5ab7922d53226ae46f2c0ce42ad1655162a9fc97b13ea0274c982e9e1492cdc9

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260604-s87mjsax6p
SHA256 5ab7922d53226ae46f2c0ce42ad1655162a9fc97b13ea0274c982e9e1492cdc9
MD5 aa8bcdc372c5bbc2dd623796cfd9544a
SHA1 fafbcedcf2d71568136defa5381d1e881a5e1b0f
SHA512 011c102550952bd5847a7ebf3290abdbe9d123d54f50cd255b40607df6aeb7cbb8ca240708f31ee5571a8c5445b1c864a4e4c135a2c43271fa2fd20e042c0ab6
SSDEEP 12288:xUYJ9bi0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:KYJ9b5nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13865013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343C08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4792	alg.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
3856	fxssvc.exe
2436	elevation_service.exe
3184	elevation_service.exe
1536	maintenanceservice.exe
3408	msdtc.exe
5092	OSE.EXE
3724	PerceptionSimulationService.exe
5380	perfhost.exe
1716	locator.exe
4384	SensorDataService.exe
796	snmptrap.exe
5508	spectrum.exe
4404	ssh-agent.exe
2768	TieringEngineService.exe
3796	AgentService.exe
2732	vds.exe
1064	vssvc.exe
1212	wbengine.exe
5124	WmiApSrv.exe
4748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e4638aa2ee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c08d1ab239f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af3a69b239f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022947fb139f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000111da8b139f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e2b18b239f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038a4d0b139f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9f5a0b139f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe
5604	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	3856	fxssvc.exe
Token: SeRestorePrivilege	2768	TieringEngineService.exe
Token: SeManageVolumePrivilege	2768	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3796	AgentService.exe
Token: SeBackupPrivilege	1064	vssvc.exe
Token: SeRestorePrivilege	1064	vssvc.exe
Token: SeAuditPrivilege	1064	vssvc.exe
Token: SeBackupPrivilege	1212	wbengine.exe
Token: SeRestorePrivilege	1212	wbengine.exe
Token: SeSecurityPrivilege	1212	wbengine.exe
Token: 33	4748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4748	SearchIndexer.exe
Token: SeDebugPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4764	2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5604	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2340	4748	SearchIndexer.exe	104
PID 4748 wrote to memory of 5088	4748	SearchIndexer.exe	105
PID 4748 wrote to memory of 5048	4748	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_aa8bcdc372c5bbc2dd623796cfd9544a_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5564

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3184

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1536

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5380

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4384

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2932 2912 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5088
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2888 2900 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2c34d7684da26550cfb38f016dcc601f05b26bc302df2552c04be60623e8652e
MD5 035405c24f61aa08ab4cf100d02e84da
SHA1 98c214f7e81603a0f69388f2e0da4b91547eb432
SHA512 e7505d717248484d78992ef399f1296beae59fd8818c7f6e28827894e7c20bfbe9f6c2a517f928113b605cd7a54e095144990a82abdbedffca6916a10636c6b8
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjQ/lFTjN4:M3q6HjBfLm
TLSH
T1E1D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4b84f71a13f9968d698e4639a4a3ddc4cd55a139a77b3468dd9e6f4fa503b7e5
MD5 041d4fafef7b1489ee212b878cd7893f
SHA1 aa741d2f92a468db79d4cb088e382fae03ba216e
SHA512 1874fe3d113a188a7fd7fbaa4b6881eda3d43731e35204e0f501f2c80811ecb8e6d91acb5e9b36785d34fa819dd8b27fd2bd029be05bad8c37a123856d0e75cd
SSDEEP 12288:T1XLsswWkxy2lRq2czAYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:JXYfDtczAYnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T14265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 74270de20e621d89f57a7e18758f4e6e1821c8e25b5772befaf2292842dbb189
MD5 99d57c1c79f1f1ca703ebbb076a78d25
SHA1 919c3cd61e2e4b29ca65ef3cc0727d7e8c67518e
SHA512 c11d26baccbc087f208365e00289c1e432b156d1e03273a90f45f4aa4c48ad5504e5a994b9dc2203c8b835966961d7e5e52c2878faeb06ef0eeb6c718336714d
SSDEEP 24576:X0Le5ji0hmxLrMrnQ/tbw/2Mkjy6Fr7g0o6:XPji0AlWQ/lFTjN4
TLSH
T144859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0761c5acf82cd832ccaabdba3abe1060b6e8cc14b3502201ac06f4d8046437d8
