176a2da7a17b563ae36225905cb7d6dc4bfb59fa38c7762a5b6eb1c69c371bea

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260517-llj5eaas8p
SHA256 176a2da7a17b563ae36225905cb7d6dc4bfb59fa38c7762a5b6eb1c69c371bea
MD5 13e3a3939e474dd623186586adb64017
SHA1 a247a4f798d634515b48e5eaa6d9c0a590da462f
SHA512 a08d62380c7390f1ae6bbd95bf1148c1621b7aa3fab4a4edd9e19b143283b092f143048097c51b7827518aa4bac5009196ce0f38fc7dc7b3b7c7ea98a210c64d
SSDEEP 24576:G2zGxmsgixOFthHE8MEX1XsdIAhb0VECwN:GcGssgixO3hHE8MEXWI4bMQN
TLSH
T13965120177C0C0B3D9A32A3445B49BB16ABEFE701F7449DBA385172A5D742D28E39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5096	alg.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
4828	fxssvc.exe
1604	elevation_service.exe
5728	elevation_service.exe
1032	maintenanceservice.exe
2224	msdtc.exe
3956	OSE.EXE
5912	PerceptionSimulationService.exe
916	perfhost.exe
1180	locator.exe
5456	SensorDataService.exe
1400	snmptrap.exe
1316	spectrum.exe
5304	ssh-agent.exe
4496	TieringEngineService.exe
4124	AgentService.exe
2216	vds.exe
5056	vssvc.exe
4552	wbengine.exe
5092	WmiApSrv.exe
4492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa1c3239ee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c36c370665e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e52c990665e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e76ff90565e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006106920665e8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028d3dc0565e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe
1748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4828	fxssvc.exe
Token: SeRestorePrivilege	4496	TieringEngineService.exe
Token: SeManageVolumePrivilege	4496	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4124	AgentService.exe
Token: SeBackupPrivilege	5056	vssvc.exe
Token: SeRestorePrivilege	5056	vssvc.exe
Token: SeAuditPrivilege	5056	vssvc.exe
Token: SeBackupPrivilege	4552	wbengine.exe
Token: SeRestorePrivilege	4552	wbengine.exe
Token: SeSecurityPrivilege	4552	wbengine.exe
Token: 33	4492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4492	SearchIndexer.exe
Token: SeDebugPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4876	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2468	4492	SearchIndexer.exe	105
PID 4492 wrote to memory of 3920	4492	SearchIndexer.exe	106
PID 4492 wrote to memory of 6036	4492	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3704

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5288

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2044 2820 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2652 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8d39f8b2c24ff7922c59d6f140c08a61282c18df2684411ebe189122dcf105b
MD5 8012cb6ff4a714ecb40a1eed0d4faadb
SHA1 e384618f817070907c5356fa20f873403e821133
SHA512 f34c2197fe44533525ed7968e86ecd3adea614357e225de6651614ad428c917df2ef25e590fa1c9e510849df0e8c063e2fcee42becf3a766c253f407bc8fdb28
SSDEEP 49152:Sb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnfixO3hHE8MEXWI4bMQN:03q6tjBlo3tzfG9btN
TLSH
T1B2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 82f36509c0f9ea9a0527431c459d6888230278fe066f3dc292e12bc5c0b7022b
MD5 eb11cdce29446f87f53d68cfafe0e53d
SHA1 bf93eb13f6f15489a58713eb61b254969477a38a
SHA512 94ce66b8621d3dc6ebd9c20530e713f4d3dabb67fb39b000059b67b76754f5ef3cfd8e8dfcf670f9caf727b7057760238bef1968cac8604e77cef763ef49557c
SSDEEP 24576:OXYfDtczAgXixOFthHE8MEX1XsdIAhb0VECwN:NtctixO3hHE8MEXWI4bMQN
TLSH
T12D65F12977E405F9ED6B823CC8A28615E673B8910760E7CB03A499661F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dde3d7f69fa560cf433b908fad6b0ae0bb26de0cb827c7f8e1aa2860bd6e4637
MD5 20955ed3420ba738488836bd049d5fe3
SHA1 94d9696db6a82ebef831f9bc4cf82a132ac2a9d5
SHA512 4e2cb1c7f26965c7902b888337fd9172d59f8f9fcd0fd2d2d3a5095989ee6a0a98511247ea7cad32f393e1d62bca01ea2f0ae394b4a9e0cdd7874dac92ff5f03
SSDEEP 24576:A0Le5ji0hmxQrM3XixOFthHE8MEX1XsdIAhb0VECwN:APji0AS0ixO3hHE8MEXWI4bMQN
TLSH
T139859E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7000fcb576ade63a8e20e5b5fb5a96828350b803580522ee08f475e50d6defbd
MD5 46da252ebdf13d8f5fd285c2322334bf
SHA1 ce70549f3e48590030815ae38f5ea7d9e534b13d
SHA512 7998bdbaf694f98620b780dff53ba5b018b458a1304edf87a9a4da92fe4bc44f81761d7181fd874e7313bfb3e5c4f62fc701827d40bc50c58a085c954a700bb5
SSDEEP 24576:ra7/ezSC6vUyDZaqgrvWx6q8wyuBXixOFthHE8MEX1XsdIAhb0VECwN:G/ezSC6vURPvMHjy4ixO3hHE8MEXWI4H
TLSH
T177755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8231632815b67883f459c9accfc6465056e13448deee9701504a9f4e03789312
MD5 40f86ebbc89805e2586b6d6057d5bd0d
SHA1 279e1cc3f900ed1baa472b21fa6d1ff3e51de262
