3d445598d6b5941272d64de145ced6ef149c36158f29437b113560c8ad174336

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260415-2dvtyabs3j
SHA256 3d445598d6b5941272d64de145ced6ef149c36158f29437b113560c8ad174336
MD5 aaae2153eb7b3a3b722b9df98a971eef
SHA1 6edca698777e842c58ace3d03e4c080316fb0ea4
SHA512 454ab7d866817284c8380a79bda71cbb3f62a239dd4e815268b9f8bd5498ebca0940dd82683b2f855e25b509bcaa8dfc155d1c8ae0edd915666435a26ffb0305
SSDEEP 12288:r93G6vHzOASubviBNDYa3d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxQ:rVGGTWBZNyxknw4FYnshx8OfVe247
TLSH
T1CE75022472C1C0B3E96315310AB0A6716A3EFE305F7585DFA398272EADB05D1993DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2960	alg.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
6028	fxssvc.exe
3368	elevation_service.exe
1868	elevation_service.exe
4864	maintenanceservice.exe
4724	msdtc.exe
5228	OSE.EXE
5588	PerceptionSimulationService.exe
3860	perfhost.exe
2764	locator.exe
2936	SensorDataService.exe
4976	snmptrap.exe
3996	spectrum.exe
5796	ssh-agent.exe
3752	TieringEngineService.exe
4428	AgentService.exe
5992	vds.exe
3740	vssvc.exe
6056	wbengine.exe
1364	WmiApSrv.exe
6080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\93e5bc3db955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaws.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002acba03927cddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002087d3927cddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013568b3927cddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007317ce3927cddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe
5488	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	6028	fxssvc.exe
Token: SeRestorePrivilege	3752	TieringEngineService.exe
Token: SeManageVolumePrivilege	3752	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: SeBackupPrivilege	3740	vssvc.exe
Token: SeRestorePrivilege	3740	vssvc.exe
Token: SeAuditPrivilege	3740	vssvc.exe
Token: SeBackupPrivilege	6056	wbengine.exe
Token: SeRestorePrivilege	6056	wbengine.exe
Token: SeSecurityPrivilege	6056	wbengine.exe
Token: 33	6080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6080	SearchIndexer.exe
Token: SeDebugPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1352	2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5488	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 2036	6080	SearchIndexer.exe	104
PID 6080 wrote to memory of 1148	6080	SearchIndexer.exe	105
PID 6080 wrote to memory of 3224	6080	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_aaae2153eb7b3a3b722b9df98a971eef_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3484