MD5 cdbb92e00685f940a028a7fdf073b77d
SHA1 48d0dc7a11ca5613e992ad6b9e2dd7d0e3ed8bd5
SHA512 f37dec71b5ee2f1a6a83e4d30d7a23617f4918e20d27cf3013a5968adf37d7bf953dc04ae2bf935e5d5abc854980e0b5a39a696972dca0448c52a189941a13b7
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0oc:G/ezSC6vUzPvxHjyCQ/lFTjN4
TLSH
T156755D15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 54a37efab4988f765e732e89c181cf96d11e5060d394ac20c2032ac0faa1bf86
MD5 07ddb3a0ddd9afebc9c234bf99685d70
SHA1 4ea85715a492d5102b6b19abb5e7a3a9087288f9
SHA512 1fc52343ce9a525a97a190c11397cb9ae358564927ad1692c81cb879d27eddc29c24d703d46b2f4dd2de1530204d8aa1f016970fb0cbd2046349c165ca2aaeb2
SSDEEP 24576:7VbqPb88hv/l+6MnQ/tbw/2Mkjy6Fr7g0oH:7VO88hXl+nQ/lFTjN4
TLSH
T183559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 87b1a88c8b8c6b7deae479eaac92738e2a0221cf73f49ba40196ec62823b3556
MD5 c7e799cab022ee7f94edaab7889c7018
SHA1 6330027644ae3dede64c7755752ee7b3127f205b
SHA512 6bb7cccc7b363acab6548d9b4b8ad052cf4f86990200a828cc76d11d7a37224bc7e83d12554a8ae4039cca6eeff3aa457ef720328f915fd5d82a70aa57b5c519
SSDEEP 12288:az/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:azfnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1F85523696A24F897FF2B06B15C8284826B7B0EC1BFD4EB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 022b864e73612c1b5111bdd807b21aa81535540e1b342072e1d2e4c6776d89e4
MD5 4e005308afd43626676d006554bbe43e
SHA1 1d9dfe0829c535b1c687a4a2f3cbd3701be144b4
SHA512 138a8e39b61f8f99b9d907ac1ede748093084a314b91fa4285087fe5be9c74ca916a98a834760671b6b87bf48d016e7080931f90772cb974c65535f367dcf596
SSDEEP 12288:OeBNUbTVO86U0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:OJIUUnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T14575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12fbb2dea5e1fea2f00f72b2ed120cd0c5a345d8fcde0ad85dc9f7e3001ed9db
MD5 64c6a7bfb9b3cab530c4b18d7a296015
SHA1 8edc2841f8b9b427932ee8afefe5618f3bc986d1
SHA512 0ba1a3a8578059baf44ce74fba0449a7994dd86b2a0bb4efefad763523c1aef9e530e7d40a04bdcf76eb8be0d282a287cb362f0ba564b13941be7db5d8bc425a
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:qQvGAdlCEL8c/yRNw5CSLm
TLSH
T17E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4b715c309b497514a6f4349362df77ad953f2a42ac17dc716db5e7cac6306970
MD5 d0885c90ee0a2d5c1040b3c3698d0f0f
SHA1 1b964f322024e7b3f7659dd42e1ab1e87878881f
SHA512 02accd57d46b7c0e022353b772ece76c85b8f7c68c96e7590130b2318425c66b89f698a88abb232b9481e5896631eb89337e4c9e9b0e99b160e5825875286367
SSDEEP 12288:iAwSfxL/2Dc39DLLmt0LDQewsAjGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgp:nQewsAjmnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T13375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db6d67f49cadc4f3b25aa6065973f3eb8dc6aa420e029aa2fd050289ef2c525e
MD5 201d2fb3a25af4458d759e156ce8b7be
SHA1 f69006fd0dd3a05594970044c898313433cc7082
SHA512 a2d96c2cfd4119e65ecc32e39638352b014854122c046c6d47dda0612d91054238e49c5122af37b61f44f21744e0bc35a89bc849779ecfe81dfa513ac47db638
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZL:IUEtQevvqc2W1cpV2EI32
TLSH
T1DD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0b9f78156a0e8dff9aab94010f4b486feba7c72c59c994a6257e1f8b66713ae6
MD5 f84e673d432dc5aeab50790789ff6202
SHA1 cc6466f3b5645a198ad8b02504441457257c06b9
SHA512 7c2b89509c48025d7dfca90c524947daf568e2c95fc5bfc3cb1beb882b4f27cac0655ce1194090b6b413862f87c377e1f7541c12ce62b58615a7cb65d5768ea0
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zGQ/lFTjN4:uoqtVjnmuLm
TLSH
T1C8D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac0bf235096a6b6088e428b3e0a608d3eb4b37ac4af214691612494ae436e48f
MD5 d0357bf4af179da9d5b115734662928b
SHA1 a73071d61ffe773c82053d9a466a87de4c4c50d9
SHA512 c3cfa357aa116a58451dadc3bde9aebcb81fb9979f1d1503cb5258921e07d8964e78bad83f60630f21f16384232b5f097a36914844763617a00340cf7cfb7d81
SSDEEP 24576:MAhGLJIFoiwtA5l7S53ZnQ/tbw/2Mkjy6Fr7g0oW:MAMyFoiq5JQ/lFTjN4
TLSH
T1A135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 76e0f9b09b0a155b02b9a430fc03fa89efcc3d5cf3dda7195554ee2f7387cf2a
MD5 579a057d52de0a1dd82eb8dc3344aedb
SHA1 4101d4c58010fbecdfa3c2ea66cf13ed8023e469
SHA512 4ba9a63aa94e4ccca78e543d0300663f1a86a9238e6383cba120c8bde6feb9764ea46872e91b8d0fb2f693e69c6e5ae9f823837d07f923fc28cc9ebb7e28f823
SSDEEP 12288:imw5HEjsChN2BFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMO:7wuHOWinQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 045f1a03d37c0fed8cc48aebe13465412e3278ffb2a2dcd45b7a9fa42793aa5d
MD5 1a352550271b4a477e3c4ed2fef4d15e
SHA1 e57feb4910f0bbdd878161029237ac8fa54dc1f9