SHA512 33cf60452b029bc7443644322e973d9777edfc2839f99b586842b8cc8413c7eb82843f30a8b3a528a45e2ee27c155340e3e3ca40a3f51b230929f3583ace8a98
SSDEEP 24576:TVbqPb88hv/lV7kXixOFthHE8MEX1XsdIAhb0VECwN:TVO88hXlV6ixO3hHE8MEXWI4bMQN
TLSH
T1BA559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a06b8d10c9eef803948c81328517f8f6284e3e6cf7a1daf1ce5c324501090333
MD5 dc260894d9c2b5a509162219d7fac3e9
SHA1 ae23ab1e46cbeaf184a244eee1ae5609ac8660bb
SHA512 3ddcb81854324d26d4d64778d7cd860901101dc2fa1f78c9236fdda0619ca7f9139c5dd74b676b5e81ddd8067eb84fdf79c9d16cb341bb45e9ceac6b7766fa99
SSDEEP 12288:g4bV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:g4bXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F1552343ABD4C1C6EF8B2B3C60AA67FD26D2DED0185449C3C2533676647A2DAC93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7fd400499ad90c26869290e8838e16d0d18d8b36708d7dd8accc44c22a540a65
MD5 5c35b2c7b0fefa139719039d1aa04c2d
SHA1 b15fbc3af8f06ff6b0df874f61d5c6b270a2c685
SHA512 ddf162f1c279b2495976ffb1ee113c0332752455569067cbb78cab42b9b2a494d7762918d88c35ac8a497b7cd438da611aeb3d64bb282adf1efa76fd3955dbbc
SSDEEP 24576:EJIUsXixOFthHE8MEX1XsdIAhb0VECwN:EJIUmixO3hHE8MEXWI4bMQN
TLSH
T12375DF2BEE28FCD2C67E5D7856918740E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c9e0d1fb9b70117aeafe95717fa320de650a1154a8bb5afda4edfbd76ec075b5
MD5 8e6e178cc01d92c94c80fa4430f63a98
SHA1 24739ee212788cee91d82ccbb332ab1dc8d67f5d
SHA512 38a046117493261e29914a4b958d0d21b6801d576afc3657f534e7b82b0e0d9e60734898fa9048a8cb59478cc640678a65b2544383ff5f610ff2341580697678
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THx:qQvGAdlCEL8c/pRNw5CUo3tzfG9btN
TLSH
T13D267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5d1b9acb7b1ed26186fb3022e48cf45e53c5fb833048fc8562c64b12f4a3272a
MD5 6e2541f17816b6ca80c9686bd9032799
SHA1 87963bdf7380175b57983018777ebf44ed3208a0
SHA512 6972c2eb28622f3178481e725ddcfc2df39b8aa53aa6e21455568c370e25aca88555173bd32fed385653c3c0e14fb63743ddd66d35149f7b8b08f95f3891402b
SSDEEP 24576:W3ewsAjmXixOFthHE8MEX1XsdIAhb0VECwN:YljkixO3hHE8MEXWI4bMQN
TLSH
T18F75E031FF74E036C6BF0DB61B26C716146DBA600F611AC3E3A84A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b4e34322d048fc1dbdbbb41aff01b6ab8dfdd8deb56d044928daf0a6f52d87f0
MD5 1f785592b9df0207b9d24d78c2a392c2
SHA1 397d91f85607ee12a3dc186580bfd37fb9835398
SHA512 f2b796e0702240923688d3a953cda40f1bbcdd2bdbe88767d877567e8a4924042bd585aba73f37eeae6d72aa9cdc1f955437b8c9fc04c7dbeb9a3faeca2c9ff4
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHo3U:fUEtQevvqc2W1cpV29I324
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5dea73825de527630f535506090a6a25295a5d76e7cdfb69177156b8aca42394
MD5 45d8b9f36c0ddf340261d134c0cb0680
SHA1 ed8262a75380205ff6887bc0f534568b58f6b3a0
SHA512 3dc09670cd3f4490a5629a72499280ef20589d2eabcc040dad655d7c6898a7f8d7bc9ad0d9e594f1e9f8557dee5d1880c878bcb003b3d75813c6dee565a20a37
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zEixO3hHE8MEXWI4bMQN:ooqtVjnmIo3tzfG9btN
TLSH
T149D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0c380b84fa00495ab12ccf1c3cb27b40def5ff77048b98be48b3d8f7f87ae337
MD5 a1adb7e88f0cb7d4d751cb6ed1652a41
SHA1 59be954a11cc8662c081dc0ac6c13dca8f97105c
SHA512 820c8744a9f2899017fc4942ba53f59eeab235922b1f828fcfa68ef49a07b40778d4801b780f2a124d4f6cdf4b8dfb033c5ccca4b2bf8355c3d0dc34ee9a1bb2
SSDEEP 24576:FAhGLmIFoiwtA5l7S53tXixOFthHE8MEX1XsdIAhb0VECwN:FAM1Foiq5xixO3hHE8MEXWI4bMQN
TLSH
T18A359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d7f130f0b984c72c922cbf9901f02553a30481074d05e2b3c46138bcc7c7a927
MD5 378ea049a2c554c5a5d8cff0eb62fc14
SHA1 169d9374ac8e33a1ba4a3b3106acfeeaf08ff344
SHA512 428e68762c411c2e31828f23384c3bdc2b25ed9af7be412ec20b423adde83a6b12b47fefb385411c9a95500f72b1bb816f9e7a3da3aa88441245ebe438d18873
SSDEEP 24576:pwumOWiXixOFthHE8MEX1XsdIAhb0VECwN:pwROlixO3hHE8MEXWI4bMQN
TLSH
T19365F14677E408E9E96752388557C236F7F2BC112A21DB1F4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f7b6f14348db5786f1c71cdb2b3448a8d83353361173f90efb375d985418846b
MD5 851b900c5f5bc710277c3dca9a86d739
SHA1 5ce83011748f70a47b44f5761c978b4e0ffb1e7b
SHA512 fa548f7a019e555710c41d35c01ef40e08cea40edf931659db552b555c56014b4cea3916c5cb86f636cf3db11d7af41025ca68574cc46bb03de063b6da4526c2
SSDEEP 24576:LZufXixOFthHE8MEX1XsdIAhb0VECwNN:IixO3hHE8MEXWI4bMQN
TLSH
T1BA55124A37E461F9E597123CC4E55799D7F2B892273143CF4262026A2F33BC65D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3a4995bbdde5b3021e23d777504bc4597aabd0c5924f05084dc337b5c636238f
MD5 7f6dd946c9adeb6c267859107516b3e5
SHA1 072bda8050b15163d1df2fd62bd6b0b16d3ab5e9
