96ca29e349f037498dcdd630d3c28412dcbd3df6d8e489416fd775b1f0f5fe98

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260505-qrfrdscz9j
SHA256 96ca29e349f037498dcdd630d3c28412dcbd3df6d8e489416fd775b1f0f5fe98
MD5 f7df598315edf40640f9b3c753561143
SHA1 b52b0e65adf021094a8a283ce57813a24170ceb0
SHA512 e65c859619000a5664a4a3be20a8fc60c481823b034cb191c82e94a5200e49b8b9151b196b9e314fc286edfb39d2aed4f5c09ae231864e348758ac18e0f4499b
SSDEEP 12288:vHPrGxzQ9TA1ubv6Zc3f45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:vHzGxmvgYz7KEMdX6keYnAcer+
TLSH
T14075121076C1C4B3E86309316AB0CA70593EFE711F644AEB7388675A5F742D28D39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3416	alg.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
4272	fxssvc.exe
3216	elevation_service.exe
3560	elevation_service.exe
4160	maintenanceservice.exe
3988	msdtc.exe
1060	OSE.EXE
4376	PerceptionSimulationService.exe
828	perfhost.exe
1092	locator.exe
5768	SensorDataService.exe
5172	snmptrap.exe
2924	spectrum.exe
3700	ssh-agent.exe
2416	TieringEngineService.exe
2076	AgentService.exe
2272	vds.exe
5140	vssvc.exe
1292	wbengine.exe
5608	WmiApSrv.exe
4328	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1bc4e1b1b955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000086aaf3993dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081dce33993dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be3d053a93dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b2b8a4093dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b68a513a93dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e77bc23993dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4272	fxssvc.exe
Token: SeRestorePrivilege	2416	TieringEngineService.exe
Token: SeManageVolumePrivilege	2416	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2076	AgentService.exe
Token: SeBackupPrivilege	5140	vssvc.exe
Token: SeRestorePrivilege	5140	vssvc.exe
Token: SeAuditPrivilege	5140	vssvc.exe
Token: SeBackupPrivilege	1292	wbengine.exe
Token: SeRestorePrivilege	1292	wbengine.exe
Token: SeSecurityPrivilege	1292	wbengine.exe
Token: 33	4328	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4328	SearchIndexer.exe
Token: SeDebugPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5728	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 5192	4328	SearchIndexer.exe	104
PID 4328 wrote to memory of 3940	4328	SearchIndexer.exe	105
PID 4328 wrote to memory of 4660	4328	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5536

