0dbfa1c183cd072274ff12055fd2b8111920678003725826b542354fb9acf582

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260427-qqmtbaft5p
SHA256 0dbfa1c183cd072274ff12055fd2b8111920678003725826b542354fb9acf582
MD5 94967f63b0be57883d359b628c9ad6fe
SHA1 cee80c720d0ef30a6d22dd8985fb2652db771160
SHA512 60c80315fe0e97281db8bf61a68796dda652c59915c0c9283400623be5e631beb8bb94c2ec285572e6811fd1a173d3e4bb32d2fc8c9e5c1baaff080d4bada219
SSDEEP 12288:C93G6vHzOASubviBNDYa3NtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCz:CVGGTWBZ9tLY2NlSzswJCAQPWNzS
TLSH
T15755026272E0C4B2D5A30D3048B4D6716A3EFD705F609AEB33C4276A9E702D29D39767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4228	alg.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
1696	fxssvc.exe
3304	elevation_service.exe
1420	elevation_service.exe
612	maintenanceservice.exe
3336	msdtc.exe
724	OSE.EXE
3512	PerceptionSimulationService.exe
4940	perfhost.exe
700	locator.exe
484	SensorDataService.exe
1700	snmptrap.exe
2696	spectrum.exe
792	ssh-agent.exe
1260	TieringEngineService.exe
820	AgentService.exe
2052	vds.exe
1780	vssvc.exe
3768	wbengine.exe
3876	WmiApSrv.exe
3980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7791a4f2cd1bad80.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cdd96f14dd6dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1069bef4dd6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000345a2def4dd6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cdba7ee4dd6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ceea60f04dd6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	1696	fxssvc.exe
Token: SeRestorePrivilege	1260	TieringEngineService.exe
Token: SeManageVolumePrivilege	1260	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	820	AgentService.exe
Token: SeBackupPrivilege	1780	vssvc.exe
Token: SeRestorePrivilege	1780	vssvc.exe
Token: SeAuditPrivilege	1780	vssvc.exe
Token: SeBackupPrivilege	3768	wbengine.exe
Token: SeRestorePrivilege	3768	wbengine.exe
Token: SeSecurityPrivilege	3768	wbengine.exe
Token: 33	3980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeDebugPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2392	2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4228	alg.exe
Token: SeDebugPrivilege	4228	alg.exe
Token: SeDebugPrivilege	4228	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1448	3980	SearchIndexer.exe	104
PID 3980 wrote to memory of 4800	3980	SearchIndexer.exe	105
PID 3980 wrote to memory of 3256	3980	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_94967f63b0be57883d359b628c9ad6fe_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5092

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3972

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1448
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1832 1640 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3016 3028 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 befae2ba92c2acdf623d22c346dddbc42047df7edd7fbc16cd61fab299ba0bca
MD5 b31b6e6f4dcd3677c48310b5565dd051
SHA1 b6bbef91f6c03d5f8ef4b3638906945fe16d4c7a
SHA512 c705854bd262fcbda65a16850994b6bd963317db8be650224af8501bed9852cfcdd6f70e38b269498f40b29160e1ef5a9a2b192fe3fe2799e03c910b7f160807
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnnlSwwJ7z:z3q6HjBn5JP
TLSH
T19FD59D03F2D900E9E06AD578D7469133EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5f3e89e2bcf3f32203ad0a14efbd6b51c93f4994898547966f518dabc2d2628a