SHA512 13d23f1838d322237ad4bf912081b52cda0668b1945dd452458b3a16e2a5baac6ff44411c1de2134e5b0669093127050916cb1df2b4cb5120884debb29abd845
SSDEEP 12288:tXZ1IyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:dZuznQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1AD55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D51E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 934caafd92958d569d62c49fd7d43f94553de1d2d1796aeef43156e8026c567a
MD5 6663d66e75bd90073e761d759751bcbe
SHA1 9b35302ee80040ff7dfca65f461066e640699f58
SHA512 4deb91485d26e7bf19077aaa1815fdb437e9253d4a615c47d84d238d9c88d39b1835a53474ab5ac2dbcc6475eaf13e0230af2898b0d528e3e844842c1f1b907b
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:OQRQyi36YOcPQLvw2gAf+PN3zLm
TLSH
T137667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fcd2facede1b6e80c18599037cbb03c83c345f5d5d9afe0c7684b5ccdfa9558b
MD5 442d3e053a218c0e1cbb042296934823
SHA1 a2c8fbcf2a9bca5799fa79f1794caa6c31884651
SHA512 820985dd478eb6191c00acb0e53c30ce05c84397391d9cc31095e555e34cfc3da838269f5ac387ac53c9856786ec9673097f8e08e66fa6ccc987b60c1e2cef8e
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:fQRQyi36YOcPQLvw2gAf+PN3zLm
TLSH
T1A9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1b763576e8f1a6557fbffbca02cde583d9e5c85687e52e3a57724f76537409b8
MD5 0bd74add79cc80159b544ad26403f195
SHA1 d6c2b80056c367a3bb813d083f6ebe169dc6c14a
SHA512 582e23b2f1047228d7fb04955b6729202de50385b679e3d3bbd3d7d40e20cff8a32a43aa5a117d67ffbf47b319b6dd54859ad0895b814aa6cf26f0020156853d
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jnQ/tbw/2Mkjy6U:k68Qg55nhheWu7PNU3/WQ/lFTjN4
TLSH
T125B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 397468d9cd7e085286bedc1d9730976983e23a8d3a7df225f1e0b0c180513c37
MD5 464cf0753c7738d500ca50c033502a99
SHA1 68cf2c8ac88536f94fbff627ddeb6f2b57e45ddf
SHA512 ebeb2465593f4ea8c0aa10d859ddd272f1f77ee42ff7e923879688bee9c1525541920cf5b0dd7cb2b869e5553d00888b9ea3a45298b6117b473d1c8c0c24b495
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:Dy5112gYy5azzVvL69nLKnhZULm
TLSH
T108167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9b2a10e6af8fbc058b3206e0e0dddf0a86aff3ab77c95093922def932a6174a7
MD5 ef6a4e4ee136c1f10a35bce888a099ae
SHA1 3950dcf3bbc0752d67f36ab1e4376e0278c8bdec
SHA512 49ef23f1063a37e9263ac719c66cf9ce6568337b135e586350c51046ab45e9f168f46c0faa04169c7d32a8cdbae3355c0b820a12e8c703a3276b44c67b04c2f7
SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIQ/lFTjN4:+u6JmVxd2drLm
TLSH
T112D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98bd74699d2217a52e4d69cd4f312c8482cbf3d76c02fab2803f7418e75a41e9
MD5 cf8f05488b90da2a8b5b174f125507c6
SHA1 f19dfde11bd9f2d4e71e645e7f4b40bf69520444
SHA512 f39d0deabdc1d41d1bddb6478e27084a01419df7bbdd522639fa84b499db88e4f6907e14d8507e4c14fd25cfc8c268daffc128cd12bbdb4f8d36821da3283f7a
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4x0Q/lFTjN4:WmifPbRuLm
TLSH
T16DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5f8889ebc8f75489af5340546ad9898784b345d8a7ec7ecdae2554f27c00e4a7
MD5 0215c9abe126ae9f0639578d2b94e45d
SHA1 ec7db4e4f4209ef42f8bed2987b36b81b75bee63
SHA512 049a3d8503fee6e5677c935dc2cd33c8fffdb8bffa482f9a531e6ca2891aa67d566fc323e2f7ccc0c55dd2dbc6bf6f11d0aa014e05ab8dc41be7a287fe63f89f
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:e5dKTi61YLm
TLSH
T150C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0dab521850d293e99865d1061997946f936725c5d4a07d3b967a7a7816fb746c
MD5 03fe3c8f98337935b1cd55bfcbcc8056
SHA1 8db32c2558cbe8565cdccfd353bc7e0e95d9508f
SHA512 adb5abc6f9e17304fab687edfaeb0ce489ef924ebfcbeb2ff9e233e48ae8ae6cbb1ec557338e23486a681ef27e1af4608b6495ba858a081507261acd654bf5b0
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wYQ/lFTjN4:1X2iyph6Lm
TLSH
T1CF95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a0796b8f5178fb85d7a582f3fa99cc1f2b2a48614675a2f29964f732819e7695
MD5 b801670ae16d5706bcbe854d6fbb87c4
SHA1 d76d2763b9c6d0753641bf47cdc8a509c954df12
SHA512 7748c0ccd835a78555731264ca7c50f8692e1ac6c2bc7627e247b5b7956ca27e4b9b62aa646a47125155a5305fcb5893e0f838e3a7bc4724f0cc32e5988c10ed
SSDEEP 12288:kHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:knnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1375523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e57d55d4ba01b8a5cda110b8dc10a7cbd841a238fb76ecfc7e17657317e2d9b8
MD5 db82ce1fd5ce12e25bd96a8b64244c27
SHA1 0ad4737b9242b9fc4fa30db9df64c1c127c5d7e2
SHA512 a72ebcdb705de39440b506559c88c56b6ef70162677baa791da5afed219023d9db6a2033b59ec36fb7a5d7dac88b309f58a3109d217cd6fe217d8fba76482c3b
