68092428ba9c36c9ab6d9b7a9dda9083f890d9dd05b2e4768a4df5fb700c72c0

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 2.1MB
Sample261017-ftzxyaxtfs
SHA256 68092428ba9c36c9ab6d9b7a9dda9083f890d9dd05b2e4768a4df5fb700c72c0
MD5 ddb4d51b56b9579bedd6fe75a9c90c6f
SHA1 6d1074d37d07abb406bcfa501c5d62cb21419207
SHA512 72bab1fac5f3a9cafad4b85eda251da5046ebb9a8396fdd66312a4702158debd81d912aab6e94858ba097c643f02bf9805c19056ed0ca77015364e4a0e50700b
SSDEEP 24576:6jJ9bC1WGA/Cj+UwA0eeEXUD6ZaKngL2jdshRTdG1YxITqvfPkbIcbjLm:6jJtC12ah9+voarSj8RoTCCW
TLSH
T139A52376B3C0D5B1EA7316311AA8EAA45C79BE751F0149DFA7A02BAE5D303C0493C727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000300000001a305-421.dat
behavioral2/files/0x000300000001a30e-422.dat
behavioral2/files/0x000300000001a30d-423.dat
behavioral2/files/0x000300000001a306-424.dat

Executes dropped EXE 10 IoCs

pid	Process
4832	elevation_service.exe
2472	maintenanceservice.exe
788	OSE.EXE
4988	PerceptionSimulationService.exe
1336	perfhost.exe
4508	ReFsDedupSvc.exe
1172	SensorDataService.exe
5948	ssh-agent.exe
5764	AgentService.exe
244	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dcdc55cf3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5096-0-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral2/memory/5096-67-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral2/files/0x000100000000934f-380.dat	upx
behavioral2/files/0x00010000000093de-381.dat	upx
behavioral2/files/0x0001000000009b92-388.dat	upx
behavioral2/files/0x000100000000a304-396.dat	upx
behavioral2/files/0x000100000000627a-400.dat	upx
behavioral2/files/0x000100000000bd44-399.dat	upx
behavioral2/files/0x0001000000006223-398.dat	upx
behavioral2/files/0x000100000000a319-397.dat	upx
behavioral2/files/0x000100000000a2c1-395.dat	upx
behavioral2/files/0x0001000000009396-394.dat	upx
behavioral2/files/0x000100000000a1d4-393.dat	upx
behavioral2/files/0x000100000000a0ce-392.dat	upx
behavioral2/files/0x000100000000ba34-391.dat	upx
behavioral2/files/0x0001000000006215-389.dat	upx
behavioral2/files/0x0001000000009cfe-386.dat	upx
behavioral2/files/0x0001000000009cd6-385.dat	upx
behavioral2/files/0x0001000000009952-382.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6c4c3ecf55ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c307ffe6f55ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b821ca24f65ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078d7de24f65ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035665f24f65ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5764	AgentService.exe
Token: 33	244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	244	SearchIndexer.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4832	elevation_service.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 4940	244	SearchIndexer.exe	99
PID 244 wrote to memory of 5500	244	SearchIndexer.exe	100
PID 244 wrote to memory of 4892	244	SearchIndexer.exe	101
PID 244 wrote to memory of 4524	244	SearchIndexer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_ddb4d51b56b9579bedd6fe75a9c90c6f_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1336

