be895f724189cf7ca2af109da16ec3424fd3a180343bce38c09f294a97d503f7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260504-ngncdady4p
SHA256 be895f724189cf7ca2af109da16ec3424fd3a180343bce38c09f294a97d503f7
MD5 c8d598fe1cfe54525d1609b129ea54be
SHA1 876154c23ad5e8af3dead7b277220c7b7334f211
SHA512 e7923c8e5213e06bb13d9a45e857a169e6f258fddeb6f08e2f293267ae4d7fc302e971571c8c8b1e0becd8d24e15fb231f210d7718f20edb42bf5c67f27980b7
SSDEEP 24576:YgzGxmsTY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:YiGssT/Jz83Zxq0JXh6k/
TLSH
T150751260B2C0D4B3E573063006B09AB199BDFD706F6449EB2394277A6E706E19D38B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5400	alg.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
6096	fxssvc.exe
5024	elevation_service.exe
684	elevation_service.exe
3012	maintenanceservice.exe
4276	msdtc.exe
3172	OSE.EXE
5132	PerceptionSimulationService.exe
2776	perfhost.exe
3108	locator.exe
3272	SensorDataService.exe
2356	snmptrap.exe
6036	spectrum.exe
5532	ssh-agent.exe
1976	TieringEngineService.exe
4524	AgentService.exe
5140	vds.exe
5932	vssvc.exe
2148	wbengine.exe
2468	WmiApSrv.exe
1688	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d6cd53c2da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaw.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055c83454b8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008accd753b8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b673254b8dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a09ae754b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021099855b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017fcca54b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c2b054b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe
3360	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	6096	fxssvc.exe
Token: SeRestorePrivilege	1976	TieringEngineService.exe
Token: SeManageVolumePrivilege	1976	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4524	AgentService.exe
Token: SeBackupPrivilege	5932	vssvc.exe
Token: SeRestorePrivilege	5932	vssvc.exe
Token: SeAuditPrivilege	5932	vssvc.exe
Token: SeBackupPrivilege	2148	wbengine.exe
Token: SeRestorePrivilege	2148	wbengine.exe
Token: SeSecurityPrivilege	2148	wbengine.exe
Token: 33	1688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1688	SearchIndexer.exe
Token: SeDebugPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2460	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3360	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2852	1688	SearchIndexer.exe	104
PID 1688 wrote to memory of 4772	1688	SearchIndexer.exe	105
PID 1688 wrote to memory of 4836	1688	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5056

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3272

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6036

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2596

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2868 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2816 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a73cf5e564845268302f0530a03c4bad51bcb1e06188c50802807d2985aed0fe
MD5 2c4f2209e8d74fb8f34cd4ff8a984014
SHA1 6cfa6323123c6ee61b0fc225bd9095ba437117fc
SHA512 6c252f3cd90c9dca10b7a2fa18ab5080517415d0fcd3e486fa2061b4a81fb9f0b5da53e9d905163547af53c70b7746572b9ab4ac133efb17dec005f959bf8a05
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnv/Jz83Zxq0JXh6k/:/3q6HjBk/JAxq0JXhR
TLSH
T146D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9c749bcf75ba4f32e443b941976a2364959729f5490cc2c5c0cca7dfca47d063
MD5 a566b317d30f164483436c55e05a9ce9
SHA1 0aa69dc91680a92ff5d18a7cba9a35b7b80afeb5
SHA512 6edf1fed5c80a0f83482b2eae3faed36f0deefd4f33b5bb013f81df2165d295920677f89914774312a3e62a353a6d2eec7e08530659d4e5f208131bf217a44fb
SSDEEP 24576:MXYfDtczA4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:rtcB/Jz83Zxq0JXh6k/
TLSH
T18185F138B39408F9ED678239C9A28511E673BC918760E7DB03E495761F332D86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 49b7eb5fb2b52f3f436bab8f158e2fc2d313f1bb59ab3479b4751eddeff35d82
MD5 43434d9e3510ca382b64af8a361f965c
SHA1 4a5e9d2ba5bd9f53cc87fd28b5ceb13d87b180f4
SHA512 07dc60d1c464d251200aee9c7fea2ae09f4120c2bfd9ec89866f08f544ce71d79a0ae8553123207e874e1570d2798e6a868cd8226f1988ee8318c01c8b6522fe
SSDEEP 24576:n0Le5ji0hmxirMnY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:nPji0AcG/Jz83Zxq0JXh6k/
TLSH
T13295AE26F6748731D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33ae202d34d087c0781384df90ce55eb032717624d81139a3d4eb5230e54e480
MD5 c50bc0ed40ae0960de225d537602cd7c
SHA1 3467022f508645f2152b1da7494cb167909806bf
SHA512 3ca2a415515661eed9674a4a2d11609b615a294b1499ca57c705c886c508e9fa5b3cebc82724dc8b5d3771217392af2d4ff9f00e6d0d4e2534fb3a6ac773c22f
