d36e7249e20e62dcbd0b6e307f8af1bf531a3f65485119989dbe322e768bcaf5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260511-b1bfpshw81
SHA256 d36e7249e20e62dcbd0b6e307f8af1bf531a3f65485119989dbe322e768bcaf5
MD5 9c64d627b55ab318a9ded89a0a57b356
SHA1 654271cfffa208659f74b835388ad2c607264847
SHA512 6f7de68fcb75c571e42348789986a9c239b84cbab9e1205a773451c38cd6d039fae3278fc0785b81a860622dc017088d4b1a2851051ce093bb29f25c028c56f7
SSDEEP 12288:EvPrGxzQ9TA1ubv6IQ3HbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:EvzGxms3MYrHzwK6kYDiPi+S1/g
TLSH
T17655020172D2C0B7D9731A3044B0EAB0653DFEB05FB549EF2384176A6EB82D29938767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5508	alg.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
4064	fxssvc.exe
3456	elevation_service.exe
3664	elevation_service.exe
5904	maintenanceservice.exe
4668	msdtc.exe
5888	OSE.EXE
4620	PerceptionSimulationService.exe
5864	perfhost.exe
660	locator.exe
2964	SensorDataService.exe
4236	snmptrap.exe
5044	spectrum.exe
2392	ssh-agent.exe
5324	TieringEngineService.exe
5220	AgentService.exe
4156	vds.exe
5576	vssvc.exe
1828	wbengine.exe
4528	WmiApSrv.exe
3336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\838bd02db955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\UseRestore.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0cf2a9ae6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048d5ae99e6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb597d93e6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
5000	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4064	fxssvc.exe
Token: SeRestorePrivilege	5324	TieringEngineService.exe
Token: SeManageVolumePrivilege	5324	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5220	AgentService.exe
Token: SeBackupPrivilege	5576	vssvc.exe
Token: SeRestorePrivilege	5576	vssvc.exe
Token: SeAuditPrivilege	5576	vssvc.exe
Token: SeBackupPrivilege	1828	wbengine.exe
Token: SeRestorePrivilege	1828	wbengine.exe
Token: SeSecurityPrivilege	1828	wbengine.exe
Token: 33	3336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeDebugPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5996	2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5000	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3160	3336	SearchIndexer.exe	104
PID 3336 wrote to memory of 4404	3336	SearchIndexer.exe	105
PID 3336 wrote to memory of 4836	3336	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c64d627b55ab318a9ded89a0a57b356_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2624

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:660

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2964

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2756 2744 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4404
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2808 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 45f57c3c50fdc73b9e6460c3c882d342c411ff4e0f5eb1605062c0e5f3996676
MD5 583316e5bfe5f02ac9d140835c77d2d0
SHA1 4816491489fb09447c38c0464a2117f8c957774a
SHA512 a46775931950aa54f2eb4aac795791ad27a830de56c0b5c828aa84d3a5e1712b6a9c1785451b67c967b46f1746c12c96790e0ed305e3b631345507849bd33871
SSDEEP 49152:db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnRL0mWUC4:j3q60jBq0VR4
TLSH
T1AED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4077941bbaffc3a4dab0e7d768f40f29fe5933d1a2c1ef768dd8c3c09d14044a
MD5 1dc385591aa4ad8b08f65297be71777a
SHA1 318ea35ff8f1e696b36310d76384c6b399957155
SHA512 582499572c0b952211b6dd43ca445dd9a7c48c4279a3f00cdcffeba2ebc393c372a9512f12abb14c78ab5124767b52e32a8d071eacd7bb538304f6b33ba9f9e2
SSDEEP 12288:81XLsswWkxy2lRq2czAAbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:KXYfDtczAAMYrHzwK6kYDiPi+S1/g
TLSH
T11165021867E108F9ED678279C8A2C501E633B89187B0E7DB03E499651F373D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 54f4950ca867ff48767c94f77db25e5f404b059951ad0111e7ba5225fb096f73
MD5 b98f11e7d5a490dc020c37ef8836fe70
SHA1 d9e4a362d399c600beda946e1c56824a6b812a0d
SHA512 8d9eaa808e61c67a3ee5d4729157a1c8ebb96aad7ba46bbf5b9044f4455931ab9982bb87ad7c5832671fd1d2fb649934ad6439842265b7ca1aa6f3f5059b6f1e
SSDEEP 24576:c0Le5ji0hmxNrM9MYrHzwK6kYDiPi+S1/g:cPji0A7oL0mWUC4
TLSH
T131859E16F6748375D073C0B9C5D2A68AE97130825B308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e254784226fcedf7cfd6c657f64641a16bdecc8f187a850089a959826bfa468
MD5 88688c62702f1571d26839c50253c95e
SHA1 2b77ae9731e368faf6a59d9fc10f532a291ede43
SHA512 3526741ba0962c2f937f50fa03e87532d300aaa8b4ee06f0922bdf29bd21ee4dac6e0813d23b777c8d40f6946cfa7c1544dd18a54ee0ce388e71e55cfe8ea45f
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWr6q8wyubMYrHzwK6kYDiPi+S1/g:x/ezSC6vUzPviHjysL0mWUC4
TLSH
