2ecf5b056c0d77646f14997ae3f7fb53381b46e975b911d6af1c05e247e1389b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.8MB
Sample260926-2n5f5ashqa
SHA256 2ecf5b056c0d77646f14997ae3f7fb53381b46e975b911d6af1c05e247e1389b
MD5 5354ec56553f3a20434a8729a5eae457
SHA1 ee1087394e56db24cefd87aa5afe4a6f2343709f
SHA512 03c3fcd64c2afee6b44424cd1be18a591931db14dd0e05ce0bdf57e5d8c832111b9d61e2cc36dba3f457c8b63f17bd5e7d71bc00906270e3c387fffd47384826
SSDEEP 49152:mr//rl8mm1URHtqVRcTwCVcej4MYPVyGLW:mrbuhUFto3CViVC
TLSH
T10D852311B5D480B2E173193056F0A6F06B3DFC306A35AA5F27C53E2F2A75692EE65323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5100	elevation_service.exe
4928	elevation_service.exe
6012	maintenanceservice.exe
296	OSE.EXE
3916	PerceptionSimulationService.exe
1252	perfhost.exe
1668	ReFsDedupSvc.exe
3540	SensorDataService.exe
3400	ssh-agent.exe
2568	AgentService.exe
4064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32f43f16b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_te.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ur.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ml.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\psuser.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\psmachine_arm64.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\psuser_arm64.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ru.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdateSetup.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdate.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\psuser_64.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveCrashHandler64.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveCrashHandlerArm64.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_am.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_nl.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_hr.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveCrashHandler.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_bn.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_is.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_it.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_iw.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ko.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ar.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_fa.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_hi.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ja.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_kn.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_pt-PT.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_uk.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_fr.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_sk.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ta.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_es.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_pt-BR.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_sv.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_sw.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdate.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdateBroker.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdateCore.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_cs.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_es-419.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_zh-TW.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdateComRegisterShell64.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\psmachine_64.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_et.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_fi.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_lt.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_vi.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ms.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_sl.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_th.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_zh-CN.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_el.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_fil.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_pl.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\BraveUpdateOnDemand.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_bg.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ca.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_en-GB.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_id.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_ro.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUMD6A5.tmp\goopdateres_sr.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000338534eb084edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed2a66eb084edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c54f1ab084edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000020b60ac084edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dac77ac084edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c345aac084edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2864	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	1668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1668	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2568	AgentService.exe