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuxY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:x/ezSC6vUzPvxHjyK/Jz83Zxq0JXh6k/
TLSH
T14F756C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 315a8af7a9db1823ceb17ee1b96fbe535c00f4f655769402d434e7842a090b79
MD5 6943e1545252d23082ea25225e9c6814
SHA1 cfabc9a9d5228a3c7f8b58f80fad536219757302
SHA512 5d0c2cd7af007140dfd74b9e360163a9698f8e1593f681e611d386dcfa3ac520628e97c14be8dd6694c21392e3ea19acd3134cc7252aec2cf7fe1578f1b39900
SSDEEP 24576:xVbqPb88hv/l+6UY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:xVO88hXl+r/Jz83Zxq0JXh6k/
TLSH
T11D55AE66F6748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 01122a334da68d3d0853d71838ac0bbc7c7ffbb38ae13f9617e2e570020736ee
MD5 63e8d9764a44fd338eb14e9ad741643f
SHA1 3e77e457e43d44414799034ddaaf8367c23ad2ea
SHA512 05dc5120d16e87521db8d4e201e4245ef4fda8772b2a5dc720efa7f273d2f0555f047f18d23d2f1bf6695938fda22b4db7f0f972269ad8f3ea904d9de08dc258
SSDEEP 12288:VRTY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:VRTY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1F76523F5E304BCC5F763033222F15AE6C6D18CC0F95898E64254B6B67A7153CF4A8AB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b368d37201e8079398ca67f84df292e37208b219d3eafb335e447e64b0f855d9
MD5 0b8d1c9ca84adac3dbb772cda36be7e5
SHA1 6c60c0cd1fe4eaa03f54f41b430ecf3b8f82d8d0
SHA512 93512e0b300ca2e2084e42c5d8bdc7e6908d977b9c3966427446f9eb6dc80e48b7034e802018de831fad1cb0db3e69570936fa83836c478ce7789b2b1c45fe72
SSDEEP 24576:OJIUMY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:OJIUM/Jz83Zxq0JXh6k/
TLSH
T18B85DF7BEE28FCD2C27A49B957918640D7B278708F21A3CBD164830EDE235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0681cb2209ae93fcb2c0fd7afbeb54e25ed9f40bfc005c561b880d5a1833e227
MD5 794a39ba2d87f5002b795a23a9386bde
SHA1 374bcb385a9dddb9d616c2234c7917c7b537be80
SHA512 a12ab1499d8ae41b675695880af07963884631a4c4b9afed992fa122f1902d892a409f7c7876c7b8a51f031347fa6008ac7e81960b9aaf95853c0e363ebc34e6
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:EQvGAdlCEL8c/yRNw5Ch/JAxq0JXhR
TLSH
T1E1267C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d38423ee5720510ea5b284bfbac519ef97bc1ce0ff5824fa232615584cd978ac
MD5 3e2c27d4948ea511235ff831f016ad26
SHA1 672fa4b14a393b64641b637c5b90bf076cc90d14
SHA512 114a22846f877d15f0b6a0523b7993cbb43521c36b615d8afc79ba78952c3a755989cc4f6cee3511481284ceb3324250012d88771c651e2a8cd29dcc36afb8dd
SSDEEP 24576:YdewsAj2Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:4lj2/Jz83Zxq0JXh6k/
TLSH
T1CF85E031FB74E436C3BB0DB21B36C716546CAD604B6119C3E3E89A9E59302D12776E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ff2aec5dd7945554835e035342bdaaf6de4ecf09166386c45bc16c7a63be84b4
MD5 9059830323720d406091cb752ba42a54
SHA1 be972998209f3391c6aafc01f745677f2094f54b
SHA512 6983f558a840155dc2cf86e2b8cf169671d3cc62e8e51ff3c748bbfc3a65bb1bcadec5c9d631b2636ce3431bd0f2c1f65e9bdcc89bc6612bcc218d8dc6cb21a4
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHeRAc0FX:sUEtQevvqc2W1cpV2EI32vc
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 263ca20a9a07dc1da01c3a5b3d46ec8994ff9a6944429fe5c8eeb44a6bdadf15
MD5 dc7144da0d159027a410642c6f4b0776
SHA1 a9f60d328cdf7fae06d237e3559ec8535b9f8286
SHA512 71a558dc7577e4ae62b2c6aea4cd8a6ba9553c9ed759a6dd6614a923223b77a5a1799cbaa2af7d51a73b8695497594504de3c66d2789bacf97b7e00a2d55dcf6
SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/zW/Jz83Zxq0JXh6k/:IoqtVjnmV/JAxq0JXhR
TLSH
T17FD58D1976B8C1E4D1F6C37886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e7ce98ff5b2c25bd45821dfa948ab1ebfbc32759019dae27c6e35daaa84d3d7c
MD5 5253b6b43b35046826d9d6ad0b3aee47
SHA1 93cbdaadd757f359532923293727ccb20ec938ad
SHA512 8e9616f12db379785136029974e6c02ab694a6cc3b4dd23f396107e65b8ae10c2b0f79554a8bff434501089b407a2978f64a143ee25884d7b1a48b4c0bf00c88
SSDEEP 24576:HAhGLJIFoiwtA5l7S531Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:HAMyFoiq5F/Jz83Zxq0JXh6k/
TLSH
T14B35AD90E7F955D4F5B3AA7899B68171EAB2BCA65E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2782bdb5a494e037b441b3d4e3f85801a21fb0bbdd09f65abec817ee0b0276ec
MD5 7a6d6ed7746d2b2f45486056ec0ffde3
SHA1 39babb36a867ca8ad41a7c81c6dc582a550c11bb
SHA512 dd34d23272551f612aa08d5c275b8daf8b5362e1de114aec13e6da62e8f2be33446827e5bf63a261fc986670b4e7b90abcd551a0928e80908db3b4ffbab6649d
SSDEEP 24576:swuoOWqY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:swDOp/Jz83Zxq0JXh6k/
TLSH
T19275F19673A41CF9E96742358697C536E7F2BC413A25DB1F0360C66B6F33220AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 be556f86fee1f81e3584cb20968354c46b7d28ff380acd92b477f8e97852658a
MD5 4fd4b934b18a867f916c99218539b5f4
SHA1 33650960ecbd0ed23d80d0ed5e52768ff0de3440
SHA512 3548965909cf7c91ccb7c2daa4b19c0f1a8037eba5bda433882989683f1f61b9249d67a9d22cc0969f1ac95a0c0f4f5a64bc9ab2f88208d961c8df1f1f29de23