MD5 710cca351fd645335ed7171657506073
SHA1 71a46a3345e6bcb6e302b408ed471ecd3bce6628
SHA512 959d5acd8caa4cee1c55915d2542d3f0996e3acc6fb3700f95566cca9fd5acde64ff1e84c2ac16e81f2e6407504e8d0d9dd3ca09ea25bd2adc989e22bb1899e8
SSDEEP 12288:m1XLsswWkxy2lRq2czAYtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:EXYfDtczAYtLY2NlSzswJCAQPWNzS
TLSH
T1CF65F129B7E008F9ED674239C8A2C511EB3378944760E7DB03E4AA654F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6cef10a0759e6868b0b98e03c147f4767c0152addc5fe309aa8cc89a04981b68
MD5 7afd0821db48c641484ce48ceaaf384a
SHA1 10751f65e8ee777f6b200a486f66f0c810547a8b
SHA512 e7f12188a6a2d98c19b4a6b9842d104a0b43126a6a19ea96c7e64af63d839196ab17ce2e9ce4eca33119568d5f24ba6a211f9e1f6230385019ec8ff55c73a5b3
SSDEEP 24576:H0Le5ji0hmxirM5tLY2NlSzswJCAQPWNzS:HPji0AcOnlSwwJ7z
TLSH
T161859E16F6748331D073C0B9C5D2A69AEE72308557308ACB0286D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eaafdb8ead51366577ffcd55b5303e59e9d620d5c3e4588976502b5c241b66d0
MD5 65bf37c9466326bbe2a8933da9c98e1a
SHA1 eae1a6bafe862fe6cdec860571089b22d09ddd2c
SHA512 27cd0e1edba58e8131ebd8197abe7026458e807f0b429fa0ccb17879d31a259641ad415961649e7182ec6937f2efe7d7cff9537eb5c6da88c644191a8ada14ab
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyuntLY2NlSzswJCAQPWNzS:Y/ezSC6vUzPvxHjy6nlSwwJ7z
TLSH
T128755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 821a38234eea801f5a45a34919fe7dc1da6a1939b6a33794a29d25685b27f088
MD5 b6b31ade4ec2564df0d31412973908c3
SHA1 9767dc43d84d6c44cee584b5073d2cf473baa918
SHA512 be656c215607462cdeebee6c79312696fbee556dd932bc412aa4b779f6d969739db0da7cbaa4ed3824b6d0b8402060af5451a3eb3d941909d5c12bb9ac84f891
SSDEEP 24576:AVbqPb88hv/l+6UtLY2NlSzswJCAQPWNzS:AVO88hXl+7nlSwwJ7z
TLSH
T110559E66F6B48331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6e3494052b5824a056cddcd3faef67c66b930d8a68413388e8431f524302d7b7
MD5 c98389f7e9ab8abbbde01fdb7c44b842
SHA1 16aad4c624c43882ecc7d387e3baa86105df1730
SHA512 3b6d173f0833f4def4d8c5d5c70268934b5fb582eb2a20cb5952803cfacd77c11c74c33551b7442fc271e69b3e03dda840af420ea73a8aeca6d68110ba8847d3
SSDEEP 12288:VRFtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:VRFtLY2NlSzswJCAQPWNzS
TLSH
T1714523ABEBF088E1E3930D31D46AE07277634DD4E610EB6316C4BBA5C73911AECA514D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 64fe2b8d050a51c250dde31ec410c40603bda80b16f58aaa379f04c6172fa011
MD5 dd431cdb6c2465fbda1eb73af608a878
SHA1 f0cb34e812b524c697ea060f1549c8ca079f83c5
SHA512 c5342839bd30a4097081b24d13d42dcaa7b6208b0ff54c3a012d0a30ab89feb36b4c834f8699dd4b6b2c86f47a301deebc12ecc6532268d4dee99a2902bc54de
SSDEEP 12288:/eBNUbTVO86UstX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:/JIUstLY2NlSzswJCAQPWNzS
TLSH
T16565CF7BEE38FCE2C27A4DB95A91C200E77278704B61A3CBD165830EDE235E15E79815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63bbd46cd4423c84c4a98f1fa54bddc72528cc35a4188482b12ac493dfd38847
MD5 a40bf4ff5ae8690e607501ec513e755f
SHA1 3d9be6aa06926d9e124d01afa9343fa281f25adb
SHA512 e1339d07ce28318bcaf4cb2f522d4c7430ea9c82969fb4ca39a2619664c70e476bb548d32e1a494b0800e6a9421ac1dbdaf2a5decd44c671e65319b0bab4f5ac
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:3QvGAdlCEL8c/yRNw5CW5JP
TLSH
T16D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 faf993c4ea0b64771edbbb90d06b99c26ba54a278ab4c5ff93c7b81097efc99d
MD5 b68597a3a59fe351a4352d148c3bf218
SHA1 0cf56b62f98e036760fb875e2f14d0769c14b464