Token: 33	4064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeDebugPrivilege	5100	elevation_service.exe
Token: SeDebugPrivilege	4928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 5436	4064	SearchIndexer.exe	100
PID 4064 wrote to memory of 5708	4064	SearchIndexer.exe	101
PID 4064 wrote to memory of 3908	4064	SearchIndexer.exe	102
PID 4064 wrote to memory of 4808	4064	SearchIndexer.exe	103
PID 4064 wrote to memory of 6064	4064	SearchIndexer.exe	105
PID 4064 wrote to memory of 1876	4064	SearchIndexer.exe	106
PID 4064 wrote to memory of 4172	4064	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:296

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9a4d318c51a8fc170172170b7084c16cf3389f7f2813eb49c1302b0ebbd1670
MD5 caff058c9293d96e7f6171c4f56ad9a4
SHA1 3003bed18248a801844c4d21d83798bd3edcd95f
SHA512 96382ba97358f22834948671c262dff2e41ddbeb43b1e3ad7793893eb5f02915d52b1126fe3f639b1b1ef6e956c273669d257ef90212ddcec39eb5bd8ffda8d7
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBj4MYPVyGLg:z3q6mjBBVM
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f0a5b293bb3fd83182445ecaf8b65d658c639b70e4d95c5455891d40cdcdd702
MD5 1ea2a50c1f9071413076a684a83c403d
SHA1 94814a59a774751dedae728feee7f590257dbf64
SHA512 908c013c745c4cd40aafa8c47fa8271cd7861442f3cd905338fc724e7a9fcffd1727f52acb2768462c5d1e56663d5bf0982a8d96a539ad2e5aec0ac4f84a56b0
SSDEEP 12288:g1XLsswWkxy2lRq2czAE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9b:2XYfDtczAPSnnrFb4PM4MYgLxEVyGLt
TLSH
T16F65F12977E408FDDD6B8278C8A28555E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f2eed9160d8d51c098daf85a54ec8239859a903ca3348853a44862eea62fbe96
MD5 2f45f35ba49c5438ecccf0f45587f8a0
SHA1 8c33acb9c1ed61efef10a28de2affc3bc2ece36e
SHA512 5d9e2f5245866262eea9641ff19b1457809610770bc79356454692825b0f2093f4067b0b0c39e4317409617dd86d8eb6739fd7550abaf186e915b740ed59f3b2
SSDEEP 24576:i0Le5ji0hmxhrMOSnnrFb4PM4MYgLxEVyGLJ:iPji0AzGj4MYPVyGLJ
TLSH
T138859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2cf8f408bd3d754fe24a0de1a482552f526b83391c252dd7a1ae8d60536ad29
MD5 17cdf62b59864515c6aae336fcf6920c
SHA1 9afd5f0046f0650e7d695ef29d6687e0ff7ffa3f
SHA512 b946ec2efba022f3a5b03d6490833c712af5ab68b1cdfd65cb96ecdc25cd167e21724ab78a745787dbe3ae704fbf417c690022125c267c6f2ae305b64e4abb13
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWj6q8wyuISnnrFb4PM4MYgLxEVyGL0:y/ezSC6vUzPv+HjyKj4MYPVyGL0
TLSH
T1B4755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 05a53ac4c19db165ad63777eae5c27202ce6d8ea307892925602315d63201b55
MD5 3707ccedb09547ccfefd3fa54e906c18
SHA1 3ead299c33b1c97ba423ca8727931ecf685e867d
SHA512 9d7bdc6f06b0e680f5642717972539e94791b9b44e50fa7869862e49bfea52b0a4c0c03fb7e785c892f84e4aa76e94fbab5f1c213bdba58657c06c1607b7f5d5
SSDEEP 24576:CVbqPb88hv/l+BLSnnrFb4PM4MYgLxEVyGL9:CVO88hXl+mj4MYPVyGL9
TLSH
T1C7559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e59c4b94c525217495666b9551bbd12c9d04615f4e2c2b58ba752726ba04e732
MD5 0d2fb588df2bc9d41a08f3b8f689720c
SHA1 58b300237e48d6c83b487b98a82e2e00ad819050
SHA512 6a3ab284edbcabcce3b6408b3d880f825883501b791a41401bc0df31b7641c8af5e57a9bde814a35ffd335a58072fba21c612ab7fb183f124c79170229bf662c
SSDEEP 12288:HGt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:HGqSnnrFb4PM4MYgLxEVyGL0
TLSH
T1884523A61BDC10FACFAE15B0D1B96AC8E2057C61F875B20B6751785B3A3F60DD892313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2dda6a407159ed2fff3b9a903e79e94ddf08eb1668b38c553b193270838c22ed
MD5 173b7d369b57c8fb478de285d7f4673d
SHA1 5b28551f1feb8ca5343a8cfa76c55077413ba53e
SHA512 65f866a85c73fe9e79405a2130add3e23d75b9588477c60ad847b9d7c8daf91a966aa9e3bb01831b33e8b420db323d38f9bfb69d5a22971e6310d78e93a0d6f6
SSDEEP 12288:1eBNUbTVO86UA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:1JIUTSnnrFb4PM4MYgLxEVyGLw
TLSH
T1A265D03BAE28FCE2C67E4DB856918740E77278308F62A3CBD165820EDE235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1ac3ce62288cc791099d92e28df8e4c7d153e80d7c4510267367a7436315834d
MD5 18b4f1a8992d7c0b3dcd185df4e34d6b
SHA1 295b1c9ff0cfe90a8481597eff3d9f8af664da48
SHA512 4624b262beb204502acb604578111ca170cf4b7aa41d79f865d7d5436aeaed3f91a01c18cd25dac7b753515d937dd3f18298d2f455242a63c49de859ead6d235
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:MQvGAdlCEL8c/WRNw5CoVY
TLSH
T1E6267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c883f2c3b58a751769d8aa82219c3e26bb80904fb3069c1f6aa1f1c733e5fc97