SSDEEP 24576:PZufY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:+/Jz83Zxq0JXh6k/
TLSH
T18E6512AA739474F9E2A3023599F14A85C7B17C92B73543CF026492B62F33AE46D38771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8388a19a4c934b2107a6ee69d3fd14a7635bc6cb21331f3b77edd0812a770778
MD5 a0dc94cb05a3cbec6e4f1a55157a36e2
SHA1 8c4f83f15693b5b93370780cf29143f59c013cd5
SHA512 c3ef98221ccfb02433f0339b4d90fef4a47ac48e73436b2b08267af03264e29f452dcd1316be4df0c23628610ec8dbb02584b86256a9eb36753d7487d15c0732
SSDEEP 98304:1QRQyi36YOcPQLvw2gAf+PN3w/JAxq0JXhR:MQyiKayX+PNARAc0FX
TLSH
T18D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 24cf7f778647598ffdede574d53013858184bc1cb16f271c2d6c03421b7e32bf
MD5 29e4e58f887d59fdefdae911b713f15a
SHA1 d6000e7dbd70a759e073ac841bcab25f66ef4319
SHA512 44748a31f72a0430e45d4dd72095861e34509f6310c945a65bcd5ac4a70ea9c83800e4f9ca7fdee125a4fccb1fc7782c9563ce2ce3e5b80eb9a5499078c8aca0
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN3w/JAxq0JXhR:sQyiKayX+PNARAc0FX
TLSH
T1CA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d48b278805d4bd10e78e4afcb45e399400228fad6ca7f492191e937e25112849
MD5 3e86e5daeae48d8dc4e8ea4aec4c1284
SHA1 52023b1f1ce768091159a6dc9b28d7aca94b8e52
SHA512 311b87aff65496dba922e167ed0272d7e6f9c37229fbca002d1385314f971892b9c87fdb72d3dd19cb438405a5b9f5f16169b94a6db97ef9c1061d39445c6fee
SSDEEP 49152:968Qg55nhheWu7PNU3/G/Jz83Zxq0JXh6k/:7thWRc/G/JAxq0JXhR
TLSH
T129B54933B2F600A9D44DE1769F4A872196D27C71CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2b075fc058e76bf7c3bc78efcfe2bb113bc56ab0368ed39c1dc234e92a0d3c3b
MD5 7e257dd16273ee07b9d5624e328cae71
SHA1 5360e020ab4bfcf503e0f72fdacce6e544b21e19
SHA512 d61b63bc76e510120f62cbbb82db09f55e5726328582c4db4098ec95c483363427ebfb18eb84c2ca368244feb034af292bdcedae385e887db7874f077fa7a5c6
SSDEEP 98304:qy5112gYy5azzVvL69nLKnhZT/JAxq0JXhR:TLIHmWh9RAc0FX
TLSH
T186167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e40640ea648b2c5ea27d9a9238af21707ffd992bd529fe4d4d04ef6d4a6d001c
MD5 971179e487b89f122939ff7a35f33d45
SHA1 9ffcf239b405386c9f0e6235bc9bec3a287be0e1
SHA512 40088495e00fdabf5625b1ce191fe57c0fc09b9ccd465c0aff71101ff9ba273384e1593d1084683abc5f64cfb0660f396f11c686dc4381424e6d474a605dd9ea
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glI/Jz83Zxq0JXh6k/:3u6JmVxd2dI/JAxq0JXhR
TLSH
T1AED59D13F1D901E8D06ED179974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1fb474f45930ef474d4628b7df7cac8bf82cef804ef4893ea47333ff5accf7fe
MD5 f92dca6ed3bbfe693d652a499db27df7
SHA1 b0e3af427a3642bafba1b1e859434a3411255316
SHA512 5e77b0b3504e04518ffade3e45833cfc4b7fe9f962ff769fa9422fb3d43dfa2b8932dcb0082ac59167aace666584dfc1afa89c95a7bcfe4fc0f18ab945457a98
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xs/Jz83Zxq0JXh6k/:tmifPbRV/JAxq0JXhR
TLSH
T17DB5BE13F2D900E8D05ED17887569632EA62BC450B34B6DF0A90B7962F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d5d72cad1b1e3616e6f66ad55b065ccad47c4143a39b634d68fee21f54c583d0
MD5 3bbd3a650efb64af9c4fc1c3bb89dea5
SHA1 542cae27530305f939cc14547f05d58cd899a06a
SHA512 caa4bd3e9e979fd29a4ac86069aa546b53c16809b63886bbc9ebd706deec473e5f144b834515055298961c9597569179256b218220559547776c99ff9740b43a
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqf/Jz83Zxq0JXh6k/:I5dKTi61f/JAxq0JXhR
TLSH
T1DDC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 29ee15b10cafde9d57911ff4f1fa0bd35616a0cebb0e936bcf74db39c7c573c0
MD5 92c442030a66edf86943b41ed2c054b0
SHA1 f6b299105fce00a1dd6c6eb31ae3ad45ed384a91
SHA512 c679d8671080e54f0714989d055578bc07fcb40f7c35ac98301dc618edc40f1a383e0b273ac477206d1703ae759a71ae32a237a061cea64670a5d7fa27d1fd57
SSDEEP 49152:chtSn8EApI0figngiDn0AP5w4/Jz83Zxq0JXh6k/:dX2iyphJ/JAxq0JXhR
TLSH
T15195BE13F2D900E8D05ED174C7568632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a975eb037506b82dd3ba6e21b53591ceb35b6099599fbf1f6c7bb8aa121a2125
MD5 62560cbe241d9d69423669c384cf7b4f
SHA1 56e620c25ca56f04c6f8eaf5bc9e143032dd5615
SHA512 088aeaa961dc8c53bb3368e0af7c407b50bd28ffd64cb26b072081e3a2a2a546b167c2764e7a0a56b7f1205e3229278f0312f80f8b5bb7dbc29050ee6c78b00a
SSDEEP 12288:XrY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:XrY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T11F6523F5E748BDCAF223037212A14AD5C6D04CC1FA5850F65299B172BB72A3C7468AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a0617eec7bb8d879de3d6157117372cdea85cf1e96d7f1e5bd3efdfff0238121
MD5 7110acb152c3e4890fcd42eb8d2727f3
SHA1 5db1e3916f7d2ce13e36542c0ee12c781de8c881
SHA512 db91c3114b3796d7313722fa5b9774372cf4f47ce3cc50fae5ca78a0ea751521249088386987203733082076b376bb021fb77cdfdd91cd099871b36818f6a153
SSDEEP 12288:tyY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:tyY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1356523F5E748ADC6F223027212A14AD5C6D08CC1FA5854F75299B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cbf49d95c4cd605142e44bad681b7d75f939ecc135e271d0437bf81844a0e647
