7114381ea9185d31b8520968b6048f88b08cb224c78b6777b8f0370b3f8778e5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260604-2prxesgt7v
SHA256 7114381ea9185d31b8520968b6048f88b08cb224c78b6777b8f0370b3f8778e5
MD5 9627aa896400b587a3e4e0c1ab5e0743
SHA1 9dfe42689982e09f32636f90c4c722c565565649
SHA512 92158ca729f67634ddc68e486775365d8ceafb5d8b93ca522103e99b58522a6d0e867613b7670bc69763e0c5fc5ebb820848de70553065d2b26f159c09810b29
SSDEEP 12288:MUYJ9bid2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:5YJ9b0Sd9Lkf733LIURkSOEUi8DApF
TLSH
T1B865023172C094B3DA73093004F9E6B2563DFD714F6098DF63A52BAA9E342D09D39A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3424	alg.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
3212	fxssvc.exe
488	elevation_service.exe
5104	elevation_service.exe
1644	maintenanceservice.exe
3316	msdtc.exe
2064	OSE.EXE
1476	PerceptionSimulationService.exe
4156	perfhost.exe
4932	locator.exe
5076	SensorDataService.exe
220	snmptrap.exe
2968	spectrum.exe
2184	ssh-agent.exe
1008	TieringEngineService.exe
732	AgentService.exe
4740	vds.exe
1804	vssvc.exe
3640	wbengine.exe
2460	WmiApSrv.exe
3384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6783971e6bf7732a.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_176265\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000935a1cf373f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e9517f373f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fceb6bf273f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fa649f373f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc1454f273f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031688cf373f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a53b7f373f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aa90bf373f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a53b7f373f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe
1344	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	3212	fxssvc.exe
Token: SeRestorePrivilege	1008	TieringEngineService.exe
Token: SeManageVolumePrivilege	1008	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	732	AgentService.exe
Token: SeBackupPrivilege	1804	vssvc.exe
Token: SeRestorePrivilege	1804	vssvc.exe
Token: SeAuditPrivilege	1804	vssvc.exe
Token: SeBackupPrivilege	3640	wbengine.exe
Token: SeRestorePrivilege	3640	wbengine.exe
Token: SeSecurityPrivilege	3640	wbengine.exe
Token: 33	3384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3384	SearchIndexer.exe
Token: SeDebugPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1828	2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1344	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4168	3384	SearchIndexer.exe	106
PID 3384 wrote to memory of 4396	3384	SearchIndexer.exe	107
PID 3384 wrote to memory of 4260	3384	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_9627aa896400b587a3e4e0c1ab5e0743_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1784

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3316

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2500

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1616 2884 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4396
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1592 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c726df44e68bd3de8795731a51ce4e74f50e3b842a40b5a9283f424ebc800ceb
MD5 b8adfc6c13fd199f562b334ccaf9096a
SHA1 336849cf153b5e0e4723dc7a905d15bfdd0eb01c
SHA512 149d9bfcd1180ac9f5b16b558fb8c042aa402dc9d3487f59d64eddcbb0bbef59c7a68c5512b6391b6d45bb9394c5192d317aff67c7f05126ab750ad94a4f6e01
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnP9mz01mJv:U3q6mjB3z01mJv
TLSH
T1E2D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 154e6f8e11c52455121be91d6d43b1df0a942f16aaf7b897097f14cc9482632e
MD5 0aaf71cd8503bb4eedfa0f983b0e0d5a
SHA1 2702408531c61e6b1e006451dc599230f9b1b5e5
SHA512 2c1c57ddc46818c2f6376ddf84077b2904b543be48e4cb1accd991441543ad2a83df7ef4a69e6c42da9df5dd150bb29416b50dbbeb559a8a41af4fbfb7f4d19c
SSDEEP 24576:DXYfDtczA7Sd9Lkf733LIURkSOEUi8DApF:Gtcp9mz01mJv
TLSH
T1E275F128B3D409F9EC678278C8A2D502E6337C554BA0E68F03F499695F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c7b90beb23d316d1222d96a38c88fde8f05b51b78dc2e831709502d59540ca78
MD5 5edfcd4fb44217285eb81184a90fa39b
SHA1 790172bc7b1a2fcf303b9fce2e027c0a5439e083
SHA512 54472f117e96a5772e0eb8816417dbeac4ffb2c117f7b96df6e3b9b6522b198acb6e159a6d150fed63dbbef130467af6dddd33cde8c940d9d0bad5ae03f61fea
SSDEEP 24576:T0Le5ji0hmxhrMcSd9Lkf733LIURkSOEUi8DApF:TPji0Azk9mz01mJv
TLSH
T191859E25F6788331D073C0B9C5D2A68EE97130865B3089CB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3c0cfe70602d23af739211e49ac471a5211f1a9ad5515e6adee3ebf2428ff75