MD5 d8bd194175a17da3131575ecf1071a4f
SHA1 129ce6f704e87f373b0537ba7672e9442acd7d9c
SHA512 a771b6e7cfdb5868da3f3bbcf9a922b8f1386becefa1e8caa7a705e03e39a87bd29b2f72eb6d23ce7f294b346df24afea8b5b2f5f47e7f0b76b35f3f3d111a17
SSDEEP 12288:oAwSfxL/2Dc3mDLLmt0LDQewsAjG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAM:NfewsAj9SnnrFb4PM4MYgLxEVyGLn
TLSH
T1E675E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 47048a430f5099e432e5e3e39d31491a2105bd2c13bb93258b81633b058bf32d
MD5 0fb6780636d229cf0fd6765bced8d347
SHA1 55d736fcf0236a2ae55c1859cc52ff4d49e7ba2d
SHA512 dc1ab8338fcdba3122955b66caea37d875e4ac7da7f28cf8a8284f87ec41449ee2df7ea6826cbee8bee21b98c647c227eda91d4f1d2c0f6a8bf1f185a5662c74
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH:LUEtQevvqc2W1cpV20I32
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7d2f1c41aafaefff99dfc98ea80e0bde245cfc1bf56764e1b8f4c3b99c705187
MD5 e48fe1be8a5f54992d12b1fd6e79d9c9
SHA1 32ff6a12e404f2ed3ca64fcf2fd46de6f4f1fc8c
SHA512 cd21a74b3855d1fae6beaf8baf6646f55140eb962812845e3bc07d85abcc379b2b505c42155ca4d24ef9b624ea1b3093c77169bee063da6a140a5fa931334d2e
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/z2j4MYPVyGLd:HoqtVjnmMVh
TLSH
T141D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8f0e755589259d6e9df2c590ee410be62a7b47dd1385f2fae357994f00a90cb7
MD5 39395bd23aa24d30814b2a1362737c0a
SHA1 6bffe2960816ccf61cf6332d070644738e0fb429
SHA512 ddaf121475c07162ec247ad9ef30cc07c68ca1a7322157d84df8c62d2fe2f159207292076d7a2419090d31878f9a2de77082ba77e3ead409c108ecbc73e09d8a
SSDEEP 24576:ZAhGL6IFoiwtA5l7S538SnnrFb4PM4MYgLxEVyGL/:ZAM5Foiq5fj4MYPVyGL/
TLSH
T1C735AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3a965493788388997c3a976cfad81d02ea4ceeef7b95f6fe7ced46c2bd15c8e7
MD5 448a5ee98e0190dce43fb98b36aa2e80
SHA1 7a88283f043bed6bb82184864a366da75bc8d75a
SHA512 d876bcb392cef77096a9426dd13d5d7bf70c2d3633f8ab528113201cdd6ac62119c742a317529bd8ead756ee64785f9551f756c2356d384a75b1619f2031462b
SSDEEP 12288:pmw5HEjsChNEBFgl0WDm+Cn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqN:kwuROWxSnnrFb4PM4MYgLxEVyGLD
TLSH
T1E365F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d619b14373fc6ec7cf65d536c2023234cbe031ddcb86d12db4ddf9ac598d7c1f
MD5 02f3f500876db22e9e7ee0e64b6b2e3d
SHA1 fb2bd2970f3a0029469b050e15ff9607ec5cae21
SHA512 32c44868c70e19e25a1f198c11af744f33b6843543a6f1c125c027ba03fc487bb5d62d788b544d35741abc8403b50e3f8957249b699920a05b547daf93cae4e9
SSDEEP 12288:ZyZ1IyW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:QZu2SnnrFb4PM4MYgLxEVyGLz
TLSH
T10255129A37E820FADAA74274C4F55A88E3227862B73293CF1750655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ff053af662ed137264809c1f7830c48f4afcb4725ab4d729e862d3296c7ec52c
MD5 328bddbdf745a8c2aae298547f32815e
SHA1 b868082fbbc60b794438d54f9a4d602ab140f917
SHA512 9729fc76242f32c036ed16e81cebd05fa63549452b788db29de84fe73713f278fdd260fef25dcb1d0d2a3a03d9ea1d98072f3b9e58a3f7dfea204a71d5d19bc5
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UR:7QRQyi36YOcPDLvw2gAf+PN3tVd
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ad24561b25b5822944125c62a224aa16dc04f52d701b03edc4a8bbaa9884835a
MD5 438cb938fc84fb8ee296c94e7ea1eb88
SHA1 37d2bf211809c439c222db656f727c9fdb98b212
SHA512 5c86050a848352e4b430bae4cad3da3e0e0369e3c02c9de9d9f10f7afc205c99c8fe560b68cd8dfbb7eb031b56303a2be39fb858128978a8aa35d43295466d88
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UY:eQRQyi36YOcPDLvw2gAf+PN3tVE
TLSH
T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 884d20b2c59dd5007249af01624d34dbcff5b75a002c4e16476334cd689b55aa
MD5 ac1fe2571e4fbdaa28387d0cb948bdc6
SHA1 9cc9087eb2e1881710f60e6ce09141dcc3c8a076
SHA512 9cf1500a09df513c7a141d9f7aea4101e1026edc05dd0a9c0ddbe1e42fee84e202b758657bae4899baf1d652d70ac40f5a0d6610ff3c45414a42fd86e1de22e2
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0mSnnrFb4PM4MYgO:E68Qg55nhkeWu7PNU3/Gj4MYPVyGLZ
TLSH
T1A1B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 477461931cc849280f7a7fe0d2ff4124647eb6a468b4c9d742de3f90e88a4159
MD5 24030345a546b8111e83d2746abf8788
SHA1 5b8f3b8799445c66a1e57092bf5def31c343d8cb
SHA512 695ad207f2286331faf4832e4185bb2261bdab536aa4b73897944fd74bac2b16f3f9a216a769dff9cf55fc919eb1e339df0f13450cff44ec7a2866619861af6b
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99M:2y5112gYy5azzVvU69nLKnhZ+Vi
TLSH
T174167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b0e88b4d5dce8a469ed220b5d1730fff47a303c31b9ae1f3152a0b3e1d0f9c72
MD5 294628a4ee503dee4c376391f6cefaa1
SHA1 76b7fcff35d3dd8671ed2a07d8cc25a736edc661
SHA512 40f769e57f1e50feb4d3b64f81430d54a9b8f87c25a714442f86910d5040fd8076d63f1075ecab93fcab28d929d409270793160adc963d9faa8e2a6439d12364
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYj4MYPVyGLZ:/u6JmIxd2dlV1
