d3da355ccfde79f053284104523ff6d4441686281cb8c31e30588b6f31a43d72

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260415-exa8baev8m
SHA256 d3da355ccfde79f053284104523ff6d4441686281cb8c31e30588b6f31a43d72
MD5 87159d1668c53e8842c884fb69af4df5
SHA1 88dc49f690418d5ec8c589c8214c9a631276810e
SHA512 c975fa2fed1408df97c54aef12f9044b0cf04eab8f9d953cf57cc4213bf4de369c24f47224ca1b3232c1e8dbcc0a68ff3c0c053ae22c48ce8c5c870765ef5ef6
SSDEEP 12288:h93G6vHzOASubviBNDYa37MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:hVGGTWBZ4SkQ/7Gb8NLEbeZ
TLSH
T18755011171C080B3D5B31A3019B48A60197EFE751F306AAF7388176B9EB46D29D3AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4328	alg.exe
5104	DiagnosticsHub.StandardCollector.Service.exe
3364	fxssvc.exe
2740	elevation_service.exe
3248	elevation_service.exe
3392	maintenanceservice.exe
5940	msdtc.exe
4736	OSE.EXE
1632	PerceptionSimulationService.exe
5740	perfhost.exe
5676	locator.exe
2484	SensorDataService.exe
4664	snmptrap.exe
5136	spectrum.exe
5640	ssh-agent.exe
808	TieringEngineService.exe
5124	AgentService.exe
3332	vds.exe
412	vssvc.exe
3680	wbengine.exe
5840	WmiApSrv.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d99322d5b955e89e.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cee3a038fccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cebd2018fccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000553949fb8eccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000855f6ffb8eccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c19dc4018fccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	3364	fxssvc.exe
Token: SeRestorePrivilege	808	TieringEngineService.exe
Token: SeManageVolumePrivilege	808	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5124	AgentService.exe
Token: SeBackupPrivilege	412	vssvc.exe
Token: SeRestorePrivilege	412	vssvc.exe
Token: SeAuditPrivilege	412	vssvc.exe
Token: SeBackupPrivilege	3680	wbengine.exe
Token: SeRestorePrivilege	3680	wbengine.exe
Token: SeSecurityPrivilege	3680	wbengine.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5316	2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4328	alg.exe
Token: SeDebugPrivilege	4328	alg.exe
Token: SeDebugPrivilege	4328	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3500	3408	SearchIndexer.exe	104
PID 3408 wrote to memory of 3076	3408	SearchIndexer.exe	105
PID 3408 wrote to memory of 6000	3408	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_87159d1668c53e8842c884fb69af4df5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4288

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2824 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3076
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2844 2644 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 801f8608e60c9c705f01e2af36be8eda82abbd987c749516e68f66e1904002b2
MD5 639bfb3ac9d37c3441ff3b208fa80256
SHA1 59fa19bac4a9b12a73c9c1964e0be774ace52178
SHA512 908ad69a15e229eefd1c07afa0b3592672475bbbaa5d77477b757aeb1c6886c5127fa5cfe64bebfb982d9d18107bdcbb07eef59ee7f3847a3b00f17613cd1048
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFkQ/qoLEw:f3q6HjBEqo4w
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 81a54e41a9b28914fe633507ec995c1a947d9fbbb253b80787c7b0da129aeb77
MD5 6100fdc06943ce108c6d7677295742b5
SHA1 efc4362b5f09bda5c2891a347f2ac5c5ca535edd
SHA512 b70f34fd341778d4cc7eaa23cd33996f272f6865dcc761a18eccaaee3eb3b433e76519ab7bcd52b1e491ec4a9ae366b4053d76f02e9b8baac3d0fdde63596b40
SSDEEP 12288:M1XLsswWkxy2lRq2czAsMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6XYfDtczA9SkQ/7Gb8NLEbeZ
TLSH
T19565F12873E408FAEC678279CCB18401EA7378854760F79B03E4997A5F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d6daf9df9051ab149c50a1f9aaab71b6ecd6cc26417d7463fb2ea8321f08182e
MD5 c3e6f6dd105c3b49912c7d139fa082a1
SHA1 445683ce5bd6e21c08da378e0d7ccf773b2622a1
SHA512 3edc5ffa706a5613f8a079dec92aa0f9ff0e948e4b3086c51f278d63470e6d009b24d1860ffa8e28e32998b2fd6fb2b0e5fc6bba45fcd300aa774882026d67fd
SSDEEP 12288:KXZNYVLeyUji0h90ZD0wxpGZIVubrHsvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBo:+0Le5ji0hmxMrMESkQ/7Gb8NLEbeZ
TLSH
T14A85AE16F6748371D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1cca70f25dfca55d339d56b67788b2df54619677e297d8ea10e6ce059acfe0f3
MD5 fbc65b5334115f6996c77c22b6237bce
SHA1 5ae979b46ee0f906dd4d55166968dfb611b7eb25
SHA512 54e0baef956540a4a8ed03c89b7d73647bcefe873358d5601bde8124ad657cef0221f062c1ec7620c12d4246cb8a64f0b8fb4d19b249b9603b4bb539b2290e80
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuuSkQ/7Gb8NLEbeZ:+/ezSC6vUzPvxHjyikQ/qoLEw
TLSH
T162756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a11312923c669fbb8ceb7f8f3dc10fc9dc31f0a7d25789887c8e70ef05fc99a5
