a7e8c9c9352c7ce80546605bb8d412e72d0170d85c674ddef146de93ae92dc8d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260504-ephbnafy2p
SHA256 a7e8c9c9352c7ce80546605bb8d412e72d0170d85c674ddef146de93ae92dc8d
MD5 3aee5738d92a656075b43a9a88b749bf
SHA1 c43d73f23dbcbf2055663cb7ca9e706f8f3f954b
SHA512 b06096cee96a32573d8caebc811e3d3bb584cc572bd352d38133010c59088aa083dce054ffeb91609dc886012c092a5bc5d631d69f53112e4f7bc45668b1bd0a
SSDEEP 24576:dkzGxmsq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:deGssqLNiXicJFFRGNzj3
TLSH
T14465025132C080B3E9B704344AB49970A96DFE345F6549EBB3842B2E5E747D28E38B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4224	alg.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
2676	fxssvc.exe
2156	elevation_service.exe
4084	elevation_service.exe
2384	maintenanceservice.exe
2496	msdtc.exe
5104	OSE.EXE
1544	PerceptionSimulationService.exe
1596	perfhost.exe
1164	locator.exe
3016	SensorDataService.exe
244	snmptrap.exe
3252	spectrum.exe
3668	ssh-agent.exe
1016	TieringEngineService.exe
884	AgentService.exe
4812	vds.exe
3204	vssvc.exe
2044	wbengine.exe
1108	WmiApSrv.exe
3808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6b3fbe62cd1bad80.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4ca2c7e7bdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032b2957e7bdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008677f47c7bdbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe
3492	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	2676	fxssvc.exe
Token: SeRestorePrivilege	1016	TieringEngineService.exe
Token: SeManageVolumePrivilege	1016	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	884	AgentService.exe
Token: SeBackupPrivilege	3204	vssvc.exe
Token: SeRestorePrivilege	3204	vssvc.exe
Token: SeAuditPrivilege	3204	vssvc.exe
Token: SeBackupPrivilege	2044	wbengine.exe
Token: SeRestorePrivilege	2044	wbengine.exe
Token: SeSecurityPrivilege	2044	wbengine.exe
Token: 33	3808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3808	SearchIndexer.exe
Token: SeDebugPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1220	2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3492	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1592	3808	SearchIndexer.exe	105
PID 3808 wrote to memory of 988	3808	SearchIndexer.exe	106
PID 3808 wrote to memory of 4292	3808	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_3aee5738d92a656075b43a9a88b749bf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2768

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1596

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3016

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2080

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1592
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2840 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2796 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a6ac07bca9fded514d107779b6bafe98ffdf0d560b906880f9be77dc1629d73
MD5 9a4ff9d01f4da21610bab45996da7c34
SHA1 ea8646268af3cafd283c94a6380e0b31b1f0e123
SHA512 65a082c9c0ca90f234777362d7c95fa188794c56d6a6c46bfbbdbe19de77ffd70ce1dca055718ccf8c0b84865192b988fd8693f18937778218901c2012549d0f
SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrLNiXicJFFRGNzj3:B3q6mjBA7wRGpj3
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 110a92952b801c5a0336a6d1cb460d92b887f0fb497ed675e2d9e4b7381941cf
MD5 c6722a22edae587d73cdbe3cc380faff
SHA1 5241f311741d41639f6f5e552ffacdd6d9cb87ae
SHA512 deaaafa78b5daa5dade058b89884f3f29991aff7f6bd8593a7517333700c177e25bfe0a30350f83d7fee2749d64f3fbab3d7006e8e567c678af8fbbec110183b
SSDEEP 24576:eXYfDtczA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9tcJLNiXicJFFRGNzj3
TLSH
T16375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cdf6801f4750aee0ca8fc00af4caa6b0717cb8cc76fceee246b18389d87bdad2
MD5 88075adb6126c65a50609d6f3ced330c
SHA1 ac0b96d46c397d4d1de1b4fc383ea39b3f4d4969
SHA512 aceaa386b3b32c966f80c8950d9b4ccc252ae30ea7a11d2c38de534538adc4cdfe38ecde8c94621407a156903b0a5eb85eba8668ec20433715ea086ed354703c
SSDEEP 24576:s0Le5ji0hmxhrMT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sPji0AzOLNiXicJFFRGNzj3
TLSH
T11085AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 45aaa942a1e0df6b2b4984118c96503557cec8071fd38b18ec4ab6bec9093376
MD5 4a9e1d67834cc94261d74be753cf6323
SHA1 2774b681f10ec75a47b5e10436a6c00c84623c2a
