02901b6a241c7e1f2d8318dbe5591f189652aafcddb74a08b5c2b722e425d2d6

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Size 1.8MB
Sample261017-g9b2gsbs21
SHA256 02901b6a241c7e1f2d8318dbe5591f189652aafcddb74a08b5c2b722e425d2d6
MD5 cef2d1f8eeac0590732628fecf6350d3
SHA1 9920d1369941775cdfb79485749450ab03f5be9b
SHA512 dd86dab3298abdbd9d67b179c83e691e7af65920667d16b1aa663f15a1712e22769bc84ad77a8fd8b68c7c218a3679c8d287f595b271b48a7c1dbe7dce814f84
SSDEEP 49152:9K9QYfDPJZr9ra11M+jtIbCRLlv7p0tOAp2ZT/CJ5Gvt:9K9Q0DPpIxkCvV0tB8/h
TLSH
T18B95230875D644F0E9F21D705FB4C9D08EBEFC304D609A4F23941A2AAF38DA2D56676B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1084	elevation_service.exe
4644	elevation_service.exe
2652	maintenanceservice.exe
5824	OSE.EXE
948	PerceptionSimulationService.exe
4488	perfhost.exe
1884	ReFsDedupSvc.exe
5788	SensorDataService.exe
5712	ssh-agent.exe
5648	AgentService.exe
5088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\913955c3b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ar.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_fr.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdateOnDemand.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdateCore.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_el.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_nl.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_sr.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdate.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_bg.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_es-419.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_sv.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ta.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_sk.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdateComRegisterShell64.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_fil.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_id.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_lt.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ml.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_mr.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdate.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_et.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_fa.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ko.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_lv.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_th.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_vi.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ms.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ca.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_en-GB.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_fi.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_hr.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdateSetup.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleCrashHandler.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_kn.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_tr.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_uk.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_bn.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ro.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_te.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_gu.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_hi.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ja.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_pt-BR.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_zh-CN.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\psuser.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_de.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_is.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_pl.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ru.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleUpdateBroker.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_iw.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_ur.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_zh-TW.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SystemTemp\GUT6276.tmp	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\psmachine_64.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\GoogleCrashHandler64.exe	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_cs.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_es.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_sl.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_sw.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_en.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SystemTemp\GUM6275.tmp\goopdateres_it.dll	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000964487f9005edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000295ffaf9005edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014d69df9005edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a6bdc0fa005edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088f61537015edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e5117fa005edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3ecd036015edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4232	2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	5648	AgentService.exe