MD5 e1c8960bce3830e9aa1e5ae719803ea8
SHA1 49cd142e82e55b8efddf899afa215172fd76ff67
SHA512 830538623f488b5f0bd278c5ac3fc6fa1b42f5c494306f22b0858324c04f7fd3895473b2d159e7b0b09f847d1712354cf79c0fb7d0212ff87e8d199a5eb85c6f
SSDEEP 12288:vVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98oMTmkJR4Do07Y86gw5CtCjX+NLt:vVbqPb88hv/l+6hSkQ/7Gb8NLEbeZ
TLSH
T1C4559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 87ab665af690fc509d343a4f5ebf85cb68d8435eeef414477a63f70e6cdb2599
MD5 0f7a87f83967c3c6bf9a1ce85f0d9b21
SHA1 7752d1737030694101bb7f1f8502f949d2dd41e7
SHA512 03ab95777754740f250bf5152df67b22bae33882e9d4e50d1d3db1cb447f2801e290d3486b7d2452736ea7b20be3034a59d11495d1cae5d0f3ceb2a4171c66fb
SSDEEP 12288:xeLMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xeYSkQ/7Gb8NLEbeZ
TLSH
T132452356915404F3D1BA1F7268FC48400DA16DCB87307A357E99FA7B9ABEC48E8EB131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1d3d8e3091a53315d8bf7b7d9d494cfc351244d13b6e0cd6891ad14897dda297
MD5 679a355f654abc85dc13b272a60b126b
SHA1 67291036107de50399dae0e08b99f305f5ce2dc8
SHA512 74bbc86e9ae41f4922d4f9987b7ff699a83c886bdd7411f460c61948211c5511fe47b783d5a9af00622f00ea2edbdf403177bc6f8c7831bc51077331f397002f
SSDEEP 12288:3eBNUbTVO86UgMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3JIUJSkQ/7Gb8NLEbeZ
TLSH
T1B465C03BEE28FCE2C27E4DB95A918600977278714B21A3CBE165C30EDE235D45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4ff1e2ecd748f8ee2b9d83e4f570fae7c8a7df0e502188d7cc7b2f02693476eb
MD5 ceba25e776d3e1ac09e9c211e8bae7f2
SHA1 693eab9108e9f6880f6634abef6fc1e2782125dd
SHA512 d5a0ce2f9dce006d6c5e7beea44fa68fda4bbf5f878745f2e83b97b32d664d7e40ce0fac652366eb30693efb752c9b66264c9e226052ecd1daec88d8badec28e
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:KQvGAdlCEL8c/yRNw5CTqo4w
TLSH
T147266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 da2b2c461291ce2bbed1a914a50a80bc83cf638eda339f21bd5fcfe71e4dde0b
MD5 2d9540e8cf881a8b922029653ff70367
SHA1 d9390a160cad1049d889de93b4a1eaa399370172
SHA512 7f2c16074fdc52309671dad23e0c1c58e114f380394d9c04aeb074a6fd7c5666320b125b090ee4ebc38125c32c231eaafa346c2fbb91dadb436a89e1fb2799e8
SSDEEP 12288:pAwSfxL/2Dc3eDLLmt0LDQewsAj+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:a3ewsAjbSkQ/7Gb8NLEbeZ
TLSH
T17875E031FA74D032C2BF0DB21B35C706187DB9604B612AC3E3E88E9E59745D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 09e51e8174576d1da5ed6121a87a353867e1c8606729cd8b56b24982dfb3dcca
MD5 e7f109e14ec510498f05504f2e715529
SHA1 09e3661a6b158e16364fb1b682f8d0f7895d3509
SHA512 b68508d3109b246e91e48182fd0f49354a977e4040ae598b3f0ec02ab76a467375d3516344adc0f850de68c9f962fe3c5a5c8a182685d28b21ee8d34d85876b2
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHC:RUEtQevvqc2W1cpV2EI32C
TLSH
T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d27c74a0d93155ab00e99fa39ed94d15b11d4446668e72594dfeac5f958fa995
MD5 f03c06e15a92ff067dd0eb242d843b65
SHA1 dcf8f4f12f89c70a599db2aae533594e866d737c
SHA512 daf96bb56792b455d108b4db35ba0c83d44c8d946ddee8ed7b64ec21f17c4dabb025c8528eafcfecbbb648cb97bf46458326fca36ff1a229f5c03fc02d95a56f
SSDEEP 49152:lCbRquA/m2yL5zifFiV+XenmE3/zGkQ/qoLEw:yoqHVjnmfqo4w
TLSH
T178D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77c514f39d0f60027189471b1590b25a5a5b51cb5e496b182f9a38fb4cd8911e
MD5 302eab3a70cfd874478721cb27df0fdd
SHA1 82c059fac4ec0113e472029a8ffb9e22c594c547
SHA512 cf467a36284935e9a06a6036189525aac12af8e087592245be5dba46526855c72a48b29242f82ed40d3db078f09f0996f73385ce2ad6ee3a8c2593f6deaac5d0
SSDEEP 24576:lAhGLJIFoiwtA5l7S53aSkQ/7Gb8NLEbeZ:lAMyFoiq5jkQ/qoLEw
TLSH
T116359D81E7F945D4F5B3AAB899B68570EA76BCAA5E31D20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4dde5752e276d8a4effe37c60a03929b8dd98653f35178ef3f128d2eb94296ea
MD5 4e215be88252c1343e11919a5be19014
SHA1 7270eadf625444d187c7e2b0de0ce1ff670461dd
SHA512 73bf9da5f473ea8ddac4a0b175315076f56e37c126904f8de5128b9c70000e591a638cc127f0746f673aa602daa337e0cf73e4bef6f147fa93af07acf7795046
SSDEEP 12288:Mmw5HEjsChN8BFgl0WDm+CtMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:pwuxOW3SkQ/7Gb8NLEbeZ
TLSH
T17B65F14A72A40CFAE56746398597C431EBF2BC462B31DB2F1760C65B6F37211AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 c61c3d6985b69b24d6758ae9a5a890ec8104cb661c383aa5b8380ab957dbf8c0
MD5 47e8fcda59ff1fd89c6c9aaffb858975
SHA1 ffe89d8465a273efe4c53e4b9b1295a24d2e1f1a
SHA512 1c4f34670c2e2374b4318b3171bd41c3c6bb0267fed4a2b10c3dd2d5ae0a7fd7e842c0cc09861cedec9d39ab97ba33c0534f7def663f01da7dddabffda692cdf
SSDEEP 12288:N4Z1IyuMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yZuMSkQ/7Gb8NLEbeZ
TLSH
T18255125A32E420F3D1A75A399CF449009BB27887533163DF2A68826B6F77DC56D3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fb1bfe19692d317d2f347d688ee8e8345e338194097544344456a3a2ce6a69ca