SSDEEP 12288:MaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:ManQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1DF5523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ab82fd28c0e2a753517b64ced42789f13d89a481c1d78da44dbc21956d04c44a
MD5 07e984478418a4644a905f1b4f8b054b
SHA1 c249ba6cb92f937dee9f48b492983fb0b12911d1
SHA512 2f31ccf13ffadef54c2cf2da4320547c6547a30ba51a70d8c4e8e21385ac1d58ae7aa941fc0a738c97583f9e6dde5f6be9e9b4111bb3f5b6a29b4163f99fdeaf
SSDEEP 12288:+8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:+8nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1275523687965F98BFB1706F14C8381829B7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ce27d6ab646f9ecb58d38ac53dd9ae9b24401ffcfd498f361a06166ff2978920
MD5 a005471fe6b77a4e9ad8c2bdb058b503
SHA1 c2c56282d93f73e56626f0d5e60270353f061d38
SHA512 206fab6b8b62419ba4c3a2a7c3381ea457df472a94c1e5f2f508757dadf93f1ad964ed42d9b5c6e73f6bdb5de8a75129e30b20fe873f89fa0370a51514ea35ed
SSDEEP 12288:8VpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:YnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1A55523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1710a89e5206814de9172acecd5740a4eac76f47361e9a23d9eafeeb66e64330
MD5 dbc1d3d8c52cc2cd0cb2eeb1685c7faa
SHA1 450365de41326f57f701457f687ec5fc09aa0a40
SHA512 9c2db6cb277fb767c8dc28a2f4839b29698a15e6125db3a36aa1d827fe65c056c31d0c8ab32fa349f53a8188b1dc81f02c77a7c12272b86bd19bc2c3ade636a6
SSDEEP 12288:4BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:4RnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1125523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F77481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f6a9ef02858154937c2cf0cae803fd412b92a72a06cb7987ea2bc1ef42656d1
MD5 f3a6a94ea55da1e00d6e71e01f597348
SHA1 80455b0f0e13f81ff316353ff6b967cb2dc353b9
SHA512 df978b7d39ad84e348f3ee18d3fc8a1e9be51a3f1804cfa8e69890ed7d52c36caa7bbf8d5b1223eff85c5bbcfa81287315ea26f60871b9e2215c8fbc656a7f05
SSDEEP 12288:6OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:6OnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1E25523697965F98BFB2706F14C828182A73F0EC6BFD1A38F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 030d725b66629f62d2896ca418754ad2def3aca52d0576561340d828ec7c2a5d
MD5 ac90a5bcfffe2b9ea43db83f10a9a228
SHA1 209c8896da3783cdc67cb316f513b7865d0934aa
SHA512 67378247d4c6c0bd94e8f23ac075471011dd7a551d287cbe7297978a19efc2bb89c1d90ef5551e12d687de2a23a239d4460673ec52ed11c457f18012719eee16
SSDEEP 12288:rSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:rSnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1125523797965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 311e3f8cecf2f267f993bdb7e4768f94e95cc84a8a5088021d4ee3dae8d1a971
MD5 a2fbcc2d24f97eeaba88c4c7d0cd3f85
SHA1 08014b9a70fab80e4890c8b1132b25e6cffe8ccb
SHA512 6ab92435aaa75605d08ef4f3162a7af2bf24556920a08713f3320f91678c62dd32710f7365c817a43d5dcec93aa00cdb94a4fd82c7d562a9a2971d6c0be3b5b0
SSDEEP 12288:WiZwbDzzFEoS2cPvy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:ZZM3zFVSO6nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1377501A4B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2cb65227cef267922aa115ab94101a50f075d86d8e0a56aa300b9da8c0d4a757
MD5 e5281cef0fd1c73db893e7294e519b74
SHA1 914b3d479a0d051a232cf10c2007106153be89fd
SHA512 acebf2bc1aabc44fd2f6b73a6a1ec0a724dffb427a27a0971015ee532876cba90de1703b21ffce74365a3cf0f64230384ff9f738e89e1a3e9203077989cf4956
SSDEEP 12288:QTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:QDnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1B45523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b41d2140c39a2bfebd9246681083e0b85cbe9d6d30d40ca1b610efb596f49401
MD5 86244d50e3cac0b9f8bd1e4df88da3f3
SHA1 c05b7930b7212b3368afd7b74451db3dfe78951f
SHA512 92aae64d011688686dbf79d6850717052267170ff3aac3664ebf53b4fb58c06e9c66aee11ed35f0ab4bc6a3ce08a0a01ba649174f88bdc703f6fc8bf5394560c
SSDEEP 12288:7PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:7vnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T10C5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a891293f48c321c4de3712406d2a8a6903fbd4e16cdc8e66cbbfd3a0d9604715
MD5 b3c98da5a03e5702e84e7ae5d11a021a
SHA1 2d0c822a5788ae0d8c5ebebab588a41e615c8ff3
SHA512 fa6e95bb8deb5e7f4dc799500cefa9fbc0f89e5e30703e4e7b60c08ac223e582810124450ac7f757a589b8199f09656cf69616f35134f4482911069eafa2f96a
SSDEEP 12288:7yPz5L8WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:2zy2nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T17D65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 75ba1254d89c6a379bddb8ed2f839ad2122fd78b9f25d6692ff29e58c0d393f8
MD5 7bdfadb982d5ab74578231ac9ced3e68