SHA512 87c79ce9c86ce61ad08b6de67f77b5f60fc1ae30c269f50ec4d074a52bd029f337d3609d151579c90c3f7e9aaf5725020c9ea4df7e1a47280d0ef33da605e2f3
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWj6q8wyu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z/ezSC6vUzPv+HjyaLNiXicJFFRGNzj3
TLSH
T116756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a53b9679f0bb64e22ad1a20290175f93c6fdc7700ffda211f2917757799111d
MD5 23de5429c166718edc8dbcca801e100e
SHA1 3595688b1b592890af91a0669399df8d5bb7eb50
SHA512 143ad6074a5015b84509b3156b2e811bfc9ef5510ba4cdc0e6cd4bda838096bcc38502d12647b9b74d9d8cbc19313e1271c05b0c0903f05c59985b67040b0a84
SSDEEP 24576:qVbqPb88hv/l+Bw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qVO88hXl+uLNiXicJFFRGNzj3
TLSH
T115559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2cc9d9edaa58ad80b23b4703debf3015dd665cdc1d2950beb7d1f5888bd9c877
MD5 e4ee51e6f20873b1269cdfd58f962e48
SHA1 972784890db5bf4a682ef29fbb13a03813ab13e4
SHA512 ba7d5b5146e88d5949d76da4a711702d5b822e200754ebbc5c1f543c696fd492f7c21567f3c75bcb03c15827c9824e66386859fa9b26048b9ec0b386f20eabf3
SSDEEP 24576:+Gn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3
TLSH
T1F65523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8d165700fa2897dc5af2b1948e00a4167eb2315fb32dc11b3faf542224a6eec0
MD5 ce79ebb97ee6b766f62355734f36601b
SHA1 1be11f7eca9f08fc7cf095bc822eeb7e81c91f83
SHA512 3fdc446d7dc67f029c623fdda6c791cc41d282001b1d722b99909cedd9ea0e760d6c17b08ec82704dbc2f0effd502ccd6eddd5822c262d94589ffdd90740ea98
SSDEEP 24576:FJIUY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJIUYLNiXicJFFRGNzj3
TLSH
T1A475CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0a71c6f11aec5361f5a9625b501c9b480885b8c891173f4d5a520bb239de89e2
MD5 5b85e59659be6d4b788e44b8bca7a7fc
SHA1 ce1984ebfe06e29da28408343dd2a8cbfc47d9a1
SHA512 8306c44ce9380523cecd94c5306b19b2fd690451ee4412334ec47456264aeee1cb31d4d83c475a2ad598e6dea842678f0dbd373a0fb695118b0d7b5e4be1cfeb
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THW:CQvGAdlCEL8c/WRNw5Cp7wRGpj3
TLSH
T144266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8ac9af8a79f6c733a5b691cee89f8529b226d7357aa89da02838e752ac0b469d
MD5 fd9ad46de2f66d94dcb752fcfeb8d6ac
SHA1 9c49a26b96072f3d6917ad9bc352b8d46a601edd
SHA512 7129507663b5a3b4def05cbf97216ba214ea8eeee3b0f8a60363dee0141951827ed258487c2857d92bd828ae46e4b74344edf35eabe85776ec88da12ce3c0a10
SSDEEP 24576:BfewsAj+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9lj+LNiXicJFFRGNzj3
TLSH
T12775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1136978bce49d3f1ffed6316ae49f3325da58644eadd36ebfe992c0ddfe0691b
MD5 9759b0f60e93cc79e14db247e7f18182
SHA1 56bc9f5b266bd5de10936b091f4232647235fb52
SHA512 c4bd1016e6d071c0a4e01363a3d85a5d9d8339831f7a98137ec3dddfd7a79f7a3fde55b916ad0c5c093e06483cec2e742be87c6c952ccf4fe7520d420d93986c
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6F9:WUEtQevvqc2W1cpV20I32+9
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c41f5fee459de0caa4b16df76df1738469e9c3a41f73e099a27f4586c4c5d82e
MD5 ff1633e55e8efd6cab55ed16663fc879
SHA1 3f646f190feca2a5d1f28431efdcfd35a1c0a964
SHA512 f46d573d0fad35ccf821c4cd70a9fe67296ffeae0cc1f59775df8a756424c8c0f93545231c3621765b3d3b4b70ae6e3f2cead3334f9e94622f92c4cc0046a947
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zeLNiXicJFFRGNzj3:xoq2Vjnm17wRGpj3
TLSH
T136D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0276b41dc4d7d9114429201f1022091e8ad9940824c772ef78aa6026a17a6ec7
MD5 880c5dbd810233d56d8b703314719982
SHA1 6dbc56c61fbd436445c4becbfea706f97a76b12c
SHA512 89ddba990e43a374a018e116d620c0ca36b7487ef844947f0e6c79bccc82055bad4b060b28968ff5bd4c374a924c00385110b0266ce128afc5c60db6801959fb
SSDEEP 24576:XAhGL6IFoiwtA5l7S53V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XAM5Foiq5lLNiXicJFFRGNzj3
TLSH
T182359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 690fea1d48fbd87b6f61a2b1e1064bb84027d04b3ad5d347cf2e00f608d49481
MD5 5d19dc478a5283e317026dc045865e53
SHA1 b0a36656f3dde611ad3eef382aeaa921bde34aca
SHA512 7a4400ab1c9c78897943f424029e05424f5e53dfa57add65b1447f2ea2e71ccedc7b08073e2f3dd0fecef03acb2d1011b03f0fae17bdac4e78271aa76ea69e05
SSDEEP 24576:fwuROW6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fwSOhLNiXicJFFRGNzj3
TLSH
T1FC65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 63943ca6e8fad6dbe046856b7cb00a664c12e3e9959d81f3361bbd19137844f8
MD5 5318e7696ed30bcfc806cc3f3537b53a