MD5 938236a3c69a9290cb18635a08cf2cad
SHA1 4a7b0644cee955769f3d8117142348f78d3906cc
SHA512 43ba2b91d5dfb9006830799c8bdc7c017bb2139724d05e08758f8371b634db0ebce3af3f562120ac63809c5de62186e32fa422bc04b986fca06e28bd474db0b4
SSDEEP 12288:LkY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:LkY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1116523F5E708BDC6F253033212A14AD5C5D04CC1FA5854F65299B172BB72A3C74A8AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a65d891f46f2d47613278b5167576da7199e2dd809a9bb7a177c6d1e8ce6fcd8
MD5 87bd435f5892a158543fb8dc85f664b7
SHA1 6aa5f8566954e39e972a58ebd2200d5c36b19e3a
SHA512 9e49f21c50134b12a121962234e01f979bb1cee7cfe1db9fa791d0b544a3857d0bd36bc5d8eb0355a851fb56120b748551a10e24c5d05d01a8f4edc57b784aed
SSDEEP 12288:tVVY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:9Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1446522B5E748A8C6F563433286B14691C2E1BCC0FB2496EF534061667F727787878FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b648b7186367501f68d32272612e147088df2714b536e289aa9d1c264266fa2f
MD5 6e047b2af7b180dcd7bb2d029b84f2af
SHA1 dc5d68d4bf21053cf69b2781067e8584b9471729
SHA512 42903ebd62c89e7528c235f0c38e0d3e5334f705b7a53628a4bbb79f314f05f729bbad7d6f8b0126480bb4dac693f5f8895dcf7d8564880c4f05850ae787e423
SSDEEP 12288:ydY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:ydY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1906523B5E748BDC6F223037212A14AE5C5D04CC1FA5854FA5299B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5de5823584f11489d1251255ff76c84d7bd3d5312720f79a3d88bd0a364301fa
MD5 f21b8e95a656ad348a8fdc25074d6970
SHA1 2b4a111c041e82a68e4f18cd2db5f06a9314175b
SHA512 e54f817fe41952df5586c71c47b460f976268221c55c3306215ae60069405b9994b546a30272aca22210046b1ee75140aeed83db232f87fcde74fe51369f1126
SSDEEP 12288:yOY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:yOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1236523F5E748ADC6F223037212A14AD5C6D08CC1FA5854FA5299B172BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f413a87b5c9707f03ec2acef38a9477bcc919215d13df10b1b7af67622c05cab
MD5 24eef9d62cc33031b263d7e6829baa57
SHA1 bd5b543eaa612e49b52c5517797e02c488a5153b
SHA512 fb03fde706df9bd8d37b8f75619405a6788657a6f425aeb46d80d81a5025d4df8e98baf6d485a14ebfbc4e84ce87c6793197a6cf83efb8012425ed95a44740a6
SSDEEP 12288:q6Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:q6Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1C36523F5E744ADC6F223027212A14AE5C6D04CC1FA5854FB6259B172BBB1A3C7468AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 3b7c01c7170b0f41d3c8afa168f56c47aa060271073baed2df688d7c44191680
MD5 01b693db484c12b1c6ebb187aaa3d654
SHA1 dc52ed974bca9e561fc76c64974e0e01ceba0094
SHA512 5e9f51775aad120ef1129131c0ff01cb6d96cbbea6371b08ab5b35064172ac927df70a4cb9e59ebf7151b387e0bb175ec42d3abb90bcd7cd8dd30ae08bd8ba38
SSDEEP 24576:OZMSzFVSOSY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:OZMSzf+/Jz83Zxq0JXh6k/
TLSH
T1A18501A5B3501CF8EC63823AC9658946D6F27C995B60C65F03A436676F333A01C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 29b605a5493f4bf0929440575f588c1aaf00bac3e940f9fddc49b94951005751
MD5 526ffa0d365c8a5fe983be79335c6c09
SHA1 caada1a6752b0b3dd37ae1f93fb8ac288fae305e
SHA512 781b756c8e349d48d99d8f43e7506228f440547f735e68b9033befc33769a5375ecd25853de97dbb4df1e4079223ff4caee62040515f023fdf8408616216c8fb
SSDEEP 12288:VPY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:VPY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T12F6523F5E748BDCAF263023212A14AD5C6D08CC1FA5854E65299B172BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1f0ddd8f676b8d8649978123df98bad1a28608124b9b2344869c70f867e6f831
MD5 1fd93779b09ed1c929cdfab243b1131a
SHA1 60fecf485b365b7a613f73195b310615eaf2a5f4
SHA512 9123f62abd3c9c3224c77a5598dbf55365b77e42c770032ba6b3085511cca7cc0f5c90c5ee0647407c2da1b9b05b3e457dc4d95423657c1cdf0d0c9709a05ac4
SSDEEP 12288:iDY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:iDY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1246523F5E748ADC6F223037212A14AD5C6D08CC1FA5851E75259B272BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 f27ce43c0d24a5190788f4f25e6e0f028ae1a81a4a4b8df9755d042474dc7e45
MD5 3c73830301055cbe4c43ce4a57cbaa78
SHA1 7880c9e4edbb53b93d84e3e93baa7df7e64cb8d5
SHA512 fb63399cd404cb421e70510c2273d7d85fe4d97712fe131f871c3c4b899caf9f89ae577546ffe692a9456a0a4938952603717baa383507c4608bc463ef1dafcf
SSDEEP 24576:vzymY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:vJ/Jz83Zxq0JXh6k/
TLSH
T101750267B39430F9E177423589A10A42E7B1BC7157248AEF13A453762F336A4AD3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5ba9404e7e1e79bd1206ae73840c9024d504466d7ea54fcc58ea42a69347e85b
