b102d275affb4677ef94567bb5998032a39a6a347aa551c55d2e6ba0cef40b91

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.8MB
Sample260926-ysc1ws1apf
SHA256 b102d275affb4677ef94567bb5998032a39a6a347aa551c55d2e6ba0cef40b91
MD5 7bfb92d0d5c9fa58897525d2dcd6fdfb
SHA1 30d987a67650772d735fc989240c5d9a95b3ae34
SHA512 1fb23b3e9236d2645808c2c0c392a38423b42fb149d28089ddf87f46b7a385da08c320b9ce69b2e6810f5f3a78fadd89d7fbc6e2e0d986baf968c6bce8e9aac3
SSDEEP 24576:ym8r/0pb7a7Gho5eNnNlinRSuL/tA/eGl41lo1+/GoFDn4flNgmS/mLCPZtHp5gm:Ir/kq7GOKliVVA/XRCPZMiwY/3g6df
TLSH
T1CC852311B1E54071F0B72A3119E4EBB5CD7EFD385E229D5B23C61E382F701A2EA25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5100	elevation_service.exe
5844	elevation_service.exe
4436	maintenanceservice.exe
352	OSE.EXE
4940	PerceptionSimulationService.exe
5272	perfhost.exe
4548	ReFsDedupSvc.exe
3292	SensorDataService.exe
2920	ssh-agent.exe
4748	AgentService.exe
1772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f1b03a83f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_pt-PT.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_sk.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_th.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdateBroker.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ja.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_id.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ko.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_no.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_pl.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_sw.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_vi.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveCrashHandler64.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_lt.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_nl.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ur.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\psmachine.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_bn.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_lv.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_pt-BR.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ro.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_sv.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_el.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_es.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_sl.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\psuser_64.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\psmachine_arm64.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_zh-CN.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdate.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_bg.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_mr.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ta.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_te.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SystemTemp\GUT164F.tmp	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_es-419.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_fil.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_hr.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ru.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_zh-TW.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveCrashHandlerArm64.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdateComRegisterShellArm64.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_kn.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_tr.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdate.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdateComRegisterShell64.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\psuser_arm64.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_am.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdateOnDemand.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveUpdateCore.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_ar.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_fa.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_fi.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_uk.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\BraveCrashHandler.exe	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\psuser.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_cs.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_hi.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_hu.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_de.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_en.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_gu.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_is.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Windows\SystemTemp\GUM164E.tmp\goopdateres_sr.dll	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d552c07f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc7a3707f24ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000040724c06f24ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f26cfe46f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000567ca847f24ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005812206f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d946eb05f24ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb8a2706f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006ab8205f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d093a806f24ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3712	2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4748	AgentService.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4548	ReFsDedupSvc.exe