SHA512 c0e5e8e8805bfcb6b293158c30943b6e708af2be585f36e0b5865fbe751177a222d380deb098e08ad83b260454180b2778c152477bdb4d1b716d02bcdab39a64
SSDEEP 98304:/QRQyi36YOcPuLvw2gAf+PN3Ro3tzfG9btN:OQyiKakX+PNy3U
TLSH
T134667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a113cc21869921c7805c2850e99df5bf89d1a27ab4958aac5f02b5d413a12329
MD5 c4d9b7ec461675fdf51d651cf74b3d4a
SHA1 118876c3299e81a175e2c8643dc6ca79f69bcb31
SHA512 9981707cc92f058384704bb10736a04374439a751db5ccc1db36316dab67421b289c40c1ae1b26df6d1b6d5a02d11f8ac6fd43922b34dea5b19b5ce02dca2e5d
SSDEEP 98304:AQRQyi36YOcPuLvw2gAf+PN3Ro3tzfG9btN:XQyiKakX+PNy3U
TLSH
T1F0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f158221d31b82efc45aae989a44849befcad848b516d6c76ff7d668f72879c4a
MD5 97c4b2440a7babfccf48956a72eff374
SHA1 f2c9c75bff4a6703c37b347b6ffdc60279b5ab08
SHA512 424136be3418754b4e0ae8a62a12be393137650cfab68fd5fc8e17a72068113913c2f84930684b0f287b67ce34c7b3c03c74060902b9cefa5069e998c897e537
SSDEEP 49152:f68Qg55nhxeWu7PNU3/0ixO3hHE8MEXWI4bMQN:ZthGRc/vo3tzfG9btN
TLSH
T101B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d65ac609ec33caaf78abc384fddf80e475ac5fc3a5772d5ac9b0b06b13d994cd
MD5 4a753759c740ae617cf31e60349f0b93
SHA1 1c9b827a59c31e14e26b2c19a40790483945f866
SHA512 5f459bf618bbe341f8fa45620e5ab680adbd881389be2107d744adc885707faeabbf8ae56d022fd89749ba0d853c980437c7d9296ee9338d222223e39bfdf6ea
SSDEEP 98304:xy5112gYy5azzVvD69nLKnhZ+o3tzfG9btN:MLIH+WhZ3U
TLSH
T176167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4788e146d78acb461c3f5ce8509b25ff32eb817670be25d2fbca196695d108dc
MD5 a43d65a78226ad940030ac425ca0bad6
SHA1 c481fb73a643ed31c1c43845dfc5979d4a1dcb18
SHA512 15f2af271b991f9457f4bea65a52bcc5de09fbd70084cff7fbd487852cc71d6e7b8f86d2aafbfbc6d7d9afdcebc400b8293bf70b5d80048219633d294bc97ce4
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glSixO3hHE8MEXWI4bMQN:0u6JmQxd2dpo3tzfG9btN
TLSH
T1D4D59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1bb79dbc8d11665051bc5a62bfce3df533350a7adf8d347bfa9981195ee9ef5a
MD5 fe765a12c2ed898dd3a40397e0f561d4
SHA1 e0389180ff4ebf80702c8a5dd730773b8db728a3
SHA512 13217b53e8b9e2794082dff2dea7c36aad53afe6ca3dcdfcdf77988003eaf23960056fc4994b91c47c2626a29459b9f48333fe2551a3940ef11f18ae0688a754
SSDEEP 49152:w1hpsNoJpF1A6yU44CwH7R4xGixO3hHE8MEXWI4bMQN:wmifPVRIo3tzfG9btN
TLSH
T1D8B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6ac295bf07560768e4e262a0fe63d6c9db98caae8a0a8cf6410f744586f9d113
MD5 fd4ba6c07626f18b4705fb3d42171528
SHA1 a9f429c98b23252ed7ffa68dc1a9b47266c1e355
SHA512 d79ff12c0096f5c9b532eb171abe66f15b91d9a68e5b27d06a1db8e4e732224e111f52c3e0df6b55a381e1fed7f7b6db71c83324bdf82e304e6eea3f4a3e59d0
SSDEEP 49152:CSuZQIY0Be2KIRVtOnks6NMHqPixO3hHE8MEXWI4bMQN:c5dKOi616o3tzfG9btN
TLSH
T1D6C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce9caa1d497d54cc2ea26a4500fa5f512cb769d7e724511baf54117b9389b4e9
MD5 a1928917535caab17e37860b3621c7a1
SHA1 46243d9ddd8279821764812cc511771329da43ac
SHA512 7bc540785492986ef6764ae53a6e7ebdeb137791c223e4c03655a68212810a9eb70aeb1a6866f5b965dbd87118ce44a114f8ad21a1b5b0e1ec8ae97f19d1087e
SSDEEP 49152:OhtSn8EApI0figGgiDn0AP5wCixO3hHE8MEXWI4bMQN:PX2i/ph8o3tzfG9btN
TLSH
T1C595BE13F2D900E8D05ED178C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4733ea62f9f24310b4c8b3d980d73bfdb38989ae127457957a17b9e91aad4dd9
MD5 9d7a45188538ad84d92214f65917158e
SHA1 9fe490a5717dfe4d46a59d634550b3d791c82f8c
SHA512 f0313d8d5f8a69ed56b38a0d5cae9cee1e5fc0cff7ba7b0fd97522ffb08d6c7fd8b116efce8af20c4e3506e392d7f3a42d1cb51a4c8b8d7d67ef60d167496105
SSDEEP 12288:IjV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:IjXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D4552343BFD5C2CAEE4A373C909663FD66C6EED5281405C3D257203264BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2888a8734271e9a6bc188b9056d700d9af66d91e71b2494e3d8689e0d6d3cb1d
MD5 21b40007032fa1b1b4984bde272ab77b
SHA1 d2cedb88b43b600f2061de5d9777a30befced961
SHA512 2584596af77957dad21160ba94842d5ef25645e98da12359eb74c60bcc365e0f9521fd6acd18f6dbf3a9433ee54eea87218f8c3635b3bed99d51faaceb341c7d
SSDEEP 12288:maV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:maXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1E5552343BFD5C2CAEE4A373D909663FD56C6EED5281005C3D257203264BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fbd443f6457a479f72ce328aa084934aacc41e7e29e5feb5ec2cab90700c4a5c
MD5 e24835b36bc23766a8c292d8a7bb87f2
SHA1 a0e6a57858cee9bfb02e387e444cf9c3728367a5
SHA512 3449f2b0eebaa8a8a2c11ff797b79121819a8b0aa217c4dd5f5bc3c120cd8dbdcf6f624390f1bca5d4ae04a2baaa6c58baa2c95307f3d8a41231e06ccf24f7f1