Token: SeBackupPrivilege	1884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1884	ReFsDedupSvc.exe
Token: 33	5088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5088	SearchIndexer.exe
Token: SeDebugPrivilege	1084	elevation_service.exe
Token: SeDebugPrivilege	4644	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1644	5088	SearchIndexer.exe	100
PID 5088 wrote to memory of 4848	5088	SearchIndexer.exe	101
PID 5088 wrote to memory of 2544	5088	SearchIndexer.exe	102
PID 5088 wrote to memory of 3568	5088	SearchIndexer.exe	103
PID 5088 wrote to memory of 4060	5088	SearchIndexer.exe	106
PID 5088 wrote to memory of 3200	5088	SearchIndexer.exe	107
PID 5088 wrote to memory of 4428	5088	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_cef2d1f8eeac0590732628fecf6350d3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5824

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 76a66f6cd61c37cd4098ab7fab4336aebbf436fe097d8244f31b6e999d500e31
MD5 13b7843f399e4c3c70181e876055554f
SHA1 45e95bc395a7b2c638adc1ea2c06714ee731e02e
SHA512 774e21290db6c202d51667f17fce0a58ca0c9adba27a6911409e02f189b362365822f7c7b4b3751ce140ed559a8e9a3934891653b26fa117b412fc582b3f13ff
SSDEEP 49152:Ib+632BuPkFKRrdE6ohQstBhuXjfS4LWxn6p2ZT/CJ5Gvt:i3q6tjBf8/h
TLSH
T171D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 fd6f61dc96da539cfc46007fc30925f984e857ab32100c606e094ea14369b63e
MD5 7755082c9084ee9570c0603fa331210c
SHA1 48b5841fbf1026ea5940b0d29fcb78372f4af8e1
SHA512 27cae90423605e22b15447edfa9b7875d1d3f519d238b733d27d807777dcd723f590765e9e7d17d94d1e1557279acb25128c9b69e2686732c50fdf27b8c0d237
SSDEEP 12288:U1XLsswWkxy2lRq2czAZpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOi:yXYfDtczAZpXG1zT/CRaY5oMEvDnDF
TLSH
T12385022867D408F9ED67823CCDA1C501E6737C9547A0E78B03A499261F337E89D7EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 40322934e492d2f31f4b7f34b4cd60ac968ec38b98da500c66aa28087563dedb
MD5 0633238ad6242d6f029f54d2fcd96dd2
SHA1 1878b6025b83724905d6dc8c1a2f3ebf709b6a35
SHA512 394b063040738a242ae61b47085876687c1a1ea1b13e88d4a2e796945d9f838348b0c5a08d3db0f9e53481430c321640af6fbdebc1a427dd4cc913b689e47f87
SSDEEP 24576:K0Le5ji0hmxtrMSpXG1zT/CRaY5oMEvDnDF:KPji0A7Hp2ZT/CJ5Gvt
TLSH
T1AF959E16F6748731D073C0B9C5D2A68AE97230865B308ACB4286D77C7F67AE6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 188ac87fef01212a25c7bf6b17c7ee6cfec21aebfe924481bf0ebb38d36ed356
MD5 f37e3951f8ccee10e894f01898692889
SHA1 4e51cd1259379d8fefca4f6f98dab5465d6221a9
SHA512 0f8d53b1a6829c2eb1d751c00b6a0dee3b0695675cd467ba749dc0cc8a3981d8bb17aa3e516fc2b48426207f2da6dac2042a078b2790f9e2240be15a6277841c
SSDEEP 24576:/a7/ezSC6vUyDZaqgrvWx6q8wyuEpXG1zT/CRaY5oMEvDnDF:y/ezSC6vURPvMHjyTp2ZT/CJ5Gvt
TLSH
T1C8756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c51fe8162c1ddfef37a074ea400f45293c38f9b466ec12e74a1b9906609d413
MD5 2e11dc1d31ec1a141d4f0384d8df0cbd
SHA1 b525f9753a243d32dc131a16665d4ff97a3b4f54
SHA512 f134af4a43cf82dc525a6e8c0a27e62635a5733821ac69ce67ca3da53cb396856881d97fa431df71482aa82f6bfdf5c4574d343c9674939ad82358d9acae57c5
SSDEEP 24576:YVbqPb88hv/lV7dpXG1zT/CRaY5oMEvDnDF:YVO88hXlVBp2ZT/CJ5Gvt
TLSH
T11A559E66F5B48331D073C0BAC5D29A9AEE3234425B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 bc4f796a7fbd8cd475ff8e0be237dcada893228b7a0c6e7630775ccc445ecc6f
MD5 4e2b1beb534e14dd87bd9889a4c9e3f9
SHA1 975fc4432c9a77ec6f0bfe5d7d1dae868d67355e
SHA512 661c3c20c0fb37be850b3282e1d1402c3553cd0a1cd40ae7d59385caf4d7bf6b11f8ac170c8a52c8630fd9a84b3f60440656a8dcbb91c81de263ec7b12aac1c5
SSDEEP 12288:V0mpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOb:V0mpXG1zT/CRaY5oMEvDnDF
TLSH
T1466523E605C80CC6DFA647304EA9C684D6935ECDA882C5072726BA1A977CA3CC4D66DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a7fd6fed3730930dac5074dd9af2dec239df86681dd3f79e4a758f90318c6149
MD5 46afef404a202749c4a1e17f66d6eb4b
SHA1 cf0d575e6b592b414de0a1fc376fe1837c5af1b4
SHA512 9695052fd092f030034de5ae05ceee2e169496c5b0c7b033c66984b6718433f7f951aeb7c2b09b2c4f69343819a00c5238875509b0044855ed35e4832763ad4c
SSDEEP 12288:ieBNUbTVO86UVpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOk:iJIUVpXG1zT/CRaY5oMEvDnDF
TLSH
T15885CF7BAE28FCD2C67A8D785B91C600D7B278704F5293CBE165820EDE235E44D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4225e7652834dceb8b44b64f55bbc9edee4f30d08c5ec28d8caae1a86ec8c200
MD5 aadd5879ddaa49deec2d60b479f4085d
SHA1 092c2b8e3c5f2f48759475dcee909fa5f6d5f459
SHA512 bc12425cfa587c8d834a6a1b979628548f8b24e5abb7d4aba5b084d39fc04be35cd621b469f7f246fc33024095ce1257bb6a3eab3493e4ed3b82a4b0f4b18b4f