SHA1 5a1c4d17b2ffbf56176d299fa65f26a57397887e
SHA512 f468e7acbe10947f7d4cd1fa6b4fdf0e42024b555d202306f4940e098995f51cebd5021d7c9b860455c5ce65882d47eeb6bd2c058ed48f972c00d491cfbb6a0f
SSDEEP 24576:vZub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T12955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09afb9997f3bcd5c63be8daedb075d7c027ae9118cd1f9961205662ec064d1ea
MD5 eaf885b0064178f1280a90f11b49890e
SHA1 b577c5c692ce30b9af83a65c4f4b98321f287129
SHA512 b92f730d4f73617d4d62fbe54bcd094f7e9b8e9d9fc5f62a61a35df105d7134451a333ea6d39bc43767fb249e5e3e591bc69e0a0c307f8f5b1e8dc86292658be
SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:LQyiKanX+PNgF9
TLSH
T14F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2cdd230449326d3a03f09509f2a7f270e6687f11e526fab270c8dba8513a297e
MD5 dba04f0dff6751b23d6a61f958cb6198
SHA1 85a94b45b46df4f30efb6760235d07d93c2acea5
SHA512 1bdb1b9e25b6bf4c1fecada9cfab45050d774b9bdce6e2287a2be773f401a6bc772096b382b736c90d8231c048eeb1bc30364b52b59e81be1ed13ae4d1bb8478
SSDEEP 98304:7QRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:KQyiKanX+PNgF9
TLSH
T1DA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bc740a3d1037d7615dc61e74ba09909e4ecc5ca2d86aba03d7a90e02769c1e15
MD5 0c79802b7a6136bb978a3ab5bda0f1eb
SHA1 1ffdda6cc43f698f065ff0b9aa9f61c3843a69a7
SHA512 e158b543b884209e29c83b21d692aa56142b265e5d61d4b3d9ded4ac1c122e17c7d8dd08b5f198d5a1eca0706ff61e6d112e3b23cc0a915cca384ef0ddbdf8fe
SSDEEP 49152:e68Qg55nhkeWu7PNU3/OLNiXicJFFRGNzj3:sthTRc/O7wRGpj3
TLSH
T112B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 98e4f02115567298794f38bd469aef9e7c55d7846b2c7c75826c99c4eb77593b
MD5 aa8410c307241bf2f99122142870c7e0
SHA1 fa569f68cdf37975d6e7aba2b99550d428484c0f
SHA512 976cb6f21129145a6136864e836b18d8e25eae6a0713f93b2633e26f26efb210ec5f6a55ffaf791df8b90106c6e96a79e82a82b4ba53d25078fc9e04c9dff238
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZn7wRGpj3:XLIHRWhxF9
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e333d05f507cded4864622d26ded7444f1ee6555676893e1c403ef22fbf93488
MD5 fae2b9c9f6af93a71a16f11ce88ca61f
SHA1 356ee2d24fb63a2d393bca8f01fa22286b8a2787
SHA512 e9ac56accead2165ae1c586073b7830b2563278060ba96e95d1a55e2b28c24e1bf2ebe9fae604423361a1ab90b21d65c3c494d22741bd6580c7a5a95e9675bbe
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMLNiXicJFFRGNzj3:Gu6JmIxd2dM7wRGpj3
TLSH
T197D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9e7840d89d0e44349060c77924aa9e952db807687623c24059d1cd7881929ef7
MD5 a9a242a29200f28a83ce56d625b00eaa
SHA1 655862b9c52c6f40ad5c4f93e2134b8fe976c688
SHA512 514bd706e7a55a925d5ddd13ba02fc18af32378629cc3d4255ad86d67770d5227f6c09ad3c2e1c834c9c36ce61338c59f170b470f7ec4ac2a1a3d431a7ce4328
SSDEEP 49152:L1hpsNoJpF1A67U44CwH7R4x4LNiXicJFFRGNzj3:LmifPqR17wRGpj3
TLSH
T10DB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9bbfcce87581c0aff7af5bce35d3f2659c22d0098172b0b6d0befbfff0e2f81b
MD5 9e12c54a20e290218462c59dbe1ef173
SHA1 2798d6b0f6233fe6814d64fb2e40a4c882d1fb81
SHA512 39072a5d8c2cd950e641dae3b3dc759a2814211ff0abfe6f98e9ffc2b7e1252ca4049af124274e34139f771ce2274308a791e74cd441f43539a579e9be7d7ce2
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHqbLNiXicJFFRGNzj3:o5dKqi61b7wRGpj3
TLSH
T117C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32de495a265f8fac91b8c50e80e99a2b5906e5cc523e7434fdfe6421c51f778d
MD5 1f63c7650f07c0db13af1a963108a319
SHA1 7494d6ff8bff50b342c9e66dc92e469be184b3e2
SHA512 0e70845803827ea316c73ad46bb1e950e977defefe34c3111f60ea83b03d9f689b9de19fef90d59f67dea9289e932ca7239cf95bb647ceda289f64f63e03f3ac
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5w8LNiXicJFFRGNzj3:PX2iWphB7wRGpj3
TLSH
T13A95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 61846a6488ba545dc9b2ef1da95276f0da9a05be52115ca60c35a38abd8163f1
MD5 23de0886432355a40405883625afca0c
SHA1 25ae8f85c6f53203450217ac6d669fb9368c3336
SHA512 eab2132ccf23b61f2b4f4f42881bdf8e19e7a2973bf322a7ef93f2619eff5f4802d978cdbdfa3ff2dd4dbe8cbeec83d13f84bb73d5ef7f5d19c45d0fbf7d01d1
SSDEEP 12288:R7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4456df961b44491e0145abe309c3d6bf990f86c1a4ec9ed066350a75f23fe769
MD5 15894867be429c0cffb59432be216596
SHA1 cde27f6d71dfe76a3b05af5082e6d0f446f3b234
SHA512 3121eef2d277776a939fa55c33caaa2bec3e585d66d8af260fb0796995b147184f19b43fd7093da48fe8e60fc9ce938b04f43bac2d8b4c667852504edffd3cd3