SSDEEP 12288:jUV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:jUXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1FD552303BFD5C2CAEE4A3B3D909663FD56C2DED5281005C3D257203264BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2a601700162c980c1de7b07d8de9b0172bd6013819601d45e6552197962d3c5e
MD5 f03e10fe316a5d6498997fe43cce11f4
SHA1 4dac41e5537fb9d56e5c5de06e771987eee1feb8
SHA512 0472893eb665662399f6fe6a504e68bc00220a5a9e31da9b346491707423a78cebc05173071295d21d7ebee01bbf6e0e291f8d326e88c089f9c1eb722b65244e
SSDEEP 12288:vVNV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:rXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T18E5523037BD981C6ED9BA73CC0A693A9A3E2FDD42A3156CBC20315261D733D59D3AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eccb40f3630c0423fba0adfb4c4ad3e6b135236230479f9ac972a237045876d2
MD5 673b6d41eceb1b205fe8f371ff2f8039
SHA1 00b2a018840754be26b626b27e81734ec0d653f4
SHA512 146f08d7303a3448fc55995acb1ab77f44520f90102d3c71a0db721f56cce1f07efa33c5ba9ae4d9e54be91dbf5ba3661c44c9df95216bda44d28d4c27c46be6
SSDEEP 12288:DFV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:DFXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1BD552343BFD5C2CAEE4A3B3C909653FD66C6DED5281405C3D257203268BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 996e2de9bbd18c92693cf4ce136a3293be92e147c39908c9b09e79a28137637d
MD5 a7c1adbfb27f38756c549c15e5e7b0af
SHA1 89550a43ae976a055cca7ddb8c8635dec6d9431b
SHA512 11dd0df16c9b7984a387ba6139bd35f8d3f9ce789a05e214b88291c7d6485f90d961abe37a50d07a768604b707842319f0b499c171b81e574f5789ef2ebf41c5
SSDEEP 12288:guV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:guXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T12B552343BFD5C2CAEE4A373C909663FD56C6EED5281005C3D257203264BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec0473b2ba1402500553cc057fc8e88e95d715da51f6a9ff305eb582dfb8a68b
MD5 8ac9002e6402f34a550b5bf3290450de
SHA1 3bf18d5f6a0d803dca5175d03fb37bbb55737b58
SHA512 58ce282a005a54c24d2464b9ddcb86e9c9edb90e9713dba913f30cb23c869244f9c9b27c5516f3791771f267411f13093fae217df266f90f8cc2b34c643b9822
SSDEEP 12288:tSV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:tSXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T120552303BFD5C2CAEE4A273C909567FC56C6EED5281445C3D257203274BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a32ba035d2fa1bc1a641d2b10173757984c1e20a214eb6efecc03763c6189f92
MD5 8b03eaa810a01614d4aa506f5c228123
SHA1 fd2afbec5be2f1dc067695064b077b18eb594c9e
SHA512 5ce5a11a5ea9b396f521444f952b576daddc5b3167c279e7b2ef62391c0f6a1bd1d9451c69d043f3aa7372289c80ffe566c12f327065bd1130ade0a98750b32a
SSDEEP 24576:zZMKzFVSO6XixOFthHE8MEX1XsdIAhb0VECwN:zZMKzfcixO3hHE8MEXWI4bMQN
TLSH
T1DF750195B39018F8EC67823EC8558A56D6F2BC5A0A60C64F03A536275F333E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8fd04b675eb6dd08e632c83bf3c78cdefcd9a5d24e129a2feb1060650ae9c0c3
MD5 9beaf26acf2fe6a89df1946657fcd10c
SHA1 0627656db9ba11ba1e4fb2a724d900d2844e3447
SHA512 cab4e1a8cc137a54be602eba595fbb876b431782c0c34c5a1be1fbcc54ae9b0900419bdcb4b8d34c517fc89853a311e911b25575262712817bba062d16cd4c72
SSDEEP 12288:BvV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:BvXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T15A552347BFD5C2CAEE4A2B3C909657FD56C6DED5281009C3C257203274BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 66d379a5edc0017dfc445b353560dd366f79153daeac811e16c357c8d8498db2
MD5 1e33323b64aa78e24557e496b5617559
SHA1 75345e8e369c15565149476bdbf8896864785df7
SHA512 d6b7239f11a56af4401b01195231c186efd8f305c5f61f4f7078cdea1c4b575a094459a2735a946320725460bc1583e9113c30dc511ae856c87c8c52f9607362
SSDEEP 12288:mrV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:mrXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T114552343BFD5C2CAEE4A273C909667FD56C6EED5281045C3C257203274BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2ecba701dd8bca982cbc1ccaad541ca32554262e2c339703ddfbc91024be82f9
MD5 17f8bd51ccef1bcf100cb42c4b08da77
SHA1 ccae59f3a16e51ed1152bbea05d607d4b7808cf3
SHA512 d8c681cd06fd510f2d0815c4b072353907bbfd6f5ec373f2ba113c31cf76a2319bd2a0d325ba81df91debb1f3058c847d106082fc63a9ad2fb0de743cb1c2c0f
SSDEEP 12288:oyPz5L82V5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:pzy2XixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1FC65020777E120E9D5675238C8A21B56F7B2B8720B208ADF536102762E376D19E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c90cd6982f49a9ecb0117807a496c078309b42e2874eaf7134da67b3d53d0355
MD5 e9c08dbbc75477b3c7940c16a3135a64
SHA1 984e4ca943e35e5e1cb12e4439f86a2bf7042eb0
SHA512 7c5945be87e46507a9af757cf9ce1122d8c1edde3d1c765c77e641f4f867c7950106f3b5e10719e76e5332bcdd0b98bb70301952c4677349f77e1eb49ce9b0bd