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:828

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5768

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5192
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2620 2740 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3940
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2824 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c425b28ff29faad449469a39bf533c60277c87d7c125fb70db715ff14f633fda
MD5 dd253d8f48346a3b90aec19262d184c4
SHA1 0a0d2a6f2ea643c37bfbf205c8992404e963ebd7
SHA512 9dbadd3e92b1502d950b5522f3f71fe61482c921e322216bdab6f77375dafdd5253bf9770f04fe8d5b0ab94976e0870a61196739bbe1a2ebbefb8973f9d77470
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIYPKEnSG:R3q6HjBxYPKES
TLSH
T18AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 80f2359ddd421bc39b7cf1e97e2098258e7eab56a110931764ba4753fbef300d
MD5 32b897be15101a34a5de391ea2f836b6
SHA1 f0df868f8c60e6a35ae0ecc83e49fb9a9e30c178
SHA512 86eba8fbe8902a437edc4538519642019b245e3d1bd5f8191ba8a98ef2ac1a2bd37664f672526b8cea3b0d2247e04ce53f9585442df82e63fb4057c9be98b23d
SSDEEP 12288:11XLsswWkxy2lRq2czAW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkc:bXYfDtczAlYz7KEMdX6keYnAcerZ
TLSH
T15885012867D508F5EC6B823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 78844441a0fac7d59c2e58af2c356c5eaa6447f1a7ce659ebe72c03950d84b6c
MD5 816837a84bb10f6784ec7e808b0b11d0
SHA1 ee78866d2937f735e539c938307480c4a15e386f
SHA512 2676fee1f592d1cf458e1de967b2e70b05b9a2b76faefd39bd0cb40ed1649efeca16a46978dd33c635817727984c3f2cf700bb52e87576fa825e93f93785fc52
SSDEEP 24576:+0Le5ji0hmx3rMwYz7KEMdX6keYnAcerS:+Pji0AZ3YPKEnSG
TLSH
T11EA59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c53dceb0bf89553e473619e9806d37b210ffc862b837b79761b8cc563d82685a
MD5 8bbfecfe146e9d415bbcd33350dc98ea
SHA1 54356706447353aaac16aa01e580f5ea7f959312
SHA512 a85ccf8833d66ea4bcd4b47887e7ce5a064df25dd8a6f5243f34b5da2f1cd3f1ebc1443eccbe189c210d838b740465e1b9eb5f7c4489386e39d24e9d10501892
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyueYz7KEMdX6keYnAcerY://ezSC6vUzPvxHjy7YPKEnSG
TLSH
T168756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bc3b3495a7c837c6c85f4f50db990fa35a0a281696ca3a7ebd20f6175fd98ed4
MD5 5933b132e59906d80d5a5a4b37c708f6
SHA1 b383c78f9eaba30bbe99326b367d32d8a4142557
SHA512 095cdc408f61f930e998fa75c8a32b731ce200b3c888146339e3140f961f9b7791faa1d1e7b2dedef9f085b6798f6c9ae729aed8c5e519763fdacffa805f3447
SSDEEP 24576:sVbqPb88hv/l+6BYz7KEMdX6keYnAceri:sVO88hXl+0YPKEnSG
TLSH
T141559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8cdea7b62c547b8c726d0441b571b29d416ca5207c7f6097a2f2427870074084
MD5 0a939b7249da801d18b7cfb4b5183dc2
SHA1 220b7d7ca8a28a86ed05de28d2c39dd4e0a3fd58
SHA512 7d16717f16de2a2dce3e0130a15922bbb7a1f844c56b57a48fba639724fcf62cfbb2d6ffedc8817552c9bcf9225171b133306b24bd1d7951804c7042a2757799
SSDEEP 12288:QXj45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:QXMYz7KEMdX6keYnAcerw
TLSH
T13E6523048B1A89D2F85F067BFFF5894189375DC62A8C9761C94CFA4283BE232C51679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 55d769883f0802b7afa08fda4b2609d87c88c4c210aa7eb023df94468ddca492
MD5 b49c6dde888c2da87b3473604c649a2a
SHA1 1a634b7d2d1445b486f9686fda9f5334baa3e160
SHA512 f767084fc4ed5aafd67af335807a979c4fcc29fc1785e6666f2c950ebb34d51e66f09ca7351ccacc606cc53eaad9907b65c52444c7e3a9793e107b57b8494df9
SSDEEP 12288:6eBNUbTVO86Ui45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRka:6JIUpYz7KEMdX6keYnAcerD
TLSH
T10C85CF3BEE28FCD2C27A8DB96A918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 557ee21303a61c62e464c1efa076d41b7a1fee8b3f8ef5c21fa971c4dd433845
MD5 5786f7c67be706a8453487b1224ac092
SHA1 b4cc0bd2197eecccad06cc9f4ef72c2b8d4cc78b
SHA512 0440b813e07c83cf8f961c23fec9c78a77a5f87a2a8308fb51df30cfaeeeaa52a0f48349bc3e6d719757b70b6929c474087606488030cdc87d9e2f8abc24bb16
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:pQvGAdlCEL8c/yRNw5CuYPKES
TLSH
T198267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e9b5c7a38f2cb04159720ffa0c36e6aa7eb0b5cf2b8ff9b865e36f348a5fb2e2
MD5 ae501ff390241bf00dba479b19bb03de
SHA1 176d0e7e37766c3efb2171af6b425c22469ba140
SHA512 5a7d36aabc1b13041adfdee39455e1bdf3c43120a4c550734b8941d3b669da4cb575f9d378297dbca279952539d1a42ff9f4b7f185d4fe9ad1d0439a1c7da19d
SSDEEP 12288:JAwSfxL/2Dc3BDLLmt0LDQewsAjE45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:6kewsAjHYz7KEMdX6keYnAcerl
TLSH
T1A295E031FE75E432C6BF0DB62B35C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ac76988ea786561a9567daec694799375b2229f19f8487b42b3b270667a81be2
MD5 20141a0503073371c1de9b547347c171