SSDEEP 12288:DAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ced8445b2b01ae7f9910aa9bcadc66e9f04886f6529f55b89bf622539e463691
MD5 eba8e5d85b650f511ddb0248b0975fbf
SHA1 7e2a6974683b48e3a420067567052ad1a84c72ba
SHA512 7b587ab9384be0f8db1e4c410e9af968750c007132682c133538b9e57fa5f078131dba1018654a6f97cdf03c622ae6a48a2fbbaa3cb80f12f625a8d38270fb63
SSDEEP 12288:z2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3548955B1F6FC003986764428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b9b7d54b3df3189e044ef7db47cf69cc097940928c09bc1480823df8b6dc0fd2
MD5 7cc3c1c273c903f09dfa695a8a575873
SHA1 e957c75876a1e4a4cdc2fa0ccdabae5918138001
SHA512 9fe84825aacf72704a59122bfbaae7741e3ae409a20343676d31f591fc1a491fb35013994f4c7598ea8c78dec9357f813edf12ec773a88d3b8bbdb3304708369
SSDEEP 12288:8VpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C552393168900F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A75BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c818a4501f8044b96300aecabd1f02178fe718e6458c53411f001806ad1dbe78
MD5 b73414e290e32ad365770722f38a95f4
SHA1 872cd765f4d6bdba87376d9c6e1b09cd9cb6eca9
SHA512 11f9a1cfebd2299c1a27a23967ac643d9585d42a694792b1ffc7e4667d867b6b7f3100998faf74369de4f47d796b044770b7afd8aee42eef2485e596a7a2ba7c
SSDEEP 12288:KBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f7a7d3ae07b8f55ed50e9dd850e714aa152889717d8354baad89cc56124c8fe1
MD5 749b7cea00af4344ba359b3cadc32f77
SHA1 47fdd8d153d1ed69930eb1a8f8e36e3e70695b16
SHA512 f4422bc45cdb70e373ba77e7d3061636c932a70c015b252dd4e3d9ff7273a03bd85bf65cc3bd5869668c5a735f237d1f6b21977ed88d37b1ab48c7dffc3eb466
SSDEEP 12288:AciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Am/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fedd8d40e5f1e4653c6ced722ae92047a5e69f7d4a67fd0d4ef24f758e0ed61c
MD5 3738ef2d4944a265bc487bb21b78d9d9
SHA1 206b45edc7926cde026135fb1cac4206403a22a0
SHA512 59125b986e675832133fef1bfc96e7ee918eba8c1e1695507909dd181e920aa370ccef2e431da1e3fffdd02bfdec75721eb5d9f06ed652183555a790d7b0b43a
SSDEEP 12288:y4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 32be932fb06290655f978551884b014d327a89992634da2d4ed760be9d60e639
MD5 6e743fd4516697624dee546d8caec320
SHA1 2cafe8fdb9601e22dd865e24c3634d2d99f02ffd
SHA512 51750a75b8922cd718ecfcaaaf86cd6817df19d3c28060e02d585f5cf6add7423f91e20d302d4140a889c70d04aa6e2f1cd0986e4835624f95895ace49879b1e
SSDEEP 24576:5ZM3zFVSOy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ZM3zfWLNiXicJFFRGNzj3
TLSH
T163750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 eb22bcb22985b541017e8440b6bd9114220c4aea7f646e4e2670e36713053700
MD5 bb2fc336fa669741f191ea051ba15db8
SHA1 b2d21cc9301b54804dd6d693ea15690d4f7e6f65
SHA512 4f9d370d9b9e7cda0917ee1c25da1b9aee48963c52693d67cd54b240c7d5d9b7e6e0c0dd5b0832775a2786a966a0680051b65a709e1cefb6b2b7a29713b3e853
SSDEEP 12288:t/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3548955B1FAFC0039C6754428F5886E2DEB5619E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 673e4f5424b9f42ab106c0fdd7374f52e40fdb4c364b21aed1bf49b7651f0399
MD5 d24ba723aa0f48033c90077fed150aab
SHA1 e3df4687f1d3e21c09ce328b93224abe5d96c97b
SHA512 c54385fcf84f3d0f9410dd30de09c441c93d48fdcecac09ea2b0f9b437ffff61a3b5745b2c4e80a007e6316719fdd8d23d68fd177444e3135f4a982a0bba7e99
SSDEEP 12288:YjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bc23cf20df8b135decca9c9a5937660677d0c196bb61ab4c83e61637477fdd50
MD5 69e78d339416b71901249f661301799e
SHA1 1e697553e9edc8fb197e4101d21ef784e4fbbf4c
SHA512 3af1195c2ba50c62b043343d167a316dfbf9367e6da399e8ce0c4b2bce77e318872cb534041b8718473980c2fa0d6c76c04237707c6860da47814b840f11cb63
SSDEEP 24576:tzyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tBLNiXicJFFRGNzj3
TLSH
T185650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 00db97603a59e59041f1f148f48fbfe8a31ed1d67fb4825b8b1053f53439d81f
MD5 c4dd0ff2f9cfbd4e11dc3c24ae3d3203
SHA1 81f473167b1ea80c8668951aa5e478ce81c450b4
SHA512 e114443023251716fc75cd5ff819b6a7b06baab61eb146436f666f0963cf2668d74ceb81d10ff8514bbb56141b6f5bc194708cb7feba0b9ad774294ab651441a
SSDEEP 12288:d/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1153c35e8c0820cec9a8f3a495e2d551924dd3be72425ddbededcca850a31900
MD5 7183d050585558fce3d8e1bd99bf4516
SHA1 720af4955e30e630838b168dd36cb0ef372fb002
SHA512 f404dfb5e988a9f2037617ec88399cae6b96db882fe8a6ce413ca92246b10d247a9d2a146b61d4dffb7de839318596df9f32502abaf44aee8ed0ea6054f7a802