Token: 33	1772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1772	SearchIndexer.exe
Token: SeDebugPrivilege	5100	elevation_service.exe
Token: SeDebugPrivilege	5844	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2088	1772	SearchIndexer.exe	100
PID 1772 wrote to memory of 4444	1772	SearchIndexer.exe	101
PID 1772 wrote to memory of 4836	1772	SearchIndexer.exe	102
PID 1772 wrote to memory of 2788	1772	SearchIndexer.exe	103
PID 1772 wrote to memory of 3948	1772	SearchIndexer.exe	105
PID 1772 wrote to memory of 5196	1772	SearchIndexer.exe	106
PID 1772 wrote to memory of 5928	1772	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_7bfb92d0d5c9fa58897525d2dcd6fdfb_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4436

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2e3142fcff57e0dea6d30cb36071d6cea088d9b31fc6e915c343cd9caba65a38
MD5 697b9117d266700b0ed42ea91b8c1b00
SHA1 c26ef1c102620608103ba3fe5f6983526ff89c4d
SHA512 dfc1179a8430929b3a5ca29ed25742d0a3a3fd680b87c0e3fda9a8aad611fe3d4154b2abce3d0531a591f2c0cdc6f7a7d11b74159abd5ac6c3a44f2ff2ae1d8e
SSDEEP 49152:zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn2Y/3g6df:R3q60jBXY/fdf
TLSH
T1FFD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 37068f0c1932859099ca979862a9f54883f7de58d99726d1080d9faf0e6cd058
MD5 f0f22acc70ab44a1ad043333384a45c2
SHA1 d853704326f58fa48617c863e40db944129a938d
SHA512 1cb28d39d3b5748272da3f921845a8f4f3517849867ab5f810c6054fa5cdead0a18b1d1155c165442d69dba2ff33446f58f3724fb35a75827fc7b560f6c98722
SSDEEP 12288:I1XLsswWkxy2lRq2czAfLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:uXYfDtczAfLCPZtHp5gV4IMjTH/h
TLSH
T1F065F12967E009F9EC679238CCA2C516EA3378554760E79B03E499351F333E86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9f51d2e51aa57df02ee0a3bcdbae2f3f1bcff83e6e78e45197ca10810a5161fe
MD5 bc3a59abe7b8277f130a1deb52782182
SHA1 e0b2a6b870fe3b79bad5e88dcbe4b3fd7290645e
SHA512 fdf5f680072aa88c438878636d9e1764cd40fbc2a6813a906982ff7b4080b184732d0495a6cd6ce2eb774343d35df7cb5df785f202b41517453eaca3971bdab1
SSDEEP 24576:i0Le5ji0hmxNrMkLCPZtHp5gV4IMjTH/h:iPji0A7dY/3g6df
TLSH
T119859D16F5748731D073C0B9C5D2A69AED7230825B308ACB4286D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 525adbdb2591dace76d84d6706b057627fff98fc40b095dc8120a27add9c3a5b
MD5 bbfcfd90f116c9a7ae20be86d0afb89e
SHA1 c3f737fde4e48d9d408ff79d4c3c9129611b0144
SHA512 ee38b34889d8308ee0fd8988d9d9339040b9b2c2b7cd9b8fd122d853561679bebfdabac1ce2ae3ef3ed0ea790c31556d8678fc7707c98a9fb916ac8e52fa71dd
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWr6q8wyuaLCPZtHp5gV4IMjTH/h:x/ezSC6vUzPviHjyZY/3g6df
TLSH
T140755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9ba1ccec9a060fe733454777a58b095703f45540b609ead2bcd2cb3878fc8f41
MD5 5fb582f71eb19680def118c197c23d8c
SHA1 fa417b98f53e146e9a69583effa3611de49291bd
SHA512 c267b1694fde1a03e19bebc2d26a1d9f0eb5c4567c82fe427e17fd7b2a8ce0d7eff2a40888244e3bd96f8dc5e592c79eed241aa61a33afd5a5b88b60071b7212
SSDEEP 24576:VVbqPb88hv/l+bLLCPZtHp5gV4IMjTH/h:VVO88hXl+bY/3g6df
TLSH
T1C3559D66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 eb0ffb3d42696cc4237c18e64970c3e5c96f1d23b994f98718cc96618083e1ac
MD5 59285256e00ace22c921d68f1a4a21d9
SHA1 1ada6bfdfdd7f3466ed424499e15c6a5fdb66aee
SHA512 c9b7f1e9f664b5b680b7856f63cf6c7875b0052156dc67baf0250c169f5467550e09dbc6a6ca2ffc36b12218c746efbf57cb139559a6bc518a4fdbeda58c8734
SSDEEP 12288:BjwLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE+:BjwLCPZtHp5gV4IMjTH/h
TLSH
T14245234244606EA6D1B826305CE5AB7BDC13AD449D02EF27DBD8B438AF3C17EFD52621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 23b67514515085b256e6bd7dd3e049b3c6a05b188662e1d6b7b280822bf63f24
MD5 037f6b85b7f066579959e1dcf4955e42
SHA1 56148444c2c7c9ef158bb3ae162fc9a81933ea50
SHA512 47788361a11935d13de29eb5cf525e50151df6a6ba96c0285b085859bd3cadbf24064f18424000fa1ce3b0fc81de7d3d9d2338a4f78906d34cd4e36041b2f6e9
SSDEEP 12288:qeBNUbTVO86UzLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:qJIUzLCPZtHp5gV4IMjTH/h
TLSH
T12465CF2BAE28FCE2C27E9D785A91C700D77278304F52A3CBD165820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4cf3add41c57b5977eda4b7c0ca5efbc045d173cf7989a23cbfdcd7858d5d8da
MD5 15a27ea0b79dd09babc019ea3ebc0711
SHA1 27e511cfae0e48e0dcbb0f705978af92950eb316
SHA512 c63bf47a13ea8f7f2100e22ced699d071c79c654a816a89b39fabd6588848552a12e289567d83f97791447b8facbc567107c2b003f92c26bfc7404e461688a51