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4864

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4724

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5228

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2936

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2264

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2860 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1148
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b3c79e084cfe9521039e80ea34404faf4e411101fdc408a19c99d170e9f303c9
MD5 5328fb1bfc60cf9995af4ebabc386f55
SHA1 fead3974e357ec0579799dffb732393accda9024
SHA512 a89ebf8c3828ef962f27c8c5dc7c35a988d412f53517eb8cd70d9bb1aabfb002d5098c47473ac8b1f9dd1c58d809d4876409ec837d2c81d9a82f99ffb9ee014b
SSDEEP 49152:Pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndx4x8EVep:N3q6HjBGix8EVy
TLSH
T117D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 af75ee2faa058d757b5e4c2e16f67a5306030d3183c087d209c198db62c75fcb
MD5 0571b5e11babdccb3ea850dd8ba84114
SHA1 641757293d1e9b69aca2bac5571e1a89cd5ae186
SHA512 e055c165415c9c2d280eada425615a1c397bf4e9a0eff0f61f0d460e0f75e5d17eb020317de905973fc6328ffa9883c1127116c81972862c6441f71faa459be7
SSDEEP 12288:a1XLsswWkxy2lRq2czAn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:wXYfDtczAnyxknw4FYnshx8OfVe247
TLSH
T15475F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 86ad6b45e27c1e1fd558b20a56053ec564c7f6ee6b074b400c50a7cb16f5c592
MD5 75b77316ffc4b26f7d3b4f5c9cd77548
SHA1 71a2050dd9a7aa87c6271db2460d0d1c6a20d6a9
SHA512 e52c2c95ca670fd6a59528e2f73524f049dd59e1e41bdd123f8be943d96a87d11c14b3e37d2b1ce822c626e426438d5bfee2440a83bc6d18fa80d78ccf5fd7b1
SSDEEP 24576:k0Le5ji0hmx1rMqyxknw4FYnshx8OfVe247:kPji0A7kx4x8EVep
TLSH
T12E95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 be8a80c2993d980ec6a6ffd03f39751494cfbfabad6e0611f8068314cc58cc74
MD5 0ce0e0ca0e9079a81785fd646387e550
SHA1 4c6d124d82e03e666b6afe1ddcd54864c585838d
SHA512 01c731a2162371871d44c6c1ba20933c0a23193623d92cecce75c4037f1f81ebf856217e5893390ec36f491285c7dba31d31d06ed7c4331a47bc9099bb7b4bfb
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyu4yxknw4FYnshx8OfVe247:Q/ezSC6vUzPvxHjyQx4x8EVep
TLSH
T1C1756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 be0d44ec66fd8dedd06e8e5e61512689cf902e23453ae44d1e92c0d2105def1c
MD5 d409cf4da49890736ba97c67a20a5680
SHA1 7c976b75aa1ef78ac0b7fb6762b9fb85f6875002
SHA512 8c6d5049ca9a5eb3f92458bfe2796008da255cc2f93137fe5025ce100bcd7f77897c33d567bf5e0aa4ef13c3d66d85c1a2d77fc0cc917e78067468031958b635
SSDEEP 24576:yVbqPb88hv/l+6zyxknw4FYnshx8OfVe247:yVO88hXl+Rx4x8EVep
TLSH
T1C2559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6bf7c0ec066504bcdd3fa4581e221a2adfe6aca37286393f42b420f94dc92994
MD5 2be8746f044d6e2c1bf594ee760b235b
SHA1 5e2392598721633dea72e4af084eb4cb3a7fb1d0
SHA512 7726aa4569c189e17ef00e449567b87548bdee398750f50c9eed82a02530dbf8563546fb822718281e0b17a54f498508b5bd99e5ce8fd842a3b0e5b9330abd5a
SSDEEP 12288:sN2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sN2yxknw4FYnshx8OfVe247
TLSH
T15A65237CA7DDA4E1FA5E15331B7172622616B9A0DA74C11BCB79B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7a96e5d70f872933acc665e4489ce0759d1cb21dd6493ee5570902ba25d97d18
MD5 8f421e5f11ec1cc964211f0aa3aafbe0
SHA1 c03744d6d9cd342ce713f6882f1dc7e342a73bdf
SHA512 b048541fa88841444bd20aa87739b745b22fbe5d5c86922465b8d684d773820b8f88e67adf1b913748dd8ee643e5d0a99ebbba58008e3494e8904e20ced46cc3
SSDEEP 12288:JeBNUbTVO86Ub+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JJIUbyxknw4FYnshx8OfVe247
TLSH
T10A75CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 58ae3e464c739405748f2dd0e2ea42f05251d5dce0c15cc0976654f91305e7b8
MD5 2f055136bdb138532ab82e3dc94bfbca
SHA1 c2d4b331aff94592bfc0884429e27363bfed3fdc
SHA512 c7b0c388e708c739a4fdb6fc1662a0c3c94c487cf8cb9e7977973e7e82499d57603b7a6fefeaff082fd3ee90adb2336df22031b0f48e3c31d942e6ed86b6bce8
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:uQvGAdlCEL8c/yRNw5CLix8EVy
TLSH
T151267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b4b7343c5df919e200fb463d0d909542a3ccfae3b5062d50a34f6b92d066c712
MD5 fdde9f0c9862dd4607612e620f4dca06
SHA1 bd117ee2d7b7f42394a34d31a66ac2cb738c035c
SHA512 5cf7322e8c5e7a5905305b565e111b34c833b81b0ea3a59b7e758aac3942eadb48c1cf8c4d8c0679f870562702189c48a8c91a0beba269d9f7bdaaff70437909
SSDEEP 12288:SAwSfxL/2Dc3LDLLmt0LDQewsAjR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:X6ewsAjRyxknw4FYnshx8OfVe247
TLSH
T18985E030FF74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9ab67550c107be8acb090bb04c002cdd5da52edffa79436519db708b53ac5ef8
MD5 606876c31eb1756d6773cb1d17769f4f
SHA1 2f9c343eb898bdc14beb9f8f2e78737a597dcf57
SHA512 1fc2293e885acfbac9f573e0d06633d8415d9bfd15416d58efe798c98c755745ba6d8eaccf29e3684e5226c851cca1c9ce220d4220899dba10e7d015b8e4d10f
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHB:CUEtQevvqc2W1cpV2EI32
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1cea507144fa7b75d7f4dd47aa5b2ffd9568a21cbd8189082ed0a198c327e2dd