SHA1 d3811f29697777af104a5d40eaa66a2d5f4b9379
SHA512 da70ebb021266615c2d72079e9d4e80b5678faab52c9fa585c8bec27e0f939fdbbb7f5d87a6c26a11c49b587152700ae0262caeff074970be44a20be3dbcb1c3
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/cKZ:XUEtQevvqc2W1cpV2EI32/n
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b0ceb6b2d73153bb98083656b492e2c7254933d224b316818eebe14f984456c7
MD5 27603f7d2aaa906cb77de7503afee8d0
SHA1 fa1d793b119ead455cdd4ea2db45589199f45ffb
SHA512 05cdf604fe9648a4c5a4f70a59f69877aa74ed8d8a1ed3ac62b75eb1ef053c483a31802dbef7422362dfcfbedf81d492cf019473034ee82e8a1018856f599bd1
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/znYPKEnSG:+oqtVjnmyYPKES
TLSH
T17CD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e988394dc293a731646ead87a5e3425fa945ccc7aa06578bc481adbc1a6a8e89
MD5 9a4419257e392203bf16e4bc0a0ee03b
SHA1 03765e74799e7d0e0bb6a393ea753cdea8535707
SHA512 737d8b785470613a3ee65f6f62360f4d86e092f2697ff7edf2ab0fbda3ade546285a69605a347fd7a32ae631e0ecf8c99fab946317da895ddcd8908216f7c031
SSDEEP 24576:RAhGLJIFoiwtA5l7S53SYz7KEMdX6keYnAcerq:RAMyFoiq5CYPKEnSG
TLSH
T16135AE80EBF955D4F5B3AA78A9B68571EA76BCA65E30C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 79ed8e3cb7c3a40256e9465de2f283972dcfbb61c377e2d4aa142f2eccb5200b
MD5 4c143420864c9f4f40efb04fe038c406
SHA1 16ef4cbaa0b53ebabf6e1842dc136d3bb034f5e7
SHA512 f932e331f0ece4fd2666d9cc22acc65a55e2887bd936740028af4fc4087c72cec9546d7382221976e976e35265858378e08d4e726ab8ca0913c51feb78638fa9
SSDEEP 12288:smw5HEjsChNzBFgl0WDm+Cx45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:JwuSOWbYz7KEMdX6keYnAcern
TLSH
T1FF85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f53ed7afabcca488d7b7633c7048f09c92f4bd4d4740822402808624766b17e2
MD5 ab0ffcbfb25c5016a5818776800b9820
SHA1 c2111feaed96a3389af3bc77d52ece1ae0b7a8bb
SHA512 b2b94ed266becd9f54d7f2ed58ba460f2241f099ef432dd6830721b656c5d5986a869b36126960b46121b4e073481feabedc55f9448bd7668309f61a26f974c5
SSDEEP 12288:HjZ1IyU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkE:DZuYYz7KEMdX6keYnAcerB
TLSH
T16A75124927A820F2F0A7423EEEF14601D7727897277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8575da5556faeb9695a4e1f614979470073c8e2a8d158c794e57f230f6c7e3aa
MD5 7b035a6be7a953fb829280c279f8043a
SHA1 a2ad79529c635bd5d58fa042ad2d15ffffcfc4ca
SHA512 a76bb9ab501e5e0d1b0f656a2303146ec9ccb9d0b9cc5b93f8884ffe4984ef16613ea0e0cc2353a96e497c44ab8ad4c8f516cc7970e67a1dfc6d8154f69c5e09
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:zQRQyi36YOcPQLvw2gAf+PN3NYPKES
TLSH
T116667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a52fc70d7c5faab777a657d89587b025f2d2a42e7dcc207246f07889de684da
MD5 5a4e59629cf02f5933c4ed7abe5e0cb2
SHA1 59214b970c3ef5c0666199bfce6fb0cfeff33dd1
SHA512 f043dea69e0b6e1b5200c7af94b330efdc28f9446360166522acfa5ace7f9894b0ca9417afe1b0ae81a7655c2edc2ee235116a2e9a66705ae1e37d023d432289
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:oQRQyi36YOcPQLvw2gAf+PN3NYPKES
TLSH
T134667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8ff3cb56eac673acaec3240d020b28765dc956b744e22c2788ea099145a3ca3
MD5 fef145f6e07c4468c134d94a0d7a46ae
SHA1 6c1c9e9fe9cdc33e3580360dcc111c789d7be60b
SHA512 d63b1951c4d3885ab2b37f7b67347a85c681a272368d31542d5e9f02f43ea3296dcfc90969a778ac4f39ee99844ec5717745a5a17bb98134e05f35af6f09e0bd
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0IYz7KEMdX6keYn9:368Qg55nhheWu7PNU3/3YPKEnSG
TLSH
T196B55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bb99fd7dbba61df3b7b4d22ffaf20ea8a8a3de2558f2c93c308dc58f7061a07a
MD5 d8dbd2e980dd2a790068b901b266b1d1
SHA1 5b82af6e02bcea78aa301619893f282db6f91c24
SHA512 07fc401bddaad5d237a1ca2fe2695e14e0799ee86bff2ae8e8787f9105e37132e3f27e85c06669994bc48dcd6635c667e2a12ab6a0e1f9521473e1bda620e726
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:ty5112gYy5azzVvL69nLKnhZMYPKES
TLSH
T1CA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f30dc34839b414de47c413083b0a58d98817d102affe500de5806b4629a25968
MD5 9382f6fa57c23b6366eb87aadcac0c4f
SHA1 06abd699e42b7ef2f714b8630bcaabe7575b3789
SHA512 7cd56f2323f7889569808e85c295df5c091dc7564ab372c7f7cfc0b4521e60844188dbfb58b342c99cced5394242fac668fa5767e799ae108ff5adbe7937859d
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVYPKEnSG:Bu6JmVxd2dVYPKES
TLSH
T187D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c01da19e2c9e7a826523d3d5226f3188f2f281e12b33eb22508e996346f2765
MD5 d4900b1c5fc8c92533b33fd1eda0235c
SHA1 83c4bd6dc653619178f6d085a4bc59af5d796d96
SHA512 9d8436142fe8fda9bdda89ef1c4258b23d20dc82fd8a393f9c4ebb818d1bc449c6da43496e81a30444ae490ba5708f1536e70a8ff5308be38b528cd3f4530fc5
