ5jdgpx
TLSH
T1BA850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 12d80e52f24687191432efab416c35062579af3662acedf3087a9e99dcd54ef1
MD5 0756eb605c41f947c87e9b6bcdade91b
SHA1 c99606ae200f21362b0edb6356498a70d62dd387
SHA512 bb0bc4a18b12fb1b5d211edb5c393c902116d00d3fa14218ec2d3be78901da61966eed22fd240e2026a7be085214e07018a0df9ac7668a831a56d42b5ce1d763
SSDEEP 24576:d32d9CHKy7GZGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:92d9CHKyaLb5+Pl6bJTIZ5jdgpJ
TLSH
T19F95CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 93ef4e078e2881c226e09e8a932b22a467ff1f32842da1204057a83682cec878
MD5 e307c2152fc410757576d9e74ec1f662
SHA1 4efdd2af341ec87f29856161822e7f3e4b870641
SHA512 d57129f3e787c420b5359220c73168f38d76b6a93f77c67556739273f6e14290cf5899b5638420e8fde7b91bea3a71ba19eef9513011d55c85f6dbc18600563b
SSDEEP 24576:VSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Tb5+Pl6bJTIZ5jdgpE
TLSH
T1DC6523424A6B30CAE09B5779D9C9DB00F879AF97DD8727B6C67E0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b773d66bc7b86c34a30be6b2827feb2aa843d6de6b1c203bda5611127c053dd1
MD5 a1d67e71986798009697d33c1dc33e8a
SHA1 2751067f4a3121ef7025d6741350ad78a00a2191
SHA512 49d31a5bb8613ea235f8098eed5fc8f6e5d3b7452b843e5fe232467a1a16cf9cefb811819da7a0528faa20d14f79f5a8d2e35382ac015d4c96db403b619cc681
SSDEEP 24576:nkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:zb5+Pl6bJTIZ5jdgpg
TLSH
T1146523864A7B20CAE05B5779D9C9CB00F87DBF56DD8727B6C67E0827F134789385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a9a65a98a438e0fda11488db0b7ce3a47478e7ec5e6e8122ff5eeccefdf5ed53
MD5 f84b52a465d1161500b26b7dbefc4e0f
SHA1 7b6869133439f0a077f4302bdbba61cc72b3acd5
SHA512 e68f9227f7203775d27116dd28606f94a2f741adfdefbd3b45a70a3a11fba231fc39ef07f6aada3fcf35cf8d418787cc52cb2bcf339903832ba490109d42eef6
SSDEEP 24576:L1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:kb5+Pl6bJTIZ5jdgpM
TLSH
T196652342496B30C6E09B5739D9C9DB00F879BF97DD8727B6C67E082BF134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 857e1c2a1ba32e3c1ee53286d1ccbd31a797580795cafe69f2cb5c9d96fc89fc
MD5 a77f207f001cf9a62aa7dd24f4051be0
SHA1 f6f724166a8f6c3cd83aed5c19cee7589471cc39
SHA512 a348979fdc65df34d79847ddee48e550ee17ca56f074988f2404754a70dd35f0d8420528e9a56afef2101a92401a2083923e879765d16af50fc39f2cee030e62
SSDEEP 24576:Tjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:Wb5+Pl6bJTIZ5jdgp8
TLSH
T13A652346496B20CAE05B5779D9C9DB00F87DBF97DD8727B6C67E042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 ca1b8d3a4bcc9b04441c45deea0e183121e5e50c78526bd17034136b06e2de00
MD5 f5959f5bf66b81cd1a72e453df4215cc
SHA1 769114753eada756b23d647865a4cb9860f98cb0
SHA512 b961002e3c26dc4ea685a58445a155d802555aa35d8d1375b6701d161ebf35989b4fd28cb8d4818310a9f89dd9e20579b1f5231213134616e3f51e7f6521ecda
SSDEEP 24576:WSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Ob5+Pl6bJTIZ5jdgpu
TLSH
T1E3652342496B30CAE09B5779D9C9DB00F879BF97DD8727B6C67E042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 6b047f7b09632043a9993467a80d8c78657b8403601777e2d0e94c3961211650
MD5 3b8f16a4ce150e11d5856eb1a79bdfd6
SHA1 8d11cb212c2702caf088e1f72b01814e33d55f02
SHA512 f2d3c2a280617812ff459341306b9a677975f6f9a218a86a59cc34029339a41a691bc6d5dc70dcfb5e326a1d14af63e0238c1a1d7d9eb71f051a6e066fad7fdd
SSDEEP 24576:gLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:pb5+Pl6bJTIZ5jdgpK
TLSH
T129652346496B20CAE05B5779D9C9DB00F87DBF96DD8727B6C67E042BF130389385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 a6d6bb3dd9b7dbf6e419d15d39c83bd253d3b019ec64ba225f52d1f8224e52b3