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 1.5MB
SHA256 54786c36e4c7d9d7e66242c91221abe6dbf588b92d2d24c0e0a2d2efa4685642
MD5 6834404a4a0ee87746a673f8dc61bbaa
SHA1 ae967a4602587eb03beab824f049ee8f4e8cb4dd
SHA512 166514b5ebf5805ddd43866d04dd8c1e4f69b374b57177792cb2db44e09405c9f6f89e557efe273368b8c3c6e054b87840a6963f84e7046b28b7a9939a45a3f3
SSDEEP 24576:cZM3zFVSODULcqbW0QYPzlvNlAtLtEwm6o:cZM3zfvUL/W03LlvNlqLtEwm6
TLSH
T149750195B35018F9ECA3863E89558909D6F27C5A1B70C70F03A436675F333A12D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 1.5MB
SHA256 5040e14bdacb3b247f2aa46ba9264ac97d31f40ebeb93471b7e49fc99db6bb25
MD5 7c66d28cb2c38131630e756465a5b655
SHA1 57d0a39165a8396b4820fab0be0c3c7d557ab1b7
SHA512 cfe740338ba8a5f85de350e386adad20312c960485b99aa42e55116d066c7098aaf15b16bd53233d54138438cd6ae30defbc6635e6136e1bf59b1344d63f18f0
SSDEEP 24576:iT8aLl3z0zDVULcqbW0QYPzlvNlAtLtEwm6o:iT7LljsUL/W03LlvNlqLtEwm6
TLSH
T1A4750195B35058F9DCA7863E8955890AD2F27C5A0770C70F03A836675F333A06D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.7MB
SHA256 8882a18991a0e07e804d10c942a057b90efbafd21a410d555944ad26011979f0
MD5 4b76778e598b0271dfcdc794ddad0c37
SHA1 bb972622f0661e137f53b28e82bfca4068c2149d
SHA512 ee877b8278867eb23dd8ad294a06990a676098495874999f8371ea964136a42aae3fcb7a0c51b4d261e43bfbac5b5f7923bf6c5bce93ff8f69eaf33cd482140b
SSDEEP 24576:R3rd9CHKy7GZxULcqbW0QYPzlvNlAtLtEwm6o:Brd9CHKyavUL/W03LlvNlqLtEwm6
TLSH
T1B185CF90F3E410E9F0B7DA3989728511DAB67C5A1B31DA8F03A4661A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 9e336a6e18835897bbb36c4581613405d1eea98e77183463852ab8300116ea08
MD5 6f98b804adf86a9a9414668d66cc48cb
SHA1 218a5f3c6071ac43af70d5756a2c19dcc6fade36
SHA512 731e27516603964672d62e8d93c5b0e9404065dd6fdfbe05be432d7d7fc53da89db8881d65facc9b5644c198b9e46faf343cc57c021f9b222572a1d27843f2d4
SSDEEP 196608:+og1P9fIlOu/6IgF+I3m2MXP6HG8Qzle1FQLtFm:+ognqOo6IgF+qbM/6HG8QBT
TLSH
T15F668C23A4E08035E5F732756D2CA73959327BA29F3145CB86906C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 a21230f89b2141693d5c8742a975edbf3c0baf3481755422b9634e6216b620b8
MD5 a08f7f4b37b906007d80eade73029a6a
SHA1 144be9c2d31ded715f6a3416b8275d2d7c9a9cf1
SHA512 78091b393ef15adf62e6a7c572d55c5ff62e77688587d5c79a3a93b00278eeed2dd4f030dbee2e2f54a12b5c47bad488451364bb54cd83c72b224cb09af7c023
SSDEEP 196608:kog1P9fIlOu/6IgF+I3m2MXP6HG8Qzle1FQLtFm:kognqOo6IgF+qbM/6HG8QBT
TLSH
T1F3668C23A4E08035E5F732756D2CA73959327BA29F3145CB86906C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e3c348a9676d8ca587e74a4d4be72e565010ebcacb098ea23a50a3568b328b94
MD5 8cfba2cb652e3a930796ae70fb0b4fff
SHA1 2071b901d7139ebb89027a2bf8d5344e00ec43a9
SHA512 1952940fdc9ba9f6acb7d5534f3888573015ed2decf38ddf9aa11d14afcf981ce5943303e5503e781c7ad613624be953d537e52edf747e29f07e56fc6d4d538c
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnt12ah9+v:63q6mjBS2Gc
TLSH
T18CD58D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ec1ab4d7cb194e8b2c1bbbcd4c4c623fb459e773d66eeeac76456666095af3ce
MD5 0e5c3f635158c8b1bb6f9733ea82bbe6
SHA1 a91ac9a136d5c27af8527adbd250171806b33fcc
SHA512 c75fffb79752c0c53799b904dc3321a6ffcd154a1f2f4ddf418d69cb2e1b00341e9c3813c9437311d779a3c0ec60a4dd58d186c71c798c37eaedbde1a9ba1d32
SSDEEP 12288:L1XLsswWkxy2lRq2czAo31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:xXYfDtczAc1WGA/Cj+UwA0eeEXUD6
TLSH
T1B9750129A3E409F9ED67813DCDA28501EA337C510760E79B03E49A7A1F333945E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 059da0f188979b4ae6d5046057909de47dd296e7de56d2dc05981a5ebae82d9a
MD5 1ab32439bb66c6cca6537693dc8b0624
SHA1 2f47bcf2bd68bb9f2759a20a969b44143ebc6e76
SHA512 b98984a2ea69e4614d6230af067e90f68a52132cfa34ed7e53b3e9e619fa0096f5128ec6e5b3cefcfd7a21926c539966d99dc651bf8da3d0aea745098570fa99
SSDEEP 12288:1mw5HEjsChNEBFgl0WDm+C731WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9X:wwuROWS1WGA/Cj+UwA0eeEXUD6
TLSH
T14965F14A63E81CF9E9678239C6479535E7B2BC013A21DB1F1760C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 894b28daa7bd776fcc0d470b64ec59a250ee605ae6ca3cd64d9dd509136e26f5
MD5 a635cc41454a7ec8104e94e524437ba4
SHA1 ef04480d8d9cf16cb85e0f358fc609a4f6cec486
SHA512 7e947e99794c81a0a39a0492004db0fcab8ea37b884b8e8ea925444fa7ebcac1c7fd629b815218f0cbaefb262e7c0c204ccb19e2c3f7f1b5c6f91a388e9c778f