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xJYPKEnSG:nmifPbRyYPKES
TLSH
T11FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8b95699e5d9fcb4c564118f9234bf87b73c71d25690296f1091aeb593dbf671
MD5 393f2549a66bd318743034af4984e302
SHA1 803e439cf9797a4586961a4defef98ba1787c453
SHA512 8366bc57a673ca33cdecbc5f0c8e7f2d866ff16264f61a8241f20c9f85ca10fef8377ca6111fc54f9386e114e2ad174a3872d8d4e9cb3f44ecc338375a4d47ea
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqYYPKEnSG:A5dKTi61YYPKES
TLSH
T1DDC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4ed98b1dca8f2370fd35ed9cd4b1211076a5b37352afe46215d3b16ba3dc8487
MD5 365884e1bdd6fd1e1015092906309254
SHA1 2bbbe5a4b273f7922109b57eab05ddb2c1d7500a
SHA512 4e0d6a066c1600d40eedced88cc00cd5eae6857c2bd21f3a157cb18526592c31125aba75dae70ae22a4037141e36e46227ded9d4dc8dc1792b0e8261a0b97386
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wlYPKEnSG:hX2iyphmYPKES
TLSH
T10D95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 3f855dcc787a1df355c53a1a8cd99f0199d5038b38c96869dfeef442e71a4663
MD5 73ff04d9d90c10c3fac06a8ebeed98d6
SHA1 3db7d6516ee89b421ca41a510ed2267ef39f3eb9
SHA512 38a74f94aa93981d77eeba35a7a36cb0e56980a50b026c575e42b81f6e5000afd91124a787397a9244af94a18d9238ad97f494707d3d12fbd38b826906214ffb
SSDEEP 12288:RL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:R0Yz7KEMdX6keYnAcerc
TLSH
T15D652304891B8AD2F84A467BFBF14540C53A6ECB3B8C93A5DE4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1509e5ee8bef72c68eca5c6cf263517c3278d4dba36295dd020de41f9e344858
MD5 05d1922453b79560cb1e4466a8087e2e
SHA1 16a816cb36f352016c8fb9b1b3dae6b9ea4cef59
SHA512 882e3bc411b766610b22f12dd9126e3fc655d6fb781a3cc0bd632e18843b47716e984be790e78502e181b632eeb864943e0dc2a2c25115341bfaea387914afc7
SSDEEP 12288:N445Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk/:NTYz7KEMdX6keYnAcer2
TLSH
T1D9652304891B8AD2F84A467BFBF04540C93A6ECB3B8C93A5DE4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 6d79a85bd8658024f9388b653f56672a8a4ead08685c78de40e1a418c64371e0
MD5 c686ad10e5e8594af2e07db7c1e2011c
SHA1 ddc3ce7d05e6219241cc28d0d89a5b4e6250a6bd
SHA512 ac440b0a964bddce13776a3c2ce93609ed6f192892efe05e337a8a4585296f3838852132fcfccf3d3e5a5f846d6c43e51a41b7d59d191345f365aed48596ed38
SSDEEP 12288:Hq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:HxYz7KEMdX6keYnAceri
TLSH
T125652304891B8AC2F84A467BFBB54540C93A6ECB3B8C93A6DD4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c44ddcccd227098c368b7936f94742b8aa628f4f25afb8f801b39a15c807aeab
MD5 8af3453cc48b9566a537ff8d7b9ce770
SHA1 ef5b7da3ce7744818485b9f8a9ff8a18f527991a
SHA512 aaa2dfbcae786c70a898a16920ab036d7b5feb0f22dff213f6415dd45560e0654092637c70a88c0e15b3cd89794590baaa12233bfbb6581337d3e86b95b30cc1
SSDEEP 12288:NVt45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRke:KYz7KEMdX6keYnAcer/
TLSH
T1DC7523044B5B45C2F85BC27BFEB18500D6767DC63B2893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 c31f3aee26370c7fe6afa2df0af5125f832888c2efaae51b60814dad1e856848
MD5 e55fccf490541fd6aeba80330d6ff82c
SHA1 d7fbf2d159b02b33a3170b3e52f68b731a69d15f
SHA512 b74fcf506d414fc349d062328ba8403b0dadaaecf0e2f12a5c6a9c70d30848fb035d8b92f76063cb5b29a990f849d1aea14e03804328a57cabcbe9385775590e
SSDEEP 12288:Xl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:XKYz7KEMdX6keYnAcer7
TLSH
T135652304891B8AC2F84A467BFBB54540C93A6ECB3B8C93A6DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 cc5fd26312a3682bdb06e4269c4b2820ffc4ac6675465c52fcceb353f3cd87df
MD5 2ea63b651421622c2cb6ab2f96736b23
SHA1 e665fe05bba6ccb65b1aa45fdb00b273f78815aa
SHA512 1f480098ef86bff883b7872d86d04f59f044967a663c09f5ee3381fbe52b8b0c97fb8c04fc6482482b6a47ccaba2479e65bb637cdc8311c71dba51e6cf061a5e
SSDEEP 12288:zM45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:zPYz7KEMdX6keYnAceri
TLSH
T183652304891B8AD2F84A467BFBF14540C53A6ECB3B8C93A6DE4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3dd1d1d46d2c17dd22ed5fb7d2e1b45ac01edd34617cb649b59aa21bfd72d9e7
MD5 443ac50d381051a3ac1fb03966691e41
SHA1 9cf7a2f40d5c8bc12bae897751ddf35cd2924bfe
SHA512 0fdeae740195882cc26a37b9518eaf2e388badff8ef363b1070caac1f8c644927ef8cd178ffcbb09dfd585d71090c95c1b2834c01cf7c4b12fedb6265cfc8265
SSDEEP 12288:GQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:GLYz7KEMdX6keYnAcerk
TLSH
T1956523048D1B4AD2F84A427BFBB44540C53A6ECB3B8C93A5DE4DF54293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f7eff2455d002547c381deb6a61a98e265fc24138bc0bef1dc891bfa9b11ea73
MD5 2e4cf1468390ed56fac35167375def22
SHA1 87482659e9a1ba922b79f9d86e44f65f3a3e6741
SHA512 b7006c3804da2b1e8594938cbca7f1caee8e292fcb9ce5e38d4c3bbc3e4b7dd61596df6e7de0622891152891e97da8707d2888be5098e145b565faea61caf014