MD5 afca3f8c618f8c36c01d109d41fd9b73
SHA1 6c593eeffe5e2897882b3447a3330a07238ebe6a
SHA512 a713b87a296c7e10da4e33dc9b28a52c51f93987b361b4029cde185147789c6d0c910a2723022c5247b73ffcedfd603b7946f04787bf71a100509e60c00e2232
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/z0x4x8EVep:qoqtVjnmnix8EVy
TLSH
T162D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 588cc11b224a58a3f408cf3405c9f75743f8516399af09da676e2f4fa504ade3
MD5 00f159b861a1aca98b885ca7f3bc556e
SHA1 349574ba19a7e2f328c8ff1b33d8167e1a1d0edb
SHA512 ba23586d992f6b5e2b619ffb99859a162153c4ee3449f9ba2bb6b5624c3afb42466d51bc52f2eb957f1e217979f52c92cd7e4daf5d77f59d8734212a1a6ebfc2
SSDEEP 24576:tAhGLJIFoiwtA5l7S53syxknw4FYnshx8OfVe247:tAMyFoiq5Xx4x8EVep
TLSH
T18935AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 954bbcccd40c5060b66ad9bcb3b55e1ec3f5c67e49b36a9ca06b9041d336b173
MD5 a9b5bfb20b5b0e9b5bd5ed65493aaeaa
SHA1 a1753a907dfe1bfa0e23802246cc5b7a6f0e20bf
SHA512 af514be0126d3386fe4b7bde7e16b978d292a68e1a5202b710b258415d4c4cfb5733bdc3387e75225978ef572ead6a41e18d3c3a772a15847a94706e3d010f18
SSDEEP 12288:+mw5HEjsChN4BFgl0WDm+CY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:XwuVOWlyxknw4FYnshx8OfVe247
TLSH
T16175F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d6d076a3ba18cb93f1279028bb4e919695d3476bcd2db503c5b45cbdd397043d
MD5 386d614de0f519a35c9170c11473bfcf
SHA1 73eca7276a1c32386ed9e59348401baecbfdb504
SHA512 710088df90c4375fc9477cf110973506a05c4994cb4515e67bc52e38691fbe40f67bcc13071006f98fee8c1a14d67d2430f98a17ac2c3c5fa95ac3a9c634abe3
SSDEEP 12288:/FZ1IyB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9ZuSyxknw4FYnshx8OfVe247
TLSH
T1AE6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5549d8757d74e424d2b5fb2fb6843397a26f8d11e1144f3350237697cb14805a
MD5 142c36c44c034504e30226179d112c41
SHA1 51931b977817528f2a7c45e13f76ad81306972ab
SHA512 cfc37798107c09d860b1015eb929a771be7a2318c98a0398759b8608aeed748ffe843d1aa993aee8bff8435dae6af4f6f740e38b14851c4e090ac2ef68dc31b6
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:FQRQyi36YOcPQLvw2gAf+PN3aix8EVy
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 62f63f4b12d27368ae037c8c10b5e75a8f3989ec9fceb3654c1330db2ee64c3a
MD5 aeae5a1cac1dce566a7fe67af1606b7f
SHA1 786efefa865f8daf00cd60e9c23a3897ec2eea79
SHA512 1829f444fc78dbcb95dce712b63fb40ee3ff74c70a509056c7de71c5c15e97782a00b58e4a37c53b04ee492aade359a22f37aaa5290311a758cf7e3a92ec2b13
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:CQRQyi36YOcPQLvw2gAf+PN3aix8EVy
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 97681711b3740bc83c50ee6e40b3b5e2c554e45619ba6aa48b0ebb66ec7fe65d
MD5 d17f3a347bd8159a4de4669cb45d0a0a
SHA1 249378323a566afed191c539889cf63e1b467073
SHA512 a0dc03e8a1bdc4a70999b97252130922f8d4b8f1cb4bad40ac5a56edebf9c23e37e85288348905e71ed84bc747100d6ec76ad2b1ad04d59a7993bd5e327176cc
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iyxknw4FYnshx8Z:D68Qg55nhheWu7PNU3/kx4x8EVep
TLSH
T11BB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 31009ac8fa022ea487b82d8b9ba920ff76a4d8442c301862ceff7b0e45ac5680
MD5 a9a2d7208ea6a38b8b8d59078e86ba11
SHA1 0f84c3c568c7f631cb2617ac70bff672eb50b162
SHA512 c11c0ac223f70b8fc3a7a803049710fb3e97b282fa1a2778680da6e87bfa37925a75b754c45b4f328d3e860f23f10b501b3d50ad813e25a9582cc811e2f1009c
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:Xy5112gYy5azzVvL69nLKnhZpix8EVy
TLSH
T1F6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 402a4acb9d6b26dd57a6e706db8dc3377e1145257162aaf1bc7841b12206d81b
MD5 bf03554ed12bc84fff0d1367235107cf
SHA1 40db2b8416abe6ec75189d832338c28321756476
SHA512 f9e618d9977adeed694055ca15a959d384b81e68aa9b696f0d997507417a467d2d8ce8f74ff7bcdacb05fe80971c3a33aac73a43ea0851941838e1091709952b
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCx4x8EVep:mu6JmVxd2dCix8EVy
TLSH
T197D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9fb8b6f9fc4c22671fd9336305291c93e61050cd8dcf2045beab2792504d1916
MD5 91a89e5c347af5cb8cf41e6229d30334
SHA1 2158b3e5991dfff353e2aeb8ba036747125d4bac
SHA512 1fd44e8fbc3a0f23e8d590d3f92dd7a46aeadb7f485b393dc2f061da788df7344e1de9b5477f1c0051d950dd2855c17d04698818fc6aa8d412b335bd071144a0
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xex4x8EVep:0mifPbRnix8EVy
TLSH
T14EB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 58726e387855b0e42422ba4508a74eae84ebe45f0129c8aea498c9ed72abc87e
MD5 560fd58ab5a1272d3537da66e1c9f9cb
SHA1 255422a407095b3f63b0223ad6e074bd38b14fab
SHA512 57b55a01d37f91091b5031e9457a9c0d6800b50ed1d51b02d47dac7b6b31411b8b30e2689e9ffd05958dac8edb5734da94e4b2d7edc0d61c886395010ed409df
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqNx4x8EVep:v5dKTi61Nix8EVy
TLSH
T16FC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 da2be796d4828235b096d2e647eaa68c55687590722fb2396a4610bc64a1544f
MD5 e8c90ea8dc1d66a2784dc951fe350c47
SHA1 06c3071e59ff9c2141d287538d5eaa96f33fe117