TLSH
T100D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 899536628e5b686950d72732754f74a69ecacd83bb8cf29d50de98c6efa050b9
MD5 590fa62bdb36e1789b1292b94cb65353
SHA1 2b5e299637698bd688adc4dd922a2f9078efd344
SHA512 2b6ac2ce3a0cba921d3325b9e798267704562520612834e84ed2b222aba7c138a24ed8be8e7d811b9b5a578576803ac74ccea401c0a565c323c53a1f4454d8d1
SSDEEP 49152:k1hpsNoJpF1A67U44CwH7R4x8j4MYPVyGLI:kmifPqRMVM
TLSH
T13EB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24e7f4639b11d6da1816eef897ca0be60329ec7ef7c9c1c1c2e8b676d1bc731a
MD5 10eade2c83258cf33816ba1ff251168d
SHA1 eb5e8eaf274a3e99d52f274fea243360b32edb7b
SHA512 8ce1a5020d7b501b6ca4aeb9553c63756bf9337223166ae27046749b22b25e39a0ae4dd14ce0ec043d4c4a63a4306b1d9b6c1eaf0d0ab35ad46e348afca9c2b1
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqRj4MYPVyGLX:G5dKqi61qV7
TLSH
T1C3C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1e1536579a6623dd0df7a001a5d2a18e6b59d97e8d953c247ae6ecb171ec8706
MD5 42e70193cc9df896202ccb2534564d55
SHA1 c7e6b4382ae647374c94a25978202de7d23ea885
SHA512 cb63f5cdf7aa3c4ca8a8671523971d487919005de4d98eaadf8a2b48f704eb3d3ca09dd9b4b9916784de4398e01dca6923a9357d0faebe0e520fd855b1f6d518
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5woj4MYPVyGLN:WX2iWphQVJ
TLSH
T10795BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5e48ad276a21fee1c4062303e3b523d640757210bb9aeed6c634f279bd9fbb23
MD5 5f86b8c44739be39a1014e43dac147d3
SHA1 80eb415ebb850ed2ca17a28776e54cdc19dae594
SHA512 173d90cab3c0d85dccbb2bf1eba12a970d31ead3097a06f78c75b784500794397bba3052d804ef97ec0e21eb8a03b008789699015326e90a86440f89e66c2d6c
SSDEEP 12288:FV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:FSSnnrFb4PM4MYgLxEVyGLk
TLSH
T1554523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F774574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 090d31829816ba58d8711a3e6c5b95a56c6f129cd9bcb37e046ecf7a6392badb
MD5 cce3b1bb38cbcadbccf131160496ed54
SHA1 250a37acb488bece1cd85a5fdccbb7dfd4df7d78
SHA512 48d8f4e3f9616331abc0241ec169c2134982d3ff6a813fe1cbbf1ae4c22b2d0343f4fae161328d59eb77d3d14fac591aba8104c72158af48a6f7eb64a5d7a4c0
SSDEEP 12288:3a34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:3JSnnrFb4PM4MYgLxEVyGLz
TLSH
T1264523A63EDD10EECF5D16F0C1A956C8E2097C63F976B20B7B4574073B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 900ef63f7dc5e1ea915aaeb7c5d31c782984220102d112d10ef563685c343fbd
MD5 a51895a208a462467170bc72fbb22f78
SHA1 68d0517a2f4140da8ebf56d91c4f47926b075adb
SHA512 628931e7742840dbc45dc8b5e9e0821f24af2a4dba156a9dd85d35328ac3480753ca7b9989a0436dc6e29c789d1bb705a9e82fbcae2dc75283f74fc9130e7cc4
SSDEEP 12288:Lo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:L7SnnrFb4PM4MYgLxEVyGLx
TLSH
T1EF4523A62EED10EFCF5D05F0C1A956C8E2097C63F976B20F7B4574163B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 236c6395ed656a4a2908ddd30fd3420dc449de09ed75b4eab48f3427eb8ba36f
MD5 d76b09754a6415c004709b39fc841852
SHA1 38f7f65d3124f85b74b15849a48a632a2d2f7236
SHA512 d04c0bcecaaf61a1413ee4990f3382e6b6c0453e111dcf4050c2abf0bbd7c5c95f31405575d7d9d73d54989612d8a1c9f971babe05ce2a06b38d58e12f4e1cc1
SSDEEP 12288:sVD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:/SnnrFb4PM4MYgLxEVyGLf
TLSH
T1314523662BED10EACE6A96B0C1B556C8E2257C61FA72B35F6740341A3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 11226feec4f4c0d263e08c6719576289ee5466791cabb2f335e606883c72b591
MD5 7a3d2dc99cbbe35c1b889f4e90c7512f
SHA1 256f6ac50336d94c579927c3422f88f330af5c58
SHA512 161cc9889373c3b866aaa34f72bbdf5281f0c57136f3dfb8a1a33b08903082e4bd98b256612b364dca2830c475f7287ecbde3082a59a442ba18a07d1264f4056
SSDEEP 12288:Ub34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:UUSnnrFb4PM4MYgLxEVyGLN
TLSH
T1384523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574163B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 84cbbe01efee53b328cc214f66c697304dd561a8b273b55787612ae56e0b7cc5
MD5 8634b2dbd8600a27fcb614bb0f93b25e
SHA1 3f259db98a8484ca80fb2656b0d099cecf7525e1
SHA512 50ba976af4fccaa26014f97fd2180d0f8342e17b0c0a4238f451408a928ff198091ca4162cee1519c3c14d3de527e21666ea6ebb3db2ac6053ae892a3198b53a
SSDEEP 12288:pu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:plSnnrFb4PM4MYgLxEVyGLf
TLSH
T1254523A62EEC10EFCF5D16F0C1A956C8E2097C63F976B20B7B4574173B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2c6451fe719e91c19aa986f895b8e4eca3506ec155afe5c60de041c773fe96af
MD5 63abd0c13acb520679786c889ecc5fd0
SHA1 a872bb5c18726baefbcbe87f425d63c1f79c9dcd
SHA512 e3ed4f4cf78804b80ae976b959b834f33e8656bc9174b5a75e54e401c2cfd73306587ac057600d9b2c0b9027086953f94ecaca493e4c2a4a422971dedc760e0b
SSDEEP 12288:dS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:dhSnnrFb4PM4MYgLxEVyGL1
TLSH