SSDEEP 49152:gB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1arSj8RoTCCW:6u6JmTxd2d1JTy
TLSH
T141E5AD13F2DA01E8D06ED178974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 28bf1f17580b25466930e9e7aa8951106450a982ce89ee50c861a09c00707038
MD5 71c4bdb6517a2cdc1970796ad62bc1e4
SHA1 afecf9f3e9075c9fe768917f2f7af1543884e937
SHA512 677f7a6f3320ac95e1bfc1a4e007a87d519b19d6be0c221a96dd5488dc4d2355f4e79cb389949a58336ff9e9ba5caced37a814c48647f3eb548846eb72b4fb07
SSDEEP 24576:7ywvtk9RX6wkyAIWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:DMnYIWarSj8RoTCCW
TLSH
T14F45E029EBCC44E5E177923C99B7460AF6B178591B32C2CF029953AD0E37ED46E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 25860da999735c60b1cf86419de990e95427f8f57d1304d6bb8d8b2d5b4de63c
MD5 a177ef26acd53b652af6149950594ab3
SHA1 8b99de00cde4b82adfc219c132f761c10e2182dc
SHA512 30cc7950412ab5c6c246d3af8f7cc864cd21a74f706ef01b2373eb008ad25d5eb2e143b2628ea925a3f68dfb703de5629bc68d13bc63597ab4f812e64c429554
SSDEEP 49152:WYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0812ah9+v:ZySzPW2Gc
TLSH
T1EB066C96A1A841D5C1B9C1B98F0BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 d7a3b59ad78522665d46dbfa4b1a94c3a39b0acc7c99f693ebb6df7f9bcc6f69
MD5 5b52df2fb13fe710ff8c92bd168fe44e
SHA1 20a44221036353cdd9dda0b8df2a4e319b16a72a
SHA512 586d3155f69c8f61e9923e4069d8117e22bf9dd40143381ba2d201b9a851ced501412ba01da1729246ae6c9afec4636096e1c30563c8a316e3a435d7d14766d1
SSDEEP 49152:sY+SNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0812ah9+v46ar1:rySzPW2GcXJTy
TLSH
T107268E97A1A841D5C1B9C1B98F0BCC1BFA7134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7110e79dd2e87a181fc621919ed8ec7f2e30e1192d80fd7bd188769c3ddb4a84
MD5 72b9a14ff311668d3b17012b2521d1fe
SHA1 7b5f5cc2a47df43b8e6af43b6f87a219f6c7407b
SHA512 365609401e6eb6240ffae604d435e755a2ad24f18ee82a0e553d7fb97b39f6250e3043a4cd0df612adcdd69a493c42cfb4ef0578cd5887b74e5a28420a8da461
SSDEEP 24576:t47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYK1WGA/Cj+UwA0eeEXUD6:t47JUQjqirIhCnDHUPfF/M12ah9+v
TLSH
T11565AE1EA3EC01E5E17A927885154A5AEA71782E1F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 348c687b0c64fce0ec742ecb25bd1b99cbdb0dc35349225e3aadf5d8b4ffe45b
MD5 d44a95f3defdd206805ef700a5e4d526
SHA1 7b63e49bdc1b8162ef3dff502466bfbc2eae3165
SHA512 02a20b3c885ca4ec2656a18c44d914a22f9f174f0224d40d4458d237f9de5a102a88c03ad1ec35e32dcdd50da70e94d07f1743e820af78fb7877e971ff51bab4
SSDEEP 49152:cQ7JUQjAirIhCnDHUPfF/M12ah9+vQarSj8RoTCCW:zJiglD0Ps2GcQJTy
TLSH
T1A1B5D01EA3EC02E5E17A927885155A5AEA71782D1F32CACF12B0437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3c7868ec15fced68ec7e01230783a707dfd16e8052fa6545a6e8262387f24b79
MD5 ec830025db27316ab21c5e9829c42e03
SHA1 5dff16c58b82e736ad86aa976d8486cd0f7a27ff
SHA512 73d3a3824f799e163ac0259fedf0e72ed6583ad5e5b450a538328bf2f4ec34c9b0e2a84b2ad5e5f9102e6728ec7e93384e0dc3e8e7b8ed024a6e3cc17505ba72
SSDEEP 12288:mcpPIBqxU0ahtYNfxZT59SmxxaRMiTcPjga5LjkR:mqIBmPZT5EQxaRMisjl5L
TLSH
T1AF5517017666CB4FC6AD80325E32D1CCAB707D01FE056F0373C99B3F9576659BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 a8292aadfd757bd30ff9d220730646d984d32487557f4deedddf427204deb880
MD5 33b52f2131423286aa9610a0a35aeb09
SHA1 90d7a7ff27989420990dbfe0edb6134ee7a58cb8
SHA512 7d11ab464969917b51e24657621299423167198e0e368c4a7b050286e82a9a9df3f2927c59e6d4df074e6636bfe93f14dca6b460b0934d9751a57967d37afdea
SSDEEP 3:OlH/lgOg0LtNyduvp3rta3mCllltq3mCllltGlslslslslslsl6cG1:KyGLtN8uBumCtSmCtEEEEEEE/
TLSH
T1C48112848B100720C102307204B6C39D4330E247F4E453EF061830329C52BD44DC6F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 430KB
SHA256 97e77934c9451b254f7ffdc107aba4094d6cec73257d54f56ed0c9f1a43f16b6
MD5 576b552a7c9e7165558e7060c35a561f
SHA1 8f8c6a8f3eabbe197148ac4a9ed40c55f15274fe
SHA512 76a7cc888afa7d9eec1dfc3282419c76ae8c5bc50d3a02f14fe90b84833bb2c213c5f8248b40f29f2d14c130698e739aa49e7a5087500f1d32da451d73251a11
SSDEEP 1536:ROFIpmdYEjb7p34hpmNzEI9jgoCpmWME2VS2uuqqfERE2PS6HEjYa4NirXqsrsKu:1p1p0Cp5uqqofsrsKBlkB9aBp
TLSH
T1E494E505B764E21FC5B9C0771530A5CFEB797825AF112E023B8C0CB1D8B219AB9B6BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToEnter.docm