SHA512 2364fb47351040335ef00f9554536c9e7792f3c165916ae0e687327b75037aecbfbdcd961bf5a39ca38b825ccf072a341d29447dfea5959d8e4e603d2eb83db1
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wyx4x8EVep:VX2iyphjix8EVy
TLSH
T15695BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7e51eba3976222f83200ed6c33c0b5bcb1428f9441454a0c10715265dcc1cc1f
MD5 9b14777a8945c81ef395875c6d31140a
SHA1 12f1d61d7dff1caed2b037d70f2f722c5381a223
SHA512 d8e9512cf7e5c5078a34b809b3f684590001a8f62f1ed756fb7fc85cdef1d3fb2691d0ea418af34d36c9316aa7d116d8266b4a36704b2026505a261935ce0132
SSDEEP 12288:Ye+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yeyxknw4FYnshx8OfVe247
TLSH
T1A76523BCBBDE95E2E50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 917642f82a3dc25e302984bb7ea459d96ba8355a8f589d04c20707d933d02bd8
MD5 3ff4b1cb0ae54e1a955d693029e12151
SHA1 1b1c2aad81c82c28f7741b4651c74e45390f45c4
SHA512 69e813b8fe57d01ccbffe281260c2e5097f930b337558850581f1c2f842d652246123830c2b50ff9f465c047eab009f4e869a7990bd70ccbfb62a7717994c615
SSDEEP 12288:m9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:m9yxknw4FYnshx8OfVe247
TLSH
T1E765237CBBDE95E2E50D11734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7d1f026dcdd9df6fd1d5ce57f8184d415f8c1dce681fbfc3fffd726407295881
MD5 0916881e0cc5a45a6f7db4decc5773bd
SHA1 0e7f6ea393e399e55948c1fb79e61b832d7278fe
SHA512 8e58b50671dddb12f5f2b341df6b7c927ddf58e558a9cf92c4ec19349a35a2a97be538a97bb71e7a9b4738ecc7b69503f7f1abb03eeaa4d9339f31e1c8936066
SSDEEP 12288:ED+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EDyxknw4FYnshx8OfVe247
TLSH
T19665237CBBDF95D2E50D11734B7273626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 52bca8410f41ef7bea319a1afdf3b306e9f72a07f0b252e520a4083ed8e50600
MD5 8407c188ecc59381116d0a3a7f1481d7
SHA1 11db14d5828b4c2eff4b11ba540294411c913e21
SHA512 b4d70cc9a9d1dc11a3277c24b515b3485a3e353972c7bd229140cf37395c2f3e798a782c4f46d372fb9324b1c5048eb8dd1cf9e723fbac674b97b36aacd5b3b4
SSDEEP 12288:eVM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hyxknw4FYnshx8OfVe247
TLSH
T14E65237C77EE50D1E85A51738A726222B365B8E5E731835FCB24710EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 492024ff1705445f464d3ae2933acaf20904bc0523c1147fb87f4b2d50bbb49f
MD5 242ec74b98ba373b72799f9eefd5b6d8
SHA1 20ddf88867185c9575101c1ef78421c121b3c157
SHA512 97947cc89b1ac19d130ad55c82d96912e76057b47f468e0dd34c1550161463ef66c020d95e87767897ee5b9eba8ecc239a115854ded007f65e2207a474a1208d
SSDEEP 12288:xE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xEyxknw4FYnshx8OfVe247
TLSH
T16465237CBBDE95D2E50D11734B7273626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 06e69fd228f9fc7b13ac3d116e271ae488161a6b7b8397d47ad776bbf399f873
MD5 45e28622893b7413705440b5dc4676dc
SHA1 285242341eaf5670f881e8d3bf9f9bc85ae998f6
SHA512 2fe649f12338e8730a91254b1cb38be4cd48dc3cf2e79fc832748dd0b8b504276b7dea6e77f2e9e0f49ee746df5c441455aaaf3799a33f115ffd24c488ab7362
SSDEEP 12288:gZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gZyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDE95E2E50D11734B7173626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 47ba1135709948c1cd85d329763a8d6b1e3ea5c99bae5804f4bd723916ec4347
MD5 d26ec2e0f7b2a0b7a4378dcba7e047eb
SHA1 6f226863f054050541558e51445262af7d035c0e
SHA512 294b5efc726a77c546cdb9fc5d3b2186ad46061c0f3db49227d83cc1151bffd67b6eb37555515fd2b3dc156c29d5f889b569fac390ac7a442bc5e31317cae224
SSDEEP 12288:z1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z1yxknw4FYnshx8OfVe247
TLSH
T13265237CBBDE95D2E50D01734B7173626609B5A5EA75821BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 dcde874cc07ec0429409e933b8af4ad178c8458e65d33ac7995c59835f8d1f92
MD5 0436085641b1a991d42a4478c27d436b
SHA1 dd5dd3cb3bcd5fb3262489b980bee3c48350f900
SHA512 c43f334a83007d122717dda032d5011ea5f434034efd554880cc3fcd0b1ef3bae406190a25aef7080cbf08f4a64e2dcaab8d82f9e73d403203ebfc0f262d707c
SSDEEP 12288:ziZwbZzzFEoS2cPvyd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eZMdzFVSOdyxknw4FYnshx8OfVe247
TLSH
T1167502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e148b78592044358f13460096eddbb431ddace1ac86acda2d3dfb5a476fb2bd2
MD5 95c7d4b1126cad10b00481aa9cec8483
SHA1 1ec483ea05b2319ad63e09717be57c3ee5b38674
SHA512 2978ba1d752934a28973e5da2287b598a63ae66d7b7a8dbbc88fc82f5879c4a947e5351be5b62c4926f2d50833f7d34db7114e6eafaf344c169d8b0806fd1dc1
SSDEEP 12288:rC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rCyxknw4FYnshx8OfVe247
TLSH
T1B06523BCBBDEA5D2E50D11734B7163626609B5E5FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 731f7e3bcdf2e87a49c2cba30c4b7ad27185e2b4131ea8fc3c891c41ed0f57f7
MD5 70089adc348d08b874afacef84da4fcf
SHA1 e7a3e3b384610e8639cb39df64e950aad5e32e3c
SHA512 39bec3b9f89179c3f756766c26d20fc11befb15db4e2c37a8391bb339293ac90baebcfa09b333515c8cc53928a20515ceb749a679e38d04d0a02d9ecec5ff294
SSDEEP 12288:Nm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nmyxknw4FYnshx8OfVe247
TLSH