T133755C15F5788323D0B2D0BAC5D6BA99FE3230865B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 de7ebdcf134456a2d04e97dfa8365962e015a7e61451c9a92cf9c802fc800c48
MD5 43be78aebcc99af030c4694227d6f1fc
SHA1 2cabf3f2067193579adbcb5ff7ee97f2b504fbe3
SHA512 044690db299ff1f3e4a4fe2671880e2d096693885699db29a71c3bf835526cb405f14298ac2d8687f2f5713eb0e1979f4189ab884cef0a4d9a7e0937d44bd319
SSDEEP 24576:7VbqPb88hv/l+bMMYrHzwK6kYDiPi+S1/g:7VO88hXl+6L0mWUC4
TLSH
T16D559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a29a802755134e30413a7fe1b72641f30a6f55aee814708210d68483308b9e67
MD5 6c34d4f884269a0598a5bfbb74673c50
SHA1 452d8ee59327b7002f262519de334be7962b5955
SHA512 a13ae808efb0321a663ed166bb1427a8efdc14bdddd660b149096e2cb5da480eb0221e61f235369f3884fe5710b8d381d5b35352064628808a6606355b31f0d4
SSDEEP 12288:pjJbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:pjJMYrHzwK6kYDiPi+S1/g
TLSH
T17E4523028BF380E9EB6747B254E5BC84A630AEC0E8FA85E5078575A67CFC5B5F438056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c734a1471484fc62fb748aea8f428650ba5699995d05c62a145c554e22783a45
MD5 a58ff6e21995f4250b615d4175010e08
SHA1 e9dccd1edb32d1f18e5215676d89ef36525525b5
SHA512 913517ced8ca6f6f6e929c4ecc67c9872ee15660e580fb3dabab86845477b7790fb9a63741478d6f53b9863f814f4e78b944802be4a101481edc265b1b2410e8
SSDEEP 12288:aeBNUbTVO86U0bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:aJIU0MYrHzwK6kYDiPi+S1/g
TLSH
T1C565D02BEE38FCE2C27A8DB95691C600D77278704F6293CBD265820EDE275E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0781512ea78d4dc60cc6d38f6695837a211284788371f73aac7621bf3d34dc48
MD5 79455d4e3cb101f5781f01feb0ca94b0
SHA1 b4684fcd836c93ad02ffd3e1d29fbc36cf2fc96f
SHA512 d50df46e76ed1b30e70970c7dbd53f5644b205f2977bf7d56a93553bd8c4bf0699d276e49223a21e50e4773887fa750d7babcf5ad8eb3e153e558ea8f700f3dd
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:EQvGAdlCEL8c/RRNw5CX0VR4
TLSH
T150267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 37ec1a3e088fe5d3416ada8c46ca2d5f892dbfcaa72b53cfff999f6dc25e0d8b
MD5 2c5b09ff6a47997b7f9b80f473a2173c
SHA1 9af441ef807c7d777ee3acc11d99668b4b3ac48d
SHA512 5eeded7e72873b10f379ae85abce3c054da8ac6664ce41c9cc6459e264910278fe2bd0a8eafbdee89b9b7d8df5aee52ac2298128d7b82cf4fa05ced7bb308bc8
SSDEEP 12288:5AwSfxL/2Dc3DDLLmt0LDQewsAjybOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1e1:qSewsAjyMYrHzwK6kYDiPi+S1/g
TLSH
T16275E031FEB5D036C77B0DB21B36D706143CB9604BA219C3E3A88E9E59742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ee4b53b4d80401bf13bc5ebc68b98b7307dd95dda319c699a1261af6b0b32b91
MD5 3cfac858fa17a94e8e2d9d612ba66248
SHA1 ee22bfd5e43af2198ff14472e6c34e9d9e167052
SHA512 e2767045723c9ebf4fc909f2ce853128f3c6afcf739acc52d6124686dcbaf2f1ead0c56818b13f135fd2d242ead96a8e075f595a5c4979266eb9eadd77bd9551
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHs0V:kUEtQevvqc2W1cpV2RI32sM
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 34c9a8eab3e5ba76fbb66f694600138be8c6cf4506190f4e4fcd77b7affa7d13
MD5 2734b2376c30218c7bf3c77fc6d559b1
SHA1 31fc5e97decf9dd6b1ceb72e81d28a5ee4be0338
SHA512 e109e0dfb32a68b9425e615afe8171f04fd98d491990838df6fa78caac07e50bf5750d15fbfafe9d1d4cc193cb0046be6906a9acc28d78b9c6e15114b2266e4d
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/z4L0mWUC4:9oq2VjnmT0VR4
TLSH
T1FFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b622524c4cb76e4f8cefc5d273477fdf15260c2245058dd842e8975648455c92
MD5 918c98f98b8af81eadb07a5117ad34d2
SHA1 499bac61773039c04d40d5af32e62dc04bef2fd9
SHA512 08b9c1efedebf08ab1c92076376da4857575e2da6dbdf4af49de946a027a37d3e7bf46e69640651b8721a2d2528decf7be6cebf5a8e3b577f1bd53abe9c1c42a
SSDEEP 24576:OAhGL2IFoiwtA5l7S53/MYrHzwK6kYDiPi+S1/g:OAM1Foiq5vL0mWUC4
TLSH
T1BA35AD80EBF945D4F5B3AAB899B69570EA72BCA55E31C20F2250D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0be2358f102d3485ba0d68119b75587a1fb572b50c92644b9047c5b4931353ee
MD5 c32a93ee9d0dae17032f5ca18b03c117
SHA1 4fcc0f64178ee06ebbf0fc2378d875bcd97bc03d
SHA512 319736cb7373c11c47a0ae6adfc62103b33c19bdfba1dc198105ab8de4afea85b70f0aff05c86c3065b9de34fb7c390e9d5eab05fb07ccdfd66f0786da755894
SSDEEP 12288:Smw5HEjsChNSBFgl0WDm+C7bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:LwuXOWWMYrHzwK6kYDiPi+S1/g
TLSH
T14665F14677E50CF9EA6782398597C431F7B2B8412A25CB2F0760C65B6F37261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9f953ec2871ce5ca5d067a847a9bb4cf27a8d1215d0aed36577bf497d74b4bf7
MD5 fd759ea33300955fe3153379c4023f43
SHA1 287121e7019cecc7808cafda6f97c614732f3541
SHA512 1dc6e4852da285617445b7b0c816d2d41e9ffc4f559701736360263c97b099bfd5992cf44c890bc08481d1613b4d39fd309c9e189bc74b57af744ca7a0353111
SSDEEP 12288:9/Z1IyibOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:FZuFMYrHzwK6kYDiPi+S1/g