Path C:\Users\Admin\Desktop\ConvertToEnter.docm
Size 775KB
SHA256 e433e9a9938aeef2782ae0cee1e416b732887c371ce404887dc725cbec286e7f
MD5 9a29c05c0580f138ef02dca751a9cfbe
SHA1 89cdfef5d4e21c95639106754edaeef802006ca5
SHA512 f1dd4ff2156c7c31767f8b13c21aa4e148e8d9bf93e6c60385c96348b80a6c801673f784ca619413b061adef9ae5261e5aedf48c7976e5f8c3cd90da6b299118
SSDEEP 12288:qtKFtZ0x6YJKeIj+ubROq9KLshTyxQHfeXc1jwhkYZu1vmyegFSBtNJ366YRoxvM:qtGa6YINKubROSKYQ4a2uynSBzJ9n6
TLSH
T157F423AE655605B5E3224077889E84CB3C8B5A422D97DB9346D27500DCCEF2E38FBC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountSearch.docm

Path C:\Users\Admin\Desktop\DismountSearch.docm
Size 777KB
SHA256 c84c8e8fd4ab57aee6fb8f735675ddbe96f4b23edad68940caea82a041e99258
MD5 b5fab8aec5175036a5e37c9eae89769c
SHA1 161b7a0c9affdff6a9dd3d1ddf3601436e5e9269
SHA512 c8a4cf7a31957f9ae48fe11d53c9499b045bf1fdf39a9fb57f2dcdb66c1e42431cfd95092ba0faeaa4081e57fac405ece5ae3f85dfe12e977c360cc2aebb8177
SSDEEP 12288:ksZN9FtiUvtklGuwwZv6CAM0RHqQkMxRP4DIbW1ONb9OWMYAZdKmKa9XVXHVK:koXYljwwZv6tM6FkMxd47mmjBVXVK
TLSH
T1F70523245B2A3A23CD828735AC17EFF41DBB2BDC11632AE7547E11EDB89C42D32059D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveAssert.docm

Path C:\Users\Admin\Desktop\ReceiveAssert.docm
Size 775KB
SHA256 defbc801c2fff707633bfd296fbee29cb741489f226c8b7f93e3095e1280c0c7
MD5 cae9826f000e02a9d5975873681ed586
SHA1 fcf94ce1e9fd6adac465ec02bf23d02715b24199
SHA512 57cc16d0dcf9561a040a4049822449a74b7fd201c6f020cfd210dd1b53a80291575712d9b0594d9e4a3b23efa0e00627722e011473f85b3113bdbf2c09a48242
SSDEEP 24576:dO909a9Qr9liackD5MDal5g1C7d1Lrs3yZMRdp9:dOyJPiacUGMq1EHA3yiRdv
TLSH
T187F423DC0F9851D6F51617344BB8D14A282A136F1237C6E5BB33B3910EDA1EAAF11F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareEdit.docm