SSDEEP 12288:MvV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:MvXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1DF552347BFD5C2CAEE4A273C909667FD56C6EED5281005C3C257203274BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 668133f84da3a318fd00562b761b0e78117a8852f8df5ded1a6d2ce5525228f9
MD5 e47ee11afbfb89a347834d9452852bc4
SHA1 0af2eee1ff11b1c232e0d1c4aa087e3bb3f5fab8
SHA512 2f7092667aba5bd5ae121e6daa42f120360a7a59924ec1d651c3a31a5e8e1d7ec96df7fff52c22f4794c3158994f32dca7842505bfdae9c5ca6d87acdead5d33
SSDEEP 12288:5vV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:5vXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T190552343BFD5C2CAEE4A273C909A57FD56C6EED5281005C3C257203278BB6DA493BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a060669a35a2d862b71c4b240e2b5a81a6be2ce991e88adc786b36cf9dc0b841
MD5 e165c14872399bda1803238e15864df0
SHA1 1f0c63adde3c689b29e1b8d69f2a7f2a5c137a7c
SHA512 4bc3200dc573b79c0c7e29e1ab3519ba7052ad552e779ac9fee16f9243bbe3a92de04d70cf86226f93dea4700dc1dc2b4a6b0b96672342da428970162394e887
SSDEEP 24576:FCUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAYXixOFthHE8MEX1XsdIAhb0k:FCUMPTY+8Wg2lIL8lrIUJLWwZixO3hH4
TLSH
T1B465BE1EA3DC0896D4BB813589518A16EB72782E1B32D6CF1160C33D6F27ED95E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 beafe7c5ed3c756a45c2e73245c106e5eea81ecd594abeae513410b0fea945a6
MD5 ff454d792a27f757b4751e92aa001699
SHA1 1627242da47ce7f46d619a07382d176472be17bc
SHA512 96034fa57b0c9ddb2714e51ef7845f912f2466efd5ea667c86edccd6499e107fe8668c6d2482efdf71f01efb6a192aa049e3660b69b5a15faae71eeab9071f40
SSDEEP 12288:uXsffV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:NfXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T12B65F10AE39842D8C46E2239C7564B85B3A37C6547E1D3CB92C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 18be0e3004852e6f4bcdc5fd17e912f601dabc3215efd0f79098ec78c3b35976
MD5 ffc8de13b32c9d641e33e5507f410045
SHA1 457612959ed86614626e4c4ca3e35da5cbb9f663
SHA512 3ce8c0c66d0a16fa07d2134656a696bd1f69e8bcc55129c1193d73d793af6d293b5cf0df8ac4f99d6bee8a6d2d896622298589f1cb8c6eb208bed58433013398
SSDEEP 12288:h0V5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:h0XixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1DA552303BBD8D2C6EDAF373C506A93B862DAFAE41F1084C3D103216674766D69D3AD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ccfbac1f5a84e0aa4722aa8a102bc3627dcc95b989319456b63233563d51bd63
MD5 5cdf539e4f55945f8bb7cac80ae1ff96
SHA1 9bb4e7097b333c44c06c126053d78f583268ca18
SHA512 e2a32a49444db020f352783873dd78470aac16b637ebf6c942f40bd2a0c61f56dba9058f37994eb2b027d4ce9e34ba6e575b6caf29971218e88302d17a7af190
SSDEEP 49152:3RZwQCyiHiQEaaPnMnixO3hHE8MEXWI4bMQN:B9xvP7o3tzfG9btN
TLSH
T18685AF1E63DC42A5E4BAD278CDA74407E6B27816173197CF0291C27D1E37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cf0711d63ad1ec71b35cb4b557111e294ae53c87c1cfb3d3bf3c960fbbdbfbec
MD5 d45108d584e8cb87f94e2a6638cefba6
SHA1 fe853788ffb89cf0596dcc0f9808e9fcf8f8b844
SHA512 26f39874eaae8641073e7c331b8632f2933cf1f251dbad05b1c47e71be2115a4881200d32b1ef218d5d628bcbe229477895918ec65c94cbab115a866b5555c16
SSDEEP 24576:LbxA1UGEXixOFthHE8MEX1XsdIAhb0VECwN:LbxA1UbixO3hHE8MEXWI4bMQN
TLSH
T1EC55121E67EC10D5E57AA63D84D28309D3B2BC66172093DF5092823A1F3BFE55C36E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c73ad5c22c9fd828da151608ec33172fd8aeb4d4aa6e0bcfafa1a5a8908fb033
MD5 0679ff387f7c5ee89159f93ea5a464bc
SHA1 c39fe8d802ce3d6977a05fe23bc7a7702db3e742
SHA512 be9f3b222edab7eaa022af51bfa80d8d56aa3b4f8212f45378d5683a402a37269afb880a36e2b6cf6e3107176f6d64442cb85d4cbe050b7e28e51ff1ec60b3c1
SSDEEP 24576:vjsmP0yHaqrVqHra44KDzMsrndXixOFthHE8MEX1XsdIAhb0VECwN:vjRP0yHfVqzlAsrnxixO3hHE8MEXWI4H
TLSH
T18C45BF2EF2B910F9D8AAD136454107B5BB71B82D1F209AC70170C235AF1AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4c8187cf2b715748d553d60dd2bb3914b3022d60c40f04c5eb723537330eef30
MD5 c022bf8df5ecd64cfb1052eb4d848cf9
SHA1 880b9ebfa8fabb6346aed5962eb447c26da9aae1
SHA512 2a0a9f5c3d00c6af649cc40f5aa10cfb575487f29ae13b058d5f55f60b5e5eb120121bdb32e40a5ca8b75f33355a2d1452fad0bcad31926daf4763285b82b507
SSDEEP 12288:fOV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:fOXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T15E552346BBC5C2CAED4B2B3C509997FD62C6EE901B2506C3D157213264BB6EB8D3BC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e022fd9531ca33463e8de104c684698ce22272c417c5c8d4902854020a49cd86
MD5 9b197260c05b64fef888ac1afa93af61
SHA1 487529edf08a87566300fd72df24edf95c131f94
SHA512 802dd7c3f8a0b68adf62e2853022849d6adab0ab3855ce288e35df6f4793d44aa9361839395dca8c8546299c5cd6631d7819754b810e9d5196ce2ce40df54878