MD5 af8ba4c712f5b46550e640ead1bb112b
SHA1 a537f24ef2951033b05880820b0c290ba0a2fcd0
SHA512 a61224c527676066fdcdfe469f41324a333da9f80049c395e824062e86345cc960bf3deab2a71b6ac75e03afad9c2753034b990262df5d3778bb1d51b6eba8ef
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyuiSd9Lkf733LIURkSOEUi8DApF:7/ezSC6vUzPv+HjyY9mz01mJv
TLSH
T1CD755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c758be65c34de048df9fa5ece6bc4ca9553fc0ebb731dbb5509c470f1ccc8909
MD5 edff5ed05ea7b4f2d281c2da10e0433e
SHA1 d8613108c569dfda88e5867918ac2ca1b81d01d2
SHA512 b1b5fe07a2f0fe2ea50528dad69a4c3c36a7e01bffc098d5cd3c5adde5fa12acd1e37ef739fa80cbfff6a2bd10e9e4e51e063ad878764c56fc99a331e15c12e4
SSDEEP 24576:mVbqPb88hv/l+BfSd9Lkf733LIURkSOEUi8DApF:mVO88hXl+E9mz01mJv
TLSH
T16A559E66F5B48321D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b4b04a862b2464f960915af4e03f18d24ec738443d3fb53f5c16091b7604c132
MD5 5e2e573cf2c15e5e26bc0d3032788edb
SHA1 0b3742ed8c006ca17fb0ac5be86a9b21ccd5e21b
SHA512 3fcca93efd58aebad69e662a42ef690bf884b68333ecabc19c4d69f1bdae7225453563dfd19da272d11d8f96289780d8f51e17c41aab5a44387ff00dc63bb079
SSDEEP 12288:fGg2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:fGgSd9Lkf733LIURkSOEUi8DApF
TLSH
T1A955236597CC7642EE735E7040EFF1C702312E688C90A00FA5757D9DE8BC9A1DDB6816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 bd93e6716320b71185758551e510468622164a2d181c48b8781e63bfe78025fa
MD5 fd5f0631c94ee060a72175eeb9ee0583
SHA1 664ffcfc312a1b367a2bb71348a4a68caa336102
SHA512 ab7842e00ef16fb3014348f4ba23c8198f691ef4b5343f104fd01ac1b2b89b8ef854a1b66e05e08d739809cf2dac05f5f88e966215a5e6e32cce632644a1b3db
SSDEEP 12288:NeBNUbTVO86UH2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:NJIUHSd9Lkf733LIURkSOEUi8DApF
TLSH
T15475CF3BEE28FCD2C67A8DB85691C240977278304F61A3CBD175820EDE275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9376ee53a3cc941c4246544fc8a2241677643421dd37f4f8733c67b021bd68de
MD5 8a63bf018bbfcfaf805cec973060f307
SHA1 25a56ffc56bb136ddd45dfedf3ac3c9cd43f538d
SHA512 ade7dad1018f0bf19bea49e2ebe0a131ed429577f627667e467f063803afb7ff3d04ca73c6bb8bca442d8e859864462341ef747cc0ab3e2b38cb1720d6150976
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THt:8QvGAdlCEL8c/WRNw5CWz01mJv
TLSH
T161266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0bafd8c81dfed45a8f728f01626f4a9cf640b9222044728ad81771ad5ba58db3
MD5 a0f9a21e4dda7e024138f599103a7c44
SHA1 86e3c6ce16be5aad9f71a766627255f2709e31e5
SHA512 204a4b008fd69fefda6064af6dcf497719b2523e5b7a8eed2e259c58e62e455306f1aefe9baaff041bf98835946a547e0779edcf0d9c5a7ca17f98897aa62add
SSDEEP 24576:1fewsAjdSd9Lkf733LIURkSOEUi8DApF:Jlj09mz01mJv
TLSH
T1A875E031FA74E032C67B0DB21B3AD706143D7A204FA119C3E3A89E9D99342D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cb6a40c1ddce9f061b7a3ed7cf3e225ad2cd59d7392160107d44e4ccafad0c1d
MD5 f5bb590a6690279e38b11cdea018328c
SHA1 3a54b996dcafe942f973baba523563f736d2f7f1
SHA512 b42838509311891a6f8bba500a06f08d88922dc3272930d0a4543a2644095c1a9af828e6ee29c48351bb71bd887b2392f186be8fd2215dd0ab49e1a7d64c00a2
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHd01md:XUEtQevvqc2W1cpV20I32Rd
TLSH
T1C8474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 106f2e7751867251d41227ae66ecfb4f45580ac87df079f452d485f8c5293405
MD5 3b179ba71787482cd0eb458de0d9577f
SHA1 14ed02278a1ed21f809aae1333fd160f44088c84
SHA512 13e9131edc614b836d76de55e4ad235cd527db73366d737564ac5a724434e49653e036e07513d78d94cad9ceaa1212b09f9f19a34af4cc6a37f1e778f52f28dd
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zU9mz01mJv:woqtVjnm6z01mJv
TLSH
T147D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e37bd61ab0701ef3c78d7de1048ed08fca89ceb3e1cc81b3572191478a64c180
MD5 f920827de8ebc0f7a73a92bc3c2af865
SHA1 a2a3fc05a415345a125212aee0d9a66dda50d380
SHA512 82675d30838e289f6bba0da971d899f4b0db73665eadccf4f084f9ca905c094f9cd00ab6da53834169bb88fa49e8e1ed237e57a7270a4529340cf0b56e4e1724
SSDEEP 24576:YAhGL6IFoiwtA5l7S53OSd9Lkf733LIURkSOEUi8DApF:YAM5Foiq599mz01mJv
TLSH
T16335AE80E7F955D4F5B3AAB899B69171EA76BCA95E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 68841eddee2d5436547e3b1358a7aa51b785e2446bf6fe834bd2851be30997cf
MD5 912a155a7d05caaf808972e6c491867f
SHA1 ad05206331e44a5a0ad3da0f3cf85a92c4f1336a
SHA512 47625ab56775cb4913eac30c9728ce9ad915b44ff898bdded71be7b22f8ed514a248e530c1cb1b0417b3f59bf6edf68632c158ffbb99e12a17b51fb7a0b0ebf6
SSDEEP 12288:bmw5HEjsChNEBFgl0WDm+CC2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvO:6wuROWpSd9Lkf733LIURkSOEUi8DApF
TLSH
T19365F14577E81CE9E9638638859BD136E7B2BC112A20D70F1770C65B6F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6c4d9a1dfca95883ad6a058883d83f3db7efb8604e4fad5112b74a91e3a94ca7