MD5 2a4d38fadd440818600b7fd571701a22
SHA1 094d0059f2bb4da47cf163b8effbccb40c7e1c1c
SHA512 e4a63c0c7aa5b6659e22baef276940af971c152b42a7de0651b6591a20ac4399373cf2d99b7d85d7a3262b0c2629c92b0549ebb496a75711181e276c9c3db1b4
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:rQRQyi36YOcPQLvw2gAf+PN34qo4w
TLSH
T13E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bbfe4a1f0bd53daaf7ab74e98124ca0f697070dcff2f06ca4ea5e8cb007d2961
MD5 de6c182868ed145036ef63aab084473b
SHA1 9210336ccc479cfbd822f7075c1fa13973bac092
SHA512 32c8514d7ee546ba9778b23551f46ecfea2c8ad3a7e016ec1f8d73e7d9831c3bba84968ca966aaaebd8a4a81a755e5669b5881773d93f96b2996c4760c84ba18
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:CQRQyi36YOcPQLvw2gAf+PN34qo4w
TLSH
T168667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3eba7af7f25c439db637efb18ad13ee73eb5249ccef4d601b77516d15dea0656
MD5 d8c73bb9913ceb6dc00cdfc4a9a16524
SHA1 3bb6c51d46acf6bf3f9023fa0a9cca9187134d19
SHA512 330f49a722715eecf9bdd0297bf3ca276502bb494f21ec7263fc2901f8bfd8209e47e21437144c7665d4906df05e8453181703b67b585e02ea466312f02039fe
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cSkQ/7Gb8NLEbeZ:368Qg55nhheWu7PNU3/WkQ/qoLEw
TLSH
T158B55A33B2F200A9C44DE1769F4A872196D17C758FE0E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f1050911bbbcd47338463ca948cf4c5a19f0ef4af5692ee85171400874d1ac42
MD5 783dfc00f2f46b7f2ecd1f28f25deaad
SHA1 639edebb54476c228a0029a1f3a11eb3c8bca8e6
SHA512 50de148a1b20ed9a84880f07cd8515cb9f1b3d1db24ab32d69b4ca039c048e598ec454a08554cda467e1186f6918c1fd878a6c2de2cd81dbf1f04a0df7273df3
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:uy5112gYy5azzVvL69nLKnhZRqo4w
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9222e3f3725398bfeada9ce8fac0ad4b7af53019c237168e0654358dcb819a2
MD5 9a33685b582fea1674d8f17591fb69d9
SHA1 1af3a45f406cee4fc14e1e6f9d502d0b627cb3d7
SHA512 f8848035040444f88c79d4ac7751161ccd649d47ba3fd44df52f91267f680483b656cd88c7a64778c7d22d7436cac436707d07c2227967dfdc9a0d0842946dbe
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAkQ/qoLEw:Xu6JmVxd2dAqo4w
TLSH
T11ED59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a7f4c1bfe880ddf7b5e532351340953124448ad98033ab5abf8d469ecd814b9e
MD5 050d1b8a8630f7c742274b0b4c6b68f8
SHA1 af863dfd122fd8fddf12a941ce3bcf2c064146fb
SHA512 826a6989b55b779b1955b5bef04bec63480368559327a969955c636bbecf830f8df7df8c0d0fe434ceb235fbb50f2d2c1390cd474d0df1c5d268f68372a37b39
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xskQ/qoLEw:6mifPbRfqo4w
TLSH
T164B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5d7089a951e80ffd89787ae1cebb85810fb14f2919fb783544ad8e1e028e372d
MD5 31caa15b9c59e6e571c52088acf335cb
SHA1 15090bd9793766935c3836c01acc11e5f7ec9bf3
SHA512 fb4f6966f1655f2966f501b27b81c11ea04b4bd5b0fdc18d5ecaf1b6ec94de343056d5663896a75f1ca7b5552a79246b4756b26f56a6af0a3bd2632bd71365c8
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqVkQ/qoLEw:t5dKTi61lqo4w
TLSH
T129C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 46cf1cb15b0259091a7c4a786ed9e2a06db2adab8592bfb2d759bf5bdc20d784
MD5 4fe6fc33830b4e4f2c577aae161b988e
SHA1 be455e96df7c5b4183b28aafb70fc372988cf021
SHA512 6bce20c51e5f4352d55fc7db77e82e3b338c5950661d691d63e41e6621c377ef77097006e78941cb3a6193fbce36b4f3b53a14143a5c0b7f6034df36c814e23e
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5wQkQ/qoLEw:HX2iyphLqo4w
TLSH
T15195BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 733b5cce2a20df1161fe5c7c6e34c878bb988c778a9ec6d0be0e69896ad79331
MD5 25219ef639d37c90cb5c6052d559b1d7
SHA1 c0376ee96b01495c26b5e314481d1f83f9162d77
SHA512 8dd054450ecf5a4cfa2a18f679a8788e09f5e85c387a004a52a468ed45da53ded8da64e45ff46da3e0c8972800ad0842d89376c88446b85d413f22c660ffa5a0
SSDEEP 12288:bjMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:bASkQ/7Gb8NLEbeZ
TLSH
T1AE452359A0A405F3D0661F7258FC04400DA569CF9731363A7F9EE53BAFBBC48A8AB174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 322bf639652bcda60b3de419b0824ba72b0c8be8104cd022be81216636eb3356
MD5 b0e67fd97aa802bf3cbe4384cbc1a3b6
SHA1 df64717191b5ea21c0d70c088c9e1f5b99d1f490
SHA512 a89ed25b448cbd913288ae1620715598153eabaa1e39bc8e0f86a082ea79c8d6abac8341cc7503cc1f6210461a40ac3ad071452c976f01372c1b4af0e1b4bff4
SSDEEP 12288:q6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qvSkQ/7Gb8NLEbeZ
TLSH
T185452359A0A405F3D0661F7258BC44400DA469CF9731763A3FDDE53BAFABC48B9AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ff5a3f6e3210700273444c49e99100c7f539306a15d9c1acd7515b89a62d1fcd
MD5 7f02b1e08c2649e9924296206b421120
SHA1 1e3d33da1b5d2ab604b837c60c98ffba1bb134da
SHA512 e39ed17694ff252eb266dfd8b4992938bd07ea06830fe3efc888d96762f1778dd061b15f929e8abd317c88c96d68bece2055e6e96d49f8b507cae755de5eff3f