T1904523A62EDD10EFCF5D06F0C1A966C8E2097C63F976B20B7B4574173B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a7bd4562538ce34462a8db26d0c20e6f8c1410273e861123979c0598432acc05
MD5 95ff4f1795c9aa6be624c7067572cdf0
SHA1 e1b7b944db37e0f9453020f74ebe7a74511b31d9
SHA512 7d62fdb069cdf7dcbb66cfc1af33b7a72859062b08c8732f970e12b24da531bf01288979a7404101c959bfd5c5ac205f4be5d3932c21f0ca8f10de47cfbe425c
SSDEEP 12288:ZiZwbDzzFEoS2cPvy634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2i:cZM3zFVSOpSnnrFb4PM4MYgLxEVyGLT
TLSH
T1CB6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ab339c98a5a792c360d0bff792035c785dfc5f20b198ae0357e35accc7d5fbc4
MD5 20aadf424a20052e3225df14f3941fc0
SHA1 4a2d289377c71ec0744d96e56117519e2a6db4fa
SHA512 54cd0c22061d8526f14a38685f8f9fde87709dd853cba0a2d6ec93d5b32ae97054ab1d304148593917bcf2e350c8aa96959ac566c04177af6e3ca6a19c69041e
SSDEEP 12288:qB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:qGSnnrFb4PM4MYgLxEVyGLe
TLSH
T1834523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20B7B4574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 92f9cd7ac1b0815098c06a7b9e0146a3f398bcfc7f0de6ce248e132a969fc7ad
MD5 64fa2cc40cbca8700b26c4b3afc5477c
SHA1 13a78d75561e7964b91846ba168111c8db0eabf9
SHA512 4c71796d96b718e4ab2165e206ca68e7cd6b377071766e2c3412c3e94286ce337d85710a8455cd45b668e7b3f77ed1f33fadfd896d43cbcb94bd78ea6191a3ca
SSDEEP 12288:u934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:u6SnnrFb4PM4MYgLxEVyGLE
TLSH
T1AA4523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20B7B4574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 692456858880dcbe05fbbcb929cfa6b0044707d896b179179aec5ba217f08bd7
MD5 35be81848ba98e5b2386dfc8d9de7b14
SHA1 41ab561a7d0ee83ff0d95b78150f3f1b5426e79c
SHA512 b2437ce0253fc99e682368d2736230d94c0c942700f773c1faf5cd339c9ac20e35514798a2d88fa88d08807c781076733b9d2571acd4bc0b03d680911e8d703c
SSDEEP 12288:ayPz5L8W34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:HzyNSnnrFb4PM4MYgLxEVyGLw
TLSH
T1DF55025737A530FDC67A8274C4A21A45F336B8329B309AAF179016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bd5dcf603c7dedc06d319b4efe17ca4413fa265ba9be0872bca701cbc6ebe353
MD5 4e2eb87e3936103abd5836eb4b997568
SHA1 9f11b403e223f5699d41bf95064de472e96df161
SHA512 fd0f56ea38feb1e5a746a218b9dc3c0a5969f02ded53a1b87787bf00d85c0762425d0328f5f3906c07f1fe0bb3f987bc7dfe76442289b18579b3eb16f79a4f79
SSDEEP 12288:jB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:jGSnnrFb4PM4MYgLxEVyGLf
TLSH
T1A14523A73EDD10EECF5D06F0C1A956C8E2097C63F976B20B7B4574163B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 28f045587d66822ece9a3fc4b11b80700b588b2ee54f1c724d81254649afedbb
MD5 89530a751787430916015fcc24f32490
SHA1 0d9d9f4df3dfecdf3879db200efd5e549dac2310
SHA512 812992bc92b083d947bbfb63e3ae1c8d3803098e54c41d5e25d0738c8e2a7300425bf9d77d94c166b6d35ac85932e37ea6c24099349a8ae9dad7ee74e47456a3
SSDEEP 12288:SB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:SGSnnrFb4PM4MYgLxEVyGLN
TLSH
T1E74523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574163B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d1318972d43f2fa0784ece394ccdd53095974a304ed8460876eb483c55387a29
MD5 a48f354ae4e1afb6993101868da3a1a7
SHA1 4d2eb2beba932f3fbb958ff5aa7dc28c12dbc840
SHA512 74f1f68cdd711e1e3b4207d02aa7edda551a0d97d2e1f9ce7299c38a3a4b5f734fa8d1a7e3a448e2643d3c39147393262c3a8ae2309ff56e9a2df4561b6555f5
SSDEEP 12288:MyPz5L8W34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:VzyNSnnrFb4PM4MYgLxEVyGLB
TLSH
T11D55025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f3ba1a1e51dffa5699eff31c198ba18026c4f0dd8b6d57bbe911e1ed1d5c7ccb
MD5 8af942792b73f426e40f2790d349f1bb
SHA1 5d041b55a5084890c3a89a35e09fe7112401bd32
SHA512 c11b315f0e781e47d3934f35f3406b72961ba7f37f51f9805e0b460cbec252b2af426320122906e2c7ecb212c9135181717a653871c28c022fd7e5b38287226d
SSDEEP 24576:nT8aLl3z0zDrSnnrFb4PM4MYgLxEVyGLO:nT7Lljbj4MYPVyGLO
TLSH
T1AF6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 60034aa3e8c6c3a81a27659144bbcec86a69f591300e941987fb0ac7b32a70c4
MD5 388b4d6d275e26bbcc604e9579332202
SHA1 5dd85246c41c6f8ba837ec6060451ae6c8b71a19
SHA512 3f5491d212e57f441f2c3c9c102320a9b71abee8b5123a86872e3906a974c0714644df9b92845e01f3a82026a0169b3ba930bd9ed5423e9fe61da1a17aa61a99
SSDEEP 24576:h3rd9CHKy7GZXSnnrFb4PM4MYgLxEVyGLy:Rrd9CHKyaOj4MYPVyGLy
TLSH
T12175DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c2143de0270eec16c22ab5d7f717e2ffbe3b228240adbe00149f301bc5358e0d
MD5 e4d3cc622761ff6fb359d3efc4a575d8
SHA1 c88d352f067bd2c407ff38ee93b45b5cd31a306f
SHA512 d23f6bd4e3eb08aa38c599d00d942d6a6802354ae60160f50828cbf8148b222a2b5bd0a190c99c883dc25277d6ddd1798018c64464907d1805dc53198c08a6bc
SSDEEP 12288:zI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:zbSnnrFb4PM4MYgLxEVyGLd
TLSH
T1A54523A62EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4255560ae45dd7888a7fdc3fd7830a6902d7b8d087cf770f02d547e7fc2d7f0a