Path C:\Users\Admin\Documents\CompareEdit.docm
Size 775KB
SHA256 cab9aef33abb54cc2523b8b0d4b7bea0488219568d72b74d331185bcb042e627
MD5 4741c53678a530c8fcf2191f7312a3c7
SHA1 ac84fee9ba150a46ee828ba59324f8147c9a6412
SHA512 84f994ec9d8c4e46cf7d53b6ed905eda1cc97e70849e72de3fc5265412749b79ecd9584a7012ee497f08da7d3fb6d7c8b9943a3d0c419b8f2ac0672979078573
SSDEEP 24576:vHVH7kmkZcQcFmq2vRckD5zDaT8NUShaBSgXJkHeTO/:9H7k9czFmDRcUtoXShC3XJTK/
TLSH
T192F4236418A538FFE77E47B1E4DD67C6B05E164E1212B3132B3E4393170A5AE434B8B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.7MB
SHA256 87b6c6043f199ebcd94e7809854cad5a2e0523e74f5b3997db63f46a830eac26
MD5 e4ae1bb4c17d38d887146623488aed3d
SHA1 8000e15e48bba5ef11ce8ec44191cde441e4784f
SHA512 ae3049b348025e81e9e017e9245973053032bb7f1afe8bbedca9f7d10fd5d2367f4f962d87616a4f08ddc0e61528ef552e09335f18b50205b549f82d74e521ac
SSDEEP 24576:X3n3i63iQULcqbW0QYPzlvNlAtLtEwm6o:XX3iMLUL/W03LlvNlqLtEwm6
TLSH
T17E85BF0273E99135F6F32B31AFB592555ABABC619D35D20F23C41A0D0DB0A90EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dd03acfb2819d34eb46a097997427ab91a115d09dc7cdd3fe72612940e7263e5
MD5 5f0f01934c8bb581a68347eb331b5b73
SHA1 5756bbc5b9d7fc2de211ec28115eab1d2aceee12
SHA512 339d312fcafc678c393c745d8e2ae43420da0551552f0292fa812dae6fd431d9dd226046860d79e828b40407436ac3e733e8cf0352c8ccf830f38b43e72729fa
SSDEEP 12288:nM7V31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:cl1WGA/Cj+UwA0eeEXUD6
TLSH
T1C355239BC3BCB6E1FD3342729A0A72A499213D943F00C5E7B6147BAE5470B4149B5B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 87b11af19196da30d4560cd11d9589390da2f78c7d113b87f6d6ef83a257be13
MD5 a98de1aa839f95adf2bec6e8ce9ca936
SHA1 29a760b33627eeb6902582fed443469ed243fa83
SHA512 f7ab62930814c106f6e221ff29097ac0a76cbe9c85abe80852980ff6a8c91efe695af427f377df5790107f1981c2debf470a85e25899fe66b0c73a15a5d2a592
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYD1WGA/Cj+UwA0eeEXUD6:Kgb4mBIBhGFK12ah9+v
TLSH
T1DB65AE1E22EC02F5E0F6D2B88DAA4417D6B278161731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 cc7e84d2d23ce4b6dd8a22c8ee9905ac3e7c50fa68a5ed076034d6c45a5371c2
MD5 bbbcec3434e87d95c358f59723e56caa
SHA1 2c56c4a43d379ceca06301a0965b52b3db53ed98
SHA512 ad11ceb7fe6e4c7ea338f852b1870c78a34ab7d9142e54529653919776b41697aef7b60ae03a2e2a95967bbaafd57407d548143f652c32809128f02b4b7a2805
SSDEEP 24576:mGJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:mGJarSj8RoTCCW
TLSH
T1A005237EA7C56694C53B977429B6A84A3CF23768970A46DF8CE0957C4F697E0223CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2bdf1d3200a0a862f4dc7b805c5d90896d8011de014a2d32df7a371283a01b42
MD5 db805c8196f55fa94ae94023c6dade3c
SHA1 1c3470eee2fd80cd1c759e28adfa4d3c1be59e0c
SHA512 6a23b873f38e94026ee6303ad3b62e1f1f292680f019c0dceb7cbe1917da58e9276a6a472304a24ac5eb5eb373aab644f84a165d11271ff7c79cd9229bed8dd0
SSDEEP 24576:gG88u8FpJqH1vzria7/m61WGA/Cj+UwA0eeEXUD6:z7ZFPqVya7/r12ah9+v
TLSH
T15785F166A7E401F0D477D1388A4646A3F6B2B8251360EFDF07A88B551F23BD10B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1a7a7b25837cce1b8bc35821a2143b6444827ce78795d229d9e10aafed2462d7
MD5 2ba118feea873266ca69e92a3cee8aa7
SHA1 83d7997ac2737cc1a6f41fb1ac076735bd9c469b
SHA512 673a87829a5eb64a6ae32094e948b34240fa6678b3c99a27aa25e385ec5f2732d1533b7f56db2014bdf9b461b84b0de72c3f3298f59dc72ab7bcfebd21c0bcb6
SSDEEP 12288:THvUrBFrEjwaQK31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:TPUr+NQ+1WGA/Cj+UwA0eeEXUD6
TLSH
T16065E16F62EC28E5E677A17D89424709E77178621711D2DF02E0817E0E73EE8AC3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f83a4056a41a643a4545727abd09ab7a280035e4d562e715e68e1cfe6fab657c
MD5 4b6007d9afea5d8ac8052c053d043cb0