MD5 8340be9530958f3474f724cfcbd8ceff
SHA1 1dbd042217587f67b0eeb47ac012e21e9eac20bf
SHA512 4f3efe9004b27846a32d71706c1100b0e3335bbd851cacb37a14685412ea17b4116ac7b40fdbc8173ee0a3ca88ec88a45cb917b502c7492275a4136fca247b9e
SSDEEP 12288:TyZ1IyN2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:+ZukSd9Lkf733LIURkSOEUi8DApF
TLSH
T18B55129933D831F2D5B34A38C4FAA246D37238665B7083CF127446A96F36AD15D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2a41ed97bc2e937e6128524de2b0da9142c36844a21eda4d43103b263e40eed3
MD5 d4b07d50a4d6500f0af426cbc5cd21db
SHA1 4d3f29939cd9c0c6a0c15ebd10d083e6c736ed36
SHA512 9b2e6e91b5fe15530d64a5d826710ada9cff89fa1a26363bcff48935e176b4101f33190a3ba500bd412929208d04674e07212c6d7b6ec27fff1b8cc37ccb5745
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:pQRQyi36YOcPDLvw2gAf+PN3Tz01mJv
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2163114378a98275cd4897c9d3b4655f66f8a386dac0700162839158093e370
MD5 7abdd260ffe012d15f2b08335abe887e
SHA1 ef8c240cf916ffea299876e1691483553575a55b
SHA512 2d478f7f568af2ff2bd1691acb7033071e96e58945bc6e1699e88b4fb024dbd8586b72540a74a31529e0435af69cf2a552a8dfd747de507022af79d8b6bf33c5
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:FQRQyi36YOcPDLvw2gAf+PN3Tz01mJv
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff08d52a61da5a2d120ddeeb787783db935ba6f4e8dc4e99c918c9d1d408fc05
MD5 f5b3a18a5705b3784d0228b663606765
SHA1 e07ea87f2a001039a186a14d61f701963f36c0e0
SHA512 57b6764bc06110696c57ef9b4a7143aaadfcdecf9a1c14004624fb3bfa37c80435b31abbe729c3ae6a294357c705c39bebef666db36e7305921d0c35d00ebd48
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL00Sd9Lkf733LIUR/:u68Qg55nhkeWu7PNU3/k9mz01mJv
TLSH
T12BB55933B2F60099C44DE1769F4A972196D27C758FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 063efd867786aca70856f7ecab9d5df36cd1d2c062186ad139213c7a7fec7195
MD5 0b65f55fb818484a556bad2f92bffb63
SHA1 c68312151d565c4bacbe987864c2eb3e08cc6551
SHA512 16602848ad96aae68c389041064c3830e5b1cd40d09744ec6f71d672119d295dd89ca53083ea53842e04f16e14a4ad4137e53765a81a93efd1bfeb98f650d4bb
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99f:Zy5112gYy5azzVvU69nLKnhZcz01mJv
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6fdb262e18e1ef70597b4962412d65ad5a522fe0acfbd0d762f98938c0b554a3
MD5 40cd0bd42f985bbd21710c09a95424b3
SHA1 aec61dfe03e8ddaa80b82dc3216f9aadaa994c0d
SHA512 852cf77a15c42967f600a881f1d4bd6595486edeafdf9673cc35e307d3e859a91acdf985ad0991efe1b4c41e22f0133264244839a631cd339de7a0aea2677a12
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl29mz01mJv:Fu6JmIxd2dLz01mJv
TLSH
T1A3D59D13F1D901E8D06ED578974AA233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f9b838f76612e9daed459a903bb8d3cd720973b5ecfad7cea98ea5ae749ad7f0
MD5 527e0e43d89b6bef0a7e0284db8e1e9f
SHA1 8054abd5314b6c5daad536614fae09b207665890
SHA512 a6c7d0c63541015d620dd87baa838054f26dec90d2c1d930dcf268078b4a0edcde0f57407f4d8d27e0d5c0000dc5e8d695796050ff6b66c50b84e9bd3610211f
SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4x69mz01mJv:FmifPqR6z01mJv
TLSH
T115B5AE13F2D901E8D06ED178875A9232EA62BC450B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aaed2a8214a6a83fa547ecff7083a823eff0a874ebff5f242eba7dd31d05219f
MD5 cfd178f929ae24c73479167410bc8044
SHA1 3ace8efebce692554e33944579100ddf164480ef
SHA512 e214701d5bb2fc59a8199b22c375e4abaf62fb9144bbb17bfce084d40a0deda1d84b1bd13e7617b600add5e96b8b0a02eb780d102c59f482d69197675ca6cf23
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHqf9mz01mJv:75dKqi61Iz01mJv
TLSH
T12BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f75fef9f05780a00aef3d6efc176d49285cb9f32f7d04377f8d983d0ba22ff6b
MD5 dadaff803cfd525483a574e47fd7396f
SHA1 6a612f1b2b307bd2151a9f9a537a01e90e7fc259
SHA512 89b4d8e4b5c1e2565c9e7110b15180e125b691f230b4609bd47435308fe5e7dd83ede6d36c8cb8e721ecef6885c69d10bf21ded909c8ec56d8e74ebf7e9542c2
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wG9mz01mJv:jX2iWph+z01mJv
TLSH
T12B95BE13F2D901E8D06ED178C7468632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ccdc312374fc6b17f66fd645b4ee87b33000e3693bbb51c458d4d4175e81c199
MD5 b22ae927d7657da30dc2c1f80d0eae95
SHA1 1de82d12ab52edc65acf48b05e7a6caf1902ac03
SHA512 f695c38bcd0b90cb01a303bc1d9d43506becf78c649d01bfc2bc8ffbf6a534f22e741af1a88f07983a7a68f9af72c24f0adeef45e9cfa433fa5d28a77f834dde
SSDEEP 12288:hI2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:hISd9Lkf733LIURkSOEUi8DApF
TLSH
T1E2552365A6CC3743D9338EB080EFF1C741312E69ED90A04FB6797858E9BC9E19DB6805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 78001271775edd6c6a35fa682192fc3f2d1e696456ee9f1e4b78159ab691a4b4