MD5 f23fa1e67c4a4a3e33f230a348f8726a
SHA1 48b903f62fa4577185caeadd30fb91e6edfc0ea2
SHA512 96be41e3d276f546dc2bc47cb58ba460e12bd4d78b6e1e59a8a8d54d40b13b66d0b65a2f43660f81c03fc2a9cd9a80b26be2ff12f7138311877a752db7103b23
SSDEEP 24576:1Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:+b5+Pl6bJTIZ5jdgpc
TLSH
T1AE652342496B30CAE05B5779D9C9DB00F879BF97DD8727B6C67E042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8db030bb2db7b55554f2f6f2e3160b5acfa723e7733e1e6064019ab9e165240e
MD5 4be6a304ac9aab57af4c56222c04b032
SHA1 9a9bf8d44be615815e6e64d81f5e7f0cb1841854
SHA512 8ae500a588727a0adcf6f1bc60d4560053fe9d3245570dd7d2e5c3cbc4c4ead64c3a848e3a65d50d61f0c7d79109b0be19477334fb192dad755bbdbc523c0110
SSDEEP 24576:OfwvEk9RX6wkyAIfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:CMnYIeb5+Pl6bJTIZ5jdgpp
TLSH
T16A95CF29EBDC04E5E0B7923C89E7460AF6B178595B31C6CF026A536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa742a4e31ffcf9e0c7b850fc455315fd9697c841ecd76fb8a3dcba7549b8bd0
MD5 6b9c0ba57673697ac4044f2c4a43a493
SHA1 4dc3c7076ba0e94e81ed63b3ce294877fa72791f
SHA512 f4c879f0290ddaa43497cc830c28e65994d5bc61cee6007f8a7d2cb97babadcf1e7584f83e4c1a6bbe2038d0819f769aa322fa979e90c01c13d0b025fa2b97a9
SSDEEP 49152:tYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Rb5+Pl6bJTIZV:jySzPVslgJTIZ5Bgp
TLSH
T114066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3a0cfe1ed4f7725bd053a3816bac47e7e1324728d4bcf02a8558ca6c249d0643
MD5 21c8eb0757b9e76cbae4c8d64394dfea
SHA1 8e1a1d95f752f409529a61de43384ea453893bc6
SHA512 dcd1fc879341537e4c4709d2e030c2241c176397a6b130eeccd6d018856c7c479f16ceac54812361c0e9487479cf29de8ec3c6b921598127380d4ed79f74afba
SSDEEP 24576:T47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYYmb57GBiOl6a8JTth/RWZvR6wQQ92v:T47JUQjairIhCnDHUPfF/Bb5+Pl6bJTb
TLSH
T1DF65AE1EA3EC01E5E1BA923885558A1AEA71782E5F31CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 fe07ef587c75faf92b1f0be9798e47eb59ab332ddf52088176c0f84480c0d248
MD5 a930955a796bd06b2dc4990e7db80090
SHA1 b550c24265951aa508bd7701391b69ffe0ad759e
SHA512 48c76459b582c363f34badadd0e80d5e269dc0cee53eddfd006fd0410073a4246710f31aa02a6411df4eccc81e8e6e095345c86739de030151732cd146d3f7c5
SSDEEP 24576:Uzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:Fb5+Pl6bJTIZ5jdgps
TLSH
T1D375F14AC29811D8D06E6279CB858A01F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fa6300eb952b759462725aab168cfde196fca618d2113af98fc8aaae2a55ff95
MD5 b86cb67f40a06198051f508c75251aab
SHA1 3b2f551879554d943f974c06baedcb8f80197815
SHA512 c4e4ed77f94440c7cd319d5d7382eabb49bf056beddf3abb1ba2e13c9c2468a7c03a882499202a7543e3056994c9f66e1fef71cab28412e694984359e4922911
SSDEEP 12288:pOKd7U3f3WYZYmuYzVXEDT17+oeWZ/VEz39LCARMAaVrV:pOKtUPNYDB7heWZtEL92ARMR
TLSH
T1C6552841722AC69FC6A940325E32D6CCA7707D05FE05AF1773C8873E8476669BAB6381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 1115485746a3453f6c8c07e3b8d0a08bd704b87d73a3ef1c1353bba01011731b
MD5 7122038ce4548558c2b0adcabb323f4d
SHA1 779d8137e40b4194e34f78c5c48f831d89503d04
SHA512 9fbe95754553ba1b19fb29ff9913168997cca37d36fd7b5ad196b7d44f3bf3d66e6d3110862a758b9107fd29e010bbb7dcf0c23b1ba48fe398cda4d21b42deb9
SSDEEP 12288:mWKozkqAc3S+hAk6aJxjvBl/ajp4Utny/mMR5HgnYnO:mWFzlDCAzjlErnMFnAYnO
TLSH
T16A451A41A5A7E35FC9FE50370232868DAB745C06BB453B0573448A3C9877ABEB5E32D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a6f29cad578d0d269b641f7ed6b9f357686c3aec53c8967981643cfe724e941b
MD5 a314f8d6eb40819b2c1587a18ea5576d
SHA1 a3e2806ea766634ae11318b2bb6dbaa46c4feb6c