MD5 5b2a00f8ab32407de00450e6dfca013b
SHA1 51171296999e65e295398a81687b10124563d043
SHA512 1a59adb3df6b72d0d7b093f888f145195689cce0d91ef582ef4503e32b8bddbed7c85a4204af099404388180b0ef804b8036a2404a16f1d6910f333937e8d1d2
SSDEEP 12288:kPY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:kPY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1C56523F5E748BDCAF263033212A14AD5C6D08CC1FA5854E65299B172BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cc32cedb361329fc73f834b08ccb159c3b8fb53a48558ff5e00faf11cec592e6
MD5 a8d5a1046753293aae1ae6cd253c4c53
SHA1 19a6d7246a2bc964c32ab410fa729456f731c103
SHA512 a5ca56cd6e9892dfb2a240111377c7795fc763988ceb8de4a4133e8ad2763a9e4020cc77aef1cb85fc62ded00cdfc86663031b9cf77076c2c448f3e528c16ad3
SSDEEP 12288:FPY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:FPY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1796523F5E748BDCAF263023212A14AD5C6D08CC1FA5854E65299B172BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2f5bb5ae282ef5ab1b6e56f0150113ac45ff634638d34ec305c1d2e7a804a26f
MD5 37043bcc4c1d35f3e67fd951676e5e42
SHA1 e347ac93bd5d9b5233cb29be2d1fb51040532eca
SHA512 b532c8f745d2babc8f259ef78a80891d455b7aff45d3481b3c6d160ba271d669c7e5b2d11600c19756c69455e001619bbb9a7100eeb1aa2d8e27f2d4f2812951
SSDEEP 24576:JCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAAY0Juaz83ZxXVk3MHJlNh6kq:JCUxPTY+8Wg2lIL8lrIUJLWwd/Jz83Zb
TLSH
T1BA65BE1DA3DC0896D0BB81358A518A16EB727C2E1B21D6CF1160C33D6F67EE95E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 66e30f78530feedd01a9861a2d233770b82bb28aac9cf68c1b80f08b4cca2204
MD5 917a4199281378ce9ca98ba163f5903e
SHA1 6c7244ce82fa0b76f2733312502a63aa5434af19
SHA512 7368073bc42d1c4b6817e8a6ee19de763ca849b30db875f2fda0d6d5efda3fbe525f169fd1ed4e49f6862cb14de4b8b96ce56b24c3952cebf20c2851ce352d55
SSDEEP 12288:vNsffY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:MfY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T15E75F169D24812D8D06E1232C7914A81F3637CA1A7E0D3CB53D0F53E2F766A4ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0d883bb383b7116c49ac183d0f3dc549f972fa650eb2ea9232f9943d460f9ee2
MD5 785be52c6fc82caf7874f69515f4b7ff
SHA1 d6b5ae1eae91b95dc97f4605072edd142629c324
SHA512 af4f701f6a4da195255c00485d2b6c1abdcd7e48e0159fdfa70c6f2a3c0812375eb44451ab03ef4a425e56df19ad5153f300923d7d3d809595a6b435179217cb
SSDEEP 12288:6EY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:6EY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1A96523B1E348BCC6F573033212B586B1C2959CD0FF1494E7624472B67A719B8BC78AAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7a550da34e04c78c76d1984cceb5924c3bf46406c65cb15590af0871bd8757c4
MD5 942472f809ac2103474bf1d5ab123437
SHA1 943d37d26c2e4b1f431050838ae5c36b35445451
SHA512 9a4cb75f5594bf35d79131690fef43290776ca081e6db2bf263ea92eb4e98c61d33a494e801cc0144280a8e4f049d288dbcfcdab6acffa26c7c89c8ae22dba0a
SSDEEP 49152:URZwQCyiHiQEaaPnMH/Jz83Zxq0JXh6k/:69xvPC/JAxq0JXhR
TLSH
T17E85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 a1378b9b7303ce857c2c89de5c3751863e244939593d13ee1d509185ce9b6ead
MD5 ae0bac0eca277782c7a162d448e1cd93
SHA1 ef9cd1cdf8489f8544bf642ddf3a2c6372f386ea
SHA512 7b809d019b0702c8c2cdfa5ec648ecaa263dbdb9d5de7f593f3e3d393b6d0c7995d656847ab6043d07ecfa99034aa40ade81f9fce2a072480e51f56f7c9a5405
SSDEEP 24576:BbxA1UG0Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:BbxA1Ur/Jz83Zxq0JXh6k/
TLSH
T11275027EA39C28D5F172923A49E18146C371BC95672093EF1190927A2F37EF86C39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8ffa9e44df8711d5ee594dd9f1b1a61f5adb5b12510457b81691644d859583c0
MD5 ddeed00986b6e348ee425be8709e0576
SHA1 b439a50fb0742cf5cf4dfbc47d99f1df03350f7f
SHA512 55220abc51dbe8c1c420b3ad5f19599b2c6b3e66570fe04cf41b2fb3ec10471db575a2d68efbd02cf3569c024d803123cb8cbfe0e80c0212d0481474a6cdd691
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrnFY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:BjRP0yHfVqzlAsrnF/Jz83Zxq0JXh6k/
TLSH
T13245AF3EF2B910E9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 80d4a01074096f15a564af2a3fe74670fe0d4dd7feb9ceda1669870017d0eeaf
MD5 a3ccbc03c740c462a4cd42b8a48d1c04
SHA1 c6d6746a6c6330bc14575c7b7fcd499e0af68913
SHA512 682d6d17c727484df7896b0385d8af535476b5b2652272b800a50b256480d5c4c9826e5b9c8978426210bd20e26b0092165fe2909ecb773004af6db0ff63d821
SSDEEP 12288:nuY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:nuY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1B46523F5E308BDC6F563033212A14AE1C6D08DC0FB5855F75195B272BB71ABC6878AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 69b0540ac6516cdcabe2cf260d09ffb5116c0561812ddb269d2bbd95fe1c2ee8
MD5 b5a6137abeffa72cf19d97b7d85bddf6
SHA1 a2773b36911f19e16b59cb418ff3c65ccba6b025
SHA512 b79a2e21678c56dfcd1fac63e587f92de88217cd244febf1ac485b62f0c652caced9b5809e2a925f70347e25744d87f829ed1cd2a3e8d9e6392159eab6d85658