SSDEEP 12288:e4MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:exSkQ/7Gb8NLEbeZ
TLSH
T1B9452359A0A404F3D0661F7258BC04400DA569CF9731763A7FDEE53BAFABC48A9EB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 adb540065c33eca84eafd88e2de9b0c2d339ae2e9fb5fca08284c08cf537dba8
MD5 57b6324bb46df7b09fb8e0b776aae288
SHA1 68a1c3d9f5ed4f8eb2484f73c3277d8662def5e2
SHA512 1443bb38569446bc0a3999eba33967e8abea2d048d8f52d833290d787aed1a2d0c306f2a259979979494e38251243b991cd2314b464a2513fddfc3a3dfec048c
SSDEEP 12288:3VhMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ASkQ/7Gb8NLEbeZ
TLSH
T19A45235661A800F3C0769F7688B844405AF1BCCB9731777F7F85852B5FB6988ACBA630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 08a6ce8d6d4e726618b8f773c94c80a9635c87ea6f4850303f1956a4da9e656e
MD5 f1d6d6cdeffff758b7dec5c5cc0d6af3
SHA1 cd464cbd4324dae4d0f64bf33dacabc250edf34f
SHA512 1c1307b7a7a9171a6ef74f52d5e3563f8da3edd789942b7de6781bcd7061e10ba9e7f925baa8f476a22f6b0ec07f35ac7adb57abdcdd8517f95ad5f087e411a4
SSDEEP 12288:DpMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:DSSkQ/7Gb8NLEbeZ
TLSH
T19E452359A0A404F3D0661F7258BC04800DA569CF9731763A7FDEE53BAFABC4869EB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dc574f81a5ed1a596d73e399ad2ae842863b82e3c65bdbcb85aebc6a664477b1
MD5 f779404b85dbf473741309a5ee2d201c
SHA1 364aaed23ec49f70d4f25711a7ec6a2f105c97a4
SHA512 3339896c19f4a25e5e2cd6cc5d98f5de66c0f17fd392bc4e1f95c180bb152907ce22d27a685206616ff3801ca77ada3bfc20efb906132232098560a5e1f93525
SSDEEP 12288:xWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xDSkQ/7Gb8NLEbeZ
TLSH
T15E452359A0A404F3D0661F725CB844800DA469CF9731763A3FDDE53BABABC58B9EB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1ede9ac9637b8085e4ad34de73a95ddcd3b0b1fe5cd587cd0067eb6040a9732b
MD5 650f055acf04b85b8c73d5408c870d0b
SHA1 03272d1251f9db4c273f797fd29ae3b1a917f17b
SHA512 f4e7bd241b929835e8bae217f0e311f610242c336e3a50e58400d50569f13ef8c3df3e17afe8c8fb9c14a7e02a67ca3022e688bf8571e241a3d7e95b3f8328f2
SSDEEP 12288:aCMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:aHSkQ/7Gb8NLEbeZ
TLSH
T104452359A0A405F3D0661F7258BC48400DA469CF9731763A7F9ED53BABBBC18B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2df80c2f42a82d80623fbc121ea7dc9353cb6bc8151fc487f75622eee0762537
MD5 c38f716f1ac0acb85f035e85763691eb
SHA1 ad0ffe8352ca13ff15dc9b988b308a95e7709ae2
SHA512 6e628fee3086ce9d3c03e24317660cfa2bf24cb00d6b4174dbe8dd8189145bdfa6a40583b54bac71eba6a457c496fb11f45b775b30f5e569851a1236690564ff
SSDEEP 12288:KiZwbQzzFEoS2cPvyaMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tZM4zFVSOPSkQ/7Gb8NLEbeZ
TLSH
T10965F195B39008F5EC67863EC9658805D6B27C5A0B70C62F17E8362B5F737A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4e1e6c09ee6db210800022550914cb481e5b8a029ec22897573e0cbef8e2cbd5
MD5 56a82081f7d8f4e76ccdad71f76c9fe0
SHA1 348add0f001d5b1c3bab79c002a71e1e9dfc3094
SHA512 3f86d54489babef836edaace352de1f32eee715bf9dfd8198f49d2fc2a798ef85a126c8ee29d19c9b196e618706a40ca01d3ad5c04a8c9f0ec3ae2f89ddf2985
SSDEEP 12288:dXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:d8SkQ/7Gb8NLEbeZ
TLSH
T121452359A0A404F3D0661F7258BC48400DA46DCF973176367FDEE53BAFABC4869AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dcad47d7f8739000f38ffc7950cd035fcea429b8e034f2dd0322d6fd7f152877
MD5 13fb32b615866684688e745a07fd35fe
SHA1 4feafae8277ea3860232c48783613bc3a0241737
SHA512 cb7f5b98bc89e2e99dd1916fe3d4835ea5757ceb4832c27f5e15197de86136d28390ff3ebf5eade43551b334a266b9ff8478fccb871f469daeeaa4ae516741c0
SSDEEP 12288:L7MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LISkQ/7Gb8NLEbeZ
TLSH
T1CA45235AA0A404F3D0661F7258BC48400DA469CF973172367F9ED53BAFBBC08A9EB174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 eeef9586ea931d6bb8ba123558e3fb8e6f22d1ce2ce32fefd1510a56f2059a49
MD5 611306d2d4ff86716e995f904f6736fc
SHA1 8aecea21c9e03ca0303b2024de42bade2000e352
SHA512 c353d22c9402520ce4117e34d9cdbd2ece90079b2a975345efa498310cf807ac1f925c82f658a2af842c3fe09f4d7fba532f3266dd6152f9c16f5599f355d9a2
SSDEEP 12288:RyPz5L8uMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:AzyLSkQ/7Gb8NLEbeZ
TLSH
T1AF55024772A120F6D077963988A50901F7B1B87647309ABF27A4477B2F27690AD7FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3c1bdf3f45419be1c67730faf702a0b4fd3148bb74c9ca3dc02d21b9368872d0
MD5 8306eda59e5c2942289d5df9d8a43b26
SHA1 2163f746e39720c11efcc9b0c2a60c58d1a594d5
SHA512 916b61c5bd51cacc51059eec66b236f6d9c0e6eb99ffd0bd26dcf46613186662424b177fd37d6a89ca46b12bc00a4c4898d88ef336ea6d0de74d133d8588dff1
SSDEEP 12288:9XMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:98SkQ/7Gb8NLEbeZ
TLSH