SHA512 e2c3d31a1924ec8f254ec62800e78361d81c074ced5ce4a49cf94644ab32bc3d319ff99fd8c29b2838aa97a3f0ad3541e7a106f20afbe25444791ffdacea26ec
SSDEEP 12288:XAwSfxL/2Dc34DLLmt0LDQewsAj6tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJz:wdewsAj6tLY2NlSzswJCAQPWNzS
TLSH
T15975E031FE74E432C3BB0DB21B36C716243D69604B511AC3E3E89E9D5A342D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 689058687f436f630e4b911f890936dedea1cf4dd2d9bdb6914a35d6491800e7
MD5 6cc90cb8634e04b20b1831ebd72af071
SHA1 36fb5aeecb4e5af2b9af5fb482e1a88d6676a690
SHA512 191cb5e74bbce2c84d9007ab755acd9ef75cc3597dd0673d1facd21e00c61e7d13b2570cd3ecfda771a70bc435319f024a5fd00fbf7ab0793a65c63fa1f2f568
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHv:nUEtQevvqc2W1cpV2EI32
TLSH
T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a559f78532dfb1723b8bdc6581dee325b634dffcb6194a92ee12a19319fee973
MD5 6f1e4245c7a3e3120c66547110f765d1
SHA1 203b2feccbe137ff2f4d05fb8b7e1213b1819379
SHA512 b358400ddc47c1ae1b42772703489862b6c522e9a17639140a124e8c3270297fec6002453eb42137c6cd1de9d7e30301d10e97dff3f5fdc9c892032c912e8ab5
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zenlSwwJ7z:7oquVjnmC5JP
TLSH
T179D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a04402edf4ec17c974c22417cd3a073eaefed0424006392784532aa144b62be0
MD5 9c8d4de6c383dd78f314b492bea68ba5
SHA1 e6b2acdcbe6fa797774249fc3a651f4e88967c56
SHA512 02f9954c495e9c4996b3f55d358a8022c87bc9193b9f149389b6e0a77897daac385e736e2bb41da8a313c7049f76f10aa432cadf9b9aa2eda638e6137cce9e4b
SSDEEP 24576:kAhGLJIFoiwtA5l7S53rtLY2NlSzswJCAQPWNzS:kAMyFoiq5pnlSwwJ7z
TLSH
T1CA359D81EBF955D4F5B3AA7899B69171EA76BCA95E30C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5dbe3df2fc22bbb48544dcf26533eaeeb2d06f9f47e0ed467b98403be35b3e6b
MD5 bacf778066e34372a131090726e3dec0
SHA1 f822edbeec95948dd3b568c1230ce65c35673a6b
SHA512 95cccbfc32764f3a246cbc202965fb2c216880384c044a85e28ddde625dafa1dfa190d2a57cb298cac9bdfdd3f73b0891ac08ac2aa213eae95a0d506279d86ac
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+CHtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyC0:UwuoOWetLY2NlSzswJCAQPWNzS
TLSH
T1A365E08A77B40CF9E5A74639C597C132F7B2B8512A20DB1F17A0C75B9F37221AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 18463090bb44a1244c9289773e0d6c8060c5f554a80d4de9ba8279fca558834f
MD5 47637ef77c2404588d00171207398075
SHA1 fb5d3b37519504a6140d13bb1d81af2386adf6e0
SHA512 a3f9788317af65b450821c4970b7a37c8dd4063528ba60f6297d395bd1d218351f098c592a6a1424e32430e3e5d460a2c6cd18b3687b75cd4ac6bc54b8ca2714
SSDEEP 12288:YBZ1IyKtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:GZuxtLY2NlSzswJCAQPWNzS
TLSH
T18A55129B33F460F5D2A30A39C8E69511E7737894673083CF1694A7AA5F33AC69D39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ebe5be0fa08b6c51257b167893c4cd250120630435118777e60b2bf4ff86b735
MD5 f4bf48cf8a941f09310cae3870a4bf98
SHA1 420fd16d9d1a2f1462d9622d53a05ae646419d28
SHA512 c2d8b653350936b9eb8b7117a488d1b0f7098969b93c5fd73b0a1b3b258ece0a6b8957f52920f196e30ee6148ba3bd0dfcaebb512d1370a7d1366b5931e2a95b
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:OQRQyi36YOcPQLvw2gAf+PN3L5JP
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55397cd7ba5582e40e2a98c8ee8c6d82c097d78736066ff960f59e6c645ad610
MD5 ca3e342b54123aa5b91a640f7a08ebf1
SHA1 355890ad20abc87cf4fa00f6d415096b80b57565
SHA512 cc9ff54f34cfe12969a14998c27a7a0bb77f93934f38371a26c4c4336278eafdb4e1f8a91c0040237b2a3b73030a1600b43049ecae8e969ec52bf1a0619f4937
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:3QRQyi36YOcPQLvw2gAf+PN3L5JP