SSDEEP 24576:7pLBUT4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:7pLBUM/Jz83Zxq0JXh6k/
TLSH
T1FE850155F79404F9E877823C85A28A12D2B2789C1764E7DF03A84B652F237F54E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 179ca320f215380f0b0ed0f85780142eb2cdf73f02915d1e265df26e089769d1
MD5 70cf1b34d2f3e9919f48df85aec5ccd4
SHA1 39e79f5e509b50abc642e1b7faed04cf237049ce
SHA512 ce81e109efa990e28afe12cea9ae974a7878f6cfa8de18e86540d3bc4c4946e4b175e4540fa11b275f0544038d1ca9f2688c1bcc1890be49f1dcc5a90429cb1d
SSDEEP 24576:irYNH5Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:irYt5/Jz83Zxq0JXh6k/
TLSH
T13375F12EA25C1CE5E53B917A8AC28649F2727C96571192DF01B0C27A1F23EF87C3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d5b439cb3aaed8f57f965c3db305d454e6926fb2114a1675890174e4dd9f492
MD5 86ad0f9447f080577915641c1fb4e4b3
SHA1 e102d00c5be5307dcca6df47925476cf8531ebb0
SHA512 d796db1b8544946d6c91d95a9371f98ebe34bc723f92d2550fe274dba8e151dd7ff844cefe3d7f543c14889cc73f21cfd0762d73d2027a136659c5ead6a1aaa3
SSDEEP 24576:9nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKi:9nXoJJYH84VVS6AmEcJas+cHBjSSKHPX
TLSH
T11465BFAEA2BC04D8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 58e7cd04b5ae0e880e79c8ad061c124aa1d8d7ccdaa62819e3b19b239301e48b
MD5 35f591dd5e710c60102709200b34a9e0
SHA1 6243c40172ebb84cc4d0b829094e139518701edc
SHA512 6d562d69e697cbb2a19fc5f527b2f1c6a345e93663cf2ce75293d82beb3e10829c60efb28bdb2889bb8922b3c335f11a9807bf2e99193fcb94e93840474dbd1e
SSDEEP 49152:5DLL9TuJ0M/TYW2PO/Jz83Zxq0JXh6k/:6B/JAxq0JXhR
TLSH
T1FB858D5EA3EC42D4E07BD6BD85B79146FAB2B895273081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 96e484d444ad120253bb181448532b74ea52501c4da1b2c515aef6db6fc8fba7
MD5 6569bdd4334f63516054242016716704
SHA1 bea6c34735b005ee2607f072717da7887fcc16dd
SHA512 3ed7726f58ed5797ee860d277d2e150a34e16695c93029c55659bc1b3d289742f297161744e7cf579960fe15f79e8c7045fe5cdf0761a42c579b903e64f509d2
SSDEEP 24576:uegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:ungOJOmPOHh4/Jz83Zxq0JXh6k/
TLSH
T14155BF3FA7BC15D5E03EC17D8A928916F6B1786613255ACF0160827E5F2BEF42E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 8326c288cbca9bc7ce6a386f562c2ce50517c44a8a5c127940b57461a2855b3c
MD5 eb133f48ff388b618ed175c077dbe584
SHA1 831c03f057ef3e76425555df1bccfcba58b492bc
SHA512 a2493adb5cc73f687a5b66f7837a04a1b87efca5e9fc09f37dc6a0c564ce02a78104cd6707f640a9b2c52edfbe5d7dbf516c720e869a3bb344c574c09c91dd70
SSDEEP 24576:ULJnJiTk3R3waE4JrOOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:ULJnJK8R304lV/Jz83Zxq0JXh6k/
TLSH
T12A85D07CD2A810E8E4B7C2B4825A1796FF71386C2B2169CB15B4D5313F12FE0A979F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 243602ada8680e550a5bafcb9d8b41b4ca63fcae5bf266f9cb2c643b18fc132f
MD5 8600d08eb9a071eaa64ffbe6af76c368
SHA1 31fd844c437335929b1226fa4e43bc668c822255
SHA512 70382a603a813c560eb8b1024c429194cef7750cc367eaf76e32089e9a6d6a2d9ddb6e5dd58637aa6d8a3053390658a2cd757e3f22b1290954dda8ce82129538
SSDEEP 49152:49GqCzDScAZmlvTcFg8Ph66/Jz83Zxq0JXh6k/:6Z/JAxq0JXhR
TLSH
T1C9955D15F7EA5298E8B3CAF1C96294159B327C409B34F7EF4A80CA7A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 428d2000f386665bc40b1a689f873af4d59ade5a9ee0fa00a6e2558175e2111d
MD5 0a597513dfdd093db0f8a1c3b4bf9fda
SHA1 fdeb9f07c7810935c30e7f94eaa4af6e14dbac0e
SHA512 ee4605a29f9b1343f5a86836f0adaaa0576f1002359472e2b3fe2c9d25c210c80c52913019cab0c3494c3715f4f525197d482ac82fd3effb8e7eb19de2d8df4c
SSDEEP 24576:flYJeXm5jUuEoY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:flYJeXmRUuEo/Jz83Zxq0JXh6k/
TLSH
T1617512ADB35C74D5E12B413646A14A94D3B1B8A1671163FF02E0D27A9F73AF82D3CE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 afd2e4b0b52dd57b3cd749c5b1e1f6d568dce95968b31717d774d222334a9a4d
MD5 547fdec4aa58450376c26acb20ba42dd
SHA1 c313d8ea4d1bb754022905bde56f934e0edc7dab
SHA512 b5294d17201334cabbd5b141ac9d42f9b1c0ff0b1f2e71233d553eee99bc5ccf8ea58639af08c053c7226ce22e6fb62503272b2b186fad266aba93f13d78cfff
SSDEEP 24576:OVtylY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:OVtC/Jz83Zxq0JXh6k/
TLSH
T1EC751265A394A9D4F57602319AB24190CAB1BC60AF1052EF51D0F23F7F72BE8B834F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 187351d397f6e5b7611aeaadd693b31f10021bf483c6c8f5053d619205c1d318
MD5 783e1386eb8e3024c04075376b9bdb04
SHA1 2533bc651b6d20717abdf6a301ffca43d5e6d60f
SHA512 9885889ce88fa76326563c81ae7d44af18f6a26af1cb8feb10c521909951d5528abdf12132cbafb26468ea0a09a5a028d4f191bcf6d4d70033d60ea09b1ab0cc
SSDEEP 12288:oP4Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:44Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1C26522B9E344BDC9F523027212B14AD1C2E16CE0FB5464FB11D4F172BB765B86878EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 32df087e526bb5e6bebdd936d015b2814af1b24508b25693a190e47d9eaa14e6