SSDEEP 12288:uiZwbHzzFEoS2cPvyY45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:RZMTzFVSOzYz7KEMdX6keYnAcerf
TLSH
T114850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 8c0e16df06cb0f2baa80859eb38c76459b396dcae6fff7e27ea9267d20ed729d
MD5 f6a19ca1f596b52452880b8cea3ed95b
SHA1 3b3ecfe923bc3b8dd9bd6e9183152a1384df151e
SHA512 a84dd8d258d19f4820da71a9f4682bec3940b14654b5173739fd8d5f37944aabd45d7f2d9c517ec5691e05403a98ad4aa54f10d415d992a5e6b93def9e736329
SSDEEP 12288:VX45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkc:VoYz7KEMdX6keYnAcerl
TLSH
T183652304891B8AC2F84A467BFBB54540C93A6ECB3B8C93A6DD4DF50293FF632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 8d9d22a6bda2ac9927610ab986286f206fa677f9836c3481006ce23df1a1aa65
MD5 61ea4c346a151df2b642bf09d712f308
SHA1 ed112fb59dbe2453d40384441bac160519d435b4
SHA512 8d41d0fd185980d835ccaf4d459746b54f450925b71f50c797319f509ba1de7315636777fd2f481d38c50b96dc45d256d8851400ef2f063bff30d9901f003191
SSDEEP 12288:Pz45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:PcYz7KEMdX6keYnAcerh
TLSH
T187652304891B8AD2F84A467BFBF04540C93A6ECB3B8C93A6DD4DF54293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 533c8bd9c93e64c3c3b656b3bf47281c553bbe8377fc67ba2845bdcc4c0ccadf
MD5 418f07a88495cea1c12c9e6a1cf5045a
SHA1 119b8945a74afac6c35d9ce199f49d6490bf2c30
SHA512 c5e07c5c3cfe333733e6259a371bf723695b07f4e327978921107ecb36fc4c4e7fa21b4c9c194ddeb2be71f6f3f5c53361570208707a71721d71222c409d757f
SSDEEP 12288:+yPz5L8U45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:jzyXYz7KEMdX6keYnAcerb
TLSH
T11375120767A630F5E0278239D9A10A01F77278761B248BAF579447731F7B3A19E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b222df3a824783b00be1ae922b5e807f28f88cfaefc3da83888e1a3c6b3432e6
MD5 419fa29f17889867afdbf8ef7d1b2780
SHA1 508717d2c8ae46374f188b5a1383a67768bc09dc
SHA512 7b34223702db617e81467a44edc01401534f27d19949bd2b344dfa69c361dffd5d3975b6f6522af363b89298bec7fe475ee1b35759727f8d942de03f20f6f4ca
SSDEEP 12288:UX45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkc:UoYz7KEMdX6keYnAcerJ
TLSH
T1BB652304891B8AC2F84A467BFBB54540C93A6ECB3B8C93E6DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 38c49ce76de045864a36188961e4437e485ff21215b954c1e31fe165468ed4b3
MD5 4037c6f1ec091554556459511887924e
SHA1 754eaf98ae9f368b1ae1d34c4918bdf54c9c364f
SHA512 92e90d5fec26548fa908ab473e1cba3007451de615e3666ed30961f6582d1bde81b24c41b9b3fa7eb4831bb83f658bf4379ada12824f8b54fc2506f53f65b731
SSDEEP 12288:5X45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:5oYz7KEMdX6keYnAcer4
TLSH
T150652304891B8AD2F84A467BFBA54540C93A6ECB3B8C93E2DD4DF50293FF632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0ecb4e0225eb743c4392d71cf24f50f5b172494738049107b15915b27f68d302
MD5 388b777d916c660842e7b598a398c7cf
SHA1 ff50e97eb7371f005b95b1d831028890625c3de3
SHA512 89a06e2ba368a52e20e47ac07e025e3fe5b2ce0e4ac79609a30600b4eb0557105ac59ae0fa04e6ac4bced30f02c60328080ec085af69fb7e636708ea03d3d2ad
SSDEEP 24576:qCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA9Yz7KEMdX6keYnAcerG:qCUxPTY+8Wg2lIL8lrIUJLWwKYPKEnSG
TLSH
T1E665BE1DA3DC0896D4BB81358A518A06EB32782E1B32D6CF2160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6b48e8323ba18597aa0990494f80bb0ea3d46ad8c3ff0d1aab0087a3ef062373
MD5 07aa27f98cde7d0e1e58d7e44d404dd4
SHA1 129ab1170fcc99ce8053fd81fe52cc82d69b5ef0
SHA512 0faf1087d8ab59d10c9644eac9a41fdeb8ac50a2b89945ce9865ac145391531c3631aa00a5574d7cca22b08909e2a596581b195faef871e39ed788d1c3f3441c
SSDEEP 12288:kzsfH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:DYYz7KEMdX6keYnAcerL
TLSH
T199750109C29802E4D06E527ADB954A40F3337CA657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2f139f935c34b79d4d0ad81b0dcba865c910a0e740fc423c1c996149f165bbd4
MD5 0a2949b530e50a8fb0f186bd78e92378
SHA1 6a4175a94d5c6642b662d105e31787b369f4e270
SHA512 ed8455326d53239661d029d776bca891153e4b81d5c70af913b100fcf78d0f0524d0125c398d718822e374f9dcdd9f17ed3b52fa5ff2c384fae21e97bcdb4ad7
SSDEEP 12288:6K45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkn:6RYz7KEMdX6keYnAcerS
TLSH
T144752304875E89C2F86E4677BAB58520953E79CA2F48C2D3E90CB242937E6E18D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 975d4a37fb81cdfdc94a8707f37fb9be2534e2bf7a35f2a85da07c418b91ff57
MD5 3d790a1a49e543ecac43d609ebdfe2b9
SHA1 8657414994e099de850cd70fdb598e8656c9c681
SHA512 94c4d61322697f6e4c02788c42169ac60783a1ac917c0bfbe267fccc527a1e2136323e023eb64e0b37c5dd023f910f65fcd8b0bc862b729ecbe602cf49eadc77
SSDEEP 24576:o8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCnYz7KEMdX6keYnAcerf:5RZwQCyiHiQEaaPnMQYPKEnSG