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d18b9cbea6a24d091ceffd2c7592af43b64f5078e85808a9f836d78b3a8e809
MD5 037cb7f694011c8672cfc433f39b94b2
SHA1 ea802a03b1f86bfd0793b0998f91384fb8d39fd7
SHA512 8c9ece1c4f3bfaec485e95b6ee20703acf7b003e8adab9da6c7508ed3a7064be784f5a16baa412f57275d84f264b19c97bc982bc3a0377cef383388fe5c2af31
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0htLY2NlSzswJCAm:x68Qg55nhheWu7PNU3/OnlSwwJ7z
TLSH
T1B9B54933B2F200A9C44DE1769F4A873196D27C758FE0E3DB854572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 210fa3638bc61fe88e7854fdb5c8f3a27fa48cea5f5fb3d23f6f6b032adfdff1
MD5 6abaa6a482980c3939af8ca4fb91986a
SHA1 aefcce4559980c3bad9d8c51b7ada9e3ca23679f
SHA512 758af1079e88b0be55af87b7e9586a0d359c84194afff2641fc50e0f821dd14e0dcb47a79b90b3b61eca6a4df7b423f39ef45b1b1bb2976f359e895d3f8ff727
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:4y5112gYy5azzVvL69nLKnhZE5JP
TLSH
T1E1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 426ef145155304ec597b7f3c72c09f12d965371604bd60b3eadf3540abaef1c2
MD5 586d83bf08567c66a44aaef89624d315
SHA1 f37cde2bf078a1682a231635af2b02fc7a5ef66a
SHA512 541a2cb4ecb505055fe6a31bd3e21d60f86a770d587bafb2094d03d56ce978356cf1bedf78d9431964cdcb83afdf36434255919960ec033ce8a4c436afac80ae
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMnlSwwJ7z:fu6JmVxd2dz5JP
TLSH
T1D8D59D13F1D901E8D06AD578974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 abdf72b7acaed52225cb131ab8c9544ae278007763217b0776d2891257600ad1
MD5 6abf9ba996e1ddf527631dd9fee9249d
SHA1 ead192a996e0fa387cb5f856e8340b17f9d538e5
SHA512 53a8146020ac44a4f8c8cdc62249f2c5230e15527136ac02c1c2093419a75cf07637875e10b7f1e500f48aaa9be649e4c44f6df74f33001fac87f4541cf92382
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xYnlSwwJ7z:AmifPbRC5JP
TLSH
T134B5AE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d5a9b9c322afbfc33de2754a88237e674a6805b354f0241cd0e6415ea59d077b
MD5 16c4c0f117906d4534500f44d84eea7e
SHA1 4613158d8ef33813ff78c6967a8d6f60632ae2d5
SHA512 197b96123a6bbf60003c194d92ae15e6870768353fa2544d1e4b0606a0b921c5234fd3e99972f673e65d60cb11ac28aac7c9791b2659f6ed6e406e1f321c4ccb
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqXnlSwwJ7z:X5dKTi61Y5JP
TLSH
T110C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1deff4712afb8f718b45923cf96063aed28a2295f9fa11372d2db11792afdd7f
MD5 d6be75c4e6d25f5863d134bf20ec8ae3
SHA1 30f851f691baf2bf4796013146de19a549e6f77f
SHA512 a1233253ce3bcce1e79db36c280aa1c3e7bc51f612ebfc1f890f72a5fcdf9636bd6d8a759910b7683500e0751fe4b9f78558ae6112ebf3c4705bc16ea83f0122
SSDEEP 49152:chtSn8EApI0figngiDn0AP5w8nlSwwJ7z:dX2iyphO5JP
TLSH
T13D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b66c46cdab6e02ce2de441013d9e1d64dff39a8d70e6513e04f3c179d19e5ff
MD5 6eb92dcd208a1a6c25c41d68da788739
SHA1 86745ba388ad716c6eecc7f47e9f4bb4ea296c9e
SHA512 d7518389adb0790c2ea85e93502b729093b7ecc933c94e3f84937cf4fc3f98342c2f196d1a9a263bfadd534564b6e12fd725240bac2cb7bfc3cf605ceb47f076
SSDEEP 12288:X9tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:X9tLY2NlSzswJCAQPWNzS
TLSH
T1994523AFFAF088E1D2520E71C45AD072B7671DD8F710E6A327C8B765CB3510AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b0092375cff87281338ea9e250e4d9861137a0fbcdf1a539b617dea07c487a89
MD5 3f2b948d7cedf573d2205562fbfbd6ec
SHA1 d785613859628293c34fc4676d714e64a1121a28
SHA512 6f4ce4e5f5745f048faceb82b4e348e1f6551bccfcf87ded6286e0e78b319f9e359bef538c81ce8041ca5fbad2a852ae1b7c143417e3ed167b221e2a961988d4