SHA1 59e1958ad062b683d834d2bf6e6edf3d9d8cb221
SHA512 64a133110cb8ed4510bccaa9ee7e1dd3d3a44d950863e830b2e7338ba933095eadc9b45e26f88bc0af16810394f210afea00c2e22ec09a0549d7bb2990308ce8
SSDEEP 12288:7TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:7DnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T10E5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7c3beeb762f4c78f7858465b201e144f0de46c54f01e867b19ccb848489acd73
MD5 28a8cbd3e215756bbd41a09de552c758
SHA1 ce40db033a81320803ca093b0c5231e29e7f006c
SHA512 3de282c73a285d31f9599123008d3049c951f86d6f3878e344e0988abb494959bdd82e583b5c8521fdb20f2d5af86944ee6dad81b880cda7aa412557e12c7067
SSDEEP 12288:ITGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:IDnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1D85523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 afec1a1b52c4e4d52c9bd6d866ce2fab7282e57380fa66e461c60aa359834c87
MD5 db681f7ad771d0a3ee537df0334202d5
SHA1 85ff44efce8e34ae480a53ab9498ec0de9bb790f
SHA512 2913821c5ca1eb46ee354a5fd46d2197b9f639a4deb13cb9ce1b3f0e6780e36a663bace050f2afaf7ecab153551de475605e8c5102952a58a81a64ee212ca1b9
SSDEEP 24576:1CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAQnQ/tbw/2Mkjy6Fr7g0om:1CUxPTY+8Wg2lIL8lrIUJLWwRQ/lFTjG
TLSH
T16F65AE1EA3EC0896D4BB817589518A06FB72782E1B22D6CF2160C33D6F27BD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 15aaea25d578e20bf63d46a1dabc56101bdd37309897b429af1bbfa213b8cdc4
MD5 74e5c24f4f74a344645ee5e670ffaa3a
SHA1 5b2db0cadd1e30403b249641b0a26543523c79b8
SHA512 44501610b412a7e2174b13f33f67299b2da9809cd8c336d44b99255d248b97582280e8327eeaa106ad35a4419e6fcf2fefc374a3b3b29e163b1003fec52c75b3
SSDEEP 12288:1ssfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:VznQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1B465F119E29852E9D02E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 72e8879039ba98074cce8799aafeb34b6f3624747576620f55ed1d247a46eebc
MD5 7d429b8ddee7cf0fbf888af2bbd5d654
SHA1 435db9ae49199e4e6f0d74e9baceb5172a060c8c
SHA512 2bd8bbf56570df7f8b976d422ee4612e8bef8b495bd83de2eb852d6f3841a8dc95556bcfb500161e8cf1365a457a7487c192d198d67831a7c1d70c2ec136ca14
SSDEEP 12288:IcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:IcnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1CF5523696668F94BFA3B06B048938111673F0EC5BF90D7CFBB082269953C3D41EB6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3591eb2fa2a203f9c16219aa70492af56d8da4ab3f56d373f9c0081314122b5e
MD5 f754b8068a64a47dcd9dcc86b2b6d501
SHA1 bfadf22bb12fe339ff52b9375734e168471f8294
SHA512 b6ac128df8999ca394fc6e023e1060686ce48dad698507c625c8d5f3e7b3f42d367ea1166cc1054e365b192a3416694278c38b8a8d0df44b3288ac3a126a6d2f
SSDEEP 24576:z8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCGnQ/tbw/2Mkjy6Fr7g0oN:ARZwQCyiHiQEaaPnMLQ/lFTjN4
TLSH
T1E285B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0374f7c209e3232391165e892049508309e1f5031a49a71b7715f9d1fa5ecffd
MD5 f6ac31a98a59a21a32f781f3185ba0fd
SHA1 c2186e6210be34999e91ae1b4abb1e2b19bc4186
SHA512 3ddb62f8eb34560508b4efb90c09b51d315c56bdf39e5acfbc611f593cce682526bf6284f906be54a800897f8aae7c8e5fab6d700655d6ad04d4750d89df99e3
SSDEEP 12288:IbxA1U7KsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:IbxA1UGsnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T13555123E26AC28E6F636917D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 562c70dd65972534be5b9cce72d7295ccff066841098e0fcd6beffa234a958fb
MD5 4dcb09ef25785782e953ef3ce2a703ff
SHA1 f38f96fb4af2fb2f48b5b50f0bdd621bfb32a1e0
SHA512 08e64382731e23457b24b9440b8863cce97139a296f2899a7db29e54b029b5b87f870f2c9fb560e0c33864f0c6be82d1da2fc654f09ba2314529c5bb8dfabc9a
SSDEEP 24576:4jsmP0yHaqrVqHra44KDzMsrnJnQ/tbw/2Mkjy6Fr7g0o1:4jRP0yHfVqzlAsrnJQ/lFTjN4
TLSH
T15E45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ec8496644f1cabb0f5eed3ac3ee4be4d0d5d17e198e839afd50cd448915d22e2
MD5 8e56af43e96a2b574e71b3198baf5221
SHA1 319b1e89577037305f87f96ee1b1d9f4acfcfb55
SHA512 4ea4e028036ec8166fff6386c5b5bcf64f13864aa6706a5f66be9d6f6cca6c070182e762831fd8e9dc61cff427b1fc45af25d7b925dedf9d05112b26f5fee005
SSDEEP 12288:ZuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:ZunQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1DF5523687655F98BFA2706F54C828142673B0EC57FD1A3CF7B482229967D3D80AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 1f2ab4383d1f5db1b914bc57c425d808321524658c2c9c0c3ee9cef2f7c0e7bf
MD5 df4975c04720797797ee98c52b16c396
SHA1 5db2ae9de61738ee6e0b95093f75e8ab08d4de92
SHA512 7b398476f7720fe1932f1d903b67a16b858f1306cadb91e61d788dd1961ee667c578707f2989338d5dea9b72c9e504dc94966f1a13ebda04f25f11a759a186f5