MD5 c0a5190c6ec2c90b4e9d1bda157acf06
SHA1 8e3e8f34c995f0eeb3adb9d435abdce3177db985
SHA512 a543a994b8a38793b635ff5d511cb85d1204cc52d7d2e34d4ea08b16d664392da7a6a05c2ff16d4053537cfaadce489acdc2ed38c618cf52dec88624c00f39fb
SSDEEP 12288:gB2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:gBSd9Lkf733LIURkSOEUi8DApF
TLSH
T152552365A6CC3743D9338EB080AFF0C701312E69ED90904FB6797898E9BC9E19DB6C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 17db3e5cd340db2b1ace0095037858fc52a0c2c99546a05ccba1611fdf755f69
MD5 656fc91b7b42c9f1a242fb4eea26cfd8
SHA1 e76accea925f6ba72b811942fcb9ad7f506b6706
SHA512 298fda9620f0d622fa03cdfe338ac62b3d8f54650c02845b46ac3998cf899eba33f99ce520b95074db053022161fce19d6826251144ff86c1a24e394a802aac2
SSDEEP 12288:pv2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:pvSd9Lkf733LIURkSOEUi8DApF
TLSH
T174552365A6CC3743D9338EB080AFF1C741312E69ED90A04FB6797858E9BC9E09DB6C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 46cd7d94df40ffade0b772c050b5f57579cf90bf93d80fb023643ad575e95bc9
MD5 6314aaf9d867af6c684491ade80fa787
SHA1 3eaac8b00a6ead3e7db6c7b27d9951cbee32f34e
SHA512 06cfdce77f1e323babd7f318aef4b0ef79997f60f7251538c3fb5b9820fd808211989e51b6af25a67fba6dc1038942b8ee44fea1f0c614fe29e87637596d27f0
SSDEEP 12288:SVu2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:JSd9Lkf733LIURkSOEUi8DApF
TLSH
T15F55236567DC22C2D873CE74C0BBF18392713DA8DF60A18FA6211C999EB87E0AD75C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e9210b92b400c5aea6778563a23adc94115f023403b18e43e11aba58b36fb353
MD5 e27d3baddb4d3dd6c7685f5fe8f328ab
SHA1 739d500052384affec326cae1bc72f90746c428e
SHA512 de2fe9834610e4dbdfa80527edc65114316d91c59ddb63a7c35c37310767c8922411be90edb96a910efc9b21b19bfd5f26b37e027a8d30aa7854f142228e5826
SSDEEP 12288:vG2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:vGSd9Lkf733LIURkSOEUi8DApF
TLSH
T193552365A6CC3743D9338EB080AFF1C741312E69ED90A04FB6797858E9BC9E19DB6C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 605228a12ddf72c54e2f19b3b8cc0dcd8dad98d5b283090d99a89d2c30ee215e
MD5 c69458878eb6c27df4981d9ff743c016
SHA1 ab21baa5a1274be92a3383df72afe40233ec6e1e
SHA512 af2bbdbdf648c5036567abf1bcc94c75cc232d8c30d4268c93068479b322e5ebfbcd7cc192322cc62d74df9bf216577fcb6a7a1400a550f9738e55e431bb2a91
SSDEEP 12288:GF2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:GFSd9Lkf733LIURkSOEUi8DApF
TLSH
T1FE552365A6CC3743D9338EB080AFF1C701312E69ED90904FB6797858E9BC9E19DB6C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ac97a23e203f225430fcd1e4d6cb963639a43cba288a7e0057474d10cbc0f546
MD5 1e1023df385c346befda8656f5b68d48
SHA1 4a25dfc51870cf533adf6944eebcae0e9c6edd90
SHA512 0d10c687370cb521913c43f8f3fa5bae60b270e4f6f75561027f7cb0ca4aa4e4bfc02c1e2779c51ceeab4f6256dbe8d79acf019761226c231d4380a502c0a393
SSDEEP 12288:n52D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:n5Sd9Lkf733LIURkSOEUi8DApF
TLSH
T100552365A6CC3743D9338EB080AFF1C701312E69DD90904FB679A898F9BC9E19DB6C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d5b086bab293f28ddc07fb81821a7473ed36138c0ddede80215790317a03d300
MD5 c5dd815cc59da8f51053a18bcc081543
SHA1 419e7bcf293499ed66c1ac813016b34f2dc38309
SHA512 fc99ef09354089f1a6e6b2770ffb23a8c2458a4572b913a6a690f31e4e8c8191e5fdd9c80ff1a26346789d08a6866173e507ec173189d5418de0b295e25713da
SSDEEP 24576:5ZM3zFVSOhSd9Lkf733LIURkSOEUi8DApF:5ZM3zfc9mz01mJv
TLSH
T1567501A5B39418F4EC73863DC8669946D2B27C690BA0C60F13B4366A5F373A11C3EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 74fee0a2d5b03021efda50777b8717fcae49f98eb1c37e369d6c1f09c14f4215
MD5 0c5c7a46510d392f1d019859422037e3
SHA1 747f1fd4cf67b0af16af90922613f7da0c399152
SHA512 9f20295bfea7690be66c0c7a692bed010ea2bcd6fd274be9dc1c063155614308d88ed51eb14cdfd4fb9a855ec58c68fb6259b7e5ab609dc4ef8d559653f08e35
SSDEEP 12288:BU2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:BUSd9Lkf733LIURkSOEUi8DApF
TLSH
T14E552365A6CC3743D9334EB080AFF1C741312E69ED90A04FB6797C58E9BC9E19DBA814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ca3166ad05ec03208ff391cf04b980128e6fca4483df609f05ebf9b35483cab7
MD5 f1c0355775d18dd94a44fcc147c0bdba
SHA1 0e051440bf4ae9f1e14e0a17d8208998c0dda1a4
SHA512 834d94d0e5a15621f463f52d15d72440241610840bfb4f485030b10a3e162f6ae066e1f4e48f35f1cc513c951cf5fe5831232574bede289a6df99da20c00e03d
SSDEEP 12288:qQ2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:qQSd9Lkf733LIURkSOEUi8DApF
TLSH
T188552365A6CC3743D9334EB080AFF1C701312E69ED90A04FB6796C58E9BC9E19DBAC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c8425946cfa4b5e69d1854e7b53db894161073f63039e253ea5260a0b47723ca
MD5 3c41cba878ffa0912e208ad99a83e3be