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THQ:GQvGAdlCEL8c/RRNw5C8Y/fdf
TLSH
T1FD266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3bd94e29e09170bcdba1f5088f1a9bc263c096a34473b9e08d822c87f3921dfb
MD5 fff45ea01fa548c81fb4621f314b7b17
SHA1 67f88570a5aae7a6d0558847fef93b8b0724ed8d
SHA512 340f2d06535d6279ae48e74792c39a021b1ed674ea2a86607d7e75f985b3f92ac5ddbced5a17c70794be763ae6b0556a4cd2f297663bdefd2ff5b0a8011dafe8
SSDEEP 12288:HAwSfxL/2Dc3DDLLmt0LDQewsAjpLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToM:gSewsAjpLCPZtHp5gV4IMjTH/h
TLSH
T16D75E031FA74E436C2BF0DB21B36C716582DB9204F521AC3E3E89D9D5A342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4759e38c76583ac21dc8466b72ab92f33750791a65311c4b4c90c6771848ba93
MD5 4ccc635e27672cf9e0a99f60b64bb778
SHA1 52b739b433d4bd3cd5441fd69abf24e1929d8c16
SHA512 73c19a0ec4a7d087c65b369fbebfeaa80bd29248c3528f77d640d9e2ab9a14ca9ec611e5135c9f3c833cac3f140541632f054562488ecab518500ad86c7c6cfe
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH1AF:iUEtQevvqc2W1cpV2RI32
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2187bbf85adb80ea387c634f2292f31495bfd3a035e1841c822c84f097398ea5
MD5 7ae00d6fb62e55f6aeb5c05508cbf5a2
SHA1 3f4b9366fa9d0f719ff7dfd68cc9ce91c25efc62
SHA512 14b046bde82cf7f20ed6342d3584e7a7283215add9645d52c86aa1603d3e1d70d39fe91c9d7376a471212dc3ec2b7899b3ba2a87797a609e02a7897b3b30b3a3
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/ztY/3g6df:LoqtVjnmoY/fdf
TLSH
T1CDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 183b51dcda922c5acc702cd3d38c86a1b9f8d323aef20b679523d0d96b3768ce
MD5 36fbb8bc71618296103d660bcd46d1d5
SHA1 a22fa376d141e1cb11f9e7db9e235213088d4c04
SHA512 60596bc3cd5cde9822345029cf05fd58f49da422e445a33233ae0bfb2c8dfbb5f27c3cf2a83381c83112043c4bb3f24f568fac660ed7563e82e7ca9d60c2aa5e
SSDEEP 24576:8AhGL2IFoiwtA5l7S53OLCPZtHp5gV4IMjTH/h:8AM1Foiq5YY/3g6df
TLSH
T13235AD81E7F945D4F5B3AA7899B68171EA77BCAA5E31C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4abb3c8b52c090c4edd347b311c41149a190edf8181cbb7e9c0585ecc85782be
MD5 247777a98c3c877d7bb43e4b188007f4
SHA1 4ac520590b5190e382c276c49fae40d9f5290ff8
SHA512 d66947fc9daa90e5c3966e7f25f631c21e5c1644584fc971d909fbb8adfdb336a61555240005430280c91fc910a26baab8764ff937b94f00513f71888f8a10c9
SSDEEP 12288:vmw5HEjsChNSBFgl0WDm+C6LTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:OwuXOWtLCPZtHp5gV4IMjTH/h
TLSH
T11D65F14636A40CF9E5B652388597C136F7B3BC012A21DB1F57A0C66B6F37361BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7120b7f3f02d4e1e7ab108daae43831b5761c3a299bf9e9598605d10a118e3b1
MD5 496a49be3ff67d80d640abf7d74cb07c
SHA1 cee5e6d7abf44d450d8b44d947c7407c41f5d1ac
SHA512 e88ee5787b7f830dc57950a7c44a85f2762b883f1bbb3eb20915ffc985692ae36deee5154ce5c2cdbb77159b6b335d7dcbb1cc88b1a4dd155ed954c99f33982d
SSDEEP 12288:K/Z1Iy5LTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:OZuMLCPZtHp5gV4IMjTH/h
TLSH
T18955224622F035F9D0B66238CCE0971ADB737852673283CF56A442792F366EA6D35731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 514c14d1cb09f9c3a6936ef83f849caedc80fc52ac7e299bcea70b572d528d51
MD5 49abc64b703a9f4263cf62f7743c5383
SHA1 4104fd2e13814bef1942a17cf4a2c9d3704b6e4e
SHA512 532b661d80e7cb944e166e928773221c6b9eb0a43cb3f1ff4ac8297c5142db6d09aa0b322bdcf1d6e86bff4146ad1819ec5b0d0ef6a003eeaac39a3a7044d35d
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UU:vQRQyi36YOcPhLvw2gAf+PN3LY/fdf
TLSH
T1E4666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7e97026a587a87f487583769d96754b14b57b5eba7ab5c1eed95428936d63f8d
MD5 fefd53506f8a8d0a8aef016bb6cf5cb2
SHA1 13c48ba500cac48855cb777e44dcf434dd978e0c
SHA512 8fae39ea31276c80d71e4939a0967b930b4af3f217ac0259b4a57937f3966b1ae970864850f1780f4218d4aff0dba2cb061f35868fa72bc4c46f8f04746c8124
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UU:GQRQyi36YOcPhLvw2gAf+PN3LY/fdf
TLSH
T1D2666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c2a2241e14d02b1ffddc81edf5cb24399866cd57305df7248eac8e538f74f444
MD5 618ae1d02c5f84ef21c05cbdc91a6758
SHA1 3c888a84f1259147ed3f2b5a0fadafc5ae86430c
SHA512 9181a246ffa203a28839815d1de40f003fdba76fa1a000dbfab49507c693d1b66e891c76b8512bab52f4661ffd7ecd34c0f057b6122c36726be0686cd9209779
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL08LCPZtHp5gV4IMh:768Qg55nhceWu7PNU3/dY/3g6df
TLSH
T1BBB54933B2F200A9C44DE1769F4A873196D27C758FE1E3DB854172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 128fe0c4a6fa263eb7583575893fd6a63474d19274191feb3ec96b1685fa5c25
MD5 1244d792b8eedd424f23e3a04edc4aec
SHA1 280d65b35b417af1c3eade2ff6d15f88d74ea8a2
SHA512 e635a3987630ae7fa42e9cfbec8eb98f247e81ec55f8d59f02456fed9ada0648c417b947422355009f76808eb3e84c14aab7df708a3003bf89366ffaf4a90816
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99W:Iy5112gYy5azzVva69nLKnhZiY/fdf
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d72ed136aac7ffebfdbf7cf72eb6ac4f34947fcf98bc112a32332e87cea6524
MD5 0e47743168665a942d8c79d8b07c2c91
SHA1 f50bedd8f0a7d6008e0e8b2428fe6e308a6c5103