SSDEEP 24576:0KLBUTgXixOFthHE8MEX1XsdIAhb0VECwN:0KLBUmixO3hHE8MEXWI4bMQN
TLSH
T11A750145F7D400F9ED6B923CC4A68616D2B2B89D0764E7DB03A94A651F337E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8fd59ea2eee5083a5e98933a2b7a749fb009ac614720bc458a5f82e698ef7049
MD5 c856713f24e2ecd05cad2b7b7732c046
SHA1 eb2c9496b07e7fd53098a25513de1ec84d7caf98
SHA512 c9d7d5c0ce1edb5066515c3228c75a0b3d0162da3e86abdd0ba5f2e3bc1f53a9fb4a7478e0fce74b2e631e9106f6bd71af7bd9d6f90a68ffe1f20ec38c8f81ca
SSDEEP 24576:aFYNHZXixOFthHE8MEX1XsdIAhb0VECwN:aFYt1ixO3hHE8MEXWI4bMQN
TLSH
T1ED65F11F67AD08D5D57BA13D89C38259F2B3B866171192CF01B0827A1E27EE97C3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bf7834a8b3947c5f716e3dd95d371a697acc6758f3fd8cd7f667391e3b4faf79
MD5 8356fea4a4a670cc1a879f6aa932c49e
SHA1 f97b6f3ea7ff13c2d0277672c79cea36f496704e
SHA512 4e86dcea1f457356b8aa242e54113646d0db6c20c300482067d431bebbe5764a49d8c820757d90d31982a608dacd293521170a9f84a8fef6cf1658b120eb19e5
SSDEEP 24576:BnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKf:BnXoJJYH84VVS6AmEvJas+cHBjSSKHPv
TLSH
T11265AE5EA2BC04D8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4bb7c742040d40a2593faa03f480da52d3896613b9167099ccb2e4f418b86125
MD5 31479da313eb68dd5abd71e8f1424973
SHA1 4742013d2def354c96cce15778d425968e0e92ff
SHA512 f5e6d85153caa8b7637581332344237b25ec651de2e086b2bdaf939dd0ea6c26f36dc438b867d0eb489b60c2bbda449322a6e12fea58412bbfd76a69067fed2d
SSDEEP 49152:HDLL9TuJ0M/TYW2PsixO3hHE8MEXWI4bMQN:U0o3tzfG9btN
TLSH
T1F5858D1EA3EC42D8E47BDABD85A79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 fdac2972661de809ef0bfde54b1633bfaed5e27fa13aa30be85366ed60b19d62
MD5 d5cfc77c618fbceba36a0e6cbd5f48b8
SHA1 f853f93d247eec78517c7b8129f2accbccba0cb4
SHA512 ef9853f3438ccc58209c7e76a3178b23f37f8edd84efe904e5540e3dae7630c128352a37ec6aaaa773a1976cee112c1b60c68beaed5fd8f9997075fcfb23685f
SSDEEP 24576:+egJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wgXixOFthHE8MEX1XsdIAhb0VECwN:+ngOJOmPOHECixO3hHE8MEXWI4bMQN
TLSH
T15655CF2FB7BC15D5E03ED13D89968916F6B1782603255ACF0160827E5F2BEE46E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 6d9b30b484112bac822fefff414b4c2d0c4c2d0b3680eed4e2a6ec1abd14fe9b
MD5 966ae08b6c75bcd0d68ca8f54c3200b0
SHA1 1ca780f52d3237d637d9ba256d0ed88c55020a31
SHA512 124cfeb45d1ae900efed607bad47eb098b4c0dded7c718c5674e0215d24e1efbf8d7ef9588bc2263b45bab7064b0a83d04a4245d93cbbe1ce694d054c2066dd5
SSDEEP 24576:kLJnJiTk3R3waE4JrOuXixOFthHE8MEX1XsdIAhb0VECwN:kLJnJK8R304lBixO3hHE8MEXWI4bMQN
TLSH
T1DA75D02DD2E810E8D4B7D2B4815A1796FF72346C2B2169CB55B4D5313F22FE0AA39F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3a3849cf3134c76c76ded23122302db130a9aeeee35c6afadee212505f7837a6
MD5 0f91cd62bc7a1acd360ef27a171c0004
SHA1 97351a279c2f487c0e4e4c5cad911e6e489921db
SHA512 48b62159761877ca156be061e85809e6cd441a9e50bc0db823d54ba3bb853c6a618aab01a3347b99db99f3d4e0d6cacbc54ff11cb13fd1ebeded512d6c511a81
SSDEEP 49152:z9GqCzDScAZmlvTcFg8Ph6oixO3hHE8MEXWI4bMQN:3so3tzfG9btN
TLSH
T157955C05F7EB5288E8B3CAF1C96295159B327C409B34F7DF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 9c30c55dce4c74163df2442191ff861aa62ad3cefeb91835a69fa5d1ffab2a0c
MD5 4fcbbe499edfa2db9d1535d84495d943
SHA1 5a492f6d3d171664c72a7a6eb973fb1a1151ad72
SHA512 c7fd25308f4cfbf46e948d49415ca9225c67ee54600fe2ce8275fd46074f6983bb1520508e174dac3898fa80cae8adf0c1d42b9f4210f5485c2e17fd5dd737ca
SSDEEP 24576:ylYJeXm5jUuEwXixOFthHE8MEX1XsdIAhb0VECwN:ylYJeXmRUuEyixO3hHE8MEXWI4bMQN
TLSH
T13955124E7BDC60D5E52E613D80924798E3B2F4B1171157EF81E0C17A4E77AE62E3AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ef29b8f927fa84a624972b15f0ec73592ce791927ac24c9850addf1a43ce7c6a
MD5 ae5d60f66bd891bfdcd96c334c1caacd
SHA1 f627a78c2166508e9e3ac65aabe8a7d37776cf21
SHA512 7d216fdc34cc68a1085aef5c4607ea236cc8df85954f5802bc88bd1e636bdff4d6515187b2aa955d354354af20bd24ff15b9c8dee4a565f3914475537c01d8df
SSDEEP 24576:8Uty9XixOFthHE8MEX1XsdIAhb0VECwN:8UtAixO3hHE8MEXWI4bMQN
TLSH
T1FC65120577D491C8EAAA163C95A383A49BB5FC601F2047DF8192A23F2E377D5AC35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 19c9dca7e0a5c59f75a3ec37a9dd6035e75d394f779aa7a64d86d19a73eff128
MD5 73251fe0a1ca2ca15d962a4b2dc0a3aa
SHA1 c5282caa72b4df7b4bd3ad7b7da89fdb00e29384
SHA512 9d7dcf1df56ac335ce9c03672da2dbfad8a30a96ecd6f0555abe124942befef8122536e9450f8fc7d5d0e663f5b720fdd2b0adc46248e7969100de9cfabbde28
SSDEEP 12288:DPgV5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:bgXixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A655230A7BD491C9ED4B3B3C506657F962D6FAB02B2018D78093A032A9BB6D79D37C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 748f90f48aef3562eb03c276c0e98d0a335d3c808f29c98f94005e2c77caf312