SHA1 37bfef6d3e31c6e945bae7c20d99a78ca384eff3
SHA512 1133713d5adc260583d90732031c583482164f2badf98521f6818e908063512bcb92f63d98b265a68ffb9647bb5569d16817b6ce439669413522cf4e3f19f371
SSDEEP 12288:WyPz5L8N2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:rzyNSd9Lkf733LIURkSOEUi8DApF
TLSH
T1AE65125773E831E5D5338634C4A66642F3727C364B608A9F53B4067A6F376E09E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 29e57488915db22e8a8c2a00c02192bc9339da94ba7e79d550dc9a307e5ffc92
MD5 c1dbb2cb08d5e658c05e8f63aaa25b65
SHA1 c63202a40b1e2b8c6a0531c71040107865b78a6a
SHA512 eefb9274242a61699e1d35b755b610df22983819aba117c162a733a9a25397393295b655f34da3a73b6404668ecd56b9a85c3a7455e2a8ff3c2c94ae8d601635
SSDEEP 12288:HU2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:HUSd9Lkf733LIURkSOEUi8DApF
TLSH
T17F552365A6CC3743D9334EB080AFF1C741312E69ED90A04FB6797858E9BC9E19DBAC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4dda29509854c282403d2c634f24b2a9a5a995a3282eb7178f6b5ed284036e3e
MD5 0f7c2a343f79dcc914f687e813093376
SHA1 c6885404f62a4529f9701f82375af14a1007fbc9
SHA512 73bbeb2224d64fa5deef28b0667fe98d1b3ced261e54c5c0b2838e16ad03e31cb798fd022974f1b68c078c93ea6f81a63af90f8168bd639dcc7998871303a111
SSDEEP 12288:wU2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:wUSd9Lkf733LIURkSOEUi8DApF
TLSH
T184552365A6CC3743D9334EB080AFF1C701352E69ED90A04FB6796C58E9BC9E19DBAC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b9fe90f37e45cdd9a76715e00b3d6c87d0f51d595b34ba390d22dcca3c00b2b5
MD5 dcfa96b96beb47349bc446bef725120e
SHA1 0b2f6bd38842ba7f5a45d99a8e09a0ff4e9b22a3
SHA512 d363b91c42ace0d254e7eab90b9521468e5ecb755d1b6e5f9f976dd4905de6d28ccd27c417c265d8c7224d99e774dd9584a3c1ab9185da68fbffb95a20a9ae69
SSDEEP 24576:bCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvATSd9Lkf733LIURkSOEUi8DAv:bCUAPTY+8Wg2lIL8lrIUJLWwV9mz01md
TLSH
T1AD65AE1EA3DC0896D4BB813489518A06EB32382E1B21D6CF2170C77D6F67EE55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 83929a404fe34224d3fbb8ab302428b661d6eb2afc513c64f3e644190bb1b12b
MD5 c54fa16635639cbe655bfc686d0d5935
SHA1 92c879db854931bd2b7646588fcc1d8e8c222e6d
SHA512 7c96497655c178cbbd8a570a59a3f654f425dd58404044c6c7782a28cea04de8334dbc1dcab62058e0610e76e0f6306e91d002f47be3b9f15f35bf2297338fc8
SSDEEP 12288:Npsfk2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:+kSd9Lkf733LIURkSOEUi8DApF
TLSH
T18065F119D29812D5C06F5674C75A9682B3333C258BE0D3CF62E0F97E1F796909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 759dea6a86ce27bdc0d45a03262693afd0724d76ef9b494a9a84ba4aefaa7947
MD5 85492782cc1ead60f26afebfefb21d31
SHA1 f0764bc22a6168f1e094af1218a7e890e85ffa7e
SHA512 dff14f223105ad44663100964a0d7b5071eb88e454db7efbb927f708c4c0a46e2f8e87834bac70ef923b9df8ecef1ee6e0ff96a8fac1acc9212e276bbac760c1
SSDEEP 12288:gP2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:gPSd9Lkf733LIURkSOEUi8DApF
TLSH
T157552361A7CC7A03E8735E7040AFF19302293E689F90D0CFB525699CE97C9E1DDB6806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e513a75af412ff09ed3f4da8ccd9ab9ec144d3ded4886c34f5dee067541dff84
MD5 2b39870df5a0ef94fda96eaebace92f9
SHA1 8e91597e4a1c21abac316e502da1c8d42cf7cd42
SHA512 be09d540ada2272b78a3cd67d9a1cb93d5e143ea0553a931f1583955e22e8ed15773a8ecba8711bbc11c050ba8b2bb071cf98e58ee5c9126a1ec85d907f7a85f
SSDEEP 24576:+8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC9Sd9Lkf733LIURkSOEUi8DApF:nRZwQCyiHiQEaaPnMH9mz01mJv
TLSH
T1E385AF1E63DC46A5E0BAD278CDA74407E6B278164731A7CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7938c439bf37466055d7ed0b837df2b6011bd20ce69e8530c656711890eaaf84
MD5 040840c0c9d76453e9693610d8570b5a
SHA1 8580a23df5834b15da841a6b5c997d3f9ee93b63
SHA512 15e34458f2fa08aa234307b7a776f5eafd347e4ffdd8c66d26776bdb472f28a390c125e43a85eb7f30b4000ba9c94ebd71488dc5a503e63c1882906a1fcb0681
SSDEEP 24576:5bxA1UG/Sd9Lkf733LIURkSOEUi8DApF:5bxA1Ur9mz01mJv
TLSH
T12855123E66DC25D1E577993884DAD146C3327C2A5B2093DF20E1827E5F3AEE49C36E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 98c1925ca1c4c05004ac5563e3822e5419723ce626d69a89ea5c631989c7a7d0
MD5 1bf9a6f49827a2ebd8a1536e7b000fcc
SHA1 ffc1be0c0b6bdc182faf1fd651403090f9d5e4a3
SHA512 859aef9c7de7ff6984b4d4ba89235b77a3c2e0ddf1fa0f65cac0c8c8838598136a6924d6d21756539e2ac2dcf361fc1490412eb5be9f709f83a1c7d2bfad0d11
SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrneSd9Lkf733LIURkSOEUi8DApF:MjRP0yHfVqzlAsrn99mz01mJv
TLSH
T17A45AF2EF2B910E9D4AAD136454507B5BB71782D1F209ACB0170C634AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 d87d333efcd2a557efbd39fd715f58c75da06103ebecbed041f3570bf55ce05d
MD5 33b2c3a04d7b5ec7272d81c0cca77d61
SHA1 b1d7b4eabcd7d17a2cbab9afd091a73fef044c26