SHA512 baaa089ede19169b130d4b81188a8c9f62b42a558760d35106cff3f2e45ba62a10bd36e0a63fe838975437f25644b99571984f3cee841bbb39f271e050d27ef3
SSDEEP 49152:gB+taZ3usBWOBr4tEG20bqx0z+n217aau1gljY/3g6df:6u6JmUxd2djY/fdf
TLSH
T1D1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f7538044c804e9a9d527d6eb2d7778639614cf52dcd1fa6b53a36817db1ce5b3
MD5 7cd957b165e4fe531490f4eac223e785
SHA1 6c9fd24bd802db2b9ad1a1d58fb2db407751a9d2
SHA512 2e9447fe0938a142e7e88169880d8e16900c175f178acca035f50779fb6937304d838196e253887d052c6226b7f22bd8a992314208366b59db9643d84455e03b
SSDEEP 49152:01hpsNoJpF1A6BU44CwH7R4x/Y/3g6df:0mifPkRoY/fdf
TLSH
T121B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e2cb44e62537a43d6082c6a85879d33cde1b2c930118efe666f317a0e53ea171
MD5 b0ce0a5a71c771b996790522e0de4fcc
SHA1 657e883416902a166f49c0ba1cef956c13567047
SHA512 ddea65508bb656005ae7120aebff1b16471695a1d2cbe46b018e5194931ab6c698e0ce4ed56dcad7b31f4cdfaeca5e0dd6c8bc1af86a972be7e7429024073ef2
SSDEEP 49152:mSuZQIY0Be2KNRVtOnks6NMHqmY/3g6df:o5dKvi61mY/fdf
TLSH
T111C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3a2f50ef8277907ba31852270c599a18ebc2487f403c280a150d4f068af1c70f
MD5 949139b5d3f4a7ca67557bf199899d6e
SHA1 58335e31d8f56e86668c3b56ac7424d6dd236a75
SHA512 6f99b746cca11bef8ebec69f6b7229bccbddbd93bebe7a22bd2b0cc015064f648ea8c613088e90c8a3c85a9a3666fdc21ccdc36995b26031a79718cdab3e3f9b
SSDEEP 49152:4htSn8EApI0figXgiDn0AP5wTY/3g6df:pX2iyphkY/fdf
TLSH
T12D95BE13F2D901E8D06ED178C7468632E962BC150B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 58546a8d0397a71b3011f17607004bc0d045c4ddb62ddf82a2f6d3e8b2cdcfa4
MD5 fba001bb9dfe8447a8947a9e7f31dde4
SHA1 da59c5580093441d3a65cf8f42f0d986974d845e
SHA512 af05c1f123de3e55154bee6c8d94771951d96451c40807b3e91fe0d04bdc6b056d20f427a3c2885ce2a4028dbfc6bdf9ff2516ce6bfef203fd45921062259441
SSDEEP 12288:eYLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:eYLCPZtHp5gV4IMjTH/h
TLSH
T10C45234254B15E9AD0B8663088E0A77ADC176D45EE039B27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e646df1f1cb96be2e848cfd9a0275d4b9ef715388ae79dd1b8f29727bb770138
MD5 fad51155c61dcef26c26591aa37d2bd6
SHA1 f6cb1c68033a1883a3818966a8a954ebf6cf7bf5
SHA512 9fb1dbddd63e6646c0923b1b65b77f137c6c9f37c9d7b0525ea7e857f06172cf0b4ad7cf31e9d425b10a61b89e169b0feb6b65d7423e2da5eb4a01da23674cd5
SSDEEP 12288:xFLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:xFLCPZtHp5gV4IMjTH/h
TLSH
T1E745234254B15E9AD0B8663048D1A77ACC176D46EE039B27EBCDB034BF3C27EBD51A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cf01033e687b8f14afabb9bb9fc0b8cc9bd4664b561f9aed7f4f920f91e49fcf
MD5 ab445f83847966b95128afb7fbc794c5
SHA1 9f314d7ec74db0a20e8f241dfec6675825b4866f
SHA512 f3139b9bef419e242ae893fff93ae9416b11fc9ef8b71953b44d85a17ac6eb567ab8ba28c01fd82da60a9f87008e5b0cda44f9150fcb44a3132d0884711ac31c
SSDEEP 12288:z7LTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:z7LCPZtHp5gV4IMjTH/h
TLSH
T18545234254725E9AD0B8663048D1A77ACC176D45EE039B27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d511f21743365f8d9ce2f48686b4be8191f4fd67082ef0acd0464110c1c94521
MD5 0fc76016ca3636728e3e1fa1ac4906b9
SHA1 e66afdb5dec5c8999d61bec9115590cd0b728a78
SHA512 a93c6b626cae7186dc0ff30ac9aeb9fde46820358894090b0f6fa8236fda85c8054c2086779daf3dc3b2ec3737dceaa5ecbc855de174dde2eae6da4441d276b5
SSDEEP 12288:JVuLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:iLCPZtHp5gV4IMjTH/h
TLSH
T1D545230225B50AD5D0B4A230CCA1A636D963BC95EB13DB2FDB8464356F343BDBD31B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d0345f25fb2eaf5c2bcd0742e16a85e6ae8c188f37210df0e0584dab3334b955
MD5 d334a2d68dc4a744b36e6160baee0b8b
SHA1 a9f929fc283d029b0509b42b0c2a6f605b17e7a0
SHA512 38a2993273f2b8b6195dc8c2dbf52dbd9fe4b4b2c43d568477099c665d3bdf7796eaccc3444ddce7de23fe364b55ca98b9d58897d4fa16fe7347ddf7ada25409
SSDEEP 12288:VmLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:VmLCPZtHp5gV4IMjTH/h
TLSH
T1E545234254715E9AD0B8663048D1A77ACC176D49EE03AB27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 72200500fdf01584350ba7aa017304f36853540141e735ce19be11bd0206b7b1
MD5 c8c44c463b711372ef3dd29dbb21714f
SHA1 6a7b8b450072d3e5007db8598a21657821403bd4
SHA512 8741b99a6cc1463de0d47f863a9199f4cf9b9568261899843d0ac4a3d1240037f56cc7a827ca63346b68ea8b08b845b93ec7750ab0f95a190c8faa9eedca771e
SSDEEP 12288:sRLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:sRLCPZtHp5gV4IMjTH/h
TLSH
T19845234254B15E9AD0B8663048D1A77ACC176D49EE039B27EBCDB034BF3C27EBD51A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 08609070caa7a4b65c6df1438df02309d7eda6230b3353ac61cbe8ba45b253a9
MD5 e6986f97027503dd1b66bff168a0f2b4
SHA1 77e46eef01f06f8a2e940c3fdadf28e8f0c2a897
SHA512 72d029c41ac68753f87bfc6c3304c4b91735cc2389465cb1f1bb18fd0738d83e2d4168357c7627adb73f27c46d78cc7fcb42efda3c5b4724f55fda6faf048d0d
SSDEEP 12288:FdLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:FdLCPZtHp5gV4IMjTH/h
TLSH
T10145234254B25E9AD0B8663048D0A77ACC176D49EE039B27EBCDB434BF3C17EBD51A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3dde8eae02a21985c040b6d63637ad0d39997420e90889270437cf99bdb94f9d