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THW:oQvGAdlCEL8c/pRNw5Ca8/h
TLSH
T1D0267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c881b8d34a34d95ad9e39b0673ae63f224d145fd6a0134a2bc4283d60ba3174b
MD5 5128e295bbec145830de9b44d05379dd
SHA1 dc8038051823ac7f8bdd8f9c25213fd7e759d667
SHA512 dc2d0d2dff82abd1a17bf77b3c2c42c1f98704d0b61e10c82d9b08303a39c4b1e6906b631e4bd68a01bf34f976e09e1381ce5dd1329b0eb654e305e4080d32e1
SSDEEP 12288:/AwSfxL/2Dc3DDLLmt0LDQewsAj3pXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstFx:I2ewsAj3pXG1zT/CRaY5oMEvDnDF
TLSH
T14D85E031FE74D432C7BB0DB11B36C706546D79604B521AC3E3A88E9E5A342E26376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b8ce0ec1e007598f82552328550d10ea9245f2e1d3a4b323deb5a800d255f6da
MD5 9f68dce72ea50f08b188fe30f4c0078c
SHA1 a066950e1b17b3ec6e1a7e092921db16f02526a9
SHA512 482844dc4a79724027fe65058d38ccd8cdee342ecb923d1685ddda605c2eae84d85df67b15e4ebb2dea439f8c50ae90c8d9f83a22902a6158e0255245c1f7ea0
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHR8/:6UEtQevvqc2W1cpV29I32R8
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7bc40094daacbdf4551a5c4f59a1d861a4a25ce3fb24f476bc57f3499242ddb1
MD5 2b330870d6712197c81ae67da9a5dcf2
SHA1 2ea4e2aaa057515b9592f0cc2f81465e3cd91879
SHA512 b6f4478423be6fdb962596864e9d9c0c769ae085e1e5f77370af903d4da29489b31f8578f0a68f39722eacd0fd37b4b42a0890cd0a6fe4e176d683debb25c2b1
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zXp2ZT/CJ5Gvt:uoqHVjnmm8/h
TLSH
T19BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b505b6a3496e2f754cccda9e179091cb7480bf3e42cce3c00f2a6878d0e1e45
MD5 08e071d50f3aa91c9a8324ec38bbf1d3
SHA1 bad0e1916db97762d16fec8d1c4034ef44accd40
SHA512 1dd7a259a7b3c76ccee8249deedf0e9a23f4f6a361df421d2898aeda03ab94cc72c32b1691352219956b28977ef917b0cd8dce7b2fa1df27774831c73fdd4451
SSDEEP 24576:CAhGLmIFoiwtA5l7S53wpXG1zT/CRaY5oMEvDnDF:CAM1Foiq5Ap2ZT/CJ5Gvt
TLSH
T1D5359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c38bebf41bfb5051436714cddd737bc81c42d6d1180d0effa44f92557821f405
MD5 046675b17c0121b86e7fc59ed6cebb72
SHA1 b2e49053d56a17d3b6b198020a592e82e00a7597
SHA512 99826a9d0bc92c6fffe322f375f231b5af5d517b1a4f479eedb19d0465d8554627ee1538ff4c60f93e576f01e2810b62b8dbb401f385686cad85578a3be9f55d
SSDEEP 12288:2mw5HEjsChNQBFgl0WDm+CkpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWz:vwulOWzpXG1zT/CRaY5oMEvDnDF
TLSH
T11F85F14636E40CF9EAA782388A97C135E7F3BC452A21D71F1760C65B5F37321AD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 81550e8561cb1870a3bf9e1d3db13c433028005c19bd349694c8fb843cec4841
MD5 97e6b5d40ca6d4c94ca6420406bf7aa7
SHA1 aa353ec459a98d113e9263efdc5de97396360997
SHA512 88510523ee511b4869f39b48d1c41ba1e07a0c32469f1d7d37a2e5edb625d1a9c9a6cce3e4ca442a12ec9b156d85851c0d096fd8f72468e73846d1f0d76d6d27
SSDEEP 12288:JdZ1IynpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOv:TZuqpXG1zT/CRaY5oMEvDnDF
TLSH
T16B75129A22D824F5DAA343388DF58644D3B33896677283CF2625431A1F36EF58C79763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4f782c597051eaf21218ffd07f5e3d17dcfa7d68ee21e1f1242f330af501922a
MD5 b517eef78bf1704b6fa2638349a1c9c7
SHA1 ac35c0ec8e23632ec411fb1eba9ffbe81aeaa00e
SHA512 c5653a08d3f162cd004653397d13f4fc39cd6e4539a5a33f82fc4240926beee067198dac8777403b3ae61ac278809c2f8888b2ac9b24a14093cf206c25530ae1
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UK:KQRQyi36YOcPuLvw2gAf+PN3z8/h
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 60bb9e5afcbdd16781d5a6eea2f5eef8672999eac19c3ef2188d24c16f80c4e3
MD5 62986a5fe6b9e3bbc5a6a38534ca379a
SHA1 c2111f67e43cef2bf70d50a732f4f8c817d5056a
SHA512 b994f314e706dc3fa063ab440179a59028abbd21c917e64358bcc678b8faf35ca07a609fd06d58eb65b683116b449d10bca6b15eec6fffdc11d727d047980ad1
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UK:fQRQyi36YOcPuLvw2gAf+PN3z8/h
TLSH
T149667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b2fcc35091ff87c52e908dfaed284ed06823de140cc9c75ae8f0b5402defd108
MD5 fb980868f31c42d8bf2456be6e155509
SHA1 d2c0cb52f031ef1f8433166c7865b3810000c2e6
SHA512 272785d6489f8a0ebf724bba0f0b404cfbc08607bcaf47409c41a5c6f13a817df2c6dbd080481269786ede1dfc3437cf233e8dd1b3f1a96ecfce37687f9b5e34
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL06pXG1zT/CRaY5oD:t68Qg55nhxeWu7PNU3/Hp2ZT/CJ5Gvt
TLSH
T118B55933B2F60099C44DE1769F4A872196D27C758FE1E3DB851172061BB2AE07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 18a116ed7d6340717544b896e14a435341978081fd6dd6940f77cd98f9fd55f3
MD5 e3b64405b75b60524f5a87df740d6751
SHA1 05bf0a491f8133a894fa5b91aaeafecb1f86b18c
SHA512 4ecbac821ad86c8426083ee6b56cff2fd89bb0686f7cd0cc56f5655d2eb1d835edb07925a054434590128334b143a979db095e3e4fa20a61290293c925d60648
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Ay5112gYy5azzVvD69nLKnhZU8/h
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e4c66e0300db77d477c4e65c0dd1a42977a73b7d43c4a8fa15dbbfb13f69824