MD5 db74af4e671cfe5d49f8d19979f07372
SHA1 89d6c9bdbd74fd42f283128ed5c7fd960e0fc916
SHA512 b6f88d09e68167ccbb1eba5cf7e4fbe10dfcd7a5eb143d74e082921195c6af765ab9b61529f6ceb9a2586c8674f55c6b49c38b5c33d17204908a5bf19adb5c75
SSDEEP 24576:cC+TyQIu93VAumZr7jm/XixOFthHE8MEX1XsdIAhb0VECwN:c/TfIq+YvixO3hHE8MEXWI4bMQN
TLSH
T1AE558D1DA7F919CAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f59b11b6409045011cd655700219a47847bb520cf71ff6bad5b32cbb6171ad36
MD5 d19dd933b44fdf268133f1ab314e116d
SHA1 cbfea181ece86191372c92a414d8b564b31b4d1d
SHA512 b222aeeebb23b2ec2e6719a3a47f821fe62d77859c99a2c569af8a4dc6584852e574a8a7454a2cb749ff9a00e964e99ec7c8c2df04363573d53472bf55ad266b
SSDEEP 24576:sLQikZcXixOFthHE8MEX1XsdIAhb0VECwN:iQikkixO3hHE8MEXWI4bMQN
TLSH
T11965F10FB7AA00D5E4A7823C88854255F6B3B470171267DF42A1C77A4BB76EABD38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 282c1e0f5d4917634eec16902814c78afd4c7da47a645880c03e5f185c2ea01c
MD5 817839630932ed1ecabc4964ac2e1061
SHA1 bf50e96d6f46a25625bc14756d9d5b425d440052
SHA512 a23152511597a3188c6fc6ad810e5a0ff104b94b1d7d56a3afef807b560ba8d9560bd398ef3b36b91ddc1b576fa1f74e8bcbf285095069f80bfdb37a5f6a7720
SSDEEP 49152:8pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPRixO3hHE8c:9pC7b4+80GTkbo3tzfG9btN
TLSH
T1ACA57C3DE2F810ADD8AA8775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c3a1fec6e998d0305f72c42a8f4ebac63476c056afbbe27e19202228bcd6904a
MD5 89ecfe3162dd9e53603d56e0a68d6d71
SHA1 9af254471643b5dd165e8d4b9c4b8f66c95725fc
SHA512 8071c88f32a09f2fc5e4189a2124173c0359e218e9a7ca0f1b122a277fbeb3753b294c49f8d958c2db7e28de04760f244171aa97814659933ee227ef6b3f9267
SSDEEP 24576:QSAwJPE1IDAo+4Kt+l4413kUQlXixOFthHE8MEX1XsdIAhb0VECwN:QqPCIo4Kol4WQ5ixO3hHE8MEXWI4bMQN
TLSH
T14955B01AA7F956E5E17ACB74D663C611FB737822133163CF8290813E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ed49270b310349706f624ac7517c18de8cf5da916bd8bad995b1344b43db2ed4
MD5 70c8ac4908ba3774028f88d8af9693e5
SHA1 11d840b458fba9a126a2fb493d2312aedf444b14
SHA512 14dffc77b3ad38ef0754882bfab164629e507bbde1c7a999c1a25923750aad9ff7bd7e149124ab4f2c1fbe1bd174799a012168b1375cceaf8608065b6595f053
SSDEEP 24576:0yLXPLcv94t1XixOFthHE8MEX1XsdIAhb0VECwN:0y7PoutpixO3hHE8MEXWI4bMQN
TLSH
T15B75E12EE76D04E5E47AC27CD2A38606F67238AD033166CB15A091791F7BFE46939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 b809d859a3e291d186228a648328bfadf195a8781bf2852f0125fbb58ec2acdd
MD5 70736b4c21e980402f14c09c0517d8dd
SHA1 464ba87b60e35e5423dbd84af1f7436e0e0a52be
SHA512 ddd3b6ab38f303dba9db3ebcbe3cfd140aa5a936155c4512209cfdf72f00c3700a7dd51f7281a76db8ee66d1d8b29b997079ea9e79270db39d4534953346e49c
SSDEEP 24576:dWv8qjpMXixOFthHE8MEX1XsdIAhb0VECwN:dWv8hixO3hHE8MEXWI4bMQN
TLSH
T1A665124E67D460C8E87A1338D026836981F2BDB217649AEFB1C5D57B4B36AC1993FF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-163-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/916-99-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/916-104-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/916-107-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1032-60-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1032-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1032-65-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1032-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1032-54-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1180-110-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1180-167-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1316-126-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1316-231-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1316-120-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1316-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1400-224-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1400-117-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1604-39-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1604-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1604-32-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1604-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1748-23-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1748-24-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1748-15-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2216-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2216-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2224-69-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2224-150-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3920-401-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-405-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-469-0x000002F86E0B0000-0x000002F86E2C4000-memory.dmp

Download

memory/3920-413-0x000002F86E0B0000-0x000002F86E2C4000-memory.dmp

Download

memory/3920-404-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-407-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-406-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-408-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-379-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-380-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-381-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-382-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-384-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-383-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-385-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-386-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-388-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-389-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-390-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-391-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-394-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-393-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-392-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-387-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-409-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-397-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-398-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-399-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-400-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-402-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-411-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-403-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-410-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3920-412-0x000002F86D670000-0x000002F86D680000-memory.dmp

Download

memory/3956-73-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3956-155-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3956-80-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3956-81-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4124-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4124-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4492-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4492-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4492-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4492-204-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4492-188-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4492-221-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4492-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4492-395-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4496-146-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4496-342-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4552-373-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4552-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4828-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4828-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4876-1-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/4876-79-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4876-6-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/5056-160-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5056-372-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5092-168-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5092-375-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5096-106-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5096-11-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5304-290-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5304-140-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5304-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5304-143-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5456-113-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5456-180-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5456-374-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5728-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5728-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5728-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5728-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-95-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5912-91-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5912-159-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5912-88-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download