MD5 fcb410016e832b49d3e8c448d3dc2cc2
SHA1 f4d3cb8483322d4d8139b6d3a6a107b77fac853c
SHA512 97eb342bd0a24af6d3859680c797716b81a5738c43f16884cade68d8e8b0e90bcb2ba879adcb1f16ba9255c86263f72621bb4ec8f4a7c3005e4ff12055aebe52
SSDEEP 12288:EiZwbczzFEoS2cPvylLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:nZMMzFVSOlLCPZtHp5gV4IMjTH/h
TLSH
T15065019572A01CF8EC67823ECC519916D6B37C5A0B60C71F13E836265F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 63aa3a6549bb2eff382f67107b079a44ce31ef89958894eef94ba18a7ba614a5
MD5 194dc311abfe43f0b40675e25fa503aa
SHA1 5c3e60a730046836142c62749644f431f1322723
SHA512 cd2de2d725892623764f4deb3e3cd472b3d7704fc893587a66624e77e30d485329ca309eb1af45133d61be8a3add95b369653e7324688d77ef0761b78c396c3f
SSDEEP 12288:TcLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:TcLCPZtHp5gV4IMjTH/h
TLSH
T1AF45234254B15E99D0B8263048D1A77ACC176D4AFA03AB27EBCDB434BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f3a571ebc94c13c67310a80fac361820aad19571ffc0c7f9c0d0eb6e4bd5c502
MD5 cb33a24863d916f98279800e348e7ef0
SHA1 928138011624ffc79f8a8be09bc17018b2849842
SHA512 90b418fbd7abb3b605949fbf760353df383fa603384a9ae890f667cd063e61bca5c8ffeaa1c0ef402867a4256fc567bcd3b8b27ffe8256faaef1c24ade406492
SSDEEP 12288:QALTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:QALCPZtHp5gV4IMjTH/h
TLSH
T13645234254B15E99D0B8663048D0A77ACC176D49FA03AB27EBCDB434BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9421f57cd152d0460976b17de685084a1001adc3c8c59cf6d1066e843c8ba541
MD5 5c526201ebae26e91980b9605d72863f
SHA1 c1c197bddf9654a9da6f43d9d5f446864a83d6c7
SHA512 b3c2776d6956d54718fdea683446dbd179c26d85e959083486c1ce665aa2c6830807d0fe2ece529067d8be173f9da0ba61d2a78359e85b6ed8ac3feac99bde73
SSDEEP 12288:QyPz5L85LTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:hzy5LCPZtHp5gV4IMjTH/h
TLSH
T11D55120372A131F9D0769234C8A15A16F77378364B218F6F57A446762F372E5AE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2929898feddb02449caa17e2dff19637ba32bf9249af86a70c04a5166dac9aa2
MD5 989933731ccd22117bf05db2f6c47beb
SHA1 216528a0c5571445a0db951032232056bf49e71a
SHA512 26e9a51a5c07387065ab5d102aaad6e58ae36079cadddd905204baecff82cc156d382b1f3d6852d7109abc2d01110957efc1f7100aae8a5d624f7ee52cae575c
SSDEEP 12288:IcLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:IcLCPZtHp5gV4IMjTH/h
TLSH
T13645234254725E9AD0B8263048D1A77ACC177D4AEA03AB27EBCDB434BF3C17EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c48d4bcd14c55715265bb5020f029ce849ecdea2ea0611aa9ecafab8c6e9a794
MD5 8a04f289fe27f7e71bfb2a05dd082438
SHA1 1d1d708aa27b73f203ef712dbaca3b9d8eb7d37c
SHA512 145209929d4b33e74854fc6dc50b6d68ecb38cc6ba65bc9d6eda06dad71d785d9997ebe3ad29e1d866ab2918c4c38b677fa9ae51d2df013a0881bb15f75cddf2
SSDEEP 12288:lcLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:lcLCPZtHp5gV4IMjTH/h
TLSH
T1D945234254715E9AD0B8263048D1A77ACC176D4AEA03AB27EBCDB434BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8d1a2674a83a1d225d5b682025f7ffcb181cde8a0e7d8c61d7c83349990553d3
MD5 c697ed7cd4fb5218825266bdfd36e632
SHA1 30d85052a16ece3a72631dc647184db8e0922fbc
SHA512 efaf11f174a700761a8a1faf47b6e7807ebc57e0c604998397979e887c000f8f1cb5971112fe196b10e165c79eb85670399250caed274c790f12702896f68914
SSDEEP 12288:QyPz5L85LTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:hzy5LCPZtHp5gV4IMjTH/h
TLSH
T1F455120372A131F9D0769234C8A15A16F77378324B218F6F57A446762F372E5AE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 40bb4682aeefd02f8d98205d8e26c59cbbb7f149b50c8ca91277fff646e9149d
MD5 21f7ac141491a384c88ac34e9f526187
SHA1 106d00a1285ef5264104d92ccd56b99a1e1eac08
SHA512 9837d719aff79798cb9d9be08f3eea4c1ac0f0a47d983908ee9546bc0d520618d75e7d2e455e8e07875e12b89588021cf0763afbefd8ab91b3ca9f3f1713a339
SSDEEP 12288:hCd9MWYoaLHF3z0z04PDvhrLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:cT9aLl3z0zDrLCPZtHp5gV4IMjTH/h
TLSH
T161650195B2A01CF8DC67813ECC618916D6B37C5A0B60CB1F13E836265F373A15C2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e39fc4444f4ca274c8a0d88ec12b80e8c0e434229ef74a59f6df7baab278489f
MD5 4c07e2d3716137e5f04059429691a23d
SHA1 4520233579b605fae4bbeace96f858c6d6a7bdf5
SHA512 6c14bee3393bb7b6b66af7686802b7005fc30dac2b4303207e2fadd94684f0f020c4bc9dd24b58cea7b87caf5ea07f9118b438d71769d7bf7b32fcea16c4c3bb
SSDEEP 12288:9i4e7oRdTfgwCHKy7GLbbdIvSLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hm:93td9CHKy7GZHLCPZtHp5gV4IMjTH/h
TLSH
T1C875CF90F3E414E8F0B79A358D729512DA767C591B21DE8F03A8652A1F337E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9686cd3453ebcd031ac4ba12810b6f766779a4466b87b0353f05bed00bf20852
MD5 7484de4ac6e14cde627074db722c8a07
SHA1 be630ebc73cef943bd66c4e7b7554cf2c6288c3b
SHA512 dd3867e058985c8ed7e7c124e5bde2bed62600657e3619a89fbf0d00d7c443958243ee52c8b22053884b631718ca66bc939b2dcc669df75b920165fc322b9be4
SSDEEP 12288:xbLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:xbLCPZtHp5gV4IMjTH/h