SSDEEP 12288:1mtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:1mtLY2NlSzswJCAQPWNzS
TLSH
T1C64523AFFAF188E1D2520D71C45AD071B7670DD8F710E6A327C8B766C73911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ed0ef5060077b6a4ffba0f1307c4eea27b23ccff99f96d5dc87c5854b6862ede
MD5 b8f41d595004127aef8a13962873489e
SHA1 e50070326bf04584215e5b7108f1a9bb03035b7b
SHA512 12a486879fd975a46e1daa9ec48499ccc82ba109e569a7e55f5303755be7f9704888c911e1c21873f37fb1f765aa3733efa28218daaab0861228bfc882e4a271
SSDEEP 12288:dEtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:dEtLY2NlSzswJCAQPWNzS
TLSH
T1734523AFFAF588E1D2520D72C45AD071B7670DD8F710E6A327C8B765CB3910AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 bc0657631dd405c5ee46a9ee025883edce77dfe6765ae14db16a954cde82fe4a
MD5 14b7ad889c9901748396bc680cd4d840
SHA1 f92e8294339856d9daac55c7ddabeb296ed972fc
SHA512 5fc32c3fabeb0e0e8e9dc98228f3b310d0c87f44280fd74328fff7b4fc39a2fa83c867c6f11fe63e674a5b6b9d598cdf5322b3c3e087396784a9e2ef0d55aa1d
SSDEEP 12288:0VLtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:QtLY2NlSzswJCAQPWNzS
TLSH
T14F4522ABBBF444E1D1620E35C866D021F7B37CD8E720E7AB2784779A8F31245AC74648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d9d967e6cefb085dba57253b055e3939ae4ab2f258fc2357a0b92b5326ac1065
MD5 d115cb2ab7428a26bc9cf5aa90c791b7
SHA1 0079f811f9a7ba3964c75e38a0d948619c026d77
SHA512 6ee4340bbb6ee616a3796ea61fc3da5e4068375c8c3d1030cf2481ff62b478af201795adc0b57f65140820cde439d463d6f50dfc5332d63f0ed8ef3bea72f1d1
SSDEEP 12288:OTtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:OTtLY2NlSzswJCAQPWNzS
TLSH
T1694523AFFAF588E1D2420D71C45AD071BB670DD8F710E6A327C8B765CB3911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 23b9698503fd957c83c56b93d20b06074c731d80305565420bc9a7806ef43956
MD5 75a9edb4fd9725a10625cee0a5a50a59
SHA1 7a1648c7f630574f2928b0d4e402d5a3278988a6
SHA512 73b15d564e4ced9e2b951098d6cffa6bbe71f280e11e2ddbc8fac3f61f091995199286193c525c464fe02446aad708d4bce4358cd92bd3a715bad7c4d1de8302
SSDEEP 12288:kytX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:kytLY2NlSzswJCAQPWNzS
TLSH
T1384523AFFAF488E1D2520E71C85AD071B7671DD8F710E6A327C8B766C73511AACA814C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 aba241f1c01ee8a7d16f07e4a4d1f2565abe86b3ec5b2a1238be9f66217999f4
MD5 274c5d03a5e4795cf55ed36aae6e4cab
SHA1 b0702b70ebd5110d77f93f303c9340f36bcc0a89
SHA512 2be43da468aaf2eb95d87062d222f81ee7a65ccc369db13a0605cf678b9bd6501913a1eab5bae18c678c8386153bdec4b7c7e7845c2f2e269669f4161b1c38e0
SSDEEP 12288:YOtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:YOtLY2NlSzswJCAQPWNzS
TLSH
T14F4523AFFAF188E1D2520D72C85AD071B7671DD8F710E6A327C8B765C73911AACA814C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 aee0a9a62b5a03f9ebb1f45d5f7294e98b2f375f667554d0193c98828e921330
MD5 afa468403e4fa8542cdbcb0300813b98
SHA1 b2f251197971a6b2c1db55a9ea6793a793445c57
SHA512 74ed5c78d49766e707f301613e6678201689fd9e83db395c4ff54f787fb53e3558329cc92106b70953ae002829699243e583f1c351b12d73173db6bb73dcff53
SSDEEP 12288:oiZwb6zzFEoS2cPvyGtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:rZMSzFVSOGtLY2NlSzswJCAQPWNzS
TLSH
T1E36501A9B3A008F4EC63453EC8658912E6B27C594B60C65F13E837675F333A15C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7c1774f7f3b403b5e84734faa3b031cffdddacb7f68538edfdb8a14d4adbdc49
MD5 b0deb7a555c1e15ddba1ee0404426eb6