T1B445235AA0A404F3D0661F7258BC44400DA469CF973176367FDEE53BAFABC4CA9AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 244adf1707a51f6325b321c9297bfe3bd9bb76195e061c937c9cd6b003f39b0d
MD5 cc06eba1b264d81018ab2c275cf84fd4
SHA1 ff69e9d5bf8e76bce07a2ce7055c659532a3afc7
SHA512 ea768ff8ca1552c8abb420ca8f5a3532efd893176ca35965d2d6f020f9a9d51eacff6c6bcd17c4cfd8e811f3fadda47930e60190fefa861088ab387c5ff59e22
SSDEEP 12288:IXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:I8SkQ/7Gb8NLEbeZ
TLSH
T12745235AA0A404F3D0661F7358BC08400DA469CF973176367FDEE53BAFABC4869AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 30cf9a5e7bc5b6fc3df4612ce280ab55c70e15e251a4fd2de9f345cd0a2606ab
MD5 288430e0e8803684a84d0637c4b44846
SHA1 84f7d7863c5c6733dce7d702332b05114186c80e
SHA512 7c5b861b22135fbe9537937ea4527e2e43e228d7c8baee4c920b49817b1f573857fc150f0d38a4d27dc416cf2457ad1a900d65cf1fdc7ad19b978bfba6052121
SSDEEP 24576:5CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAVSkQ/7Gb8NLEbeZ:5CUxPTY+8Wg2lIL8lrIUJLWw7kQ/qoL9
TLSH
T12D65BE1EA3EC0896D0BB813589518A06EB72782E1B32D6CF2160C73D6F67ED95E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5577b5cd42957252a1a7b6599370ccbfb08a1f2d4c95eb168475b3b700e066c0
MD5 3b8ad7a2e4621a7d45cf5c53fd0582de
SHA1 0df5c0ae990a436025077f57f0e139981827f14a
SHA512 39cb979f3f87d66014cf69e3e0f6a1047033b729d51e514b78468cc03d67fff86e1214d88d3f053276e9cf37384d48d9abe3f51e06e1bf73a526d28bc250522e
SSDEEP 12288:YysfnMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0MSkQ/7Gb8NLEbeZ
TLSH
T15255F109D29802E5C06E6675CBA54A40B7337C5683F1E3DB27C0F53E1F7A984ADEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 59568571d047198d7f0fcef045bf93b607659073d12660d246b90ab31e5a9f71
MD5 37db1d1fd0a11da53cf4d345d0be23a3
SHA1 f62590d163172bb7e3af610ecd713f4a92b08979
SHA512 c863f04c505af81082942c587a4afb9fab59abf7879d7b5d957cd7e907674a006c56f8e514e4f4f1ef580488dcc8d784eb212c25644687b66c1d8cd8d0afdcac
SSDEEP 12288:KYMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:KRSkQ/7Gb8NLEbeZ
TLSH
T119452355A19804F3D07A1F7118BC44100969B9CF8B30B5F77E8DA27BAB7ACC8ECB6125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 176dc7501bdb560756be24651d3d9ac891e1e72c8278b13fd1dd39f94a109801
MD5 f600bf24b3aaa5268f026c9da79abd86
SHA1 0dca54e517af75fa37ba86c6785cb6f6761b5849
SHA512 973059e72532e5eac84dcfe1af4f804cc8d18760e29e19d2c6950acf4ff67e6b2baa1feb20a742e4c1680a33d7ffc96da50948d9d6e4fced28f3c3667f11de29
SSDEEP 24576:h8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC7SkQ/7Gb8NLEbeZ:+RZwQCyiHiQEaiPnMdkQ/qoLEw
TLSH
T14285B01E62DC46A5E0BAD278CDA74407E6B278164731A7CF1190C27E1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 40ba12dbb114cfceb6c71f5faeb4451bec7305f2eefe60b9418e1d84160af411
MD5 eccdeea0735b405fe823c95c678bd7ad
SHA1 b333af5a43e3068dd3e5b464064a55b8fd5a0bcf
SHA512 e0641267a3c75cb74333f26ad08d03c66bb6bf502b93522f3767184b9e7ca06fbdff74b4012c1b814a36a5cc6190e4403ea6da6299efa3de89d26c9240cc2bb7
SSDEEP 12288:ibxA1U7KIMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ibxA1UGBSkQ/7Gb8NLEbeZ
TLSH
T1D155022E61AC14F2E176AA3988E58001C771785A5731A3EF25D5C27F0F3BDE8AC36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fada56674ee90b9827128243aead20bd578c99089ef56065dbda5409dc54c136
MD5 4d1be7da4810c4681271591115f2d77f
SHA1 b6f76c408c2d3a6020c4d91c15110044339c665c
SHA512 2e2c88aa98c50656713720a634076d7fd633fbe804e07d382c07f4d0507bb791764d5316a4b5171e03f90c5a4517b53047504c5ffe98b606f9d033de7f879134
SSDEEP 24576:HjsmP0yHaqrVqHra44KDzMsrnqSkQ/7Gb8NLEbeZ:HjRP0yHfVqzlAsrnjkQ/qoLEw
TLSH
T1CC45BF2EF2B910F9D4AAD236454107B5BB71B42D1F209ACB0170C635AF0AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 73505022b4b6cd142f018f8b0eee47c6fe87d6edf76bd204eaf4f94b3371b286
MD5 043a2f15cf102e158cf6a2639e14d36c
SHA1 c9847eb07bd7474c59f17f37762b5cfcd8f5f455
SHA512 88089b917555755ca51945736b9ea6b40026c6ee7a7248ff16c899857617143167451a74dcc2413bf27a6e43ee623fa980517817143115088b54c2066c433f4f
SSDEEP 12288:R2MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:RjSkQ/7Gb8NLEbeZ
TLSH
T14A452359A09404F3D07A1F7618BC48401DA479CB573136B73E9DE63B9BAECDCA9BB120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 f0ac999133ba44bbf3f76a68bb59fc7365d348f48c9ec7a9b427dbf76eadf14c
MD5 c84a849d1d520095fec3ff662afadcc9
SHA1 d593b9089774b90741e4988358908e6a8662b5f5
SHA512 264658c38cb89b7a5ad2f0afe647565273701e0896b250092e7083a716a283cf20b9c457e7c78d6deca076a7d446e7edebbfa52105d575a8125b14d0d458c017
SSDEEP 12288:uOb3A4LWO+vAYFTsMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:XTLBUT9SkQ/7Gb8NLEbeZ
TLSH
T1BF75F155F2A400F5E87B923CC9B68912D672B49D0320F7EF17A88B661F536E54E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 55ac89abc9c5c1f716a71d08a4aba46832406e9acbfa181951d1f2fc97918ce9