SHA1 05e86138ed433090be188c5495a086243dcdd733
SHA512 28ab221ff4c5e80bd7adcdabfcfc4777a0cee5975780f50328b8216a016df4e14e74774fe86114ef7c8a450ad5700198bcc374742d4bbbf49b4588592c3403bf
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAju12ah9+v:9G05lO43bn2Gc
TLSH
T1CDD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c578b1922cb1d7e3a0fd6f910dd502c7b2b9d6781a38a538bc5098d0d1bb556c
MD5 ce7517ffb5f2631611969dfc4ba619fc
SHA1 8c09e0ebe1a99d8e197b723fcf8e5533363630ca
SHA512 ee06bf4368c3362f1895f44101a02e8cce99fcb15b6dbd4e1f35c80210711d76853db4b76260754accf06c1f062cf09cac4b3fc2a1b86b38508f49a8328f8e90
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn81WGA/Cj+UwA0eeEXUD6:Xa5POZ3lJt2pasx2+mm12ah9+v
TLSH
T12665AF5EA7FC01D5E57AD17DC583461AE5B1342213319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1e94fabfdacd2dc0d14d63f08f262269c95dfdda97cdf06de105c82542528f87
MD5 23f51945113d4cd08bb6bab39a81598a
SHA1 ea94b8e905fae2d2ee84ed036ea378fa8baea15a
SHA512 161f136be61e7c38a39f994deee173a6f72d4715db50981dbe8c5ad9a5b52bf1093986482668d90997068d83c87c013fb9d12fb3f27dc74839f05afea27ae04c
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fky1WGA/Cj+UwA0eeEXUD6:PNc/zEOVHFL12ah9+v
TLSH
T182858C1623E901E4F5BBE1BE89679546FA71786913308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 54f03c1fd3188fa12c592559b23001516da2b06f70fc8d3fe05c04156799d84f
MD5 7d91df1f9db3a6487f2cbdac542617fc
SHA1 2533929b41b781ade559b64a04d06c37776062ed
SHA512 169a3a8afa6a751c9976fc10b210fa9c1d465334ae3799d7c267e6b42d67cb7535a89a9653015271fa172faa2230fdd7fa1d4d23dd21495391112309add05218
SSDEEP 24576:RD3FHshBIYQgAR1WGA/Cj+UwA0eeEXUD6:RDVHeBIAAR12ah9+v
TLSH
T1E275E17EE7AC04E4E57BC1BCCA534A06E77138A9032156DB12D491BA1F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 5cd450ede72e08488062e2124dac9a139ff2e2e58b0b7efaf591a3b1f7c46843
MD5 cac8309635c85efbf24be53a7bd83a1d
SHA1 6d19228632ef1bb337358db059c8a9fe42d35823
SHA512 c59d4a853735a5d0ff855cdd045ceedc5e6d32c07f0efd988e528fcabd3a7fbf5ca17fa05d022c5a3650566f5b26c793d8bf339893c312c84b180d98b85021f0
SSDEEP 24576:y6DIYaKngL2jdshRTdG1YxITqvfPkbIcbjLm:y6DIYarSj8RoTCCW
TLSH
T15B25126D63AA01F4D06BE13D96934506E5F2B1B487074ACF4AE4C5BD4EA3ED8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 27a7ce955a25e395f45c422c6b4a47aa94e99c6ea4b0ee25c4c2ec46b8165873
MD5 e8347853001e2d75dcd3f141a068a1d6
SHA1 c173883b0db918ad3289c9cc5a9eac90f0583b33
SHA512 f61c478d4a712d6b7c47e2676af71af502e63838ffd9e5207a99b0d1312d31ca9707caf504ec54990cadd6b4ed9292bd22d36c6b7e9e2caac35989993c2a9bb9
SSDEEP 24576:Etyx0aKngL2jdshRTdG1YxITqvfPkbIcbjLm:EtZarSj8RoTCCW
TLSH
T11B15235AD7C456D4E57A27786EB385882D727E249B0783CF89E0E63D2F3A7D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 b19a9dc4acd2a16fa2cfa4f633a6a1c175acd8443eb42aa4062767c1979ec54f
MD5 0a248857a44a36d0126a651e0f4e62c3
SHA1 51dfd81b812dac9ae9215d6f52e6f4996c0e97b7
SHA512 2b31aaa9394d2e68e766d3c31fff702545bf6e7377717eeb724e8906f69762cb01990dcbb0071ea63ad0439552f8cd75a69f1b5460b6f204951dececfcc89bd3
SSDEEP 24576:lqaKngL2jdshRTdG1YxITqvfPkbIcbjLm:lqarSj8RoTCCW
TLSH
T1E60523BEDBC45BA4D41A7B743AB6A98D38A3376C970B46CF8CE0557C4E7A7D02538900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 b94f8227794b143048beb4af420b0355183422fde2810e6682dfb6efe1b445bd
MD5 e73b8debe6bc8d933e73037179ddf09c
SHA1 5423471cdcc6378638ebeb9395ae3172ae6e1213
SHA512 9b23aa05f14fe8315da1a3478f27e9eb429decf6b2f1b462f3ffaa1954e1948e6b61026776b6830eaca276395691fca37249b00289d32850f76b3dea79482744
SSDEEP 24576:l1gKLoTfaidZYaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bgZTrZYarSj8RoTCCW
TLSH
T1B465AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 f46921c8981018c3820d00e36e7b6f2dcdf6e107a6374ac97fc7a18e9ef22ae5