T1B86523BCBBDE95D2E50D01734B7163626609B6A5FA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 fc840a04481d61c2dd3651c0d4081fb2dd1ac4b51d5fffaf7b813c4caf440040
MD5 6cd31e0b0ec8bcb3d45dbcaafc0ef45a
SHA1 be2598f20ebef97eb88ffa3ed6ac82f83bc4cf36
SHA512 32896a04598b7f28e1bc1c8c57a2b353c657b5e9e9736828c67e6e1e73e5505bf27af40253143fd1d7e9f492c6ebe386a328d444eae953372e6589d6708ee246
SSDEEP 12288:3yPz5L8B+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6zyByxknw4FYnshx8OfVe247
TLSH
T17475125B73E530F5D12A423689621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 30e4adade7e118a0179e4aa3fbb7f8a07563e14588083eb01c6492f5c0574ed7
MD5 444c38b4195e18ec82e3b5da3b7e0887
SHA1 08dde0aca5d7c37671706849d1d51c7108583200
SHA512 d6a430899ee442c73b27e596b3f6966c9e97702a4baabaf9a58e8b5d28e9d6717bea185e16439b61a4e32f3dda0cbb6f9f01ce2c90f241c7880f45490d379766
SSDEEP 12288:TC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TCyxknw4FYnshx8OfVe247
TLSH
T1576523BCBBDEA5D2F50D01734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bdb06536a18675bb580bd27952c98d92349e6bd935cd5861b36d3fd6103b5057
MD5 a8a453e2c2e43afde50a5ca22a654819
SHA1 78e527c1d4a2fbf259cc5afa6eb536290045d357
SHA512 a514d741610cc34cda8943216a0e3cc17c0246cc3168d666b896cb6655673b564118ab738fc4f891eb39779127c2a63b80c8685cc9ba12bb37457b6ce0fb8754
SSDEEP 12288:BC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BCyxknw4FYnshx8OfVe247
TLSH
T1716523BCBBDEA5D2E50D01734B7173666609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5c5bf00d3aa9e73e597dadf9b154442219f3b183837d1078786f4349d4c3611c
MD5 302c8184bd389d99fda1e1a7c6b25272
SHA1 6d3397760a93d2b0f62051bb6fd2770eb6a63648
SHA512 d7bea68fb30f2d6f3b09f1d8f0ef80f36a2decb68cc4d6581b3387cdbbd1bd3088984e7356c9d2ba6aebd9eec24085870adfa1380e6f8e7e51bcd41bf06a8b97
SSDEEP 24576:UCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA/yxknw4FYnshx8OfVe247:UCUxPTY+8Wg2lIL8lrIUJLWwfx4x8EVy
TLSH
T14465AE1DA3EC0896D4BB81358A518A16EB32782E1B32D6CF1160C33D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b9f445d893be56581b1a50d28baabd757b707244d86c01e3cb95db4e7d5beee1
MD5 a83b384dab1f3d8b50923768d1481fbc
SHA1 b221505a6083d8a7e6915e58504d98aa5878810a
SHA512 768fd69f350ff291c22d4b301020f90aee40b3a4766a0b856198b02e17f4880ffe9587d460f735aa13d393e8f683b4fa534d2d2b057f4a16ce1ebda07b974173
SSDEEP 12288:D+sfS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RSyxknw4FYnshx8OfVe247
TLSH
T14675F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2d143ffd7c9a56b421f179a6984fcd3d6464fe90aca8213c832498541b140e23
MD5 c428d46bee4d3814f709fec091a3ca2e
SHA1 3b35ec8bd494972138bbdaaef6a605915a5e6448
SHA512 8237d95841420f281a2f09dc877e5286b754378a695ca9a1841cd0116aa6ff1e5d53a78a1868d9c38bb1d5a503abb63bac3cf7aa2d50e8fc307a45ba335fe278
SSDEEP 12288:lj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ljyxknw4FYnshx8OfVe247
TLSH
T1FB65237CA7DDA992F46D15730A76A231220AB1B4DF71C18BDB59B14EE0B0CD0E83DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 586a6d52fb774486524adb617379b517222b88ea2e0ccbf57e6d4cf00afcb0f5
MD5 5cf01d1ee6097af35be3396f35d90778
SHA1 e42552dfee107c10bf1fc9e572fa074fd0e43bc0
SHA512 76cf93cfe75b0ea34d9174ef25bbb9287762fd009a22c2f11e55b4a4a02fbbeefd4af7790aa17b700e1f41588f3ed876d240529c5628358c74ed7fc516a6d50c
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCxyxknw4FYnshx8OfVe247:9RZwQCyiHiQEaaPnMlx4x8EVep
TLSH
T14A85AF1D63DC46A5E0BAD2B8CDA74407E6B27816573193CF0291C27D2F27DE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ef58827eedc1d3e9ebf589d8f79297b4a9a0ee4051ef3a131271990edf628005
MD5 752edced67dadc285f32daeaeb51ce66
SHA1 b828c73255bbe10e004fb1afb83f27c1c09b3f73
SHA512 f1ff6be05459361df9b478d1864b77adbf44f1d569c6aa21e315378c1770005db3b3da09d8a43a625b2864673eb23282badf996018be7110a81f9a2a7ff4446f
SSDEEP 12288:EbxA1U7KT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EbxA1UGTyxknw4FYnshx8OfVe247
TLSH
T1A065123C66EC24E1F17A913A89A18206D332B866573193DF52D4D23E5F32DE49C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d585e21244309637092087c498b68a551e9c773e12b552ce6c66f03f787f4845
MD5 a8126234dbd3c9691e8a2d0709725b77
SHA1 f34042879249d8178788fdfb2cc293087f525e4a
SHA512 78a56db6eb0ec125cc7109a37a600175481925f082fb4e52a24d409c09f9e97a43aba563f6aaf0f3b407af8f09471f9d74f82ce4ad487f30be5453ee0667baee
SSDEEP 24576:qjsmP0yHaqrVqHra44KDzMsrn8yxknw4FYnshx8OfVe247:qjRP0yHfVqzlAsrnXx4x8EVep
TLSH
T1F745AF2DF2B910F9D4AAD136454107B5BB71B42D1F209ACB4170C239AF06EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 380be80ed2646cde1c30b6dd8223a944a7bce5c70280fee941a41164185e8ee6
MD5 83f62f7fba002a35b38a8681c39073f4
SHA1 97cc6f92ec7a4c02c7f597ce226f117589227199
SHA512 1fd956b15bf688ad93ff48f0ef12ae664a95ff7b4fc265bbc9b9d342602f2ac8cbff5112141354e6e4b4fddcd894d7641a34cd12835641b6131ee851f8349b6e
SSDEEP 12288:O5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:O5yxknw4FYnshx8OfVe247
TLSH
T1066523BCB7DEA5D1E91D15730B7162223205B5A4EB71829BCB6DB10EE1F0CE4903E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b299b0d5d7d9d57f804391897d5b2674b0d6ecb4af65cfe2b7b2ffc6d636b3ee