SHA512 27068f78583b3f221e7e3679ac949e15d8870e83a545eb9473438fadcc2ce0770750f90891f0343235742cbdf3a5418bcaf371cffdc2cd0be22301743f603cf8
SSDEEP 12288:fl2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:flSd9Lkf733LIURkSOEUi8DApF
TLSH
T12C552365A7CC7643D9338EB040AFF1C702212F689F9090CFB4757999E9BC9E29DB6805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 b0702ec2e2450e264a4c13627efbd4b9a2fcaa698e58a3735c97dbe4ada1cc16
MD5 e14de0964165c85fd76b87ab690fb526
SHA1 a11d92f3504a1adc31613b5456bf7a7ddcf7fe7d
SHA512 bcc8e6deaf0bd3445b3c844d9bcfd64d668a186c50db25307ab6a9538dcfc3da0924161a1a93ffa617b2df1e7d906bed0a9901792be5f8fc2ed02226477bc8c3
SSDEEP 12288:TObIA4LWO+vAYFT72D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:8ALBUT7Sd9Lkf733LIURkSOEUi8DApF
TLSH
T15175F155F79810F5E977823CC8A69617D272785D0760E7DF03A88A691F237E28E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 47f0fb7ba53c8678bd298e33bd24ae70d126de7f3fec31ed9812abe238f53fa8
MD5 9e434a2bdea90f1a9016f18bf72f9bf2
SHA1 5e251a7f0b3db939eb1060b1886b44041b69c7aa
SHA512 56e52aa0494daa47d7584b57984e7da255afa4df7c4f33a2b3ca3a540784f0b09244e3c4601e2588897e57bd8ea3f09e35efc4fb9427c653b50b53137007aced
SSDEEP 12288:s70VmzIYNvUyBpY2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:5fYNH6Sd9Lkf733LIURkSOEUi8DApF
TLSH
T18865F12EA2AC1DD5D53B917989C78249F2737866175092CF05B0C27E1E27EE8BC3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7c9ce2605873a97c61c184662e54f279e6188757af827007567efc1d0b386beb
MD5 bd005debae7c9863fd12f7b31079a243
SHA1 27cab104c2d9791a15c17ed49c10da1355f4cc03
SHA512 93b413e968771cc63f569e9e133c1e498b0c76840d217531f585cbe5d08ed1f0d71e99836fc3ebebfb116de780f2d04cdd085052da3c4bcf1419f312c39cbcc3
SSDEEP 24576:2nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKj:2nXoJJYH84VVS6AmETJas+cHBjSSKHPT
TLSH
T1DA65BFAEA2BC04D8D5BBD17CC5C25506F5B178621331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 959a883c12cee15934f07fc7337d2478a92351394ccc276802b675c0678f6778
MD5 29a722d3d5990b490a99c7ecec280605
SHA1 8c2419e32f34b0ca1be83c6992789e005e7e75b0
SHA512 1517472527d2164f0c8c1e327d3e5c3f259c442e5c26c76eff5384114d7af98b3ae2dd2f9e5cbfb03d5315f2ea24bff67936cc05c12374badc4004198f09b181
SSDEEP 24576:Mv7Xbxd9Tuycf8M/TYlSuxwr2PCASd9Lkf733LIURkSOEUi8DApF:MDLL9TuJ0M/TYW2PM9mz01mJv
TLSH
T1F3858C5EA2EC42D4E47BDABD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 df15be9245404ba12d42e6b66a45431a12e5cce6cff3a88e7be3e12117ebbb18
MD5 a4344a9fd30ab60bf389cca80e9f74a1
SHA1 3c5d7c8953c790499521cf5c5e730681c28193d2
SHA512 63909188e60a7c7fb1993b87b983a6faa3b15b25463f4592819825cd4bc305aa4b2ebf847a2319791d5999c7be7ecdcfe67e43e6e8bf5b6bb0b6d478fd7ee356
SSDEEP 24576:eegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w7Sd9Lkf733LIURkSOEUi8DApF:engOJOmPOHkG9mz01mJv
TLSH
T16255BF3FA7BC15D5E03FC17D89968916F6B1782603255ACF0160827E5F2BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 9c8a32a70563ab5a92169393534b51e45d37766f179ccbc983a3e86e5baa23ca
MD5 c6f0f23f8e1aa4385d09e9df2ac65783
SHA1 353eb2e53a37852ec9606d57022549cf977ecf38
SHA512 b4f03712a7e91a714f19bb27589e0deb80d1cbeb8a54d47d81ea91cdd32cf58f4b342a4b7bcf92122742784c3b51f4d265e694fdfe8d298a0dc5c2dd8f8f4650
SSDEEP 24576:KLJnJiTk3R3waE4JrOFSd9Lkf733LIURkSOEUi8DApF:KLJnJK8R304lt9mz01mJv
TLSH
T1D475D03CD2A810E4D4B7C2B4815A6696FF31346C2F2169CB69B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0543251213fe12f31c7d40d359adf35996913a1a6b2543fe9200c2d87005194d
MD5 36cf16aa864cfed37054cdf48c03da75
SHA1 fca7e149a7b7db3d25b081bd707787479f8b51a6
SHA512 da1502e3fa55f1a8ebc91a39294c266c574b5b5ea7310346ee627d97e851594124d0dc853d7302c57f1db47cedfdd3c9898bb5870090517363c42a5481292170
SSDEEP 24576:SA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pDSd9Lkf733LIURkSOEUi8DApF:t9GqCzDScAZmlvTcFg8Ph6o9mz01mJv
TLSH
T182955D05F7EB5284E8B3CAF1C96694169B327C409B34F7DF4A80CA6A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 24e134258cf3cd8511b3443e9eb40e14d453b9a500a877cc8d4cd4703c0a5ed1
MD5 3fe0ce5cba2acf1d45263ea45394c7a2
SHA1 50db556fb51c83a8515d3591eb30933bbd12ad3b
SHA512 4b26d659286f880ea65bca2cc742d6f015344040780d85c2647fe973375161f33a68e71a083c2b3a38f74b224ebbe6ca4417525ec5fd166c55f7dd1ca1e83173
SSDEEP 24576:ylYJeXm5jUuErSd9Lkf733LIURkSOEUi8DApF:ylYJeXmRUuEW9mz01mJv
TLSH
T1A155126D76DC31D2E13B897880A69186D332B4751B4063EF61F0C5BE8F7AAE16E39D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 dfb94e6112c1e3721c81d5655eb096aedc97c2cf0d8855597dd9b92e099a0496
MD5 2d855792402cdc23097bac2dfdac5df0
SHA1 917ffd95acd6f6d8deacbeb353ea42121f1a55c0
SHA512 d60c374e6fe1fad578a1bdabb3c328ca1b126355b2096c5614cb47703b3541cdf92d281dadf7834164fb7ffce4213b518f3bf3f14c57e0b118116813d472c297