TLSH
T15155124A23F560F9E2A38379C8F15944D33178D2A77683CF175442A62F7BAD1AD38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fea3e5e690f58848f681fd00f88c373dfa39d2f4d4e38a0ad70f4c1ad55bfee4
MD5 8f7c5d43e97e55e33f0a187b5b42a9d6
SHA1 3f42cbb801a78a09e749e30cefab94ac04ae0fc9
SHA512 f4dcde78d0d43130ffd86c3d19bc3e17fd9c3766fbed1e122feae13bcfb232134cbd3da316af260b0e82c81f3e6cbb41dc8f357ddeeaabd8a5c6126b560a8a38
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U:5QRQyi36YOcPhLvw2gAf+PN3+0VR4
TLSH
T127667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b305c3088bba69f670e71c7b877424425c37d8aafd05e25665200e280e8d433
MD5 d958b315e3ba00b0f7d013cfe0574059
SHA1 4dadf51425ce94db62798fe99131ef1f4590efd6
SHA512 909346ba0c8654c0c7272000bb54e8b335b8f6f2a2ba51bda9831fe3cc7165d1b1dff93de3020c9694f06dc4d19086d19321a2dd798b4bb52bd038e9f4819a09
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U:eQRQyi36YOcPhLvw2gAf+PN3+0VR4
TLSH
T1A7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5d68b99a7668719ea251790e6be74a802e0484d51caa8ee6d25fa2128f2b3827
MD5 9eeaf62f0640d0ccaa0e677427d51156
SHA1 cc22585bb81d6738abd3a4da5455d187dd3b30ef
SHA512 dd13fa2a41f00c46dc1d58022c32ed7583d13505045e8931a44c63cd98f75eee2928ce85c5837688f4c6c75e0eebdd5eeb98e428593d5d52dadd672ace833fdf
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0VMYrHzwK6kYDiPR:Y68Qg55nhceWu7PNU3/oL0mWUC4
TLSH
T1D3B54933B2F200A9C44DE1769F4A972196D17C75CFE1E3DB860172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ec260330243fd8fb8d68d588bbfe1b15547efd61c9a5f8e12eb6a9589caa5d10
MD5 34fe1b81d2c39ac8419cca63ced63232
SHA1 011eb5761648fb7a5a1568d0865f891c44c2b1c6
SHA512 ee77f6384b3c22f1fe1e90068b64d967588c5f51317fc65b8be5a8b6121e4c1f9e6ac200ee9a74bb85e1321719f0d1c5fc379700f80557c9b81e48a69af27ce0
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk992:Cy5112gYy5azzVva69nLKnhZx0VR4
TLSH
T1D8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 64eeee7faf9354b671caa397328851c5ebe3157199564413193ff0ade65e2249
MD5 9419050763cd45cefa0800c8092651b8
SHA1 85ea7c5a4255ad2ada63acc7ac0dee782964c4b1
SHA512 3cabec48e33a3322c5625c7a9ef00d09c5334dc8136f3a242268aa695e319e8a711da87bf8f0ba23015bd97b24b869237a3e57506dd7367031d20f8953d8d8f8
SSDEEP 49152:aB+taZ3usBWOBr4tEG20bqx0z+n217aau1glCL0mWUC4:Iu6JmUxd2dm0VR4
TLSH
T11BD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a6f29deffe2d598a5489f91c8eaea70d85905b796c4794fe0083034d3a07fd8
MD5 6e2aca8e5396e5c738ae2db9de69f312
SHA1 03361cf703953c996608378b33b9af36b96413b6
SHA512 cb54af2cecb60a04112d428fe90081a9cfeba103584fb05386ebe53d5d2cdb96a59f78e9294c829f4212717128b8f95f403fa584533572fdb3240b6787d281f0
SSDEEP 49152:t1hpsNoJpF1A6BU44CwH7R4xWL0mWUC4:tmifPkRT0VR4
TLSH
T1D5B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6e54c390c1b8af5d1605169da332652dc6525e7235939a077a915a6464ce67ab
MD5 07d55136ba78a3164ae7fb4b1a36f4f7
SHA1 be19f8465a6d8a9ca37dfb28af755271ed34c18e
SHA512 5b54ccb9707f21b869c5f6c4a271358316bda06f7b155baf0da19b0dc6e127187b4a059243f8a94d39df441cc9e47f9b2221c6d5cfa4ff6ae0ef6b25053e5462
SSDEEP 49152:DSuZQIY0Be2KNRVtOnks6NMHqBL0mWUC4:h5dKvi61l0VR4
TLSH
T10EC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bdefa160b66920e1fca66e6aee6f4768742e704bf3df97e78528f7e217678e57
MD5 f5acc9fee50a6ba426db9615cb299d53
SHA1 4a42f39994a5f056cdc07246931a78d4cc5c1840
SHA512 02f41cbb9ab6fc6430baeaa1d9a4f775dec9bb3c23d7c721d414129ef49588df820858166e1b951c9cfbef32007a3e2a86bcbe6d323d1f8c9785d5cdc4999a51
SSDEEP 49152:IhtSn8EApI0figXgiDn0AP5wyL0mWUC4:ZX2iyphP0VR4
TLSH
T17295BE13F2D900E8D05ED174C7568632EA62BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 33676d9729a70108e289eb19611088f8c62ccbd512a7481c83dc9a912da35fde
MD5 8c03c46ec6feb5973694c9eb92265bea
SHA1 e58f63ebaa540875b186b20021f0e97000b4cd5d
SHA512 d6aa2d6dba6a3448d65e1e2f02982e184f440ab5256d1c1d63047f067389af44c7ad306801fd9b92ec08a862c9eff51d16f63d8eacc58cb44268f43dd87c5b23
SSDEEP 12288:7RbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:7RMYrHzwK6kYDiPi+S1/g
TLSH
T1A1452306CAF780EAE62687B284E1BC84A530AAC5F4FB81F5174D21627EFD5B5F03C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d2753578a78d2b0db93fd8d5be83e5465459625553fe29c16b4590d70c43345
MD5 3b366f80bd3f0b88585de03dd4905715
SHA1 69a5fc78adabbb7585a11baadaec18d72d441f7c
SHA512 88d3b0fc99284092603e185135ad58b7122787422e2f5c57680c2a8948a60df30736941fd9fb24b65f6a09a55f3a48163a4ce5dad1d776ac02703c6dfa9cece1
SSDEEP 12288:BObOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:BOMYrHzwK6kYDiPi+S1/g
TLSH
T10E452306CAF380EAE62687B284E1BC849530AAC5F4FB81F5174D64627EFC6B5F43C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5835fb04478647db847b3ec6662eb60a8f5686a60eeb85b6a99031ae8bd2604d