MD5 e079df787aafb675dfd89148a2b47ef9
SHA1 797bbca7fc8706bb899cc204117feaf33db5b1de
SHA512 d22a5e1d090dfbf305717c22deb567a384ef28d30711976d7acffcd76d9f42298179fd74f76ee3aebd7d9abe6eeee863b3cff0b094a25fdb7e9bd4c448aa778b
SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpp2ZT/CJ5Gvt:wu6JmQxd2db8/h
TLSH
T17CD59D13F1D901E8D05ED178974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f4ede57a2af6bad30a39aa37bb4b13633956350dc47f7b241f26b26a4cabb843
MD5 55914437fb3494cc21fe2e6512504d6a
SHA1 278933bc0274f8cebef6d9e36235b64047790838
SHA512 2ee15d0112def09214e08ca75ea49ee7e1c21881ef9c74356f554120f904790e63ed79933ac4c7ebee17de80467780acdd185eea2abf9963e53948b1655fa82e
SSDEEP 49152:o1hpsNoJpF1A6yU44CwH7R4x1p2ZT/CJ5Gvt:omifPVRm8/h
TLSH
T16EB5BE13F2D900E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aba02b1cdf1aaa30625f7f0bb58c4d20c300a5b561b567b636faed014b617b15
MD5 9698410faf17a94364a5be01130c69d8
SHA1 618961ef62fea9954a47dee8d4dc57f3983e57c3
SHA512 b7a331f5df346201762622bfb3695e06ce586700d854f497f2938e743da6308354ddd921b126a547f579219cd15317df214d1f260b9db833cc22d83de5ca3e74
SSDEEP 49152:gSuZQIY0Be2KIRVtOnks6NMHqqp2ZT/CJ5Gvt:65dKOi61I8/h
TLSH
T128C5BF13F2E940E8E0BED6748B659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 227233ad9cf8e6c56855a75981d0af9869fe10c22e68795d871ad194d12646eb
MD5 d506a4e44793345de9df00015c9eea41
SHA1 cb9a926ee03b443ee256b16ffcfe4c29b6fbbae0
SHA512 e45125712ee888a0c826a92c4bbc8e9432efd082a165550c27b172cdbe9e2beada7c02dd3935e491e8628685a4059aacd00bc532cf7b0f440e8edb71fb44aebd
SSDEEP 49152:nhtSn8EApI0figGgiDn0AP5wZp2ZT/CJ5Gvt:2X2i/phy8/h
TLSH
T19595BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d05ff47602d613664951c95241b0cd5ed2118107bd895f3e5956fd7df09428b4
MD5 bb62a7dd2f21e9bb70f460da0f4243f0
SHA1 b3348ede199b1cfab41fb21accab9168a70a2453
SHA512 53c409907366f7532a55646305e670af2d66f45666b9afee185997ad7a7316b6bd588cd313e244f1cd32ed5084e4612986214606b42f932757b9285b881f631e
SSDEEP 12288:PepXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOf:PepXG1zT/CRaY5oMEvDnDF
TLSH
T1BD6523E654C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b86df0d22d32c432c604ee9c53b65b40a5829ac0c039758da14f62059a3f71b4
MD5 fae3502e9b74a25194768568132d16d5
SHA1 af565ca36a4cc7273c7d056e639f6c44586a7fb1
SHA512 6ef64d41efffe0aeddeb5d50cff064cc107911a4ad175251f1cabd7287fe62d2f9ce1122935c89a503c741ed1a52641e523594a443b2b98e6655394a3008b3ce
SSDEEP 12288:obpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOm:obpXG1zT/CRaY5oMEvDnDF
TLSH
T1876523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 eade3e5e1ef69ae61f2a25edb16ade408763238fa560f25f0c9cd590f1f85232
MD5 2fa0e9f7aa807f256536e14c02defc9b
SHA1 935e24a84d9049eda41d652d9baab09d504456bf
SHA512 ab7cf768a9265b56031114545988d02856dca67e6f349ccae3cb8f449cddb8fd7386ab8c030e829c398f9b15ef60f2967e88b813131a7a9a7689317d2a848d07
SSDEEP 12288:ltpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO/:ltpXG1zT/CRaY5oMEvDnDF
TLSH
T1FB6523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0fa653ba64bd9213be296be4566534eb5ccf56b4ffb3a52c2a37d60d4f9030ab
MD5 195b095eee9458fc4c218dcec400235c
SHA1 a453e1e859a468067bd2eff0d92ea78f0c88567c
SHA512 356b6ea2961e33abb3799f26a9dea9858db23755b6e971d7634dd374ac1afe8f6cfed49d95ee1f3c69eddf09b48cfc0435be4f22c957b9fde45785243e220247
SSDEEP 12288:3VQpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO4:epXG1zT/CRaY5oMEvDnDF
TLSH
T16065239616D908C6DEA2C3308EB5C244D2F37DC9F962824F2712561A4F74B78C8B5FDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 40544abf08b586a058924627f3f2ce1246a7fcc6e02d2f8390579862e395070c
MD5 8dd3c921f91d3ccc3bb0878ae996d200
SHA1 fd601f4e18e74efc3308f26158b4e48719e3aa76
SHA512 ee4c1a7035eae56c7f5c5f037f1e4c09f4318784c6b50f19c9c3313ea4a400425bd8b79e56d04bae79b7c79bef1a85dc7caa37ae8cd1c244544ce25227e7d325
SSDEEP 12288:MYpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO/:MYpXG1zT/CRaY5oMEvDnDF
TLSH
T1C36523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 abca1e2497a3a6b9d680e9185d6d67cfba8a5af81ab34cee3760514f73a7f0e8
MD5 61bf232904acac3d9047a2384df3da88
SHA1 8b7a44e00ab55c4e0f60de576cfd9f237a538cea
SHA512 e103a8e19113054c7acc7f044a60537b4e0969a8b7335bfb458700ab9c90a77b2cac57b2e83a7a7365decb6c2c104105c99d5fe526e448d23ebd23640b293e19
SSDEEP 12288:jvpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOY:jvpXG1zT/CRaY5oMEvDnDF
TLSH
T11F6523E554C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 778136ff2e9f58b066f206c95cd367ad88c985ebe90510c58911d8b77267b465
MD5 44bb44c5b09b8dd6d2b49cb415c6c27e
SHA1 cafead12ad42421930fbe6ff392c8754d397768f
SHA512 ae1dab2a32b41627c7729674c5f454d94d26bfa18c4481ac2ad73dfaa7c02e51c62c385ec06acf007b885ed6a46e420151bbcecedac177d6f8de17c7fa6a822b
SSDEEP 12288:EDpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOE:EDpXG1zT/CRaY5oMEvDnDF
TLSH
T11A6523E554C90CC6DF9187304EA9C288D5971ECEF893810B371AA6169778E3CC4D6AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c3b5a8f2460bf894eceddb728899c0f3920ceb5bb350403d98f2a4bb6b5420a0