MD5 f9ddaf70a62149ebd929d940d51b869e
SHA1 20307961f622aebced18ca6dc2fcef97f5fbb428
SHA512 7bd2a727b5b86c78997a4b1e124666f4e2130bdb5e2ad943c8860803202e2e1eec544af7614bb6b87c0add14df75ee8b90ecf1543d44a1df6c61f6de80753a3e
SSDEEP 12288:eOb6A4LWO+vAYFTn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HCLBUTnyxknw4FYnshx8OfVe247
TLSH
T1AF850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 60930581ce41dd3e1e9717ae50d8e78a007c0e319410400ec11fddeb46ad655e
MD5 ddd87a1ef35873a66a6169ab0b68d5a3
SHA1 0e01585783ceb72ead4abe349cbcaf5bb85f0527
SHA512 3b1898bb7542603a7be211e04fd853807b28f6da031cfe1b5af0bb070067af5bc3811bd4d0e870c69d9d6ce9381b98dbb01f5a2eecf63222c76a7a94da36f232
SSDEEP 12288:270VmwIYNvUyBpu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ngYNHQyxknw4FYnshx8OfVe247
TLSH
T14675F22E62AD1CE5E57B517A8AD38209F2737466172192CF05B0C27E5E23DE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8f6b22e965369ad0dba10d52654b8a33d202700fb5428721ddec843a4f6b6596
MD5 03a146cc09edc1187244626b206e2ed3
SHA1 5480a410baf626b397b1683e9df009260fd6da7f
SHA512 194d34d00405fe7917a0aea7ae31e3b61e35ec3f86561bfcf37b4b07c3b609d4b0d8bc42687abd9ec698aa8b7856834d8fc27bbbe2f68b9e213dae491aed1637
SSDEEP 24576:XnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK2:XnXoJJYH84VVS6AmEcJas+cHBjSSKHPm
TLSH
T15265BFADA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8afc286cbb6dd2eddc26f361a27ec1d8144fdac21450a549cc59a591d8049a9d
MD5 87f3df586ddf446bda86683437d3a2da
SHA1 bbba4baabca072e5520521c5dd4d8db77473d2b2
SHA512 2d2967f67878231b63341a0cf5cce2d7778f438e9f8e9361431d160b7a71eeceebd183ab6cda7446fa0e4ca1302ab41bff8d5a7dd7222cdafd1d8149cf859554
SSDEEP 24576:Yv7Xbxd9Tuycf8M/TYlSuxwr2PCWyxknw4FYnshx8OfVe247:YDLL9TuJ0M/TYW2Pcx4x8EVep
TLSH
T196858D5EA3EC42D4E07BD6BD85B79146FAB2B855273081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 b406c1273b3557ce6cb8bd30444c973e0d19428ec9714144de4545d423b8bc87
MD5 120b4d60af299f3308bb3fbaa55dabd7
SHA1 ca76b3b93a8de4f451f8e07723654bad9c167234
SHA512 c844d8b9520b9a3ff7ee8472a99fe13eeac1af0c352a8cd98c447eb539405a800509a511a1bc89cdd8bc8199d3834e498bdb5077e7510626981f58765d7ecc21
SSDEEP 24576:begJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wnyxknw4FYnshx8OfVe247:bngOJOmPOHhyx4x8EVep
TLSH
T13A55CF3EA7BC15D5E03EC17E8A928916F6B1782603355ACF0160827E5F1BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 27d5c757b6a82f2707dac1f468d9ee6c342a4b360560a890084aa8d10afd1331
MD5 247fe88a6cb6df93da5b63af24461d18
SHA1 9b0b0b5992c199f49d46936be5473a0c34c9c93e
SHA512 49182ab542be90001ac085a790f09ca5edea87d07977775c621142277c623272102b9fd09544cf3b4edd67cf79836f9adc224977ff8d8cf28d5f83c0403ae745
SSDEEP 24576:oLJnJiTk3R3waE4JrOZyxknw4FYnshx8OfVe247:oLJnJK8R304lnx4x8EVep
TLSH
T1B785D03CD2A810E8D4B7C2B5825A2756FF31347C2B2169CB59B4D4353F12EE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d897b69bbfbf974e00d24f0ab386f389329e0e0ddf9632f2265355759f42e193
MD5 0fe7329c161372f0263f51d388ca2acc
SHA1 a8a70c1699d34de38899b08dc215436f2d20e11d
SHA512 13c89d234ca6eaa45de7cbff6c53b9f14b74564e04e9e25c29ba41af8aa57acec1f612220109d22441cc4f336996578d56a2a0d713068f1775dc7e43d0d39ad3
SSDEEP 24576:YA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pvyxknw4FYnshx8OfVe247:39GqCzDScAZmlvTcFg8Ph6Ax4x8EVep
TLSH
T19B955D15F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 ea056741953fc4df694c834b54749489180db9af0eda3bfe8d8b7c24ed336969
MD5 ffc5720f80b04bb38e1ff4adb5f103bf
SHA1 46dc8cb3939cd172367cbfb971f454b188c96d0c
SHA512 49670592d8fa4c5f6a82548d3e3a295b723cc054943009f9fd75fcf7f043a65b1e65b76ba98d9a746f9218ac1aaa0f48b087191791c714dde720ddbcb94a68e5
SSDEEP 24576:ZlYJeXm5jUuEXyxknw4FYnshx8OfVe247:ZlYJeXmRUuEix4x8EVep
TLSH
T1B365126C769D70E1E12E507A8AA24615E372F0B1672153EF82E4D17ECEB2CE06D3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 a84f1a8d17b49eb906f39913e020c9ce47a6c831097ac710a30f1a5ca879ce97
MD5 132bf692b2d3d0d536372bfc03648886
SHA1 c69761eb9bdc003a8a868dcefe016ef4f25f7fd7
SHA512 e31657954d5f74821c2a7b5a22235ffd07147518d10dd8f1200ab1a8f7cd5030f8c125fbfb09479a9b4a64f05a6072e31a369dba543bacecda5b1ca4fabcd727
SSDEEP 12288:WTu6kyc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WKtycyxknw4FYnshx8OfVe247
TLSH
T13375121873D9A4D0E57905368A734261AB35BC709F3183DF86E0F23FAE719D0A839B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 8c8005ff392784f00551c8f6bf7e35b348f65364dcb61eae93692ba92f84e0a1
MD5 a1f659a7199ee3f58a89f075edd242bc
SHA1 6898071939d80ae9b1972e8cc084ca3a561ad8fa
SHA512 98ffe9fa6db06f0e3287137b00d1ec0db559854a241d1ca4ea325b3036f5c7ec264a9209c9b6671e3c34b7daa81d57c8766d486a0d67495080601f5ef921e196
SSDEEP 12288:fPn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xnyxknw4FYnshx8OfVe247
TLSH
T18865237C67DAA4E1E8191573063222626215B1B4AB7191AFC7F8F13EE5F0CD0A03EE53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 40761897d301c20f9cd1f6fe64574846035093cf1f6b996e2fd956da81ec7cbd