SHA1 1c1f18beddc3984064f17740a46bc17d9f5af3d4
SHA512 ff4e54295075e86849d4f3aebd6e6c80cde2b4fd55a01b8a60b6adfcbc14dec681c995e8c8e73c63568221c5dfb7d812ea2d68d14da0632f2df18fb92bb59e36
SSDEEP 12288:LBtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:LBtLY2NlSzswJCAQPWNzS
TLSH
T1F34523AFFAF088E1D2520D71C45AD171BB670DD8F710E6A327C8B765CB3911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 71b5be5d1edb23afa6b4ce276604a3b26ce7ef4fe3710df5d5e1dfe3908bb9d2
MD5 4aa77576635e8dc34f801760e4a9b49b
SHA1 4ec5a898511f9a0e2fb96bed6ee32442fadb023f
SHA512 3a87b7b55482ee0c4238e1140756f4aea3eea6204e2c3964d1dcef8e7f84e5b95a5263e361c59dc9beeef0bd31df732bb21b5e8010dfd8abd4bf44bea33f6a59
SSDEEP 12288:/VtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:/VtLY2NlSzswJCAQPWNzS
TLSH
T1DA4523AFFAF188E1D2520D71C45AD071BB671DD8F710E6A327C8B765CB3911AACA814C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b5d5aaea9fca0260693c13e3eb9a82a0455e1e607e46044e95cb4e5a67054594
MD5 8a3f38f036315be9015a1b90e47d162c
SHA1 963d438ed72e66238e137c59043bbb7f662e502a
SHA512 9bb2b90d56ae872d33bf6e7a6ac1b27b8df157b916d95620955187507441c5e31b69eb14bfaca69ea95f8d8ff9b580d9ea7f529b9dd908d5a24f896cdf1805d6
SSDEEP 12288:KyPz5L8KtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:XzyKtLY2NlSzswJCAQPWNzS
TLSH
T10D55125BB3B120F8D1634638C8A25A12F77278755720CBAF139467765F37291AE3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 35d3e29e10b73bc17d0197154d1e4ff60ac0aaa0e488ed712cb029e2330cf45c
MD5 1699afb5d033d110085472f3fcf9da84
SHA1 15d1caa62cd40a14e8765d715c30fb857eea99f8
SHA512 0625f2aab6c70f3300679137c5fa726ccfc7f59928bd8ac05c828e11a855ac5a82f172fd9a9c88c2ccb0e9780be5bb12a1a439ad8e42b5d79ca515bb78ec8865
SSDEEP 12288:UBtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:UBtLY2NlSzswJCAQPWNzS
TLSH
T1D64523AFFAF088E1D2520D71C45AD071BB670DD8F710E6A327C8B765CB3911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c43111b6b989177e80cfb2a9ce96aad5a9ac6d652adc0542bc5ab1aba4891680
MD5 92aa5448d3bc1cec0f226be2f71cbd5b
SHA1 5d8f3540ffba95e89e6b8eb57a41558898ccc80c
SHA512 d71722a403c4d5c07cef37a2a2bd2ed86824d7d34c34355225fb0bfb2e2aa4cff8e70186feb38a24c590b569acbbe8f6fcaf71fc529215fa457984dc60caa241
SSDEEP 12288:/BtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:/BtLY2NlSzswJCAQPWNzS
TLSH
T1F44523AFFAF088E1D2520D71C45AD071BB671DD8F710E6A327C8B765CB3911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 841c29528ebd92ce6791781c85444970ee6fe4bafca65f52a3cc8b8cf51502bb
MD5 0ee4b9b6e55357fa1c0f0d4f62fdc96b
SHA1 15335aebc7c7ff8b4357b197f3103b95c0894fc5
SHA512 b036649f481ad328a155bd4bf9a02408d142f3bfd85753d5edcd9b02fd3074fee47da58673cf660f9d38f3d261921f015536bbcd05697f107226b8ccfc11290f
SSDEEP 24576:YCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAAtLY2NlSzswJCAQPWNzS:YCUxPTY+8Wg2lIL8lrIUJLWwBnlSwwJP
TLSH
T1BB65AE1EA3EC0896D0BB81358951CA16FB72782E1B21D6CF2160C37D6F27AD95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 def0232cd30aadb35e000efd794871f93204a2fdd21694e8ef1339a4dfcc1b38
MD5 c485683668e110b135bd2e3a47a26945
SHA1 0f43053aca073138505b89d247987bf4eeb453d0
SHA512 9fe2aa8d275450605bb6e7f01f1181c8aa4901dd09f8f73ecce5f0712d2d029614df0c4888b77be741ad8888d1111a08125654c3c08cc18a0129bc55cd96d5e7
SSDEEP 12288:GNsfxtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:PxtLY2NlSzswJCAQPWNzS
TLSH
T18255F15AE2A841E8C06E1675CB569651B3333C6497E0D3CB23C0F67E0F36695ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9ffe417b8bcbd0373f1adb50d87839571472b156268d587bded37d2b0d16cc36