MD5 60dce304c13c3ef0865799f32714e3a0
SHA1 c978d3f547e18ec2dc248abb803670439a2b959c
SHA512 ad5665a3489bae21b3a1f2f8829418188e4e9a0b0410451a3400ab50b3712567e850f9e4a26627ce29b7929a2e6d6af36163936659572ead86a345e687e3d635
SSDEEP 12288:TiZwbPzzFEoS2cPvy7pXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOZ:+ZM7zFVSO7pXG1zT/CRaY5oMEvDnDF
TLSH
T1E98501A573900CF8ED63823DCD658906D6B27C5A5A60C60F13A436275F337B14C7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9edfc5263c7a0e9ed74969dba6b64f30014d947936f17945a39bec2a26c4b156
MD5 3e62b09eabe35b8354a641065962908d
SHA1 744315e3eb372549affdedb44ec918633cab547a
SHA512 867f4e7897aa4fd886dda74b418e9decacd8417d14d36f4c8c6b4e5da3d27d934da6d76da326dd5b60856c62a79d496a851ac45b9faba08ffd1645ac889257b7
SSDEEP 12288:vapXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOd:vapXG1zT/CRaY5oMEvDnDF
TLSH
T1EC6523E654C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 11f1f70aac2bf9bcac03a4126aaaad39921d4e6358d96a3a44b6e045542662e2
MD5 53b891ad923e976b5102080a28b31ac1
SHA1 fd1fe472ac8d99c87407f3cc1eeae40a75ac9efa
SHA512 da9f6dca03cec7ca9d4c12bb5b948deef2f3d0a4c3ba73221d6e1cc7a7c06499c8b815580c87c8e78a1ce9198de51859aaf0b0298c278f51046d7d4ba1527aae
SSDEEP 12288:fWpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOv:fWpXG1zT/CRaY5oMEvDnDF
TLSH
T17F6523E654C90CC6DF5187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 72160b8524ba39301712e66c496b6aa511686b2fe4966f7f147d835b990379b2
MD5 7832920920ab9a96937d46f599644ca2
SHA1 6d087468083385a5a920a0c857f9bf1afee8d1da
SHA512 534e4faff327ebe69ac5315ab7a97a158924c24b9a5d66c199643f43e073ed3d00eb6c25e7a9d8cc2b12e8032f325857077384582bbf74414da341d049461d07
SSDEEP 12288:gyPz5L8npXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOw:RzynpXG1zT/CRaY5oMEvDnDF
TLSH
T1E475125732E520F9D6768234CDA24A01F3B27C765B218A9F236447362F376B0CD7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 95302941643b503ceb27ba881eb553816180b61981129be6a1f495d12612fdfb
MD5 08a7084578669689f0b07d8cd4e5a71d
SHA1 e5bc802521907739dccb03a4d62c106d5421bbc1
SHA512 895036973b97f13cc633f1d3ba7f0d8592454bdafa14b2351058babbfa585bacf92baff32a0e016a2097e6e6785d8c11bbde8a2a6e6eba1299bf8f29af68c6c4
SSDEEP 12288:AapXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOl:AapXG1zT/CRaY5oMEvDnDF
TLSH
T1AA6523E654C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 73bda6158c1974c9e7a4bdbc6a5e031205c2b14a7fa0cf4b47681ab7e0f45cdf
MD5 8130df8f1ce87e56abe1ddae4c6ac99d
SHA1 f50e5627b1d2de88131db52e8dca2774ae69b6cb
SHA512 0d51889ba0f77419d05dda91965168d0992672bd52894acb9a37da46a372a2cbff3de245e2e3e9b500c8d228911d4a48ab03cc8239ed49b1d9370e1db9361b78
SSDEEP 12288:1apXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOi:1apXG1zT/CRaY5oMEvDnDF
TLSH
T10A6523E654C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 7fa2825695fca24e1f622002fa065e8098997d4a8328555672969189d9bf94bc
MD5 ecc5bfe28bd5d3ac0def65b0276676e3
SHA1 65836117e091b9433a2cfe09c4908febbc2ff06e
SHA512 2a35ea90f84e04ab032b4787ec9d7ea0dbe32266a64547ed2a39e3a16ff8a9dc4b5fcc9093c88154a7ad4ca55cb350ca3b960c11f936ca18c45cc978ffad085f
SSDEEP 12288:PyPz5L8npXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOR:izynpXG1zT/CRaY5oMEvDnDF
TLSH
T14075125732E520F9D6768234CDA24A01F3B27C765B218A9F236447362F376B0CD7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 116308049b23bcd4b07cefe93758dcec9116dab870717da77689a5b797fbec59
MD5 316c799527338413f1ac18dd8f736517
SHA1 5e09d01e9b1f7cabf4dee024a5e1ce50dd6bceb5
SHA512 adbc019e3b6c116fe5dde79b25aeb58e4f80348c2f392002065ccc99cb815ff159ded4b064996c900adeaab775e89e7787945bd51474649232a351c69949fa20
SSDEEP 24576:NTQaLl3z0zD9pXG1zT/CRaY5oMEvDnDF:NT3LljEp2ZT/CJ5Gvt
TLSH
T1BA8501A5B3901CF8DD67823DCD658906D2B27C5A4A60C61F13A836275F333B05C7EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a16c06b4cbd0ba4259a1d110e13b502fa90cb2bf19d0181ae40a431c607a061c
MD5 a41308ec195cd5648372847c6e2f3d41
SHA1 003c8ebf17f47f16c6fe3cdbd968f73c54dabfb1
SHA512 6feb0b2828407b8f28d2dedda41e05ce1f6a87e7ee754c87428e6b1a93cab06a1b672cf4b9df7c641a6711d3ca8c46e86b3cb33474d0dc60521ffdcc7b32a1ae
SSDEEP 24576:K3/d9CHKy7GZxpXG1zT/CRaY5oMEvDnDF:s/d9CHKyafp2ZT/CJ5Gvt
TLSH
T16E95CF90F3E414E4F1B78A358D768501DAB67C995B71CA8F03A4661A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4380a23e51d2a42f87365fc58fd802ec571abd8d2f46fe26a7b0cd2c971ddd9a
MD5 8e2ca9bd7dfb11e666e480c176183452
SHA1 ab37a58c49b466923e3aa519ebf7953e34c7eb8f
SHA512 37ac4a8a92b6f9d62882583600e987b9f1ee5b4188983242a4f21df264a69ee12063f4a9b8216bfa06144ecea0622f370fecef4ff2dae335ef3bc8d81e915fa7
SSDEEP 12288:fNpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOU:fNpXG1zT/CRaY5oMEvDnDF
TLSH
T1BE6523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5659b7e61fb04a2bb08514eb6c3f90c3e13e5cba9be0bb5fc7e7efa8079f2b18
MD5 386e4ec19d6abe64891c6f59f8267bdb