TLSH
T1C745234254725E9AD0B8663088D1A77ACC176D46EE039B27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cd5af92f2a50ce14716147212b3f6e218cb44841228ee2790cfe876b0a6643a8
MD5 2da0317d29f1ccd23b349561beedceb2
SHA1 d6e4315d95b8463b537fc6479d3269f5026456c3
SHA512 3b8c8c78a8227b99ca0433c3ccf7d872a944aebba7d1cd3f051a0f638c06ca2a029c4fd2746428ad6bc20421ba89b6e2c6a4660868e7b097f027049936e617e2
SSDEEP 12288:gZLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:gZLCPZtHp5gV4IMjTH/h
TLSH
T19D45230214B15EAAD0B8663048E1A77ACC177D49EA039B27EBC9B034AF3C17EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 955a3f00700f3fbf49a309829521813a7f40f67193b1efac89b58d2ecc356101
MD5 b5866a3ebab6f042961eb0fbf9f2f317
SHA1 a4cb3b18c2be746407816a02c76142bed727c5d4
SHA512 7083abf0c881c80ef2550730edc4ff04ecb4bf417bdfadc773b25186d4fb7d9e609ad4dea6453c5e5a5866c2fa029078273c9d4daa8afd9c2f976a54222dbacf
SSDEEP 12288:9SLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:9SLCPZtHp5gV4IMjTH/h
TLSH
T1CE45234254725E9AD0B8663048D1A77ACC177D4AEA03AB27EBCDB034BF3C17EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 52619cd68fe197628076057d932e0127c1df7b97536eb86f636ee4144e1aa69b
MD5 02c9e2bec3858806d49530a13e8edf14
SHA1 ee8bebb64ef6468c7476f93771e4dac879234acd
SHA512 fbc59846b6277fdc438f49f1de128e64cbb96dcd13d50ecb5634aa26e0ad63c96dddb32ec404c41d71f2db12cf349dbbb32bacf5e6184bda0cf11b5680d390a0
SSDEEP 12288:TcLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:TcLCPZtHp5gV4IMjTH/h
TLSH
T1D245234254725E99D0B8663048D1A77ACC176D4AFA03AB27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ba2f8136328876141004efc0d192b2593b23df893b179985db0a46cd1b4777df
MD5 c9cb49b407344356bb6c7f71b4e46b1c
SHA1 ac425840bfbccc868aaa0be258149ce85a1d7ef9
SHA512 74cca8516b9dbc116f96b399304e61e9762c97dbed7d0d05cfedb8f39bb6749d2e34978f3c8cd705a8e64acd4760b6c6589fb2b964c47ff5e48152b4f8a64b49
SSDEEP 12288:pbLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:pbLCPZtHp5gV4IMjTH/h
TLSH
T10F45234254725E9AD0B8663048D1A77ACC176D46EE03AB27EBCDB034BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3b6e23106289599d94bc7813241872840f8e8ee45951dd1cf55673f917968c23
MD5 31354627b250faeeaa7b6a425454782f
SHA1 c5afbf7c63ed7b4182af41d2706ad98d51e27986
SHA512 08f4e58d57403523481e699ea5e04df793f6ed94e9dbcf25da94b9a801816e842ba328e488e65fde992354124b68c594e20cf2155bd27dc71aa3d864452f57dd
SSDEEP 12288:0ULTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:0ULCPZtHp5gV4IMjTH/h
TLSH
T1FE45234254715E99D0B8663088D0A77ACC176D49FA03AB27EBC9B434BF3C27EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4afa4e44113433e0c0668b0b93b0ee4cc672f25347ac680fa3a68f823d7dae13
MD5 1e9af8173e9ba05c5a3200ab41453c7c
SHA1 47c3fa5e06e824783b21f1249443a00a4f21a1b3
SHA512 a211193dc328f5fd6f8deacebd09bd4f752b39043321ed8218f15513ca8f856a4cda7a6f0d0ad3ba1e0e28a1690350f09050abbe929f2e7e907aa35ca1cd3b57
SSDEEP 12288:HmLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:HmLCPZtHp5gV4IMjTH/h
TLSH
T1C745234254725E9AD0B8663048D1A77ACC176D46EE03AB27EBCDB034BF3C17EBD51660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1b92a2bbc04541a77a867143eff5fd4d8b9b1f3a9caecd62a6e012940178cc84
MD5 2af7db6240d1cf6257af8e12bf67e1de
SHA1 fe2ab94d354cc16bab75674123d0054522f11a7c
SHA512 3291264153e5ff255be972ac0921a6cf4522d0622e7fec0132542c241f500407c2cfe14596da53d243620750c9973e76c696ef03bd541a5bad825905c7af0287
SSDEEP 12288:vDLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:vDLCPZtHp5gV4IMjTH/h
TLSH
T1C045234254715E99D0B8663088D0A77ACC176D45FA03AB27EBC9B434BF3C27EBD51A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 1bb32df131b669d38d800c02b50ab58eba2f703e0f0fd3de10c86460598aa9eb
MD5 91afaa2ab6a67b81c6c0d18717f497fd
SHA1 956a765ed52fb93706cb9c401dd6f75fbbd509d0
SHA512 5bd66d9935fe7b748adcdf786e567e55252a0b5e42c8e4502c28986ae6b48c13fb5a5406cc9f96613da726fd0b6acbe916e31d23d044ae00c011a037d906aaa3
SSDEEP 12288:ymLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:ymLCPZtHp5gV4IMjTH/h
TLSH
T1B045234254725E9AD0B8663048D1A77ACC176D4AEE039B27EBCDB034BF3C17EBD51A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bccd5b99e8b9c15c9709a23c742994020640f8f1797c39b4b876c8fec6cf2c5b
MD5 08918d7513d2b655f1cbd4a3a5b7bed9
SHA1 27135222de6cb10b4460e9b36339e3059ea589b6
SHA512 ecfbcca2237955c551df74049d0ac82c7215f84add937f3806cf554cc8a07009d259780c4ce22eb5cd46b3da703a0f0769e054dcfaed330b3ed25c11c6ea6b77
SSDEEP 24576:hfwvok9RX6wkyAIQLCPZtHp5gV4IMjTH/h:fMnYICY/3g6df
TLSH
T19285D029EBD848E5E0B7913C89B3460AF6B178591B31C7CF129A536D0E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8953d8d217abf9ac063468406cc1f96a8417c7c9f6cc1508846874b25489aeda
MD5 799ca3b7b5ba19c635b2637c011aa636
SHA1 8dc8a212a2cb92e6b40c7831b03aa7c815167019
SHA512 199c9af5db00d518745688141fa9d7e0b2a390f2a7acdf4cfca4ddf7d6ec860a4993805ad348ea8ebf263df199dfe08a5ce8d1e5dbb998669856069c68c24344
SSDEEP 49152:vYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zY/3g6df:JySzPrY/fdf
TLSH