MD5 cec671dc9743c1bf0d48822619203bbc
SHA1 b5a5f0dcd5824f19cd47317a3b1b0416bbc5e7a2
SHA512 af2a0d5c93d77d703d6d990a64e3d393b036c9b75981f9740399ff6ce58b3c69599aad9d8a8e3d3f23ddcbfe9be4e01a776b37974277b7068a85ca02fc4c48cc
SSDEEP 12288:j70Vm5IYNvUyBpzMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:M5YNHmSkQ/7Gb8NLEbeZ
TLSH
T15A65F12E62AC08E5D57BA1798AD28105F67278961321A2DF15F0C27F1F17EE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c2c1a053434486a83bf02adb5c463e98f017814648b715fd5fcfd0e4bbe59e3
MD5 16a7cf1729b23e22431b62dc4507825b
SHA1 447e8dfcebcac19ab8a5e44e697a73679cb1f696
SHA512 e2593778087985382084d786feb9fdb0e8002b249fb518cda0e69982f0310cc5128c14f5b27298dd8e9086e8bb9fdf23efe11afce587ba52eb90dacc1eb57b6b
SSDEEP 24576:TnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKC:TnXoJJYH84VVS6AmEcJas+cHBjSSKHPS
TLSH
T13F65BF6EA2BC04E9D5BBD17DC5C24506F5B178621331C6CF026082BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8130081f697d496defe3cbbca39aac7e8819fe98bc7ad0400d2c4c6ce5a7100b
MD5 6772b8469069d92e2a034dcf019d5333
SHA1 f151e7430b12b7543d07b0253dea12f757c604a3
SHA512 e7c2f9f8b10aedd94030f69b609035bfdeb1cf424b3deadec92686784f87c26a1c1b717fa01efe59b16a166f5203a0efbcb573036c2f54f070d1bf72f6b2f71b
SSDEEP 24576:lv7Xbxd9Tuycf8M/TYlSuxrr2PC4SkQ/7Gb8NLEbeZ:lDLL9TuJ0M/TYj2PekQ/qoLEw
TLSH
T11E859D5EA2EC42D4E07BDABD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 5e9da45422571f87bbe4ee53104621463a2ee37d27e6b90c51dd7117b51896fb
MD5 9c7d15a81e50c04c6fbb120b67f769fd
SHA1 b104cec1eb3529a29006bc2b4b00b443bf9ef989
SHA512 aa7baf61835af0ce47cef00be5a7df755bdba9dba5f9d6ef04b285e7ed07a76afcc306985ecbf519975d0ac4f2b8b4c718fde9ddf1a84e50a9bb032f070ae9e6
SSDEEP 24576:VegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w9SkQ/7Gb8NLEbeZ:VngOJOmPOHhQkQ/qoLEw
TLSH
T14955BF3FA7BC15D5D03EC17D8A968816F6B1782603356ACF0560827E5F1BEE46E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b40b37ea3f3a7d1813dcc72d8605d28f8d7102d64339562ba8fd12440b1d872f
MD5 0660cac7e2fa1e3c362cb0b0839c5fce
SHA1 2356c3339d7eecd4342efe0d11d346663fef24a6
SHA512 0d85fd0f7f67d8f7a762f47d5b2bd278279f2096a419dc93c0c9fdf0ea03d63521c4da36f3ff20c07dc9a0911693a204893acbf9b48602e667494ed22b9c2154
SSDEEP 24576:lLJnJiTk3R3waE4JrODSkQ/7Gb8NLEbeZ:lLJnJK8R304lTkQ/qoLEw
TLSH
T10C65E03CD2A810E9D4B7C2B4815A1A56FF31346D2B2179CB29B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ee1179fd26cc9a378f5bd15f9938efc9b66687f1d3e479dc1b04a651ca035570
MD5 97980b10088c437d6b7f2b8a98ed5b67
SHA1 986e55e86a992bee0b1ab4b6d521e7abc3f44143
SHA512 2fdd9c7a266a3709aacec4772e5fdb1f7802d188d9cdc831b94d77d65848dd24065fd47bde729d26fe34f590496ee374739eb8a5e9137e1f1b01f81e23dbaf70
SSDEEP 24576:qA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pFSkQ/7Gb8NLEbeZ:19mqCzDScAZmlvTcFg8Ph6ykQ/qoLEw
TLSH
T15D955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 a60be03608ab6e8f8266eccc863372abc4fb5492f3fd835823fc8c11b5025ebe
MD5 98590030d68981a0836e96d1948103dd
SHA1 ffc8659f66ccc0957ef3c24d677a14d9494fba35
SHA512 32bb2846a125a48e7a024953bfa643f7fb08c8d7fca2651665f8bd62f7447e20fb5c61912eec7babd2646e8246f3d3c6b6d52e738b625d78dd90532c413f0845
SSDEEP 12288:+lYJeXm5nkEUuEcMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:+lYJeXm5jUuEtSkQ/7Gb8NLEbeZ
TLSH
T16555125D71AC20F2D13E967A98A54800D7B1B0A6132133FF26E4C27F8F6BDD56D3AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 987427816dacb00c343fcd70494fc9214a23d6f624ebf5e013d71985ce56cd66
MD5 cbb26758b4f85b3ea851ed4ba9326d02
SHA1 f7d948416fda34c54cb08eb91eba4bcba49d17ca
SHA512 d6364814464df59617ee8d9328812e48211da72a54e3d4560435f8b8671deff53d0175abdbe00b4a9e79c283eb310c652a476d57c04173a3fc2f763dbd17e0cc
SSDEEP 12288:ITu6kyxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:IKtyKSkQ/7Gb8NLEbeZ
TLSH
T13255120962A410E2E5BA0F399DB640908E75BC558B3063FF25D0E63F6F77AC4AC75B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b020b883426214174914ee4429512ea3ef8e927a461b92c616a9c6238a620448
MD5 b50cb41173d1869902573cca0883fe79
SHA1 666b040a5db109e966f6aba460ecafe3c2977c54
SHA512 1184e047cb58f6115725b2d3c7cd987a255c167e4aa9a6ef290080936136e0ff98c18919543b166389be55f819f89b2e7877b33ef051e36716acd01fee05afbc
SSDEEP 12288:LPsMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:z9SkQ/7Gb8NLEbeZ
TLSH
T12545235D61A410F3C0361F7658B8084009B5799B573136BF3ED9E63BDFABC84A8B7920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0a227835dcd1c57c0f1911f560b069b8a2ddf74dd02704d2736c53d98d908292
MD5 8b929a9bac3d24790144e9cdaea0a2ca
SHA1 34bdce24b1d7692d5dd382aebe125a334487c36f
SHA512 e2038758f550d569ad2a7c654c6337186d5c7a9ead332cd442e4d0aed85b44404eee5176fd649dba9ba99b9192531a99ab857f7adf466cc16029ebcd9312a11c
SSDEEP 24576:OC+TyQIu93VAumZr7jmsSkQ/7Gb8NLEbeZ:O/TfIq+Y1kQ/qoLEw