MD5 91896dec4e5f6c001124b0008a67ee06
SHA1 50d773bc97b5be508b9d7310b5bc136c8d233e30
SHA512 bcd385e4a23bb95488e38056e965fd5394bcba51c4a4befd86c8b620096141e441fd80195462c89f80b066b1e1b922ccf5669c1b7cb6f9e73cffeed86d499352
SSDEEP 12288:iktX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:iktLY2NlSzswJCAQPWNzS
TLSH
T11B4523ABE7F488E1E1670E30846ED031772B6DE8EB10D6D33688B7959735586ECB420D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 33fc21dccb7fefb8475b821c10451254db0272e02575f50dfd8a433f26641607
MD5 5ebfb76043cd1f9912df05f8f8f60758
SHA1 351a515cf3b176f349053675737bb72caa84f342
SHA512 e31b1a6359d3fee1bd2d04306e4708e5b72d8cf93b78499731962e2dfaf65b0816c40baef7470f8d38b5a5df1892a897cf88637253545b0d7c4ce8f4a3675c97
SSDEEP 24576:Y8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCatLY2NlSzswJCAQPWNzS:JRZwQCyiHiQEaiPnM/nlSwwJ7z
TLSH
T1B285B01E63DC46A4E0BAD278CDA74407E6B27816573197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3094d609d8cb21de130ec3ba6870637054eba4b9e48994697f073151faec5630
MD5 1b1bea805946bd2f73c19da7a4e2f086
SHA1 c9ee9ee93fe3cf9ccde663362a8c5923112b9bf0
SHA512 fe808fbe1a8fe275aab984363b7cfe21cc52e819ab400e369faffe1e20ec67a3ab9c2dd5985e25df346a5d48dfb76c4071da9c355af57960bcb34cfbe5519b82
SSDEEP 12288:+bxA1U7K0tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:+bxA1UG0tLY2NlSzswJCAQPWNzS
TLSH
T1B255016F66FC14E0E17649398896C112E3327C696720E7EF21C4937A4F3BAE99C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b8dfe33b0cd194ca0babfabf203efe90b7448bf692d87eb73f463031665616d5
MD5 2529c8d3f6b6e9908e16dbf7e6a351c2
SHA1 7108ff55211ef55c84ca5431bd5474a976d1a3da
SHA512 1e91e37444d729606cc2bc66f7fe216c8475a152d95fab39f44ec1a82a0649c8e1fd85fabbc9112e404438c44770c77270a44c4a531dba9f99afc77d0c7453a8
SSDEEP 24576:YjsmP0yHaqrVqHra44KDzMsrnbtLY2NlSzswJCAQPWNzS:YjRP0yHfVqzlAsrnpnlSwwJ7z
TLSH
T1E945AF2EF2B910F9D4AAC136454507B5BB71782D1F209AC701B0C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3b11a8ed3d3b53970c62c61d3593b1709b92568f1272863a78517b5e98d6bb5e
MD5 7190a35c5323f04ae5f34df80e9daa63
SHA1 c99e038a96aeaef2123b3f5f39060059215122fa
SHA512 e92dea005a9597be5870be95c927e0fabfaedb3186d2adbbf429e6a99acbbfedde2e1696f7e4fdd1489e627b1d70949b5aea5ec9b56c8b852ceea5987b3c1b59
SSDEEP 12288:iStX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:iStLY2NlSzswJCAQPWNzS
TLSH
T1284523AFF7F488E1D2520E71C45AD03177231D98A710E7E326C8B7A6CB3959BACB5148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6aa36351ca6e2ac061b2c92c9440547c7277c3f4910a952b31be159f5445e817
MD5 077d4276bfac4a911101ec02aa3fa517
SHA1 b718863dcb1d830c70fb89f8a7ab16f94d862e22
SHA512 e8c214e0563681337b10454368ea2674c44bca320ee01bb06c48a615b73ae6a5cbda8c26b457e4879623952c5b01bb20ff61bd150ec1361937d9dbbeb9f8696e
SSDEEP 12288:IOb9A4LWO+vAYFTYtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:lpLBUTYtLY2NlSzswJCAQPWNzS
TLSH
T11775F159F7E404F5E967813CC8A68522E672789C1760E7DF03A88B651F237E68E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dd1c49dfd4ff8371501af9fcbc7efe8103f3fcaa26e19c67993bb1ddcdb2b083
MD5 fedbd5159e0efa27e907ace35e54d0b4
SHA1 f321fffdde2e8a1eaf48086362086f2a4509ab27
SHA512 af023659da8ecbba74e45f231f40b2e273a88b8198fec5e158009e4a9e1fda42bbcf085fa3ac17771f5013b044d54ea6d748d31cd2bcfd24c6469e54f726db9e
SSDEEP 12288:C70VmvIYNvUyBpttX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:zrYNHvtLY2NlSzswJCAQPWNzS
TLSH