T1D4066C56A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e30d639e72e47437e1234a8a69c8b37ff0c76e4306fb5746f000e20b59f9cfc7
MD5 1f3d84bd6e4f3ea568caa591d8343d30
SHA1 4efccab19a3e1d7b5f31f7005d00ca90738a317d
SHA512 4ce32660322eb094904c3ca8dfed673681376e1ff5b2ee57f65033e8e646640060214ffbafc6b9c6727090e8cd7769c1cdc43657c89799e3ca66776932c34386
SSDEEP 24576:J47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY1LCPZtHp5gV4IMjTH/h:J47JUQj4irIhCnDHUPfF/jY/3g6df
TLSH
T1D765AE1EA3EC01E5E1BA927885554A1AEA71742D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5270dba7038f09ea883b7c2fb64f1f47602e7caeac9f9ddd7efd7906c71abd09
MD5 8e61bd51d3ddf78d9cf0e9960fe7e27b
SHA1 343eff1474db72a82920ef3f5530547e1bd7fbf0
SHA512 2db370978ac82b049f6ca3e0536530fd56e8ef5b1daebd6afe1b6236ae0bf222aada1606e9b2dd5eb7cadf4c0ff280f692fffad721021f4ad9a1c48625deca4c
SSDEEP 12288:mGsfMLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:qMLCPZtHp5gV4IMjTH/h
TLSH
T1A255F10AD29406E8C06E6235CB919651F7237C6597E2D3CB97C0F43E1F392A4ADE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a76a0fa84d797c438a83306a5e82c4d5093f1f43934c776d3deb74b64dffdb33
MD5 57189a5282ec5299b772c7690b34a7d4
SHA1 c7425b9a036808fe1052448b4817fd3de2df67df
SHA512 a747b67baf14b64e6b73652ef1ba739d8c5b8427f90c3f4d2a5fdff1a96105ccdd9f53f1c3a46eb3a86ad666a07515fb237db657b7b07a2bb53c18c53f7f44fd
SSDEEP 12288:zG/NzvmU3fkLbElD5tT6meQm/mszfSTp0bhPiOwUkRrMZ5oCNjm4+z:zG1z+UPoEl6DrBKTpsUOwxZMZi+jm4
TLSH
T1974518407626DB4BC66940321E36C6CCAB707D46FE45AF1772C9873FC476658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 f2afca8e48f13b6a3fffd97bc7c09773e2dc6aff1b0cb2c45e08b9eb984e5ac6
MD5 dbbf3cb8ce1fb503a7b23c311fb376aa
SHA1 2f30fd0be284302face410bb5e6dec93b864b21d
SHA512 2a35c5dfd25a5f09c5fd39f3424f86a67baefaf20cdab6c4a3b39ce93a08c523c76d5dcd35bd3c8d07957656e52987ed32c133d5f16d19f6e07c2f5ca209b9ea
SSDEEP 12288:CA8Q5TglL2DdnUMh+CYhQnUdt/GQB5sJeBRzsy2I/t99VaBXzN0twMJwVoZXpsFV:CAEKeCYhf/OOWYt99umw9PWXDJaRvcct
TLSH
T15F853B416577DB4FC5BE8037033286CDAB74AC06BB852F016785CD3A98A695EB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 179e7e475cecacbbb6c9451f346b9cb7d4ff80c0cc17abf15d60df0296e07744
MD5 f313cee7ab4c51c3bf64ea5529f31402
SHA1 611dd8006089d40c5b6876b7a74aad00d6198851
SHA512 386df1d0432956bef4a2b811ca0d95029a187c24d6b0c4473fe93060d5434c52409b9f1433bcd12414a0e74622bae0ae0a85deef2c6fc7adf53cbfc73f9a2a62
SSDEEP 12288:KM7ELTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVEP:nELCPZtHp5gV4IMjTH/h
TLSH
T1AB45230241A55E56E0B8363048A5E73AD81BBD549F02DBA7FA88B0747F382FDBD71B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 76c1d46ece0144579b93a0fcf1e6972ec540820a2e8e0e556fb855b498953e2a
MD5 89fcdd8a36ad058d8c01040cb178f098
SHA1 c8decb32dff6abd64f6667d327f6b18110a8737c
SHA512 1ec246dce7fabbef15cd3bd900684e5b7ad562ffbb1a342cde6d7b228fe4f88b77795f48c49fd84c5c76019e308dae8ad0fe868414ae975c1c3c1e0d18ae094f
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYaLCPZtHp5gV4IMjTH/h:ggb4mBIBhGFxY/3g6df
TLSH
T146659E1E22E802F5E0F9E2B89DA64417D6B378161732D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e26612d0c1574f580714a7b7467c69cf3b7f5ac6cc459e860f2f0eaded11b806
MD5 7be2eada6e548dac2028463407977f94
SHA1 6efc38c5d00464544bbdb7340fed7b5871511a11
SHA512 582f1ae6c39dcd68bc96df8eb90aefcf371048161dae6a1085e779ad8bb8e54d04643cd0fb482d8398241c897964277473a78e94d7bf4d94585b3444baf2cd82
SSDEEP 24576:8G88u8FpJqH1Wzria7/mlLCPZtHp5gV4IMjTH/h:/7ZFPqVha7/0Y/3g6df
TLSH
T1CA85F16576E102F0D47BD13889824663F6B2B8251360EFDF07AC8A651F336E54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d65426185ade4fde3c375b844b122fd7bbfc845c34aef8e1ba6617900c831d49
MD5 8e0bf6eacc273d7fe1fdeabd6866fb16
SHA1 8d73f0b80e4a5e7941f0c185a39e32216b615ab8
SHA512 8ffed0966e8e69c9e4818aa6037692dc821b1e97badd985faaee3e1155d40620329cb1f1360e94f78eb2e8f39bdcaf9cbbd314a8f0badebd54fa5c215c0b8b05
SSDEEP 12288:THvUrBFrEjwaQhLTmjmWK+ntHOtg5e1LpsOlHDeTfzIM5ywToa/hVE:TPUr+NQhLCPZtHp5gV4IMjTH/h
TLSH
T18165E11F21E91CE5E676A17C89828719E772B8621712D3DF02D0817E5F37AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 442fccdd49fb5120ab9b0b551d4cdcd799233da7cac6c73bb5de0fcbfa71e875
MD5 822a01687e4f25f01a0386d348bf850c
SHA1 015c59e7b8bf14f39ca6bcaef518facc756e9b05
SHA512 3228468d4cf9017cc50e3b2c63875e2ba97a4774f32f19bd8aff712ce85c2640a0638531beed9399675584e5d88b54479c8068b8ca8618a7197580ed1a27a333
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlY/3g6df:8G05lO43bKY/fdf
TLSH
T1FDD5C06A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 40e6a5bb860c15589b2230f4e9134cddd4c02efe0d85cdbbe2aba8c3d38e8727
MD5 c479dc458dc40dcb27e70dc08ae3a914
SHA1 78f1de37b4dfde68c5f3a37b0e2b836be684a3ba
SHA512 4138453fe4eb1b7675987991825ed5278d138ad37691c516f6acd6f485a96904f9fe82acaf94caf07372f68bc5a5091755d648b4f6f49e8a88027567f88a16e6
SSDEEP 24576:Wfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn/LCPZtHp5gV4IMjTH/h:Oa5POZ39Jt2pasx2+mdY/3g6df
TLSH
T18765BF5EA6FC01D5D179D17DC583861AE5B2342153329BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 90b0e5adda8d0c3a0e9c0e12c2566a3f6aace0bd3b639ac9d4236af6b40fd3fe