MD5 67c40603d5ff0924c2a2dddfb1f689f4
SHA1 a01613dabc63cd379e712e64c92470e2b918fd6f
SHA512 cf8bfea628c5307f7df0204f64b86a85de40e392f32fbe1794e82af722f3f607a6f604fe80727ecb7bbcb4d75b5ecd439fc411d91215dfcfa9c0d040f597d3fa
SSDEEP 12288:scbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:scMYrHzwK6kYDiPi+S1/g
TLSH
T16E452306CAF780EAE62687B284E1BC849530AAC5F4FB81F5578E20617DFC5B5F03C499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6495614c3d83c7314e12d2bbfd1ccdf224891e8b38c1014d5201048588b9a314
MD5 611cfc7c6340d85007912fefd9d0456c
SHA1 b20928889e9b1842068390dc64382a782177cc1f
SHA512 1c44282546a867bd522b5b4679ab57f0072075a4deecb03841c0758b858504591e2cb0f909f972754375acc7b6d59ce23f98c2d61050b7d3d53536459a4c1784
SSDEEP 12288:NVfbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:3MYrHzwK6kYDiPi+S1/g
TLSH
T1854523029BF740E9E967C3B2C4F1A840E230BDC4F6B682EF574514562EBD7A4F838A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c53621daa3a2ef58cf576f6b5ab7512fa23969087c2190e60cad33cbe542be5b
MD5 26f463546e4b0042dffe08882c2811ea
SHA1 4c10efaa3e4e496bf96e2cda3976fbcb84c8432d
SHA512 b7e2257a1a92eab76eac8d472db6d164f6755c7246282e57c4e80bb1b011aa14b75a090dbdaa6cb246a2d66fba81a10133d043280047f828d7fc34653e2f9469
SSDEEP 12288:z3bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:z3MYrHzwK6kYDiPi+S1/g
TLSH
T147452306CAF780EAE61687B284E1BC849530AAC5F4FB81F5178D20617EFD5B5F43C499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6176ba5faeea013500a2f767f5adfb96477085ead1d7f6e6c7340d4f229a03ea
MD5 a40348c36c40469e5385ba249b1ac163
SHA1 fd8d756e99ae791cd57443208f9bed9c24d23bae
SHA512 b3b90e9edab438390f40c15abb0ee5e8a727af23e6721a634433633c2a77777069f9a71d89b112b76d6672f9ac16fc72e5605bd2419c89f38bc1b14f368f7466
SSDEEP 12288:26bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:26MYrHzwK6kYDiPi+S1/g
TLSH
T10C452306CAF780EAE62687B284E1BC849530AAC5F4FB81F5174D60627EFC6B5F43C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 264e5209c32c002cf8403d41a464533cd136e8650cbd6657c2fe74232b925e1c
MD5 36f0d815a3f014751e0d9011409697bf
SHA1 f4f0db5bbd1f3a3fe1ca59b1b40db64a870ecc00
SHA512 c5874e499f72845c9346a4a1e6dd0b2b9b01ba63e7e3590a4d41555afc17e006903409fe7dd2d448fa35b35783b35c37293997b620241458d6afdb58a30fc3e8
SSDEEP 12288:PmbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:PmMYrHzwK6kYDiPi+S1/g
TLSH
T1E8452306CAF380EAE72687B284E0BC849530AAC5F8FB81F5274D64627AFC575F43C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 60cce0d51133a204a0577d2ca1731780296f14db15b2549e169f2f126bad4a82
MD5 b0894ecd6f830b7ba3649fe39309907c
SHA1 2e9a750ca12d1bc113f97108d2f4ab078045fde3
SHA512 543ad5b2c428734c93a6938d591ceace4a9b66d78bda6b63bac0d5a6c091d87c33fc798a211b388d1e326697e246562edfcc94c650fee82263d0228c1ce8af7b
SSDEEP 12288:aiZwbczzFEoS2cPvyubOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:9ZMMzFVSOuMYrHzwK6kYDiPi+S1/g
TLSH
T197650285B3A108F8EC63823EC8619D05D2B27C995BB0C65F03A436676F773A15C3DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79694f5bafe4178898168ae9de4bf41e32b84325cb405bc147cbd95206fc243d
MD5 65581926ad0a40c677828698d00e6ff8
SHA1 18839159ec34bf2fe076ff8653b40e5ca184a731
SHA512 57b338a8842d5005debb89389354557ff75d828539185988dd7b142a7534216d513de7a1cd35032945650ea36291ad00ea29fc06613ca2dc827115821687cc4a
SSDEEP 12288:I1bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:I1MYrHzwK6kYDiPi+S1/g
TLSH
T161452306CAF380EAE62687B284E1BC849530AAC5F4FB81F5578E24617EFC5B5F43C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 616806592dca1af1119a1e9cc30124cbadeb84e2300952f221d2cac326dd6d8d
MD5 7331f6c8e16d54ea42298b1d33fda9ee
SHA1 54f7e6532198bf9601beda7984c880a04fa16239
SHA512 0d76242fc98bf100e7eabe677dc217ca9370c0cd5f90430eb96734c12f3078f884163fe0c6eed7a357135d3584adc8232795be3c21e39dd58ed67156f57b7b88
SSDEEP 12288:S5bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:S5MYrHzwK6kYDiPi+S1/g
TLSH
T1314523068AF380EAE72687B284E1BC849530AAC5F4FB81F5174D64627EFC6B5F03C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 47909f0ca3a93be28087c270b0d1f136ab279aabc965e9640aafe70aff41c29f
MD5 1fedb5a0ba9cf5a1c1cd2a2ce9724187
SHA1 8d6ec626ad896e6188b210e8e14baa3eec45d919
SHA512 ed6253b3fad6a433799ea9fb2123db86d6d303b54bc2e212593e5772727c57682a03083a1cf4c42c88fddc407e266d7d77844f5f65f272ed36a992617058a656
SSDEEP 12288:fyPz5L8ibOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:SzyiMYrHzwK6kYDiPi+S1/g
TLSH
T18455020767F220F9D1378275C8A21901F331B8B197758AEF179406762E7B6E1AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0f70ff2c1221cfb4b4ab41d9e4003518a47f3d71f71647f8500af383a2f4e02b
MD5 ef151916005c6a77d96f146a937bb6d6
SHA1 4da73868b1d024c2c60905b08aa5155516798c78