SHA1 b29cccbdacc9143676e68143860bd88f0e063ee1
SHA512 d87cd854d0509a9c19050acb813fc71f3072a0e02616fad16a1c432062e39c418c4ad8a8388f2452f8e08a6c62f56cf765d4ba00ea2ae946e15172af58b7b925
SSDEEP 12288:/HpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOq:/HpXG1zT/CRaY5oMEvDnDF
TLSH
T1C56523E514C90CC6DF9587304EA9C284D5971ECEF8938207371AA6169778E3CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 1e0f553285f3eb6ee87211c67253a6297f9b74091521ddfbbf2a2184f79c3758
MD5 653d46bd683a15120ad250a4996a6441
SHA1 2552024f120b89eb701dc37e95a0fe30ffb64fe3
SHA512 765e8c3acffd4433756eb1de6d5c414bddc2c9e23f062ba85f0a6336268cf58fe786daa1b08f60a5115eadd61c0a9b743445c41f898ccc40014e41b806b8b0cc
SSDEEP 12288:mMpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOa:mMpXG1zT/CRaY5oMEvDnDF
TLSH
T1666523E654C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 4313ec883ceb38109fa6d7bcc9924e291543c6976d1ab7dcb272ff834f89867a
MD5 67bf6cf25fed236fc839b0ae989a32ac
SHA1 464cac6d8e9ec00ea4f5c365e015dffc55213bc1
SHA512 3ef6ced283eae58e7ec0c3c186e189b97a5726a5f027cbe925af2e85f8b7f7105e98bbe8593c622578c5601bbc795a09636d9af08e02296d5fe2ed2c86c11295
SSDEEP 12288:UapXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOe:UapXG1zT/CRaY5oMEvDnDF
TLSH
T1626523E654C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b10d38c0cceec871ac8c6c8be7411324a265124a79a5a58e949310a5aa0ce892
MD5 80653b44c887ca23147b288e359e2777
SHA1 3f9c80d140a468de0299e4a7deb2164308dbd5ca
SHA512 ed59dc248f55a2787403552d1c6060e4fec2623ec735b3f6343f8b99e2b920d99e51016788d5edba02a982b5b4fc12177092d5da99c02f7f270b4bd0489fe90e
SSDEEP 12288:6NpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSO5:6NpXG1zT/CRaY5oMEvDnDF
TLSH
T1176523E654C90CC6DF9187304EA9C288D5971ECEF883810B371AA6169778E7CC4D6ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 9130231ebdced3f2cfe18476dded10e6478d79c4510faf3d5e218dcf996f2e9c
MD5 94621267776a338069b8b06ec88b8e5f
SHA1 9598d4efd10d4f7d0ce2b48cfb4285852e1dc9f6
SHA512 6633f1fd57eb01f0f2ccdd95e6c068028dc4253e2f9f834786bda438341be9a90541cb9c18d0c360a605fa174cd086628a18af42a1f79e59dffefdf28c4aae7d
SSDEEP 12288:eipXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOS:eipXG1zT/CRaY5oMEvDnDF
TLSH
T1EE6523E518C90CC6DF9187304FA9C284D5971ECEF883820B371AA6169778E7DC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2aa17742ad9d961f927cb7e336296742a34f559ddf2195f902b3ddc22dc3a784
MD5 628eb69d5d5387612dba8d52eb1b9b89
SHA1 16da651b400567831ecb4a155b2e99197f4e657f
SHA512 29703e8ecfecd58a56ea9e3348121034f57bdacc1a3486e05425a73f40cc60969251d50404d930ca7aa0fd051820b2246294692d6a03b6c12776a8f614348843
SSDEEP 12288:0YpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOo:0YpXG1zT/CRaY5oMEvDnDF
TLSH
T19F6523E558C90CC6DF9187304EA9C288D5971ECEF883810B371AA616977CE7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 06b90832735fe49ee7d658609b8649a0caae6eed79b32862db9d5fb90889d49d
MD5 b64d3bf0fb2acc1707553a83582cc91a
SHA1 546cacb7bcb0a6f6dff9e7c6d20437dd312d35cd
SHA512 b593dd5a3e4e20773cb2d04dc8271ad4f93f6b5c3907a0af8704abf6ee2651d7c10ec24b32289f75b8c7eb3813bc8f6a88cb00518af0f4819908330672570f1b
SSDEEP 12288:nFpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOR:nFpXG1zT/CRaY5oMEvDnDF
TLSH
T1C06523E558C90CC6DF9187304FA9C684D5971ECEF883820B371AA6169778E3CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 70db0806792bcfa050ff49ead17a2b471f41a338cafdca7daa79d1aa4cf0d521
MD5 984f810ebe2b6e76aff9f748d9fde7df
SHA1 ebbe408747a1061c7160a53e41dd787f545d9b97
SHA512 40c93e6b2fd1a577feb1acbde673875ed79189a4020e01695edca859cffd4c0f33f9de3e938749808c38cfb7f6f9e8be7fc1d11d6412840aa33f2bb9b8dfde26
SSDEEP 12288:HYpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOS:HYpXG1zT/CRaY5oMEvDnDF
TLSH
T12D6523E558C90CC6DF9187304FA9C288D5971ECEF883810B371AA6169778E7CC4D6ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 2ac246a13ee3120e2834fb8ca905c9becf344f03926bcfb507e2c21c3e9afd0c
MD5 7f64bda07955e8fdd50e7c0472f02692
SHA1 e012ec3cb81316bcb4cbdc7e7182b2222f65ca58
SHA512 0e152464e68202a468521d18ed4a920a73cccd908279e35513f801bffb0fe633a56e998154e7e4b641bd06b760e4f873768992e4821b7e0d3b1b92f393493ac0
SSDEEP 24576:bfwvUk9RX6wkyAIGpXG1zT/CRaY5oMEvDnDF:lMnYIGp2ZT/CJ5Gvt
TLSH
T1F395CF29EBDC08E5E1B7923C89B7460AF6B178591B31C2CF125A536D0E37EE49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 02ffdd8953596d45b66c1a42b09874e571ae6e73f3d6eae69b99943f6c1c8803
MD5 91918f23b4c56fafb7b08c91a1bc3bd1
SHA1 3cb3a998dc70efd00828a5a817670e9386bd7188
SHA512 89b94c87077f6332bd9b15597e35e7bb4977c8bee97d3f9787343b86c1252cf012d9aa659ffc05e815959855ac69f616ace7db644b4dd4444df27d233b304f76
SSDEEP 49152:QYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05p2ZT/CJ5Gvt:MySzPT8/h
TLSH
T1B6067C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a50855e6495880eb705deaad2fcde14ea9920f3bd661fd0f7ea73317314acaad
MD5 c7a097e8bd722671f0ffd7058822f39e
SHA1 ca0f7952651d24f94a3cc3324c4851413cd970fd