TLSH
T11D85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 16209b9ef1236a373ff99962af3c470ac66555b0673c68f8e7cf89f6c52e7200
MD5 a0eb3e7e222e58d960da489710914145
SHA1 d6c6dfa0b4e411152bfec2ab48a1d8abd427e393
SHA512 dd466423d3122497de85d17814b150308233b3665e4ff5f8059b40d747732faedd982b7b37053a0d5ec9fe93d33ac87661163099ac71b2a7f4c4e653226d34ad
SSDEEP 12288:1bxA1U7Ka45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkC:1bxA1UGhYz7KEMdX6keYnAcerr
TLSH
T17875122E56AD18E1F47A923EE9E18101C3327C5A272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 bbb6f4a9e0d8eb1944ff7386a95e7f31c5368463b65b44df13b49449ef6cb6e2
MD5 8cbf264fe5c8506bae0528c59e786f5b
SHA1 7e1249a65e7b732ae01a8edee13923521d1bda24
SHA512 f445ff3e1b438bed9d3f861037f1678850cfaf8cbcf6721512a44305759988745a23216f6bd97bc3fe0df2844bd7bb2a5ad5b281d81638827f028038f5841aca
SSDEEP 24576:ajsmP0yHaqrVqHra44KDzMsrnCYz7KEMdX6keYnAcer0:ajRP0yHfVqzlAsrnCYPKEnSG
TLSH
T10645AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 a860359c70c4c4c3a247ec01416e9f4f3c0182bd7c4df26a8e4d22d351af3f56
MD5 e4553247411791476049c966ebf977ec
SHA1 f802ce222dbce8c7bd0571c08e435de9b26849ef
SHA512 1208d560f1fb007e537a9a8155687ff4b276d48b61ccba271c4d56104a4266059f653b207a44cff2a98f4a147c1113f7ea89a71b2af25d0ba192bfde12263116
SSDEEP 12288:ls45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk/:lvYz7KEMdX6keYnAcerK
TLSH
T1B97523088A0B8AC2F85A467BFBA44500853A6EC63B5C53E3DC4DF54293BE6F3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b15493f218a7bfe4df869fde18003bd4bc9599325f3849c971e7ba6552e8bce4
MD5 fe2e85f2fc312282aa81af6fe4ed5d83
SHA1 8ac4a22d1a9ba3cdc1a68301a84a6ca3967b2e5b
SHA512 ffa66d36535fe7e2906d6ce1ac674ecf31d8418ffc2cdde73a791a07e098a9550a13abce744c4ec803e06176c2622df42175d6b8d0e9f5444834ab681aa8a3d5
SSDEEP 12288:QObMA4LWO+vAYFTW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:NMLBUTlYz7KEMdX6keYnAcerS
TLSH
T161950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 0ae706f4288d1f557e67a5ea82d83a33fdcf9ee1bf07a8a1c790a3a213cb9ff0
MD5 c9bf36cc7837531e9f9f995f0d85ffd8
SHA1 61f70c25e5c62d247e4ff32312a054d124fbf364
SHA512 4c1829051419c3e5fac08e68134d86c32c62eb5cf323bb13a2ae961692f170379d4bdf7dce9af3f530b5650f696c5ee7fa98b35948f3e9a5e7fa0f59d719552e
SSDEEP 12288:z70VmKIYNvUyBp745Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkm:8GYNH2Yz7KEMdX6keYnAcerj
TLSH
T1FE85F11E52AD0CE1E57B917EDAC28205F2737896171193DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3497cdc1dabb241c7eaa2f8f58af86fad3a89833c481467be98f6a4180b6facc
MD5 e8ee943a3684dc3f5780b3fe212f3bd4
SHA1 1e6ec464558f47e77223422e9bb4326309dc9aae
SHA512 a2394ca12a1f3f7e72ebddd22ca41c64b12d99920cf5bf4d89309362dbcf82776f08e59d0762c602d312f1e4a92cf0f52f19dae14cf75a504fda31b703e5fa98
SSDEEP 24576:xnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKU:xnXoJJYH84VVS6AmEcJas+cHBjSSKHPa
TLSH
T10365BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7c1f2ad8cc2cf3361bfb98dd24acf5aba9ce19d5cea362917fc99a5f7406034b
MD5 a87906e47155da3beb2b674220ed2c36
SHA1 b000d54bc25eb7ba039274a9acd0a78674dd5619
SHA512 98a94b451975767d552d9069384f0686ac2841a83aab4d6ad384ec8c960f30e9c5d34e4aaf5a2b0a6f81554cd3b20c3d7c675a849f0cd1a049ee9907a3a5f834
SSDEEP 24576:ev7Xbxd9Tuycf8M/TYlSuxwr2PCsYz7KEMdX6keYnAcerc:eDLL9TuJ0M/TYW2PPYPKEnSG
TLSH
T1C3858D5EA2EC42D4E47BD6BD85B79046FAB2B895273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 5488a00bb70484f051d06a3eb7f889cae850cc246ebc206e59742cd3117a850d
MD5 08e1c183eccddb8f449cb347f16756f8
SHA1 023bf76aed32e6bbfa9271df4c39e8ec4ac2f762
SHA512 ba955528e0b4fe76d2291e59660d6a44fe5ff0590e2a2a63692f82ce57ca3108dd5c49f66730f196ab4498768ea7f5491731e0669c0548f1493337ece356c5c4
SSDEEP 24576:WegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wlYz7KEMdX6keYnAcerg:WngOJOmPOHhlYPKEnSG
TLSH
T10E55CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 8c5164f18ea2e8d904c0752f9b0d1aa4872900036d7e3f8f4c93111b98ba26d6
MD5 17d6373d59dbab0c363d711e94c764af
SHA1 64e7e493ef7bfdb3116c7d25474648db75783525
SHA512 abb7db621caf057ec134c913212bc23ed1fb93e36381cbc972044eb3917826967f836b3503d6497111d3a1b4a106f0ed0ed3d8a856499c2f5634d85a9c8cef2b
SSDEEP 24576:eLJnJiTk3R3waE4JrOPYz7KEMdX6keYnAcerN:eLJnJK8R304lyYPKEnSG
TLSH
T13A85D02CD2A810E4E4B7C2B4825A1756FF32346D3B2569CB59B4D5313F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 280ac484eaed55f379224de3f595abffef0730f07cb7fa940c3175c3fceab89d
MD5 f2530aeb11ecf63a958dd0db9d19c54b
SHA1 44f5f62623949cf9ea3c312a2bba6e7e871226f8
SHA512 e7c0d5f523fc80974f3aaee7d7b9739dcdc974b9dd40ef184b676c2ff7412b9d1e51f87484dc31bfc87ee0c6ac7ce95e0a65dd5a4d76719865ace514a092ed41