SHA512 5da6d8f81e1d9d21fd4d494e8caf366be3b4a660ebf9788a1a4e094540a5a415acee835136af6a6aee3fc30c7f28b514aa537b69c7bde5accee68a47b2d2486a
SSDEEP 12288:61bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:61MYrHzwK6kYDiPi+S1/g
TLSH
T1D4452306CAF380EAE62687B284E1BC849530AAC5F4FB81F5578E24617EFC5B5F43C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b20924f9d73db3f28cbedd68144b944c10b1f4703d4ac25d6bbac0d3031b7d96
MD5 e5bfc96b3502e1ebe04df6b3fba64afc
SHA1 3ee6c7ed9ea11b74015e8a8176109e9f4ec2efcd
SHA512 61663ae776ab0cca4530f58ece65ce70e79735772c519ff35f47b43c131e02a1bdaa6bc2f2f28f185f98ca91efcdf6f02d08a2283c8eb8c442738eabe7fa3468
SSDEEP 12288:S1bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:S1MYrHzwK6kYDiPi+S1/g
TLSH
T1FF452306CAF380EAE62687B284E1BC849530AAC5F4FB81F5578E24617EFD5B5F03C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 de052a5ae717bcb763e710057061b049901a7d70a89fc714e48d8d17aedc86f9
MD5 ced17d5f1e2f08a897a406d4fde2224a
SHA1 b241e8516c2928e8878980b926adc08d63adf67d
SHA512 8e9339ccce64653b5315de631c154b821e3a5ce57553470d16327eb4f05e23a229037aae448ce0d7efc5ff1ced20eae8e9c7b5f9e186d008fbe005352f9f17b9
SSDEEP 24576:dCUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAYMYrHzwK6kYDiPi+S1/g:dCUEPTY+8Wg2lIL8lrIUJLWwHL0mWUC4
TLSH
T1F965AE1EA3EC0896D4BB813589518A06EB32782E1B32D6CF1160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 15b7c7b179d8600afe07b39b84ac2ada80e7c31a758b7009a8003aaee03429d4
MD5 982cb28f3b5f76e743c74ad877318f40
SHA1 f13e8126e0a04dabbe79031db7d3cfb629de4c8a
SHA512 2db4dccc9e06afde066141bc456a5530302dd145110a05a08038aca727aaee8958511f3cf2eeb97af314b06a80579fab1cdb872ce6e4619e940685981ae0f539
SSDEEP 12288:TGsfFbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:5FMYrHzwK6kYDiPi+S1/g
TLSH
T17055F10AD2A501E8C16E6276C7915A40B3337CA597F2D3CB57C0F53E2F7A690ADE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b7d07dff542d0be8a113b82108c6741d1413c8f6d28ead70990df284d790deee
MD5 2eee331abf034d4d74b7bed500d4b1d8
SHA1 e6eb600c658146fff41b5761e84d236ce7f1ae7b
SHA512 2d79d4d29f078668abcb499d9163a7852eccfbab201c78bd6497fed6272651f061b4b4657975e8acc5f7271402797e162a15ecdd1a275ee1612b2197c44aaff4
SSDEEP 12288:i8bOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:i8MYrHzwK6kYDiPi+S1/g
TLSH
T172452302C7F784E9E67B97B140E5E8106224BAD4FFB6C0E76749219179BC9E1FC3850A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 38d3c7dbe7d45de97108d187f199c500e0228f0e6feaa285051b9b83f32cd7c2
MD5 431db5e506698d3d3b1b2b68139e6de3
SHA1 2b949b846aa5bddf37b0bcbbd5520d29a3204386
SHA512 604e1c39ebdc1e5bc47a848fb2aaebf7ac87d9380deb83642bf814108f86475f0124f69cc7ea20e4ad77882abb7531f96cefb24acdde88f06adb88f290b7e7c1
SSDEEP 24576:K8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCSMYrHzwK6kYDiPi+S1/g:7RZwQCyiHiQEaaPnMpL0mWUC4
TLSH
T1D085AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 27ff5717272bc94bd39f73803a265777c66db57585bdaa07a5f13a524de97c0d
MD5 8f4895b983c7ba78b6678bc84b25b4b7
SHA1 a7daf2cddc1e6421aa795b6509f3cb2121526068
SHA512 1edacf9e0393503c444169c20dfe30868347e037950ee173392fb4cec848093aa3be175dee54306e05c818befc92cad4f4551517d69a5cf3756d745383d9c9bf
SSDEEP 12288:4bxA1U7KsbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:4bxA1UGsMYrHzwK6kYDiPi+S1/g
TLSH
T18055121E56FD14F4E276927A88D18004D331B896A77193EF12C5827A1F3BEF4AC39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1994f2bdcf3d182d8f3c651adda3ff88c699f1a84ce6c9a2a0febc3adcf3909e
MD5 0c7228472644972004ea132c487fee99
SHA1 9cccab1af94e32a81b73f7b1fb289ad8186f520f
SHA512 21e3bf872b195aaaa8e9587a849e23e89ced092fa21b4b6cc4ce5decf4adc01264c0036eb9c5e5471d5f112f6281b527fcdd4dc83f01300a6aeeefcf31eda6a1
SSDEEP 24576:ajsmP0yHaqrVqHra44KDzMsrnPMYrHzwK6kYDiPi+S1/g:ajRP0yHfVqzlAsrnvL0mWUC4
TLSH
T19245AF2EF2B910F9D4AAD236454107B5BB71B42D1F219AC70170C634AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9ce09e2ab1b38745b345a69a49f71e930e2b4ae388b50b22c2624aad39e004d8
MD5 b529b39e6e171235d17a53de89160012
SHA1 736bec07ff4a0106622549e72e7b08df92684dd4
SHA512 41f681b543ae76f544bb29224ccd467c21984ea9872e98220bf9001001f123031b58bf8718d8a4a47ce332e6c00e68ff54b8481ffb4ec0131520dec8888f1bf4
SSDEEP 12288:HabOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:HaMYrHzwK6kYDiPi+S1/g
TLSH
T12345234587F780E9E62687B244E1AC40A230AAD0FBFB41F7178961627EFC6F6F438455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d0470846ac08b7eded519a7bbc1a5e73276b07717c94f859c9b288ceb3b2a1b7
MD5 dd9a7f19b85818ba0e1c923a4674b502
SHA1 47aea76d9ab4f9a3a29ba77ae710a56b7e811ddb
SHA512 26c9c03f4506207fae59c6092b1f1785b14d6089b92ad76e41bf256aa93491237b1f9923d797000101c742b0687c9e26328bbb2c1b7fd9009b75c8050c0427af
SSDEEP 12288:UObvA4LWO+vAYFTAbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:5rLBUTAMYrHzwK6kYDiPi+S1/g