MD5 c8c194efc9a940040b490e58e6a9e07a
SHA1 d8310b969cc93a3d0f77c7e33f9617d0504d8e82
SHA512 ae6019ebbfd2c8456593807d0abc62151ec2d8cd72619fbae03ad86a522eecdf44aa240a2bdb389d3e5ddbd627d35ad315cbd56ee890264d53a049b2bdac72a9
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYD1WGA/Cj+UwA0eeEXUD6LaKngL2jdshRTdG1YH:igb4mBIBhGFK12ah9+viarSj8RoTCCW
TLSH
T1F6A5D01E22EC02F5E0F6E2B89DAA4407D6B278161732D2DF1151427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 694285b629d3e940f5e9b025c5fcf45865d3dad494a1cfc8bcdf3375431e4e8b
MD5 e9c326d482b73bba45b983ad76d4700f
SHA1 4ef23ff68b362152261ff9d249ebe2c789a5eb60
SHA512 12de4e36b2578e209ac19a140c9cd87968878d5365cf9e56771a76cb28f664ef2ec53b6ca1a6ee6da1554119a61e98500bbc9c754c4091795000e98686db1758
SSDEEP 24576:oTkNvNnaFeYhJNtmZBmXaKngL2jdshRTdG1YxITqvfPkbIcbjLm:oTMwBtOmXarSj8RoTCCW
TLSH
T17575BF6EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.4MB
SHA256 b71f3cc6e7407a0c5485b8157d2f53b1a55842412e11ff0b31b37131e524e3f6
MD5 efafe15f57f6d9d94a07601a78acd5a2
SHA1 2e28058e968411cf5bd261e5b56e3ec6fd1e4efa
SHA512 ee710296aff9566368fb8490e84f39b95c7304a7fd59c2e12c24a167b9e7b202fcb4d754795a22bd173f6e29ceedd44d94e88ee525eed87edc8890fc1e1f74fb
SSDEEP 24576:LD3FHshBIYQgAR1WGA/Cj+UwA0eeEXUD6daKngL2jdshRTdG1YxITqvfPkbIcbjK:LDVHeBIAAR12ah9+vgarSj8RoTCCW
TLSH
T17EB5027ED79C04E4E57BD2BC9A539A06E67138AD032256CB06D091B91F6BFE02D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 82d523f242f2f28c9a677262141b6f325dbb1e0bb95e6509816525582e3b1e8e
MD5 45045f60ecc59b5beda550766c6f7fd4
SHA1 1a60e9ee4e0aa716b476d7e6dc1b4394bebad3bf
SHA512 511bac0f8e037ebdb733e856255e60b7bdcd342d4854c879adaa100a6aa3bae100365371c7e8a9f0276646ccfda67f1ecc8c88f2c2ba50b961a77efc185fb00c
SSDEEP 24576:6JnJPbzB4SSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:6JnJv6SSarSj8RoTCCW
TLSH
T12435F13DD29810E8E4B7C2B4815A1B4ABE71387D2F1669CB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 febeca138d89c757f67f3e8c70edbad4f390f74e75520e53c4ef60418a885802
MD5 cfe1d21f5008bfc1e53d598d7ecb3ef5
SHA1 819626b507862bb538ef7ac45b75abf09c0144e1
SHA512 06d0fdab0b7610de0bda81211418d2706669747685c13a0ffd7f07fbf87706d910a81b1331ff131783df69544847af16fa5225183bde076e7a0ae07a9f089ab3
SSDEEP 24576:pYcaKngL2jdshRTdG1YxITqvfPkbIcbjLm:pHarSj8RoTCCW
TLSH
T1400523AFDBC48BA0D55A3B743AA7AC4D3CA33B5D974B46CFC8E0159C19AA7D1253C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 02b4a4aecc106a4333fa7ebaa06c9021d4d382bdeb9f8eb68eafe1860474000d
MD5 175b1ddd7288f04d0644ac9e106130ac
SHA1 59f15e671e06f2cab6943208f89a5e18e91563ab
SHA512 94f5b1a0d0075df9591e71aed9a9dd9fbc2312840d0dff769d028572e47491297b15a0efc3d5b81c218fa60598ae5503016ea89c485a6ffca4d3d65eb4f682d5
SSDEEP 24576:B6UqjpSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:B6UzarSj8RoTCCW
TLSH
T1C715236E97C459F4E03A2330AAB6C10918B27E7A035B86DF65D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 a8822ab90901a3b97ced7298bb0515112ce16b804e0ef422dd89ec70092c70aa
MD5 000b9ee3faf4fd2e2d8495d57105a566
SHA1 dbef2ad9431d06b12ceed34ec9c4176cfb57d7da
SHA512 0121c7debb5cb41479f6ced3976164385853a32cdf24a86c8f6f2dc198fb9ee9cf149f954f7754e7c31cb655b5aba6c2342e34d609ba665c3c17868801d49023
SSDEEP 24576:pCLHGL0MoeVtFumTijCmlKQWDkq1aKngL2jdshRTdG1YxITqvfPkbIcbjLm:pCLHGeeV5ijCmlDWDk6arSj8RoTCCW
TLSH
T14CA57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 9bbaea551866c4ffb8d79e3f0849ab7ab0f58d1b9af051e70ead772019b028dd
MD5 54c9dc84919b049f346227dae719855c
SHA1 eb8bd48ebf6e5d2e500e5b9be9f558c79ad4322b
SHA512 3346dbf0c81a260d21f90d20703348e620c1916c5c7e566434f3ee97d269866cdc6f7155fa4d078887191990c5cd98004a03c753a866c76b399fad3225c2ec8a