SHA512 4d6eb02b7c6411de7b8a095addab802b3141e7ff9521aa7f5d8ffe248b33280b3106627f119cd51150f80b93a2e2c7db0f431f3bb055ec60f3efae8c33787ad9
SSDEEP 24576:p47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYrpXG1zT/CRaY5oMEvDnDF:p47JUQjairIhCnDHUPfF/pp2ZT/CJ5GF
TLSH
T16F65AE1DA3EC01D5E1BA927885158A5AEA71742E5F31CACF2270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ee797fcc1ae6b3bfda4ef1c4e148c27e01ef6fbe98f6e94c831e8b0e1211a275
MD5 69051b0d7410d02d255a64c37e6d50f0
SHA1 0611d25fdaef8f85ecdec6df4c07f78e346d26ad
SHA512 d7b942edf06e58697aaea53f0276eeaf0e257185611d886bf55c3bf61371978d003796f07b595e920fd750979d4d20c0c2cc6f39f0901bed0e488ca3ce9e19c8
SSDEEP 12288:wqsfqpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOl:cqpXG1zT/CRaY5oMEvDnDF
TLSH
T14C75F05AD29801D8C56E5234CB558640F3633CA997E2D3CB23D0F53E1F79AA49CEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fb80482c57692ed0a51bb5d7a6289f4ce48ab3c8280b59a1b2c8817198110d5b
MD5 cb62b8e5ce7cc5e12d7d899b0dbda8a9
SHA1 2a114ca7cfa2d2ce2992a5b0121f507cc3ee9557
SHA512 ca0cca19ccffe9f5440cf6389d861a02265c0d1c4f55efa7e52950ee38b8ccc348d4c9a77dd23039fd431eed1862db129029b032a940a1d2f70819227322dff6
SSDEEP 12288:BnNWvQEzNDsQEC3WJzRVt9s6+OeH5MUj2Ok10R:BAoEzNDsQEC3WJtNzeH5MK3S0R
TLSH
T1753517107666DA8FC6A980325E33D1CCAB707D11EE446F0773C9873FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 ca7b32f5876a343aaa52f5db6c413e321bd5e3b9c86261630eda66ed0ee7adac
MD5 9242e4048fb70dd31772c8611298a42e
SHA1 08e5ccf5b6fe176d4c37eb168a4258a434e22210
SHA512 d4e95204e683dc5a595332f93ae0adce41afea0441c0af66850af828d69bbc13e41adaffd50ea9b58c4956a2d7ce1e69606d6b6ea8f55a0ffcacaeab44160a3b
SSDEEP 12288:oJj9QiWQHQd/e2M/Tg/Ad2eYO6+L+20IwD:S9QiWQHQd/e2M/Tg/Ak79+Lq3
TLSH
T1306519419537E68FD1BB6032072A5B4CBB64EC07B7096F2277C9493AD82A751B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 159c7436e491a37ddbaa03eb0ffb01428db89eabdfd0583e5d3e10f6d180d720
MD5 4df1f138ca5d3151eca5cecb5da72641
SHA1 4da297bd3c8828680246d7e525b8616037d25da7
SHA512 c7ec7e6d62c4d29cf6c90ff36393acf5327927a028bc16378d07430639bc17a5aa385a34c852bd7f88e5d2ab9165616abf523cb5c5a27eaeb35d8dbcd450e295
SSDEEP 12288:xN7ypXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOf:TypXG1zT/CRaY5oMEvDnDF
TLSH
T10D6523A245CC0C86EEB547300EADC204D65B6EDDAF41C1877606A2169778EF8CCF5A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b135c3d5800a3a39fcf67bbf0f026ee53c7e422da8631e2be4a7e3815f93f763
MD5 14fd64e826503f505a34d170d9383088
SHA1 e6cb752f7f22e56395fc6d45c882753ed4284ceb
SHA512 b655c5364fc44f89441d4f07afb0971ce74c9a76bb5d2a91a3d7156512f90ca6f671a3f2611e1eeac884020daaa7bddbfa930e44cd5992f3a7b963fabfd97f8b
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYEpXG1zT/CRaY5oMEvDnDFm:Bgb4mBIBhGFrp2ZT/CJ5Gvt
TLSH
T1EF65AE1E22EC01F5E1F6D2B88DAA4417D6B378161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 da8f074440214477a96f0f0bdaa0b257615e56db26cc77372bfc573edaf34b77
MD5 08b900a16354bc02c80536e16a024ac4
SHA1 83fdf3372fa46cabf5ef9b38c1944f27433fa1e0
SHA512 0f93b70d3ca72c4d3d6ff7e8b005f89966c007d69db8a4e4b7e5b2df37c80e263fc53e4f36552444c1d3dca1f9add406bbc9a158d044cef675f3f15b3e14a179
SSDEEP 24576:WG88u8FpJqH1pzria7/m7pXG1zT/CRaY5oMEvDnDF:97ZFPqVga7/sp2ZT/CJ5Gvt
TLSH
T10F95F16576E101F1D477D1388A868663F6B2B8251360EBDF07A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ff40a1831d0a12246706a4c54f98ec755cf1bc1000f1e8033d8537e726ce747c
MD5 e6b569293c4db489652f27d065d7bf85
SHA1 f94c3e428397681bb400fa59f4b0838ea7500749
SHA512 69150988a0464e35035098f09152ce531038eaa209f21698d7f781a7b6420295695c0ef18f55b0b4fdd8a2e1b1c5c4011fcbbd3eda34a93ed4703789e0561847
SSDEEP 12288:9HvUrBFrEjwaQfpXGM02MzTTLCcaKl8VQY5oMEAmDBVaXzstF2HxSWSOd:9PUr+NQfpXG1zT/CRaY5oMEvDnDF
TLSH
T11F85E16F22DC1CD5E676E13C89868709E77278661712D2CF02A1813E4F77EE8AC39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8aae31a727c159bf7300faf9c7b6635101c2753a625032210c878a0687727bcb
MD5 025658d6ce99d509eb0ae1b7aea20662
SHA1 d86ba3e071c7b21d4cf1f5270ff09a15986e24b5
SHA512 0f6f7566de9ec0266c897d1b64ad83cf5f5068ac0e669aea8de92ec72e1ab0f65fc99cf0aa126a7ee3580bb4ffcdb5da5a057059a5ca2f1c6ae1f79a6c92857e
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvp2ZT/CJ5Gvt:AG05lO43bs8/h
TLSH
T1A3D5C06A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 32d5072045f7bb83d581584f2c4f19f09dbc1c9e3c20244b9b411f3856ec2e3c
MD5 159fb5eb7a0d37d15e8fe1d8aadb4c62
SHA1 8b646cc164ac4486df58e12d6262ae733b9e00a6
SHA512 f8cbdff1c3166fc337aefbdf4d8423ee9adb7b7032cc65395cc55db16dec4ad3e91b8a8d4b4a6e2c858c1a1337d16228ff1ca9b86e3e55c82105754765c176bc
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5pXG1zT/CRaY5oMEvDnDF:9a5POZ3hJt2pasx2+mHp2ZT/CJ5Gvt
TLSH
T13465AF5EA6FC00D5D5B9D17CC583860AE5B1346653329BCB122182BE3F27EF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 11581720b6d19c4ab491ea6320f25ffb78b1c6bdfe5630724186fc5c8eb05288
MD5 dbd6d24e3e6e178f5c6ba08c2925b103