SSDEEP 12288:iOb4A4LWO+vAYFTYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:TwLBUTYnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1CA75F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f06a71130c499e7168a318a6fb36b3e8f64772674c300e1767b71b118287138d
MD5 e46258f2fa4e70ec54dd6526f8e14864
SHA1 ce588370c48b21c5ec02187f08754ca163d5348c
SHA512 d5dfdba65c14f45a19e053717ad0caaf1353745e36d0074bf83679a85f47fba5e4bf58e1ee1839932b2e4c9ff9ff9cd4acaebe42cd42b0fb3b47f2c3a32942d3
SSDEEP 12288:670VmuIYNvUyBp3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:LKYNHlnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1BB65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a2925b037a227b5d65739482b48ae5842ed59843103a2a3145998ba5eb4a62b6
MD5 4dcb0219973a880097285de291ca4ac3
SHA1 a1fc9adffd1c07b230a043563eb4d81deeab1bde
SHA512 17155396d9e6f060a2532aca02631c86631a60b8eaa917eab4d3eeccf20935bbb78fa518410f1a91eb590813a7cdd687d52449bca73c9e551ff63bda4e14a628
SSDEEP 24576:0nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKQ:0nXoJJYH84VVS6AmEcJas+cHBjSSKHPI
TLSH
T18965BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 396dcc14bea8a13f5b0c262b45a53379bfad86802bed5bc502385e0fe59241b5
MD5 97e6b1792fd0c53feea85eac64ac8bd1
SHA1 eff8fdda98b47b03d26cb3044189ade7499930c6
SHA512 75cc6bf582fbc29c423e5c9ff3b68ebed2080e0b96cece1ed2bb66cd4535a7238678d2412097061ad6ba439cbd263f160a0853e299a5aaf3a9a70e6d53050a23
SSDEEP 24576:gv7Xbxd9Tuycf8M/TYlSuxwr2PC/nQ/tbw/2Mkjy6Fr7g0o4:gDLL9TuJ0M/TYW2POQ/lFTjN4
TLSH
T139858D5EA2EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 44711ceb91e8b2472963069839850753b6b4d93b459dae2104caa6379365bec8
MD5 d970c07bc2ec7a197b4096a42b395213
SHA1 7aecf51b4fa9c9faf8cbd9e0501bbf7ce29a4375
SHA512 406f2b0a77164019ff3f8d12d43cf3354aaf11a70eb21f0af5bbb4ebf9de9ce71e709023df6d27b7e1efd54abb734dd0dc365cc1fe89dbe5425659503ae7f291
SSDEEP 24576:DegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wYnQ/tbw/2Mkjy6Fr7g0oL:DngOJOmPOHhYQ/lFTjN4
TLSH
T1A655BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 edbbaf3d65a4a9bd6ce5e9e3aaae0c7c2f6946cdb66f96366dad6e8d07f991ea
MD5 4055a2191e40a23c9aecd6d322251f8a
SHA1 a066f7f65bcbae9f9d2d6b59d06a59ba04000a64
SHA512 c73a412282d7a4d5dff969d3eb08101599d8c6bd3aed4f29a84f03f95ad4e10cfacb02cbb40acb5427451933a4b0bd057bcec244713b688fd0068375b6ebb693
SSDEEP 24576:uLJnJiTk3R3waE4JrOOnQ/tbw/2Mkjy6Fr7g0o9:uLJnJK8R304l5Q/lFTjN4
TLSH
T18475D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 41b087177cac2be090f1b4f7586e57af4ab2e01d59f56629be383fce54cf5455
MD5 4f5091f6baed0868c43276b87229e70a
SHA1 9c85e13ff7a703618a5e53d1ae3fd9db81ccaac5
SHA512 f54f055e6df74fabaf06e51f8aaf3b0c8141a02bfb2c298787d502fedd3e0cc9b544cd5f740a7968742da481bd369e457888063ddbe52a4e885335b9ff62c963
SSDEEP 24576:MA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pgnQ/tbw/2Mkjy6Fr7g0o4:r9GqCzDScAZmlvTcFg8Ph6SQ/lFTjN4
TLSH
T125955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4350b38dbb926af412553a5f7b2f0a2e0c99386f3b2947d89b39d53cbd3c725c
MD5 3a2af12bd0285e569c59238167b6641d
SHA1 4f566cacf511b9d40df3adc61d8e1251a4aaa18a
SHA512 f2f56369dc5fdfafe2f41e504c50f414d905ed9b7ce44ccb40bf3b7b994f73af12f00c69409b13039be50fe998ad219873fa4d40cb14ca5672799d65ec92f2d2
SSDEEP 24576:FlYJeXm5jUuEonQ/tbw/2Mkjy6Fr7g0oT:FlYJeXmRUuEoQ/lFTjN4
TLSH
T1D455126D366CB0E6E22F41B988928545E372B4A1274163EF62D0C17D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 fc020674f1c4dcd582a213750ade5f4e609a78ca119ff6ec1b82a55993573dad
MD5 4d3f80645698b5a8d538a89a101c0822
SHA1 001e70987068c2bfad379b6d91480edf4dd5e3c2
SHA512 fb307a82d5c678605b8ef5748bf0601320ecf50f044efc4ef497b1a7136e68c2fdbf16dac4b11e057b1bef2becf58ba813729cda3e337807f3cf10dac2ff5c15
SSDEEP 12288:pFu6kyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:pUtypnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T11B65121833A4B499FA7A0678CDA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 4b4944bdfb779c205282c6515e342acb912708cf532f75f45f2154ad0e5a970f
MD5 408ece89db4781befade318e7d0054ad
SHA1 80bcf1b8405f30444522df102a73b76618ec5ecb
SHA512 1ef0b4db075b5f7e705ffc3403f4a1761d22b1cd770f80b44212275fd1ca3c6d7e424d2666adeda5397fd00ba101121e8ea6118d60711334e9275d6cae6e26c4
SSDEEP 12288:mPYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:iYnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1BE55236C2664F49BFE2706F448524142A77B1ED17F91A7EF3684A139CB7D3D00AB6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6aa524c2d3b63cc9e9ce896587e7de6fb30ac50fd56a125e34a20b03ba259cf6
MD5 1d27d4106e6bd3474e64c761e40ec8f7
SHA1 5cf07d16100450bd97206be704fb79a0db0b7734