MD5 36bfe6667782bf5876b2ba464e81dc6b
SHA1 50c0153feacc0185647fa9fe1c733c7c8b7b8abe
SHA512 ff28f991999915760e05ad993d6559c0061a65f581cb4b5ef18b6e97c5e15e78d2b8f48f52e3871df0a27ebd537f523e95e3f904e2934af2d498a915349b0a36
SSDEEP 24576:AC+TyQIu93VAumZr7jmyyxknw4FYnshx8OfVe247:A/TfIq+Ytx4x8EVep
TLSH
T18E558D2DA7E91DCAE276C675C9A34493E633B472137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 da8bedc2782e0ad30a9176d959cc041dccccbcef0aeea763504346bd2cd23e31
MD5 da310b06344b44c05ad318eee9e08599
SHA1 69a16a1738ef10ee092c2eb6353f202cb3c7e966
SHA512 316c0c55e5813040b7f9da7d50e8b485e7d1138aea7039032b430326835dc20143bd8be72f631b516205cb837de0222f2a6182be0588ed22f0c9ee38dd7c9f05
SSDEEP 12288:kcyrWOstaa3kcsr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xLQikZryxknw4FYnshx8OfVe247
TLSH
T19475F11EB3AE10E1E0AB813989554212F673B074572263DF42A0C77D5BB78E9BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b3a82c51d70cb48a7b443a7d5b456fc841601029ca5d4dc15ca35b6ec34a8372
MD5 7ac2fa1066238cfb152f7051c4f0387c
SHA1 8047877acbddcbbcce7b038b9a99998b321b0c33
SHA512 b0e37752f5d4718a57694a41a14e3234237921879ac5004afced1f13a6576afcdff6fe006b79db04c58be4b50e2349f0a1547697321694a102b4d10d90c82f9d
SSDEEP 49152:upJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP3x4x8EVep:bpC7b4+80GTkYix8EVy
TLSH
T1EDA57C3DE2F810ADD8AA8376C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 80068ba6ccd19974fdc984d5d8ba58bf413e5a6f82a2d262601d5946edac739a
MD5 6b769aa26dada0f53a3adb0a6756dc09
SHA1 bfcccc9e8c2c85f03e45fa5bae0fec437929d005
SHA512 891139c7e0b9a394d45ad4af4bc2d711061451c6ad2c44e53b9b58916f295b2578c8a07b75c1c07d12fea1ac3c1fe694d1b9c28475bab4c30a86dbdae75acb3b
SSDEEP 24576:eSAwJPE1IDAo+4Kt+l44135UQkyxknw4FYnshx8OfVe247:eqPCIo4Kol4/Q/x4x8EVep
TLSH
T1AF55B029A7F956E4E17AC7B4D663C611FB737822133163CF8290913E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 c1b2119c6f51756ff36080b5fc2bc0cf31867095b904d4e20979b03541163867
MD5 1ae0cda64512fd552dda8fc082386ab0
SHA1 62e283d2aa21700048271db4c8a140a6d827ee3e
SHA512 7d147474bb57dab2154edbf067a1f09b55782e40f49c32832474fe807d409f88357772d354c3456c758ce3fea1aa91fa4560de32bc06ea2c1b7369792d9915bc
SSDEEP 24576:syLXPLcl94tUyxknw4FYnshx8OfVe247:sy7Pootvx4x8EVep
TLSH
T19185E03DE76D04E0E47AC27DC6A38506F67238AD033166CB46A491792F67EF4A93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 d74841872048184431142033975da0f1dfcf1d307c75370760b5115588a33b7c
MD5 3ccc4b7a18d7c0d901c2540ff8ac3cfe
SHA1 c0d9f2959a38ad3bd8068a2cb3e3a50c7c63c6ff
SHA512 c34fd8058597262c868e0dbe6768bf6da695f91ce6b3cce2e855fd25e2cf7b34e01a26543d31d38fca2cdcb2a6db4bc33cddf7fcea471284ad4e97eeeec1e9f0
SSDEEP 12288:t9lyvj3IkxjbBz7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tWv8qjp7yxknw4FYnshx8OfVe247
TLSH
T1D675126C67E864D4F47D02319A3292269172BCB2177492EFA6D8E57F8B708D0D43EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-384-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-393-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-396-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-397-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-398-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-372-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-399-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-374-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-375-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-400-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-376-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-401-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-377-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-378-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-379-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-404-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-380-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-381-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-382-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-383-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-405-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-395-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-385-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-406-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-388-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-389-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-390-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-392-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-407-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-391-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-394-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-373-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-387-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-386-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-402-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1148-403-0x00000250437A0000-0x00000250437B0000-memory.dmp