SSDEEP 12288:t/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1d194196f879dceb7ac8166e842de2e8d732abd8844ced9c6239cb0d94c47c21
MD5 923a552cb126ac2c82e2df9e02b782e4
SHA1 b6565e006f8e94b6da2057c5158240cccd8e916e
SHA512 732a15daa9c50562b809151127199c1fce88dfdc3c5b3d375fedae2bcfc48ee2984ffc5930c38dc63784e96925622df9f1278550830f5fbb3e7c723c0f1933f6
SSDEEP 24576:tCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA0/TwSfVcYG3K/cJHlnFR+IGe:tCUAPTY+8Wg2lIL8lrIUJLWwtLNiXico
TLSH
T18365BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 66cabebb62300db4a49bfe7537a5df595d2319404c9c658365478fca5dd92afa
MD5 f50adbd081b2a594791b91c2847299e9
SHA1 c2ce50e19d2294400df71e6b1928d29049ce4250
SHA512 32a9c14161539b813f290c09b8b433b63f202059f22b48d81d28196df18edb469ba7845571aaa922e6b1061d49060774080d6a7987ba70d79a13c151bc60c354
SSDEEP 12288:NpsfviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB65F15AD28802E8D1AE5139C7664900F3637C2987E193CB53D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 80fa4cfc421e731ad6426018c4a40fb644706afcdff74ca9d3737097b0661bbd
MD5 310eeba37447d944f6ca12369609e617
SHA1 ec2727b98fd538c7939d17438f11795b39bca1f4
SHA512 5dce78ec37ae23b417e5e7099487c21a2decc2eb89c200011d6d10a8f9f2b7c806cf3da20945531e4d35da22efa51f651baa9cc8d0a18c6dbd97df243312a91e
SSDEEP 12288:sWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD552392428C59B1FAFD1039857A9438B14C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fc01d0c9abeb69b9d959190beb37312022b100f6aebfff4ad9bd53ad6cd830e4
MD5 41917962d68fd914b9a3517fd43f5066
SHA1 6f0a0518f8677019daf84cd0ae2ddd8ef2bc4df2
SHA512 0a48c73483daa2c3f2dc3bcad0d8057463e7113eabf9f6636ea1a6a72e0265ba8d452045caa044cfb22d4647cc0d97c16594ff875d86b5f35ff413245ecd96ab
SSDEEP 49152:HRZwQCyiHiQEaaPnMzLNiXicJFFRGNzj3:x9xvPi7wRGpj3
TLSH
T1AC85B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7d42ef87752ad01c69ca41d7a2da9839c3c6c0b95106289defda25cc3b0021ed
MD5 752646494457f9bc771aa4ed753487d8
SHA1 d9a112c9a6767b7d48033217a48ecc5cc8ed229f
SHA512 11a375b1449bda9d0aeb48c82ca1146d8ef4e59c7b75c41e82adbcdaa1a2db49149698f3008b9a58cc4710e6e9cd51b18b8b2eb17239163a6c683c6e48ad2797
SSDEEP 24576:NbxA1UGQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NbxA1UvLNiXicJFFRGNzj3
TLSH
T1D855126E129C14F0F5B9903D89A68005E3317C2A572197EF6190923E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 bff244e37ee91b019bcd029347f82f6dc31fcd5262f0fe80c6b2dbfbbd26487e
MD5 655736e1d0313f2e72bd6f55c2e16329
SHA1 f1302bd31f47721801e92209d9f58edf7ef0b04b
SHA512 83e0769acaeb8918f3a19259522fc919e3624d2ca8fc5712f0675b1a636cb0932a42f782f21131427ba65bdc541dce78941e66cde9a52f292ca17d9c51a3c216
SSDEEP 24576:HjsmP0yHaqrVqHra44KDzMsrnl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HjRP0yHfVqzlAsrnlLNiXicJFFRGNzj3
TLSH
T1DB45AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 5392088a87865525adf4f1ee5b64bf9cbc023a88b592949f573747de12785508
MD5 9c0a32fb8e19859ef6f3532ee0ed3eb1
SHA1 5a9ca56be78c44dbcd09dac471b97586c0a7015e
SHA512 20762d522191c93499809c6e8b000525d12f69d6ee74c42dfb2b60b427d00bed71957cb3d7810323662ea5c43152417f8eb555f1fe7024211c4a4285af7b1f46
SSDEEP 12288:n8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D2518955B1FAFD003D867A4428B5886F2C9B2619E3E1543E1E927CFEFCF38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8b3484e72e58a3ff4de9536f327def712d22bbe34dcc85c012490416839b7601
MD5 c762b8ff94569ec368b3d440ff1a8a68
SHA1 ebe1c6b415fc6259cf2b0a0f6a27965b2ae5faa5
SHA512 dfbfabf00caf1baa6c456df71d2cbe7d37d0e1f45c0810d7071a4c9a6fda5f71e82dd42d9836fc8afde66d4eb48bd794f70ed502473588be0b68c06d7e1daf27
SSDEEP 24576:8ALBUT8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8ALBUYLNiXicJFFRGNzj3
TLSH
T1E2750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ae384a398a1fd467fcba72df4558162ccb15636f423d31d08a0edcc15712bdc3
MD5 58d3607c4e23a126395fc7f0dd4bb5a3
SHA1 a52fdc2322bb47a28d8aedf471dcd531a75596d8
SHA512 7eb1d7876a4657415cfd4feaabf29df22f8455549260633eb74442bf166cfb64eecb86cb795a49ee9d3fbbedf7cbd4ff0da18224ac5c73c8c63f85ade43690fe
SSDEEP 24576:rfYNHx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rfYtxLNiXicJFFRGNzj3
TLSH
T14F65F12F62AD18E4E57B913DCA828109F2727C66171192DF01A0827E1F27FE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 84f6b3bcef1ffb38fa1bc7520d9f0570b5740279803ee853e58d82ecdd4e8d17
MD5 e6cefc55b5bea916f7c50c665a737e1e
SHA1 5a80d2b1dd66ad445c09bde7b405f04019fe5f67