MD5 aaf58dbbc1c7722feac06e6ae08baff0
SHA1 5bf71ac63d5568975f38661a2ef971e15f448da4
SHA512 15beab27448e94d68b0dd71c8632970b8b3ba0aa5b581fe4e47c237d923e1fdacb94e8bb9ce9b8b03464849b6055a4ca6cad2fbcaaa29f9ca3c840216369776f
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkNLCPZtHp5gV4IMjTH/h:JNc/zEOVHFUY/3g6df
TLSH
T1B3857B1622E901E4E1BBE1BE89779646FA71786557308ACF0291811F1F73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e1a4c2ad45d6b8b101a7d4c341a5c6a82a2b7a4011324efb97d36d035f98a5e4
MD5 095c293435df2404d32de6ebaf598809
SHA1 d3a208a7dbe072545c65a8a14a43e686a3dece77
SHA512 14d248dd2c55266f891f2107ce020b972a8e2cc2ce3614fec829ad1c901d4058af86cbb8066201aa206cb2698e5ebb5de2a1bed690f5dfc2fce5bf19bd19bad4
SSDEEP 24576:BtkNvNnaFeYhJNtmZBmDLCPZtHp5gV4IMjTH/h:BtMwBtOmPY/3g6df
TLSH
T1E255AF2EB6B846E4D1FEC674CD238512EA727461173293CB9390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 eae1845ec06b30a3b7b9ee63b886ceea483e71717db383984f9fd5e45483b402
MD5 6ac50cd3655667d05f435bbdc696d33c
SHA1 670ec29b921c4e739be6c577c1935e7acd9f8787
SHA512 760a9717916f8dfed31f9b2358f27c7b2760c051b77d7ce60ed7fd38f9e3978bdec2512b3e321782e05392ffabff106a36f5627156772aef99d8273b59651c33
SSDEEP 24576:1D3FHshBIYQgA4LCPZtHp5gV4IMjTH/h:1DVHeBIAA6Y/3g6df
TLSH
T1F675E13EE69C04E4D47AD17CCA638A06E77238A9032266DB16D4C1B55F2BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/352-125-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/352-131-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/352-123-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1772-213-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-440-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-214-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1772-220-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2788-449-0x000002BCBAEE0000-0x000002BCBB128000-memory.dmp

Download

memory/2920-183-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2920-437-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2920-191-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2920-185-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3292-409-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3292-411-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-172-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3292-178-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3292-171-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3712-6-0x0000000002250000-0x00000000022B7000-memory.dmp

Download

memory/3712-1-0x0000000002250000-0x00000000022B7000-memory.dmp

Download

memory/3712-157-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3712-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3712-350-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3712-7-0x0000000002250000-0x00000000022B7000-memory.dmp

Download

memory/4436-120-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4436-117-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4436-109-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4436-115-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/4436-124-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4548-454-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4548-159-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4548-165-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4548-158-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4548-453-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4548-408-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4748-210-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4748-208-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4748-203-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4748-196-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4748-197-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4940-137-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4940-143-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4940-319-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4940-135-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5100-170-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-92-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5100-91-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5100-85-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5100-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5272-153-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/5272-147-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5272-148-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/5272-406-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5844-97-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5844-105-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5844-104-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5844-103-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-195-0x0000000140000000-0x00000001402D4000-memory.dmp

Download