TLSH
T1D1750105E7E500F9E977C23CC8A29916E272B49D1764E7DF03A84A652F637E18E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1553a0942c67869881cd1588fd9fc666ec79797639ae4829aee53d59b229738f
MD5 f6caa9a7be59f3bd0923ed6865839685
SHA1 2822d43efea1de73247f8790bb2d199e769ad99e
SHA512 213e25d9fe098e393a8cc94d61d5276c0834c127fa72416f7efa491971982f1e18ec9e3e2b616d7558bcead86ce38c053b3f086ae90e8f516a2ef25f4411e419
SSDEEP 12288:r70VmuIYNvUyBphbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:U2YNHzMYrHzwK6kYDiPi+S1/g
TLSH
T10D65F11F92AD08E4E53B927AC9C38509F2727896576192DF05F0827A1F27EE8BC3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 155b3d8b1a46022f3e146c0b27573c25b0e9593691bed69758ea6eed82f78476
MD5 0d919273b8a9d71547b0523d3689deb5
SHA1 72e3570693fde941eae9bfc63f048a458c2b5e8f
SHA512 5e53166a0ba2b16eb2ca97d6b98cc8dc6d6608a4c41a827ad0106937c1fffda03ae397288450f1ef9e3ef1e4245aa1e3284884ac34c2777987ebb175cbd08c29
SSDEEP 24576:xnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKi:xnXoJJYH84VVS6AmERJas+cHBjSSKHPy
TLSH
T18D65BF5EA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6670ae1df50fea3deccb33aa4bf23c6b98dd03f02d0c2481d8560de71f38847d
MD5 2f0e9fc563566925aed1eb7161d567df
SHA1 aa99fb9882790a0cd8f6bb7f89fcadc52bcd4612
SHA512 0376d08b67975c9a651100e237a4c5e835abb393c0c7a82c20745c096898e5c2d2d18f7f2f11f7666186187b1757e666ffe3d08b68d933be0146a5559247e79f
SSDEEP 24576:cv7Xbxd9Tuycf8M/TYlSuxwr2PCpMYrHzwK6kYDiPi+S1/g:cDLL9TuJ0M/TYW2PQL0mWUC4
TLSH
T193858D5EA3ED42D8E07BD6BD85B79046FAB2B895173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cfa2eba440762c9953367d2806cc849f8423c684c098e51ddc668be95762629a
MD5 385ca6536eab7b02913ac3dc8e73ae2d
SHA1 f3f3274a92a7c2ed674e167c1e83be650b43999f
SHA512 5008a6d4a9b95a94550d4b7cd14edc90d706d758117dc348b5c294f12e7f521bdae585672a898806f5c5fcd74a6419d83caab475076d87313cff642684501c3c
SSDEEP 24576:yegJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10wAMYrHzwK6kYDiPi+S1/g:yngOJOmPOHcyL0mWUC4
TLSH
T10955CF2FA7BC05D5E03EC17D8A928816F6B1786613355ACF05A0827E5F1BEF46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 1689dcced13da74aae76235729e030d55f19a59023db159e84a36e6730ea6114
MD5 1fe0c00b5cdb1d5f703d215abe59e593
SHA1 e1922bdedc05022c67fcb9afb75dcc1343af00d5
SHA512 b3359c1d57ed62e28c3c00117f94d68cf5164e191ce42cf150311a742fa377e57db5d4713c9e0e29c9c3fc139f571ab27c8b8c24856980f9051dfd0f799c629e
SSDEEP 24576:DLJnJiTk3R3waE4JrO6MYrHzwK6kYDiPi+S1/g:DLJnJK8R304l/L0mWUC4
TLSH
T1EA75D02DD2E910E8D4B7C2B4815A2A56FF31346C3B2569CB19B4D5313F16FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d125bbd8256b05befac82ca01c89e92d1f8b8bbfbafa8ab0f69cba11fe353869
MD5 93f954f403a5c1921bb05fbab83dc448
SHA1 f4e842c27ca58f10f09857548fa879b8d59c1495
SHA512 03b2b347a1f76be5474f5c102ad96a672a6180448d6f18693395647f0c81dd989af2704efc3957e7f5d1d50b734df052d329c20c0be6593d62694c29902022bf
SSDEEP 24576:MA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pIMYrHzwK6kYDiPi+S1/g:r9GqCzDScAZmlvTcFg8Ph6cL0mWUC4
TLSH
T118955D05F7EB5298E8B3CAF1C96294159B327C409B34F7EF4A80C96A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1d4e81d381d2d95434fe46b2ae48d3e6f9063242f2c6b8d5becc620d81390125
MD5 db605ef8fbdb6c2a63102b4b6194874b
SHA1 35bfa84898f2771b65d125d69c2f2ba638245479
SHA512 73c6ece743ba2d9d7575b9d9e9359353f2a012dd7f1ab0fd5cdbb8bc8e9df68452dfbdcc6a66ee519664e6841052a9961c536264d2bf59048a4b0ac68ea69704
SSDEEP 24576:jlYJeXm5jUuEwMYrHzwK6kYDiPi+S1/g:jlYJeXmRUuEiL0mWUC4
TLSH
T1E155124D66FE60F5E22A827684E18944E331F0E1676253FF13D0C17A5FAAAE56D3CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 919fa950d31fee765ea8fea6b1bf52d156576c3ab4d5916a0cf92573c80251bb
MD5 1e2edb635eff7cc96a2b9ea08d31f032
SHA1 ad7d8100b18cb035af2548fd6a13cce7e07c6acf
SHA512 a949c93e7ec5c4246dc2a566995d8b8686889519dd5c242259203f2f6008d4c85cc0b454eab3e61f1c28288980f19bcdcc8875a56e9afe1ef7358affb25bd313
SSDEEP 12288:kwu6kyvbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:kVtyvMYrHzwK6kYDiPi+S1/g
TLSH
T18855120553E650E8E6764775C9A285809B34BCA0AF6182EF13D0E63F7E7A7E0F834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a71347f3efa1b933deafa4c580b15978593ed6190b91ad4ec846190e20c11d27
MD5 c4e1dce60fd4cb21fad6cf33d446f0a8
SHA1 3f59bfaf6c80d4e2397ff44fd1886ced178e8e15
SHA512 094d2e5864d61f151b0ae073f081a81d2258e5ab61ecb65d580c2c9456015cc8b3c8b162612cb8be0a44e780dad54e741c9d55185491901351148a4bb557c9a5
SSDEEP 12288:uPAbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:6AMYrHzwK6kYDiPi+S1/g
TLSH
T11A45230987F790E9DA2687B240A16C40A230BAE0F7B654FF17C9A571BEFD5E1F438845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b9fe5d0d899747606181b30cf44b73482e29bf58ab91b176fe3f7c19fd081a7c