SHA512 d33bcf88f4750f5cb2ccc7b7a3bf6922e622eb798cec538ce7b941af3e86406e6c72eb1fd60f3d37370c1120fc9675623c0f722069e9f311c23020f37a308c6b
SSDEEP 24576:Abmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:ASb5+Pl6bJTIZ5jdgpZ
TLSH
T1686522428A6A6086E4BB5778D8CDC710B83EBF65CF8566E7C569142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d6af6ab93d75e3fc70982a05b3177c96c94474c081cfb527f18761ae9e85571
MD5 27457979d8695f58585c2711623a9546
SHA1 b29c9fc95187fb8217d206135841abf6aa977c32
SHA512 f029d978ab661b1200bc5ddea35b6b8117728276ab6835ace66a11841478b17082ff690bbdc1664033d26c0093b1beec116f14c00a952eb2a67a9cdb8a684633
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:6gb4mBIBhGFPb5+Pl6bJTIZ5jdgpM
TLSH
T1A6659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b79a184c842265714d89660fa7504e90970d95e3501d5439e183a8df8587d605
MD5 a740fda750c4fc110c2e46f5f4baff87
SHA1 3eca82d43876e299870dde7d1db21408cfd0a792
SHA512 fe6058436593ee00d3be87f65e9ff1a8cdf8441b9bdcc40bf3f76b99518d1047110b014239c46080c07da8f3d4bb50072ca7581dfb4b192600ec7108fe862461
SSDEEP 24576:QG88u8FpJqH1Mzria7/momb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:D7ZFPqVra7/Yb5+Pl6bJTIZ5jdgpu
TLSH
T10195F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 78024eb0914b3df9f6023a0e5adf361569f8965e4abb477bcce98699ec839d69
MD5 0dd6c9e67abd36e1e413e8efd0b0b871
SHA1 3dea7b4932cba5500dffd3a401f41a33a24843fd
SHA512 6d5d55dc1aa959566b74f9ccf9321954ef12320d87d0da7872494c0e5ee67b3130c87edcfb791d48750a8cca7f5d056894e4184f3b67c989259dd77ef3abc774
SSDEEP 24576:XPUr+NQ8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:XJQLb5+Pl6bJTIZ5jdgpl
TLSH
T1A175E11F26AD18E5E57AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 35c4a7311d54a80dfc0cec33fd6074f8f908502af30e5a04d9472f434bede520
MD5 ff8f7d5ab7f0dbf2ee5e047dcd35a017
SHA1 079a6b23d64acd2d253571dc2799688572e59faa
SHA512 7ac4c009f52230d4ff9f38b921842ea80cb92f10bab77731f5549bda084c339a4bb448b814bc75a8cb2a009551fab4495706b24b1288b20ff2a29838fb397723
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbb5+Pl6bJTIZ5jdgh:NG05lO43bcslgJTIZ5Bgp
TLSH
T14DD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3cb6855ef121555d88e9796883d14f891c9d73f08a635571d8f5ad9e27792fa0
MD5 cb8b3ee5e24ebf25f3489e19ed08db9c
SHA1 59f0a13446728019fd3294b77ffb795d2f7cd7c2
SHA512 cfd3d2d29fd19772251ed9f59a358df3905b178ac57604d99498dce8586cfeedd4d4b5bd1f70535801672390117c228a1bdadeb31cd922c80d897fa91034d211
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnumb57GBiOl6a8JTth/RWZvR6wQQC:ma5POZ3hJt2pasx2+mzb5+Pl6bJTIZ5
TLSH
T10065AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 782c749f674c1da085dcb96d53cd240016776e69737d58410e0fb79fdf4ea273
MD5 e60c2a2eb85f6dfad196621810990b3d
SHA1 a9b4ee882cf4fa05f389d3f03faad3a056f085f5
SHA512 de3c4a2b5cbbc00f227499936b1ccf55240c5581698ba567687fc81ff6c4f63634079127fdeb1653a6ae8ef6cbd224992df835934ee41b18505bb5b065e9f2b0
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fkgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:PNc/zEOVHF4b5+Pl6bJTIZ5jdgpK
TLSH
T1A3858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9b1d697f4741c84a7f04d47a1b0eda9036c1245c9df5f72ad32e952539dc0e34
MD5 a4bde31d4bc386d4fad0a41def4a5413
SHA1 7f74e088a081b180f48fa6d7a5d8707266f2326a
SHA512 ba2839a64a338c53ac00174850571a5c5ce215b44aa654f1dbd9d52415b6cd5a82ff8d3b2cc58f1caccd7e98f75fcf9f77ea641a773d6d9741f8842737c9ce2c
SSDEEP 24576:73kNvNnaFeYhJNtmZBmbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:73MwBtOmSb5+Pl6bJTIZ5jdgpq
TLSH
T19E55AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1e038411eb0ecc5e274b7c7ad83d94c71bb1af49dd88556eea890a4c65d808e1
MD5 f12efd6858df80c7adb08e381c2a57d8
SHA1 f277b4bf089b77d95be3b056fa3616cd0db44d19
SHA512 d94aa410692e012318444bc97836467ba0958b8e16486dbba51e63c915d3ba1efc1c65830a51c5b101569b7a3601738b1e5a0cffe04cd86775dd49985b9a3901
SSDEEP 24576:jD3FHshBIYQgAXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:jDVHeBIAAWb5+Pl6bJTIZ5jdgpi
TLSH
T1FF85E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/936-55-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/936-49-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/936-57-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/936-155-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1420-98-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1420-323-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1756-114-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1756-120-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1756-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1756-328-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1756-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1756-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2712-73-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2712-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2712-60-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2712-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2712-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2776-322-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2776-86-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2776-89-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2776-94-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2816-40-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2816-32-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2816-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2816-126-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3532-127-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3532-128-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3532-326-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3532-134-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3900-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3900-342-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3900-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3900-102-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3900-108-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3900-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4836-0-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4836-7-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4836-6-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4836-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4836-47-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/5132-148-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5132-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-139-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5132-145-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5132-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5532-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5532-75-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5532-307-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5824-163-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5824-157-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5824-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5824-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download