SHA512 5617b17a24b5f5cd527028f4882b4d7d586ee4480ddcbf61f54d6a107597bfe3f4e8cc4c2a23b23134f08d55e065b249cc3bd90c576dc75a0ca04c6b892b0d81
SSDEEP 24576:LnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:LnXoJJYH84VVS6AmETJas+cHBjSSKHP0
TLSH
T16665BFAEA2BC04E8D5BBD13DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5d62ffe0f98d57e7c0b2f814464ab128717af92a5f8f01c26cd630b2325bf599
MD5 f6380ebe8caf6040b35eba407879961c
SHA1 d05173ebe66fdd7ec16225c9ee3527c3ad08da55
SHA512 65fcb03afdb6a39a65b4973c9b1d202d32dcff1250151856af5c089c63813fa7ae332ea582538fcbf9c17c6016efef416a60629a9171ac63461b11e695f8c1de
SSDEEP 49152:GDLL9TuJ0M/TYW2PmLNiXicJFFRGNzj3:FJ7wRGpj3
TLSH
T1D0858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7957b5de3402682c5d8530563e5e61cd0403f7a51cfde846ba53028f8b13d37b
MD5 c27f08481dd6d027af30b8184296289f
SHA1 85ffb4ce7e22f0841b176a9560acce6afec50aec
SHA512 0d0ffb3168eef985e08203c97ce18f8601bde196cab18fd53e2ec6d42aea58180f24437c1eb6553afcca08ca7c514e992c8293e4960a142fdf58395d984ea27d
SSDEEP 24576:YegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w8/TwSfVcYG3K/cJHlnFR+IGNe8j3w:YngOJOmPOHk8LNiXicJFFRGNzj3
TLSH
T18455CF3FA7BC15D5E07EC13DCA968816F6B1782603255ACF0160827E5F2BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 255ecf19aa01339f9780dd48676c8542e9dc78d7433c0ef528757fe7a5cfead9
MD5 2a810997bfbcd331aaba9fb1332cd58f
SHA1 a1c8bbffba1d352e07105c2a02c04bccc34995ae
SHA512 8a8039bbfc6062f9d007cb752ea34cdcdbdf040267c3a0136d5d6e6bc0186331dc25f71b06fbdc9d1d16d41961bdc10525b59c2c1622e1cc41b5323a2237e993
SSDEEP 24576:QLJnJiTk3R3waE4JrOm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QLJnJK8R304l1LNiXicJFFRGNzj3
TLSH
T16B75E07DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a4e1f20e20fc1d78054315fbbad34ef61ef028fa35934e1436047a3ee72c76cc
MD5 d64d1a53d1ecbdf3330c64d7e8bb24e0
SHA1 75ab08e1acb99da16e2bcdd83578acd8469f6f8d
SHA512 1c8f17141eaaa84f7fb5b791670f89136ff6205b87669ed8660c075bdcb2a41124359d107a2fb1bbf1a1898c9297ad2f81297b5751bec426d63a546a19c49b3b
SSDEEP 49152:q9GqCzDScAZmlvTcFg8Ph6KLNiXicJFFRGNzj3:ER7wRGpj3
TLSH
T190955D05F7EB5298E8B3C9F1C96294159B327C409B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fe1a29ba3a172c176ed6e2637385eb3b998d49c082e68a17a39cf5bf17d9ca13
MD5 259b4d3941035b19dfd4b12eae08e43b
SHA1 0fe4eb6b513531bab2dc53993c58f7ea718b61cd
SHA512 6208857936a18e08cc8705f1f8e7121a65e03368ca217e89492f0ac20b6645310b8be48a3bb8fdebb940e813d660b6c45712c7d1b72cc7382c1a5321600743b7
SSDEEP 24576:8lYJeXm5jUuEs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8lYJeXmRUuEsLNiXicJFFRGNzj3
TLSH
T17755129E268C30F1E27E803D85A24414E371B879571217FF91A0A57E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 89d2a5fcc52e9d887c80fa23de13a5b77cdaf7c5833df1e2873719322ccf99f6
MD5 0bc31800360eede026ae6d1963d26ac2
SHA1 263db27afc0634cd415ea278915555033b525237
SHA512 5ad6b5bca374f997df820cde4942b9afd0ccb2ad7900794a380453fd0baa86398eec3bf1842b3063d5c18b7c980fb5db0befd8e07182abe87656ea5c5e3c10a3
SSDEEP 24576:9VtyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9VtiLNiXicJFFRGNzj3
TLSH
T10A65124522C465E4EABD053CCA734064EA647C249F2147EF9190BA3F6B36FD5AE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 3516fa09ebd597fd9cc3f811f721282895b014b8c524e26d4222a9da26e140a4
MD5 93c0f20354c0cfb0b051a5829fa7bf22
SHA1 dfafaa861023b552e8ee88ec28308be0c8237e53
SHA512 da9645d016ad116fe9eaa1284a52600bb1ec3f99c2927cd13c8fa96f768ee022cfb997834c5e2a977a2394a365d07971175f4c7ecf5c82a7c4d74cefc4dc97b7
SSDEEP 12288:uPaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:68/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523DA118865B1EABD003D86364424F1987E3C9B2528F7A194793ED379FD7CF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 08c9085ec04e66aa0dd6c2aa2901e3b8e0d085166f898515bb1bc8a0dbfde9d9
MD5 f8d3b6350cc6e9968330a8ec37598d96
SHA1 a7d656bbe712da225d8d6b1505fe8ffa665ec1b4
SHA512 e9cda847f18a45397300b7e3197d2445c715fb10b23c307c2e77bc31396364cf6d247328967a24bd251d7b53129a6367cc90a5bf3ec15968fb11dc062bdb5700
SSDEEP 24576:MC+TyQIu93VAumZr7jm7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M/TfIq+Y7LNiXicJFFRGNzj3
TLSH
T1E5558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8a0adfe972bcb824347aab3f07aefe28faf6da92b8c6d46e18661fa18a6e3912
MD5 5862a55754f5f7632464784f1b1f7541
SHA1 ac649d799052673efa3a67146f787fd7d10e4e67
SHA512 84a08fead4c4e865db5cc2649e415474378c1d60d99323a525d12503155fd399f3284a85b9f26d6a34f6ac9d4188d3613fbc40a018659fd2fb3fed953aedc5f6