SSDEEP 24576:lA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pNYz7KEMdX6keYnAcerl:K9GqCzDScAZmlvTcFg8Ph6LYPKEnSG
TLSH
T1DD955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 c3b69cf0ef6442a40a88a639a9ea9c2b0cc1e282746a6152db40c87120251537
MD5 b2af8b7093d8a4b27a59670ab3730475
SHA1 31b5e978ee83cafa9af6c94bfb7ced1f30824c8f
SHA512 24f9c73a6bf4016ee13d8562a3f4a6a6b01f9ba65d7e7345822610b6a7d1c2be3b207e7bafa5b3795f2159640c7cb92a26e273664760f475ba8715d4b220eab3
SSDEEP 12288:JlYJeXm5nkEUuEm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:JlYJeXm5jUuE1Yz7KEMdX6keYnAcerv
TLSH
T1A475120C669D70E1F02E817EEAA14900D372F4A6274553FF85D4D2768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 59e53f4e67bb9207126f3971a2ca9c4dc97d7916bbbf120d21e2d912acc40f52
MD5 1d2504a89bd58048f750eb58c9aabe64
SHA1 55d97846fc6fa7200325f457073c94b36ed24d90
SHA512 b0ded81e4a617f6dfd3a5fddee3ff003f6c3e4688ae6e7a69d10e48a3e52b30c7878cad0cfef0565305c2638fa751856a7ef7319e70478a1226fb6334f72b5b5
SSDEEP 12288:eCu6kyd45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:eHtyiYz7KEMdX6keYnAcerQ
TLSH
T1E5751204579555D1F8BA0639EEB28150CB36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 ceef7049e08d13a01cf6b3f8d2f88cf66b3ce41a8f35c217fb75e3181e34fcc6
MD5 5b5a0766c9d510bcabfed9483886cbea
SHA1 e60e24db35b86317123ecbd6dbee89deccbfe783
SHA512 3d55960f2a28017d4758a1a2cf6d7ee640622be3fb2ff480a378b98009dfe1ac78e5e49ec03f09841333059fb585a42070f57a1473a6d5550538aea9b65a7008
SSDEEP 12288:DPW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:blYz7KEMdX6keYnAcer3
TLSH
T14975230C461A55D2F80A467BFAB14540C53A7ED63B5852FB98CCF162C7BF2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8f0fa3dd26b708768616cc7bc7dc3844e46790aa4986404e248eb5ef01364301
MD5 12a1f1a8846499db7b11f1e7d369bd70
SHA1 b6904dc59ed01bfa841c3c389295bcf28b37ed63
SHA512 1d652dcf4a6b07ae2cede2714ea3257d794faf522449a5b07b2159e29329ce5b1ab182af5788b7eb737cbc856b080bfd4c7774d1dc8720a395724f58fcd45130
SSDEEP 24576:qC+TyQIu93VAumZr7jm4Yz7KEMdX6keYnAcerH:q/TfIq+Y4YPKEnSG
TLSH
T13F558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 07d724ce2056bed14083165ec0805a7d88fb7b42aae233a2a0d38368860cdcaa
MD5 a5b1b68749557f7436ae5e90a3759ebd
SHA1 126443a937be1d443c1c1e8df6ca7e2c8c72964d
SHA512 87ce191cdf86904d071a901a692b390ac6b60d5349722e910186d72ed0c7e14bce32a98c7f333b085e65788a0fc176c27078577e01ba4f7f4fa6cac0f5121a81
SSDEEP 12288:wcyrWOstaa3kcsS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:lLQikZZYz7KEMdX6keYnAceri
TLSH
T10B85F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 43d9181cd80be2e3ab2ef7a4ee4c5fb0209c0d80a8e16add6c8506d42d7482e2
MD5 2c6a374b67f43fa5c17c02536bec1b78
SHA1 0f97b4f2d1fc0b0b63322c5f115b5a16ec68b797
SHA512 d27e5a0686a5b2f984ba278face31bcaa114919c22b8b82220a1373b11d4163b16c25828f40721fdc07466289b8cb8e0bf3621c15492099389ea53966ea776c0
SSDEEP 49152:qpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPiYPKEnSG:HpC7b4+80GTkjYPKES
TLSH
T11EA57D3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 773c980de714891be3c6d013a902459bcebda7df5ef378f05497ee1d3e651885
MD5 97017445689f8bf5f08c42ea30d7180e
SHA1 a5c657585d6ad224ec9481e29cc7c6a907eb99a3
SHA512 f4a47b4c8114c6f3234e61a97ec3de7de802779a648753b99eae5ca722c2decd041e07b81657839dcac33c84c676fd5ba3d36d12f3e20f1d9f29ad6eabee0e3b
SSDEEP 24576:kSAwJPE1IDAo+4Kt+l44135UQqYz7KEMdX6keYnAcerP:kqPCIo4Kol4/QqYPKEnSG
TLSH
T1D855AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 8abcdebbc65368541b7430fb0e1c07b2b5c7abb4a2f7ac4c5274d8c1b36d1982
MD5 4f555d1454f3fa95c632a0fe963b16aa
SHA1 eb7bd0d6ad4efd1d39203db3227645d62b0d3af3
SHA512 09e341c4939435f497378dcd59e811052f3970494f66cfb0e5eed0220b42f47b7e612f287465f2db4e739d667fde6b8aff2a458fad6f4a3e026bca43c3e4ef04
SSDEEP 12288:YSsyLCFBoPLCRyg6NQ4tV45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:gyLXPLcL94t6Yz7KEMdX6keYnAcer/
TLSH
T17595E03ED66D08E0E47AC27DD6A38906F67238AD033166CB19A491751F6BFF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 f0dacd8191eed48ed3fa04da5ce695f7647af26efaa70a79718389b2c1d62794
MD5 882555635a21a00d196eb1631d2d0536
SHA1 0cfbf2d559089e1d60829ffc1d60f9ca4cbebfca
SHA512 24a5a34bc9c893b94c811442604a67e0affa600c57f9700e7349584c38c15a976da7a7ce56801f91188a89c7e7dd8079788e22a4e6c6d8ef5eee1324992a4a9f
SSDEEP 12288:t9lyvj3IkxjbBzC45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk8:tWv8qjpJYz7KEMdX6keYnAcerF
TLSH
T19B85120D46A468D0F47A4234FA728121C172BCB727689AFFB4C8E5774B3AAD1853EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-105-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/828-391-0x0000000000E30000-0x0000000000F2E000-memory.dmp