SHA512 eedfc253591c27867a35971b8e62dd6c68b9936a7c419a7f6e3ae4209a99d9a37242da3b5913d300df551023d357343125fce068860251a961c8d4ad51f31b27
SSDEEP 24576:bC+TyQIu93VAumZr7jmTnQ/tbw/2Mkjy6Fr7g0oK:b/TfIq+YTQ/lFTjN4
TLSH
T1E4558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dfc8ecbf0b015e860395ba3c3faf2953a5381eb29c42b900e0fe088bf2ebc8c8
MD5 b054537764808b63e7bbb1905d8e2c16
SHA1 a3621ee3aa6cf855e735c70f67c102973560ff3b
SHA512 530b5316020006522ec8b3dfe16f61510b7ccaa7269f3f11c4d29b53defbff52baf103be8f70381107433fbd60efff6d8120c4991bfc08e7380286fa593439be
SSDEEP 12288:RcyrWOstaa3kcskGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:kLQikZEnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1F765F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a3c402dce1be43f4a4d850f6f713370e66047e6462b0150ce8bab6772bd1161f
MD5 d90ff847439bc504d090c93ff2a36dd8
SHA1 feaa8f762741bf06ba8b7eb62c1ac766f62ba42c
SHA512 33fecf5bf7aa80c6ac6e514f8ea77d0d0a5ddd75d886646c383aec7c9a907db523cde7ac979069cee67e18d4aeb94bd941a7b1eaeb71043c55864d67ef035f99
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPpQ/lFTjN4:DpC7b4+80GTklLm
TLSH
T1D3A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a9b42917afc06239de7f97c48acc32329996ce92e0b1faeed8caaeef1c7f2d3c
MD5 5a9e71c518835c73dc536a1a554f38e0
SHA1 10d051e34327305bfd6432b5cecc6e981c66a621
SHA512 5ded88346865df0a4a8baaf7999f36df382100752bdf79e224e3003c71ed846e7f5334eaed6e14368c19beaf3f7f688ad4a3a337db874fc25a8841b8fa097d6d
SSDEEP 24576:ESAwJPE1IDAo+4Kt+l44135UQxnQ/tbw/2Mkjy6Fr7g0oZ:EqPCIo4Kol4/QxQ/lFTjN4
TLSH
T1D155B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 c18b68c03fd11d21f345ccc06f52d331db544a03efcd6c1db3d5fd5e11168250
MD5 44a2fca2919a89ac9152c73e5ca7263b
SHA1 4c5b843cb21eff3d3d8a7682c83301960bdc0d58
SHA512 1ea36a303b28904711410a87d7e7107010328f481a1ac2ec4a63d9f4261733b00971592f56abb4cb48ae56fea0a8a2d451a6e05b1f0c353ab54919b48d238ce0
SSDEEP 24576:lyLXPLcf94tBnQ/tbw/2Mkjy6Fr7g0oK:ly7PoetBQ/lFTjN4
TLSH
T10C75E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 a5e3825bd11bc8e47d2d310d17eccde10e9f0b91b7df723001fe6104fe9ae2a7
MD5 3b788825816083dfed8b4f50465b7162
SHA1 d821e9c9ec1a7df2d18ee132701978b1b2a49d32
SHA512 2a130941d979d0569d1280c4dfb288748ae529781b9c1ddc5d46d7d6895fa7e26f928d8052a84d8635ff55f64a41d594fbe22afdcb49b5e42e9a93c4d6c1b20f
SSDEEP 12288:k9lyvj3IkxjbBzUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:kWv8qjp0nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T18865125E26A4B4D9F53A0274D863811692767CB227A4ABEF72C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-119-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/796-243-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1064-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1064-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1212-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1536-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1536-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1536-56-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1536-61-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1536-65-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1716-111-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1716-169-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2436-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2436-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2436-31-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2436-37-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2732-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2732-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2768-148-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2768-371-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3184-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3184-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3184-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3184-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3408-69-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3408-151-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3724-160-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3724-94-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3724-95-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3724-88-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3796-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3796-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3856-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3856-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4384-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4384-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4384-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4404-141-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4404-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4404-356-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4404-144-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4748-189-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4748-223-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4748-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4748-412-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4748-205-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4748-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4748-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4748-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4764-6-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/4764-73-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4764-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4764-1-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/4792-11-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4792-106-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5088-399-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-418-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-400-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-401-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-402-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-411-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-410-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-409-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-408-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-407-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-406-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-405-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-404-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-403-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-396-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-414-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-415-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-416-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-417-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-388-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-381-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-398-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-382-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-397-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-383-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-385-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-390-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-380-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-384-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-386-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-391-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-393-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-395-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-394-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-392-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-387-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5088-389-0x0000027885B10000-0x0000027885B20000-memory.dmp

Download

memory/5092-156-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5092-84-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5092-80-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5092-74-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5124-376-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5124-170-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5380-164-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5380-108-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5380-104-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/5380-99-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/5508-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5508-122-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5508-316-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5508-128-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5604-107-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5604-15-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5604-23-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5604-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5604-21-0x0000000140000000-0x0000000140155000-memory.dmp

Download