Download

memory/1352-83-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/1352-6-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/1352-2-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/1352-0-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/1364-170-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1364-474-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1868-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1868-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1868-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1868-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2764-112-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/2936-118-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2936-169-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2936-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2960-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2960-100-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3368-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3368-32-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/3368-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3368-38-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/3740-371-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3740-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3752-150-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3752-365-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3860-106-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3860-108-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3860-101-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3860-164-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3996-315-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3996-130-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3996-132-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3996-124-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4428-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4724-70-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/4724-154-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/4864-64-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4864-67-0x00000000015C0000-0x000000000175A000-memory.dmp

Download

memory/4864-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4864-60-0x0000000001CA0000-0x0000000001D00000-memory.dmp

Download

memory/4864-65-0x0000000001CA0000-0x0000000001D00000-memory.dmp

Download

memory/4864-54-0x0000000001CA0000-0x0000000001D00000-memory.dmp

Download

memory/4976-233-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4976-119-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/5228-86-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5228-157-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5228-77-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5228-84-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5488-15-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5488-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5488-16-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5488-111-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5588-160-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/5588-89-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5588-95-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5588-97-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/5796-147-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/5796-136-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5796-142-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5992-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5992-370-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6028-27-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6028-28-0x0000000000930000-0x0000000000ACA000-memory.dmp

Download

memory/6028-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6056-426-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6056-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6080-222-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/6080-187-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/6080-477-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6080-203-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/6080-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/6080-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/6080-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download