MD5 4bf2bfdb6285430131e904f7d1557be2
SHA1 878c9846a031bf3d0d7b50ad6525d853532d9867
SHA512 6a0c6e68e48205d2ca55159eaf4cb74b475dcb9bf4179ab98eaef36053ccc9fa2e7d4bd7724a2117a78e86f75073e2a330e7526e760427325c6f80b876681bcd
SSDEEP 12288:y234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:ytSnnrFb4PM4MYgLxEVyGLi
TLSH
T1934523A62EEC10FFCF5D16F0C1A956C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3fdbe506bd323d7d45c8f07786cadbfc73690e0c0f5617dac8811af41e5b9602
MD5 06a31d175fe2070ef9479697eca3e5ab
SHA1 193d14eb1e17730caa30f93da77a85010fb339a2
SHA512 7aefed5d9b05448aefdb28746baff9acc54c2b779b0b15bc692a9333163c022e1333d1cb42ce8cfd6d50dd72b1337845a397ba2c40d146fa55a74491e6909814
SSDEEP 12288:u/34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:uASnnrFb4PM4MYgLxEVyGLt
TLSH
T1C74523A63EED10EECF5D06F0C1A956C8E6097C63F976B20F7B4574063B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 301f38bc79e4cd4c6836f7c2a6422856058e636ef6eae754f654aff606270653
MD5 5f19ffe9101627da4931a54ff013be40
SHA1 250d9c3ae837bd7d40ca5fd2ce1562322e23adae
SHA512 697dedf36fd7e068d05cb84da43772e182f2c7e8a804965119a2287692f3ac82806e0426cc8b5b4b419619408b4a0d04d240666e40e6f5485e06d637d70c4b70
SSDEEP 12288:qB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:qGSnnrFb4PM4MYgLxEVyGLH
TLSH
T18A4523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20B7B4574163B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1f1a1eb8a416b61636c51ec50aa9980c6a2bfe20dabb39b7f270bfff23a7f5dc
MD5 5d0c8dd02e29fa1c3f51ae598991e310
SHA1 db3461f099d467eef24e09b34ebd326af54fbc4c
SHA512 0fbf1bceb6d5d300e71bc1b3deac2e17ef488091bcafb037d70c961c7d1d45026279def1b2892f45420402e6359b1b36b718d4f5bc29914f420b839a4d4deafe
SSDEEP 12288:8I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:8bSnnrFb4PM4MYgLxEVyGL0
TLSH
T1E84523A62EDC10EFCF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 57c782062d3ba890318b50b8c8f78fd9c0af3cb3868ff4e77805297bb7444594
MD5 2ba42289492d300bf25572ea38949c13
SHA1 ab44329b5b1c4ea0c08c178a9dc8bac4b3edc105
SHA512 4b1e0702591d8d8bfa8a42e43a797db342b7734700676eb431e46127b754c50825fef4877b16f704deb8985a7ae07509168aac625b7695a1d99ec5554ee22608
SSDEEP 12288:L534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:L+SnnrFb4PM4MYgLxEVyGLA
TLSH
T15C4523A63EDD10EECF5D46F0C1A956C8E6097C62F876B20F7B4574073B3B60D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 41c5fc99453ec7ae7e5e6e99fabbfad0b359612282421969c9a906a2f095794a
MD5 c5f534c2f808318bcec89a5e2edd27a3
SHA1 e6cba70eeb71054fe74d98ba82a514efbf7727e7
SHA512 15a6a351a36c6db3e90de858d4b2f321e9e7852a51e4bdaa37bf586583833a216f4d3ab216fffbc4f98a83f15a7939a1613efd1189312c8906d05d6660c2b199
SSDEEP 12288:Fb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:FUSnnrFb4PM4MYgLxEVyGLF
TLSH
T1624523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 869ab26e9a7f22867aa8cf1ad65eceb8260911576c8ef6198918c478d93ebaf2
MD5 d724f3f1d8540e598c88c8cfc034bb52
SHA1 26b812dce6e254c9715736aace31b83b863d1728
SHA512 294f5d2ecc4c2cce566f0227b880cd889a0c5e715d69d0a7ce3bcb4f10b955abe5f1903acb9aa6c584c4ff8744e5cf95f85d7ba8349cdbde3fc196dd7b9818be
SSDEEP 12288:1Q34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:1jSnnrFb4PM4MYgLxEVyGLv
TLSH
T11A4523A63EDD10EECF5D06F0C1A95AC8E6097C62F976B20F7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 2a71d5fe6e8ca8b829c07820d7d8eacc51b0a371f9f69a9ae8f0f6450057b829
MD5 a37eebcce047b690f16440fb93557e34
SHA1 f4ae111174043ea274998975d24d13db475a92ff
SHA512 12d7a0ee693fd307ca321545f529e3a003ae984372d7da4b7d9c1cec14c1ccc40be1dbe4ce12933609e296d3a2c1a8720a73f3ce6ec1348bcd881bb3039581c2
SSDEEP 12288:1b34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:1USnnrFb4PM4MYgLxEVyGLc
TLSH
T1644523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 97060102c47812d26bc9deb508fe0608d337088ce71ccbfb586738d9c744a849
MD5 c0ef6ca685d7b5aa66aa8a8fc15ae2fd
SHA1 c335475266d1acebbdfcb927a9dea0d326c4deda
SHA512 b0fe472423af51d274d20d9c20c50a0f383d1c43af9181c92ade19029cda3a1b2bc82ce130838e2dc683437da9a67f06b2f9fb710482c74a92dbb502aa7d8e24
SSDEEP 24576:Zfwvzk9RX6wkyAIKSnnrFb4PM4MYgLxEVyGL3:YMnYIFj4MYPVyGL3
TLSH
T1FB85D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dce7a1062b0d75f92077da895c5141a4e42df70855c5c9658a5da9d80eef2d7a
MD5 842344e7b2ff89ef65620ddec08581e3
SHA1 95fb65a48f6b9d8b32b9891a46764abe3afacc47
SHA512 4e0b15de99b222c3cbbce82db0d80ec46a5b1686646fcad00200e878da6f03097b67356ce1959959a3d838f4a7d0ae5bfcc4054ca0c09cc46b9fdbfd13fbbf5a
SSDEEP 49152:JYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ij4MYPVyGLv:AySzPNVr
TLSH
T1DA066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a09f845490ae45a8f02137d36e0f2702d57f77ba58527d3018dcae2947e21ab1
MD5 04fd7147c8faa87505b1dfdef8a96d5b
SHA1 32d335d6ea9c2b774ca47d25eccfdaf8fdca6663