Download

memory/828-163-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/828-100-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/828-109-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1060-77-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1060-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1060-86-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1092-114-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1292-373-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1292-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1748-24-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1748-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1748-108-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1748-25-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2076-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2272-368-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2272-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2416-154-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2924-122-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2924-128-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2924-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2924-307-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3216-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3216-38-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3216-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3216-32-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3416-107-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3416-12-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3560-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3560-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3560-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3560-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3700-142-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3700-136-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3700-145-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3940-408-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-398-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-381-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-377-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-380-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-379-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-378-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-374-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-383-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-372-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-370-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-376-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-375-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-384-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-387-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-397-0x0000026FA1670000-0x0000026FA1682000-memory.dmp

Download

memory/3940-403-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-402-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-406-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-413-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-412-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-411-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-410-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-417-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-416-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-415-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-414-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-409-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-386-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-407-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-405-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-404-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-401-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-400-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-399-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-382-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3940-385-0x0000026FA1540000-0x0000026FA1550000-memory.dmp

Download

memory/3988-155-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3988-70-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4160-66-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4160-68-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4160-63-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4160-55-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4160-61-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4272-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4272-41-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4328-187-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4328-177-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4328-393-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4328-179-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4328-171-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4328-203-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4328-388-0x000000000B980000-0x000000000B988000-memory.dmp

Download

memory/4328-221-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4376-162-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/4376-89-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4376-95-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4376-97-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/5140-159-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5140-369-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5172-119-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/5172-263-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/5608-168-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5608-392-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5728-85-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/5728-0-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/5728-371-0x0000000002450000-0x000000000254E000-memory.dmp

Download

memory/5728-8-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/5728-2-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/5768-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5768-228-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5768-390-0x0000000140000000-0x00000001401C1000-memory.dmp

Download