TLSH
T1C9558D1DA7E91DCAE176C675C8A34493EA33B472137196CF2044C07E499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 18bb9a71f18dd78a36cfbf22ab52cd0aab0f15bb75a8ff7a2d76b9810e634f2b
MD5 8f1188f926ede2c12018e2fb809f6205
SHA1 fd0f50d07ee21edc743c8f1ebc132c0b0ef73042
SHA512 84f34de8deb0937275c40deddc62556a7c2b87f9a0dc6db3a169e1217e725d66c0bf245632ed82b68807d85db9f3c528e33b10c39eaa4b5a098f3cf7af33a5b1
SSDEEP 12288:ZcyrWOstaa3kcswMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8LQikZZSkQ/7Gb8NLEbeZ
TLSH
T14E55F10FB2AA00E2D0A7823C88954141FAB37475572267EF16E0C77E4FA75E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3c133ac81e290880745936f8d1705df1d3ce46fd6f14d46134d9173f81711e34
MD5 fbdf79e122b539f06ffb687350b617df
SHA1 befcebfe72d17302a246713b04867528508d070f
SHA512 7e2bdce0c6d6dff830abcd7d6ce36fa465775b79d2fd328c782264421647854b39cf527d6abf9011ea2a6a1e7d997a2548898467514e0b1ab28bf5c4346bcbdc
SSDEEP 49152:kpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDkQ/qoLEw:lpC7b4+80GTkOqo4w
TLSH
T134A57C3DE2B800ADD8AAC775C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 74d3f717ac928c630239b7d02eea1d5a4f5e2a522589c7035ff7d1ce5c7af945
MD5 0a1e40f262825f31a12215411405f352
SHA1 6ffc596c8e437fc38fa96ffd71d6951af3522816
SHA512 0f9db8b9c7625196b26a01688ab94d6758fb3737be11d4b661a918d3d5ced4f5b5cf396fbc02165a92086b9c33341b898c80e2da95e6f3cc3567b1988b48f2aa
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l44135UQySkQ/7Gb8NLEbeZ:dqPCIo4Kol4/QbkQ/qoLEw
TLSH
T17855AF2AA6F946F5E17ACBB49663C501FB727823133163CF5290813E0F169E85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1d9a4968787b58f47178b01df93e8cc780a29da2d0532e61df0ea1bd8e94d78d
MD5 4ba0db9c9ee6eacd4b65d00892db0606
SHA1 e0b18070451eba121adaa4fbcd36959ecb41450b
SHA512 2849cd91ba8d278387fa897ef243502601e768481091af8e4ff00d91ed2247a443fd8b9a1fd7ff729798d8c7b382b879d23e6bd45a776825d4a19b2c2c5459c7
SSDEEP 12288:mSsyLCFBoPLCRyh6NQ4t5MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qyLXPLca94tiSkQ/7Gb8NLEbeZ
TLSH
T1A575E13ED66C04F1E47AC27CD6A38906F672389D033166CB19E4D17A1F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 04e5631c6228c8f1127e136a19ec3b22e1b7e2ca0a6b2447df956d9cc3e0bd3a
MD5 4bccbdf9ad9bcd509c3fc78fbfc75cd1
SHA1 eea058213027f467fb89f679cd87416591f3c6fa
SHA512 9b4c359dc92209f87a0f05aad47630ae16e5214c6a44f16b6cfbbd8a235417d1e07e8d712049d0c8f5e2acfa908a579b8985fe207f682500237fb4845d451859
SSDEEP 12288:p9lyvj3IkxjbBzAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:pWv8qjppSkQ/7Gb8NLEbeZ
TLSH
T1C155125E62A414E6E07A4B74A976801045B1BCBB1334BAFF35C8D57B4B369C4A93FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-234-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/412-240-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/412-475-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/412-282-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/808-200-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/808-281-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/808-206-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1632-438-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1632-124-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1632-127-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1632-118-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2484-156-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2484-472-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2484-474-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2484-171-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2740-55-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2740-195-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2740-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2740-49-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3076-480-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-478-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-483-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-484-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-482-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-489-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-488-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-486-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-493-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-492-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-479-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-481-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-496-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-485-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-490-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-487-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3076-491-0x000001F09E600000-0x000001F09E610000-memory.dmp

Download

memory/3248-70-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3248-72-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3248-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3248-208-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-286-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3332-224-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3332-230-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3364-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3364-38-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/3364-46-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/3364-61-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/3364-60-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3392-88-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/3392-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3392-84-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/3392-86-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3392-82-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3408-271-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3408-303-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3408-287-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3408-477-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-265-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3408-319-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3408-285-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-244-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3680-250-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3680-283-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4328-18-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4328-20-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4328-111-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4328-12-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4664-167-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4664-469-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4664-170-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4736-109-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4736-103-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4736-322-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4736-112-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/5104-26-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5104-25-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5104-34-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5104-136-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5124-211-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5124-217-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5124-222-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5124-220-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5136-181-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5136-183-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5136-470-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5136-174-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5316-1-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/5316-8-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/5316-0-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/5316-75-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/5640-471-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5640-196-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5640-193-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5640-187-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5676-467-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/5676-146-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5676-140-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5676-169-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/5740-466-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/5740-137-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/5740-134-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/5740-129-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/5840-476-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/5840-260-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5840-284-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/5840-254-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5940-91-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/5940-98-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5940-92-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5940-321-0x0000000140000000-0x0000000140151000-memory.dmp

Download