SHA512 bbedcc793d84e2a63bc21197eaebddd80bfd8cbb4b710b89d7730281e7da1ccc6dd03d256c2feac440234cbb179d22142dab41168833797151cfcdd2cbb6954a
SSDEEP 24576:V47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY5SnnrFb4PM4MYgLxEVyGLq:V47JUQjqirIhCnDHUPfF/Yj4MYPVyGLq
TLSH
T1BD65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 64ed765fdd2a43f62798612ac46ca3b47d2487e244e99c84b059eff03e17b6f4
MD5 8d09c416ed532ec7104993de790325f3
SHA1 3428d3724cf846ba052d920519581c01be0dd56b
SHA512 61575a085f9e28d854dd6f48136d1314ee2d90f910ea06e9d0edab5ab2a31e0c6afc6a091deda7be28d0e9b661a1540c918e4ef8f8ef58e768612f1632ff28ba
SSDEEP 12288:ppsfx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:K2SnnrFb4PM4MYgLxEVyGLr
TLSH
T13955F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2d45ec172d5f9f62e8ee144ac382fa579445ae60646a66136d3363751a8ae790
MD5 20287a3d78279bba011345b5b69403d2
SHA1 cdd297ada01d59e7e61f311839c262b9510340d6
SHA512 baded280f71f51a7c0e8c32a0e663202736aa1e948849e99b425f653faa660d2c477d1a751a4b07c2699ade5530283ec1b1aa92ba323e110e13196878d8a79ae
SSDEEP 12288:Wzh0WICQfA5+LBZZ/K4SuR0Rqu6nHABF7y5Q+kV:Wzv+5TZ/0uWRquMH+m
TLSH
T15E351800766ACB4FC66940325E37C1CCAB707D51FE45AB0773C98B3FD576658BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 316d6a1349d916160e629b0d295f7815de95d1711909fd4a658125345281150f
MD5 8170c8bfaa46ce3ebaf836dbe94efff7
SHA1 36ff0a2dbc9d1c316edf6e344df319c3351bcbb3
SHA512 af32275f407de0b102680528bc49c1a1111da7a0fc7c896ab5396133a4de2fd23ec3c496b3268f274c013f867bfe0ec7d2b2f990f6d7db0b4e8c25de818a28dd
SSDEEP 6144:CHrKrhdNMNdLHpysJLKZ7dHP4eolZ3DARL2tabRwYDB+2wCLmUSauYwu8NK96QnD:CLShpfAGVX/aFN/A
TLSH
T194650941A037A78FC1B76032072A5B4CBB64EC17B7056F2673C9453AD86AB52B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 661b742a8a32ac3ae1f09c81275dda0ab6f6dac5556219d7e71f13e9887a514f
MD5 955296d9da0fdef2ae93d99a0954844e
SHA1 b694b1efbe97b27f44f2f53ed91f708cb8853e97
SHA512 a14d0a182d432144d15a5ea47f8e3dbdb177083eec092a587bb5c298a4b3ab487cd8b68980699afbf92a624feed0ab38a7852db18d0f58eb4adceee8ecfcaa16
SSDEEP 12288:QM7p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:RuSnnrFb4PM4MYgLxEVyGLK
TLSH
T1E34523622BDC14EADE7D16F080AA5698F209BC61FF61B18BB74074463A366CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 262d4e8f5cf7cca815610e5cdda31425350d37f6f76edb25c0706bbcea1e08fe
MD5 0c59dfc19e407cc91e85db52a2d29209
SHA1 63a3573f6ffe9c842bf7023cbd0a780051f3c6e4
SHA512 e252a62d4746546cab65439dc05d0a7be9c627b7dc10b208101bdb00601e4facbd5aa0ded3a4c97b790a1f3444283acd76b983ca835d7add2df041587bda0f15
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYISnnrFb4PM4MYgLxEVyGLT:qgb4mBIBhGFyj4MYPVyGLT
TLSH
T19E65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 69d4d02623fbbe82a9cdb3f7f3f95d872c0c132f07c90aca825de82daa177554
MD5 2026cf9b50174216c65a273551351dc8
SHA1 760e5c6545de4fa313b90f915917f5dff717c8d7
SHA512 7c126b90de58febabc6f3735ae3fb68128450bba13b19531388439eecdf00d5bb81be16bb816b4528bce1b75dc79e3b1e21d63b8bc829436df19e508846e10d9
SSDEEP 24576:nG88u8FpJqH1vzria7/mpSnnrFb4PM4MYgLxEVyGLA:G7ZFPqVya7/zj4MYPVyGLA
TLSH
T17D85F16577E401F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2dd71f46a87695a2736c600b4c22e1f1dccee0902e6339ff1eb2758c62b5a25e
MD5 c1a547c7363f711d1bb1df28fc7ad5c3
SHA1 266b879139cd3d0c74c28f2c4222655574fb2433
SHA512 19276738c33569d99f5eb5ede4fca62f5984ec2ded61d1386d534f35c54899e6d2540c6a9333206f9cd6492b4f4b9b7ecf8539701a3260e0318037d71bfe4cac
SSDEEP 12288:zHvUrBFrEjwaQ+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:zPUr+NQ1SnnrFb4PM4MYgLxEVyGL6
TLSH
T16C65E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0917E1F27ED8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d7db934dda77c01123885f7670a79d3c5eba22f7e0e5f68a89217d6806f1f6bc
MD5 3411c49c2776bc9f37cd0be894cffa17
SHA1 d0b5fe301bd153089c8d95f872a612e16cd7d4af
SHA512 994f213ef7f8b5b01ff7f3ab397f4869572c262003b4be3fb151ac4c9114bb3cdaa2600397349ef5baad1cc01d2d28083d9e025173d2c10434aa4d15a0ab4781
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+j4MYPVyGLk:OG05lO43bmVA
TLSH
T1EBD5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 415467110f32bff6afdcef8dabd0ae6a66730b74f88cb547032d57688b1e1f4d
MD5 054071b76747c9b8eab2b086dbc969ad
SHA1 efe825e6e3fe06b4268881c10a46a31643432a59
SHA512 dac0df939a00bb9feb10c722f8169405fd734cc88917221be8341f36d1142a97036101a27d8694c29dd4b20b13f76efbe27978c48f71a33b6ef45f78daf192e6
SSDEEP 24576:6fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnvSnnrFb4PM4MYgLxEVyGLr:Sa5POZ3lJt2pasx2+mGj4MYPVyGLr
TLSH
T13265AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 26e6cbf6f0677fd40b0e05b6b1c403269546a23cc45dbac392173611311657e7
MD5 0a8abb75b4843b25397685d045494f6f
SHA1 5e1ad3bf45ee5ecfe86a743c427cbb36313f8c03