MD5 9479edf34f8f3a96adc2f83ac744a18b
SHA1 2a407136765cdcfdcd74ae2572d23b91c4b18b7e
SHA512 b324ae9c9d7b67bf05160b672e692a45c56d2a017db8336476dbc07e0b307aed41f29e1b81f04531200b54e6bc66065e6a5577187788bae80b2138629fae0776
SSDEEP 24576:HC+TyQIu93VAumZr7jmlMYrHzwK6kYDiPi+S1/g:H/TfIq+YhL0mWUC4
TLSH
T175558C1DA7F919CAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1db737f07e3bd0cb10d3dc2a12ae0e354c29dc75eaa41382f032d35997ad6533
MD5 3caa29e132cc5d96be7fde1f5ad5ad2c
SHA1 b89696e1135dc7c82508a8c1fb76c4ca87050fa7
SHA512 b56132460222980ca83a380018288746ccdc28b99b7216a34dc554003558828a6ec629207548300b12dd493c55719bca324a93ab346ee375505270c8944cd1aa
SSDEEP 12288:JcyrWOstaa3kcsEbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:MLQikZEMYrHzwK6kYDiPi+S1/g
TLSH
T1D965F10FB3BB00A5E1A7C27888954541F673B4B0976263EF0290C7795FAB5E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 537aa995cf5e285fd0badbb364bf647fbad628c0333a8ee43db3a273cf83d263
MD5 acdfc4df661869abf320ad23a7739639
SHA1 5cb8bf3fd567f0d582901787f3f2ffd51276c93d
SHA512 e194f72708ec755a0b9e6ff2708c0420e81a7c3a39cc0ce5513d43569f683a5eea65cd0bf19170741e0918bc56d80302d2cb885d82a60d7666beb611c97dedef
SSDEEP 49152:QpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPPL0mWUC4:BpC7b4+80GTk40VR4
TLSH
T1F5A56C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7cf2bb477375f716aaf48f2c0f6c64026fb94fa84b2292a685a5dc211f9297b3
MD5 c248f84a011187f7aaf13ce594d3235f
SHA1 612ec56879bcafcf663b37a67b850007341396ea
SHA512 b7bae288a7573b6b4e63b2dec6775eb5a587376f7eed4e80f62b1125bdaa64dc17f1b5a92f5283f5055719f6d7fc95658316f11ac8ce786f9c90a32ad8241c71
SSDEEP 24576:BSAwJPE1IDAo+4Kt+l4413AUQXMYrHzwK6kYDiPi+S1/g:BqPCIo4Kol4KQnL0mWUC4
TLSH
T13F55B01AA7F946F5E17ACBB4D663C501FB727822133163CF5290817E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 07a6ccf73b23dd80a324a50030771799fc9f77f2e6ad8d78b35d4eba4af9ded2
MD5 b6157db37c7d3f9e7156ef1c6228fc4a
SHA1 a7b896b78aa18bb44e38f5dd8cbeea244663dc30
SHA512 70d3e2f4433002aea0660bcba56ad1283353993f56f7c408c91811f25b9ed21c6fc71eac0fb73da876e6d554582615bda765389bc0ca771cf97d35ca2f09d185
SSDEEP 12288:ESsyLCFBoPLCRyf6NQ4tHbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:MyLXPLcE94tHMYrHzwK6kYDiPi+S1/g
TLSH
T1B775E12ED76D04F5E47AC27CC6A38906F67138AD037166CB169490752F6BFF4A939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 8907dbd89ec1c2e02e3d165a2832f87a58bb03ed4c7a1243f855fa8c3a93eb26
MD5 45436aa09e8c586788fef5ad8a6488c0
SHA1 6826ea6b1f46b1f385ec414b3475f4d75e02c99d
SHA512 454fca6eef0684c260c29795894657d37d22c6d88962d308d7fe8f138f63be6c3504c6b292fbec81a83f6489d968a229b55bf9f58869a69fc78f7c99ae1c7e67
SSDEEP 12288:H9lyvj3IkxjbBzUbOnYrHzP9W4GWBL6kYN++iPW9yIRvw2MS1eElMVrr:HWv8qjpUMYrHzwK6kYDiPi+S1/g
TLSH
T18765120E56E560E8E13A8370D46295148131BCF267B99AFF32C8D5BA4F79AD0E43EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/660-111-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/660-218-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1828-181-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2392-134-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2392-145-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2392-140-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2964-372-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2964-231-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2964-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3336-202-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3336-378-0x000000000C000000-0x000000000C008000-memory.dmp

Download

memory/3336-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3336-219-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3336-373-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3336-168-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3336-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3336-186-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3456-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-32-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3456-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-38-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3664-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3664-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3664-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3664-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4064-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4064-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4156-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4156-370-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4236-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4236-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4404-385-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-400-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-413-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-377-0x0000020827920000-0x0000020827951000-memory.dmp

Download

memory/4404-414-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-380-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-381-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-382-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-383-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-384-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-415-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-386-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-387-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-388-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-395-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-394-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-393-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-392-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-391-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-390-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-389-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-396-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-397-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-398-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-399-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-416-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-401-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-402-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-406-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-411-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-410-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-409-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-408-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-407-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-405-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-404-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-403-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4404-412-0x00000208286F0000-0x0000020828700000-memory.dmp

Download

memory/4528-185-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4528-374-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4620-94-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4620-96-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4620-88-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4620-159-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4668-69-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4668-151-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5000-107-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5000-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5000-24-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5000-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5044-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5044-323-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5044-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5044-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5220-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5324-369-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5324-149-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5508-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5508-99-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5576-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5576-371-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5864-108-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5864-180-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5864-105-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5864-100-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5888-77-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5888-85-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5888-155-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5888-83-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5904-54-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5904-64-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5904-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5904-60-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/5904-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5996-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/5996-76-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/5996-6-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/5996-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download