MD5 84ce00b46458a05a84ddce31cd5c40ef
SHA1 cfed9bc4ef1d40180ab9a4ca89313d07694efbfb
SHA512 c25638134a1a2ca25a39b76608a18ed5e9256a844b86c61ce89bed07d2b8bbe4430c15376d24577ad03b01b5cb19ebb77fddd35668ea3cf94e8e0c15402ff0e3
SSDEEP 24576:3C+TyQIu93VAumZr7jm/Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:3/TfIq+Y//Jz83Zxq0JXh6k/
TLSH
T165558D1DA7E91DCAE276C675C9A34493E633B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0d83716efe630d72f3056cd214b1a15e7561f064d2801894821b157566f2b7c8
MD5 110298f7f9400cccf982e6d8923b787b
SHA1 84a635f2190e5fe01289b742ebc92937e2b561fd
SHA512 bcf746098e336aa193ea4ea31d77bf9f79d38a9b225ec50ac99a1e42ca29381a091e39a658db277ace8ca575e503e8c7b0343069d48546e673e0c3a0e3e0c5b1
SSDEEP 24576:ZLQikZcY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:tQik2/Jz83Zxq0JXh6k/
TLSH
T15E75F15FB3AA10D5E0A7823888914152F6B37870571263EF02A0C77A5FB75F9BD38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 141495b9a65ae0160aeb547ba1dd788da40051f83f623218dda513a4bfbdf974
MD5 4374c308a187e8939ebade9956bb7872
SHA1 5ffced188d3f950db1e034060fb755c2beef504a
SHA512 704094ac34feff008b57f3dadab3f84d4e618dbfa049e4b90d9f143b83f625f1f6315d0740ba1481a7fecc172b275f55afa15ef15e8d7fa73e14ef96fe6b102e
SSDEEP 49152:SpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPl/Jz83Zxq2:PpC7b4+80GTki/JAxq0JXhR
TLSH
T17FA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9773a033dc7a2b0ffb21fa22d7dfccc587f52aa5736c9ba91823eb4395e403f4
MD5 a06090feb41310e971e3e927e30dd55e
SHA1 7a9540b3bb181ba5ac8399495c13ccf1ae77f3bf
SHA512 e87f00cd28f36a9cf07e8803120475f3f4e732c751d6850960557e703fd14fa6e531df4373d9d1ee7f7ed200116625bb16b7b1c50eedcb838828d887ba3368a2
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l44135UQ9Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:MqPCIo4Kol4/Q9/Jz83Zxq0JXh6k/
TLSH
T1D455BF2AE7F956E5E17AC7B49663C611FB727822133163CF4290813E0F16AE85E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 b604f94ce1a9e64f359d7e2a60e6fffcca2135c413217c05d40c549a07168210
MD5 d494855af41ee76a86492d22ef9fc9c2
SHA1 b5fec5151521fc9dfee4b2ec43b7d9bcda327912
SHA512 1b1da044ab0c3cee3c6a022425f26dcd382b94b396b938509602412772d5490d0cc79b6722151a8f4a52bf95600e8d73646d31654f126f2459d3fd368adc92bb
SSDEEP 24576:vyLXPLcM94ttY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:vy7PoLtt/Jz83Zxq0JXh6k/
TLSH
T16885D03EE76C08E4E47AC27C96A38906F6723CAD033166CB15A091752F67EF46939F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 682394be3d617bc8d5741d1b01cb9b664207d9be4e2e5ee981b43ae8bf1c5899
MD5 8fb1b93fd71a917531f9ed923d11ebb6
SHA1 bce791b8782e7d2a3e7c249e42aae85ebc54db91
SHA512 1c3cea1dba88af95e5f2e975d08c4b1e205454311ff5a65fb52e42a4ee8f2cf608dc1532f18c073f4a384c70d0866f519e75bbc3e03346110f9b12baa66f8386
SSDEEP 24576:FWv8qjpsY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:FWv81/Jz83Zxq0JXh6k/
TLSH
T1577512AEA39478C8F076033096728265C1B1BCB2676499FF31C4E5775B31AE4A43EF64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/684-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/684-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/684-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1688-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1688-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1688-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1688-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1688-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1688-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1688-225-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1976-147-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1976-371-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/2148-375-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2148-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2356-118-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2356-312-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2460-7-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/2460-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/2460-81-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/2460-1-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/2468-376-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/2468-169-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/2776-104-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2776-107-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2776-164-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2776-99-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/3012-55-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3012-66-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3012-67-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/3012-62-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3012-54-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/3108-111-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/3108-168-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/3172-79-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3172-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3172-82-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3172-156-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3272-373-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3272-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3272-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3360-110-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3360-23-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3360-21-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3360-15-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3360-22-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4276-69-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/4276-150-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/4524-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4524-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4772-392-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-416-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-381-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-388-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-396-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-397-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-398-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-399-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-401-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-400-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-404-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-405-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-406-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-409-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-411-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-410-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-408-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-407-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-403-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-402-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-417-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-394-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-415-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-414-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-413-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-412-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-380-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-395-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-393-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-390-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-391-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-389-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-387-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-382-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-386-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-384-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-385-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/4772-383-0x0000024A9E460000-0x0000024A9E470000-memory.dmp

Download

memory/5024-37-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5024-31-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5024-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5132-97-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/5132-88-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5132-94-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5132-160-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/5140-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5140-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5400-11-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5400-106-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5532-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5532-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5532-144-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/5532-356-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/5932-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5932-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6036-121-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6036-128-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6036-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/6036-340-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/6096-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6096-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download