SHA512 97bc7cd268060f4dd8673b3f0b8418ca62d39da46a1384c453970d1115dbc6af1b45f79062a4807704bf15e4dad40bb3ae889d14cd4ce113f57edf7b5d17f50f
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkRSnnrFb4PM4MYgLxEVyGLk:iNc/zEOVHFTj4MYPVyGLk
TLSH
T1F1858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d74c493dc605b9e508fe4026a18caa62e6a7824fed06bd1de29e2a449b0a83c6
MD5 446f2cee81c178eab86d26f44e65de51
SHA1 2cb217079375fe1a83a75aa056cd8e9c714974a5
SHA512 56a132f8e4d76796ac0b41958e6a678ed35f4cfc28ed15e97c6a899fc6bc16eadc4efdf697d6f99862c1dd463fbef6fc7b820fd676b07b8971f087e13ca2ac06
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmjSnnrFb4PM4MYgLxEVyGLy:RzMwBtOmsj4MYPVyGLy
TLSH
T1F755AE6EBAF806E4D1FEC6B4CD238512E6727461173293CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d62924e63ed8c6ce5da9a256354a4540d259a4e1a3f01ef80cb2367aa7efcc6f
MD5 27c3ce73ec7bbc0342dd89e15615b626
SHA1 9c45499954bf36b24e6eb00505fab1910d2a77ff
SHA512 8e005be7fbb389c37eb7c76bb26a5b94a29a32d7126f992daeec3da27e0084dd9039bee2fd6407bbd3b7f823315dd62675b8b06241e6cedde34fd9836f06bb3b
SSDEEP 24576:iD3FHshBIYQgAySnnrFb4PM4MYgLxEVyGLs:iDVHeBIAAtj4MYPVyGLs
TLSH
T1A375E17EEA9C04E4D57AC1BCC6638A06E77138A9033266CB12D491B61F6BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-132-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/296-123-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/296-302-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/296-125-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1252-149-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Download

memory/1252-148-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1252-419-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1252-154-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Download

memory/1668-432-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1668-452-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1668-450-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1668-159-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1668-160-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1668-166-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2568-196-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-203-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2568-209-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-206-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2568-197-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2864-2-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/2864-355-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/2864-8-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/2864-147-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/2864-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/2864-6-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/3400-183-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3400-191-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3400-438-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3400-186-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3540-178-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3540-172-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3540-434-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-435-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3540-437-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-171-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3916-143-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3916-348-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3916-135-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3916-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4064-439-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4064-214-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4064-213-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4064-220-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4928-104-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-105-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-98-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-97-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4928-195-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-92-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5100-91-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5100-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-84-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5100-158-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6012-111-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6012-116-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6012-109-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6012-121-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6012-124-0x0000000140000000-0x0000000140214000-memory.dmp

Download