SSDEEP 24576:2rcmRKaKngL2jdshRTdG1YxITqvfPkbIcbjLm:AcmRKarSj8RoTCCW
TLSH
T17425015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 8c260ea372bf5af06b31cfc19cf87627275cc82df3e8dee6c92ab25d12be85d4
MD5 206202078c732719319fb2171ed22a1d
SHA1 e3b3fe110d17e78d72a676d5ba32ad2cdb1c55d7
SHA512 c0162d0e8ccf7cfd68dec3cb33931b943b4680b55b72074042c336885b0b9642e501aff55f7db03896e3458d6aa8e2063ff2749761c4a32380f771da46215fd0
SSDEEP 49152:vDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3HarSj8RoTCCW:E3Upow8sB6JTy
TLSH
T197B59D3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-174-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/244-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/244-167-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/244-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/788-68-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/788-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/788-61-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/788-69-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/788-270-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1172-126-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1172-132-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1172-355-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1172-353-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1172-125-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1172-348-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1336-92-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/1336-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1336-342-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1336-87-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2472-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2472-52-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/2472-46-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/2472-57-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/2472-81-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4508-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4508-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4508-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-363-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-362-0x0000025EACAF0000-0x0000025EAD170000-memory.dmp

Download

memory/4988-328-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4988-82-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4988-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4988-73-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5096-20-0x0000000003390000-0x00000000033F6000-memory.dmp

Download

memory/5096-0-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/5096-7-0x00000000026F0000-0x0000000002775000-memory.dmp

Download

memory/5096-6-0x00000000026F0000-0x0000000002775000-memory.dmp

Download

memory/5096-67-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/5096-1-0x00000000026F0000-0x0000000002775000-memory.dmp

Download

memory/5096-13-0x0000000003390000-0x00000000033F6000-memory.dmp

Download

memory/5764-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5764-152-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5764-160-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5764-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5764-158-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5948-147-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5948-140-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5948-352-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5948-138-0x0000000140000000-0x0000000140295000-memory.dmp

Download