SSDEEP 24576:YLQikZo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uQik+LNiXicJFFRGNzj3
TLSH
T11265F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1bc021f9e140defa52606acabf4433de07f4eb1e17d9a3833122a50fdf0992e8
MD5 aa4182cd29c6ec2ea91897fa82ef61b6
SHA1 026b102dde5e3728190a4d14c0a20beed0c48746
SHA512 f77a7fb8f9d68d7ba35503933ce3eaf18989d6efaab6cff858f6a547e63ddc18f0328a62930036dd6d694f833b75f335da01ddc680c81c0f9c46ec301de99edd
SSDEEP 49152:SpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPFLNiXicJFc:PpC7b4+80GTkC7wRGpj3
TLSH
T198A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 34d44c5265ae1e646cf1dfd93d3defa947e2138dff4cedab08413fb1c283c56e
MD5 117768bade5bbff1affbbcf74a7d14dc
SHA1 74d1f781bc160015d712b176696c2e7dfb56d2c3
SHA512 35b64d6f36182f6054691ef9347f27c4a805c14317e2fb4d98e63330b951a924bab76340ca5350731c18aab0b90d8180f8c1f8769d4437959a9142c348268826
SSDEEP 24576:YSAwJPE1IDAo+4Kt+l4413lUQN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YqPCIo4Kol4jQNLNiXicJFFRGNzj3
TLSH
T1E755B02AA7F956F4E17AC774C663C511FB727822133163CF9290913E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 e9876507f1e1cfb9613a1d0fe7574f9f34a64517dd5fadbcdcd9b5971f73dc66
MD5 5e0b1c4564f995de0118d9f7f09b16dd
SHA1 1191961177d34bf189912e0745b8189132ff9c4d
SHA512 d95734ed16af69b4696b6e19d2c4bba9a00b140795895e85f71998c805c2b92b17964ec233f652cc94e6ccf854db9f0df3fd37e53bb42258971df1628e1f2582
SSDEEP 24576:hyLXPLcT94t9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hy7Poqt9LNiXicJFFRGNzj3
TLSH
T1A675D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 a133f3064167025965303f39eeb6321153d0caa55b6b88af342ff1954709a7f1
MD5 3d0c3f7a0e0c6b9806037e314bff98a1
SHA1 b04167e8be41f3ed6de6436f1b9837e5c762cdec
SHA512 dcdb35d9de3729dcc70eeae6ba0ac5f4fcee72db6024e37ece71cd667046ad2d26f4c49daa0bc312248747202bbdae55946625dbbc210be9d3c347cd87923878
SSDEEP 24576:7Wv8qjp4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Wv8VLNiXicJFFRGNzj3
TLSH
T13165129E12C424E4F5BD4138C636802490B1BD3A176559FFB1C4A97E8739BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-117-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/244-283-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/884-152-0x0000000000660000-0x00000000006B6000-memory.dmp

Download

memory/884-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/884-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/988-413-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-388-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-389-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-390-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-391-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-392-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-418-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-419-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-393-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-394-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-395-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-396-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-397-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-420-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-409-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-410-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-398-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-411-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-412-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-399-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-400-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-414-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-415-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-416-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-417-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-401-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-387-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-408-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-405-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-407-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-406-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-404-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-386-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-403-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/988-402-0x0000021C10ED0000-0x0000021C10EE0000-memory.dmp

Download

memory/1016-371-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1016-146-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1108-378-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/1108-169-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/1164-168-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1164-110-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1220-0-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/1220-68-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/1220-6-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/1220-2-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/1220-372-0x0000000000B90000-0x0000000000C6F000-memory.dmp

Download

memory/1544-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1544-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1544-96-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1544-160-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1596-164-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1596-107-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1596-99-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/1596-374-0x0000000000A30000-0x0000000000B0F000-memory.dmp

Download

memory/1596-104-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2044-377-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2044-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2156-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2156-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2156-30-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2156-36-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2384-64-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2384-59-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2384-53-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2384-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2384-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2496-69-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2496-149-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2676-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2676-70-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3016-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3016-376-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3016-113-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3204-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3204-375-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3252-126-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3252-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3252-120-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3252-332-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3492-23-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3492-15-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3492-24-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3668-140-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3668-356-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3668-143-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3668-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3808-229-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3808-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3808-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3808-384-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/3808-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3808-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3808-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4084-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4084-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4084-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4084-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4224-106-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4224-11-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4812-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4812-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5104-156-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5104-82-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5104-74-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/5104-80-0x00000000004A0000-0x0000000000500000-memory.dmp

Download