SHA1 7529a7c0f1ab31d6c365fc66d61946f2f7df22ae
SHA512 85d1f324b8bbb2c9be0454f7d7a424809f88871be19b4f8387d841838a629b6344a7263af7948f3c921b2e4490bf86de5ff7e392233e350d2b9bc95e1275114f
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkTpXG1zT/CRaY5oMEvDnDF:3Nc/zEOVHFMp2ZT/CJ5Gvt
TLSH
T1E8858C1622E901E4F5BBE1BE89779546FAB17869533086CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 67bf3e2dde90d0b7de05e8d0d81164b7a039c7b40818109209bfdb679471fa69
MD5 e2c3c2137a149dd4bc412ad79a7d583b
SHA1 0ad2a12c5fbc62a5f4b2cb87e30bb4ef8845f352
SHA512 2de4d586dfa4db6f9c9e6843465bdebf6faf0f520b9040fac7b8ea0d060b515123f78859ea1423bbb29495762147cff5e37369f7aeda8bf4e612eb08de44de63
SSDEEP 24576:u3kNvNnaFeYhJNtmZBmFpXG1zT/CRaY5oMEvDnDF:u3MwBtOmFp2ZT/CJ5Gvt
TLSH
T1A155AF6EBAF805E4D1FAC6B48D238512E6727861173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 26d6e6d38268272626ba9c91d2ff76e2e5ef7493b158a1b9660384d8cd4522ad
MD5 ef2fef7c8d176e48a520a621c84bbbdf
SHA1 94c5340b9e86fdb27a7cc33ea7fb6ff992fde307
SHA512 15b254326dd45804b8e80433f742ea70cd205f9f57949fed03dd98f9e280409abd845131f9de004d726ba7e26f9c211be1ec9d62ed16279da071d30f71ddc077
SSDEEP 24576:5D3FHshBIYQgA+pXG1zT/CRaY5oMEvDnDF:5DVHeBIAA+p2ZT/CJ5Gvt
TLSH
T10295E17DE69C04E4D57BC27CCA638606E77238AD032256CB1294C1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-330-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/948-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/948-139-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/948-131-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1084-178-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1084-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1084-89-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1084-49-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1884-154-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1884-414-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1884-449-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1884-447-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1884-161-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1884-155-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2652-117-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2652-112-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2652-118-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2652-106-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2652-105-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3568-450-0x0000027DEC780000-0x0000027DEC9C8000-memory.dmp

Download

memory/4232-6-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4232-7-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4232-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4232-153-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4232-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4232-361-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/4488-350-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4488-144-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4488-149-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4488-143-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4644-100-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4644-101-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4644-94-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4644-205-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4644-93-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5088-206-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5088-436-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5088-207-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5088-213-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5648-218-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5648-199-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5648-192-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5648-220-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5648-193-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5712-187-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5712-182-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5712-179-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5712-434-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5788-435-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-432-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5788-173-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5788-428-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-167-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5788-166-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5824-127-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5824-121-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5824-120-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5824-293-0x0000000140000000-0x00000001401AF000-memory.dmp

Download