SSDEEP 12288:bwu6ky+2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:bVty+Sd9Lkf733LIURkSOEUi8DApF
TLSH
T1C665121463D87181E9B74E74C4A791918B357C249F2092CF61E0FA3EAE79BD0AD71E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 bd4843f84d237b90bcc8c140272ac8f138a65af58d3237a7daaceeea970790cb
MD5 6f6675eca353cdac3abbec9c36a4c8a0
SHA1 6a1bd598a7b0472ecfd5b86f3de3c8c1aec63547
SHA512 a7c3bb1c1deb7d8d0a47e82828ed1e405eed7b32ee750822afd7e2e2d801a6ca5b0ce1f24eca1b83f08272a0293c15f8c6aef08481558d06dd3336509ce7a832
SSDEEP 12288:2P72D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:y7Sd9Lkf733LIURkSOEUi8DApF
TLSH
T13A55236967DC3642D9334EB040AFB18342353E389F90A09F74B5E8B8DABC5E19DB6C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3763219415a940c4aef403370b864c452995f1bc52eba9ed0a2aff674d04050e
MD5 f51e746b69b0e58e49928522b800f824
SHA1 1ef610f2bc918cc8ffcbc00255e212d46e858781
SHA512 1eb1a7dea85ef22b8f2550c3e29ef6919237706b65e573869cc7370a4dda7085488784a3b47ab09c60052a9a6a3fe09194580df3a9872516fa06a1bdddac987d
SSDEEP 24576:6C+TyQIu93VAumZr7jmESd9Lkf733LIURkSOEUi8DApF:6/TfIq+Y/9mz01mJv
TLSH
T17C558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 57c9a75ea5d767bd88269049cb6fd739dc05cb7f7226a44505931a36397f43ff
MD5 98d605ccfa67d57927cfd25e5855b89b
SHA1 aa0d49c2d1a0a4f3b101746420b5a028863cb92f
SHA512 ac48878058906aff4c57a89a3d0acfbfde9a845e8b4b70f82c2798e4dfd8bdfb9137f071200f0643eec7484d8330d5cf72ce95e49ce76cf9b8f591061300f43a
SSDEEP 12288:scyrWOstaa3kcsX2D2ipcPpkLRSCi8zimxW30oLIUCykSO8flUi8BxvQ9pF:JLQikZXSd9Lkf733LIURkSOEUi8DApF
TLSH
T11A65F10EB3AE1092E4A7C23C889A8142F67374745B1163DF52A0C77D5FBB5E9BD38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 46db808f7adb41669ad85631a600a635717b3c80f8b87d330eec3ccf62a4b9c3
MD5 601038f84ec0bcce7dda786c54a8efad
SHA1 ce1e226609a46e70c45c69f0f90ad62c49eb1b8b
SHA512 d64aab91974e04d0a52a2e38c3d14dcdf8bfd0bbbaa03310c0633071e6eefb01d5ac848c4b523431909f25847fe6f8da19790a27b58dab71a5fe04bc8ccd1705
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPd9mz01mJv:DpC7b4+80GTk5z01mJv
TLSH
T180A57C3DE2B810ADD8AAC77585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ed5a00cc621b259f3b7b04fc41606ea8804cc115f3ec34319258830ae25c8a39
MD5 5001af5a4053a324fa85c52cb323a59a
SHA1 68a9584968486eb78eee1260668725909fa66183
SHA512 e416c119421ad1669d745eb36b385f59b5ba8e37d6f26a55cb9b15da42a6ac97316d284afd871e44123424a4deaac03db86a39e5f62bae71029b288d8ea3ccef
SSDEEP 24576:1SAwJPE1IDAo+4Kt+l4413lUQmSd9Lkf733LIURkSOEUi8DApF:1qPCIo4Kol4jQ19mz01mJv
TLSH
T14855B02AA7FD56E5E17ACBB4C663C501FB723822133163CF5290817E0E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 425dab658dbd3ae32aa0c94d72d1c7cbb11c1b43a81b7c21418a5c7db1c4e8a9
MD5 271a6d01cf4f3804122504144af37a36
SHA1 575eb787919a042192692284b82aa656c2161ea8
SHA512 acb029769af5ba0b64e3f32cc7caf46ef2424dea9384da488388e09d94e6b10c4a93ced1450e6dd1bfcaff24daa0967314b5260a21abb22f472fc3db6d7d5e71
SSDEEP 24576:WyLXPLcT94tWSd9Lkf733LIURkSOEUi8DApF:Wy7PoqtF9mz01mJv
TLSH
T19675D03EE76C04E5E47AC27CC2A38506F67238AD037166CB15A495791F6BEF4A939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 f78830ae116440be6e53cb1eea106f748649702e33f73200128af241247341e7
MD5 77a2e677a779cc2dc4f3e548311072b2
SHA1 ad472f3bae1342b775eb88eb6d8c782e3807638b
SHA512 20a8d7e996aedf2a778247d808610be09cddfb4b5c64690c8c1e2e0817e22e2d8e2a766f70702417bb2814a26e0bad34f001ec5ea7f35445a2fa1ff615e27827
SSDEEP 24576:yWv8qjpnSd9Lkf733LIURkSOEUi8DApF:yWv8N9mz01mJv
TLSH
T18965126E63D83481E4374A70C06BD15681717D761BA4A5EF70E8E9BA8F38AD0D83FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-166-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/488-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/488-37-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/488-31-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/732-136-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1008-169-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1344-22-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1344-23-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1344-15-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1344-21-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1344-357-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1476-84-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1476-90-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1476-209-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1644-53-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1644-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1644-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1644-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1804-203-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1828-341-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/1828-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/1828-6-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/1828-1-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/2064-207-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2064-77-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2064-71-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2184-128-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2184-122-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2184-168-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2460-205-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2968-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2968-167-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2968-116-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3212-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3212-67-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3316-208-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3384-171-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3384-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3384-153-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3384-147-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3384-187-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3384-210-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3384-206-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3424-356-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3424-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3640-204-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4156-94-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4156-99-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4156-163-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4396-381-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-383-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-391-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-388-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-387-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-386-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-385-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-395-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-396-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-397-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-398-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-400-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-399-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-389-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-384-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-372-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-382-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-379-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-380-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-394-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-369-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-370-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-392-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-373-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-390-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-377-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-378-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-376-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-374-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-371-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-365-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-366-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-367-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-368-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-364-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-363-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-375-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4396-393-0x000001A1E3B50000-0x000001A1E3B60000-memory.dmp

Download

memory/4740-170-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4932-164-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/5076-358-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5076-165-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5104-359-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5104-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5104-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5104-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download