T17565E12FA2BD08E4E57B5579C9838215F27378A6171192DF05E0837A0F27EE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 10674e90783a8a60f4fa9dae183438ea2b1be8444d8c897c7f9fef19dca8e9c7
MD5 6c2f306abe73a919ecd38d76ee8ec8e7
SHA1 5e2a612c5d98c5708cf2b3eb4da8e08f618ad165
SHA512 fe1425f11db16ffd9b687497e2e2c7b74ac4a02a0fb592131a5c0d786419c28356f5c550fb2e32e968be9e52466153931105c409605af642c8f17ea56f951e97
SSDEEP 24576:WnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKw:WnXoJJYH84VVS6AmEcJas+cHBjSSKHP9
TLSH
T1CB65BFAEA2BC04E8D5BBC17DC5C24506F5B278651331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6a8dca413ed3ac4086aafebf3794f351792a7f8eb61aadf98f51ad948335e80e
MD5 89a83e18b5d24ebf990fef06e27b746f
SHA1 25e021da23f0119aaa568ec2a016b4948e3844b6
SHA512 3e3873b0149f2607ca577aad59dc3c6c93ff1d26043917c2232b462846de4b8a54281620fcfab2c005deee2218cf8cb3ae77e78a7ae8f73b7f4ce08718ef29e4
SSDEEP 24576:Uv7Xbxd9Tuycf8M/TYlSuxrr2PCltLY2NlSzswJCAQPWNzS:UDLL9TuJ0M/TYj2PWnlSwwJ7z
TLSH
T1A0858C5EA3EC42D4E07BDABD85A79046FAB2B855273081CF1291856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 19f838dbc8a24debefd4732a39f4909e7e35ee4aced3677fc634a900d70ec669
MD5 b0f78ec6cd9ebf36c34cf3bddb190042
SHA1 b4864ff00435fc6270b1232a112a356b7ceb3488
SHA512 87a96958b714214765138897f76ef4e156d33065f53db2f1055d477bbeaf6c88130a7c5d0da19171d6840b771f5d2fceeb3917310dc13b19191833a871e83fb4
SSDEEP 24576:SegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wYtLY2NlSzswJCAQPWNzS:SngOJOmPOHh8nlSwwJ7z
TLSH
T1A855BF3FB7BC15D5E03EC17D89968916F6B1782613259ACF0190827E5F2BEE46E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 df98ef8eb749fbc1074f072f87482cec1d0222141f9950d8de02bf96667b8891
MD5 9c7d6275def0844e6925fffd88edf07a
SHA1 ef367252d31fd4d945d247c37faaed969a5bc59b
SHA512 46c3fe9787f3dc1c49fa09b302d2b676f1898c63eee4cb38e102812b652254f8a06561a388dbbf297c2e314263505fa56dad63a30c6633b1db111b4c4a27217f
SSDEEP 24576:MLJnJiTk3R3waE4JrOytLY2NlSzswJCAQPWNzS:MLJnJK8R304l5nlSwwJ7z
TLSH
T1AA75D07DD2B810E8D4B7C2B4815A5656FF32346C2B21A9CB29B4D5353F12FD0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 724eca2e368df8fc783d72db26b62c00d360fe9a9c665e16b7fc069fefa0d063
MD5 ed5cc9ffe25793efa226c93677709d78
SHA1 e812ba62fe2301eb43d5a781545a591827d4b680
SHA512 768492c9a136389286ff512fcc317727378f609d42d6f5db466384e0ecc49ada2078331f5d8436798f6a6b1ab0098ac30b93dc2f8c5710bab52d4a6b6a5c1ae0
SSDEEP 24576:BA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pQtLY2NlSzswJCAQPWNzS:m9mqCzDScAZmlvTcFg8Ph6qnlSwwJ7z
TLSH
T1B1955C15F7EA5298E8B3C9F1C96694159B337C409B34F7EF0A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 561ea4be85727e4f398a28b626c5ecb2606f262562c756bd00b051eb0227d785
MD5 2eef0f82d39b86ae65898f69f1ae3f31
SHA1 c581baf20cc0030c95f200f1755986c832d3bb81
SHA512 8c25c10d5a3cc3f2ea86e62de06ae7522412c0cf2e3d7417206875bb8f72ad4350249a83bfda6fb7b323e726383da70bf40900feb95dabb0f7704d15b6f5eb27
SSDEEP 24576:DlYJeXm5jUuEotLY2NlSzswJCAQPWNzS:DlYJeXmRUuEsnlSwwJ7z
TLSH
T11755129E76FC60E0E16B4979C4928521F372B4B46311A7FF12D0D27A8F37AD66D38A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 87d32dbe830f7dcf249c5c107edb26ac12398f3c5451119c947f84cdf86e384f
MD5 7739c6e34495c56397444175a1f12eb8
SHA1 6da083454c6b740d2d418d3a16703d090701e824
SHA512 50c244f64783462c6790204721a1529faedf81bc56977b202d3adc992568694404f8681c7a796582d79acc621ceee2a9115c0e5b21a4d4b40fdb499282af3aa2
SSDEEP 12288:tmu6ky7tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:t7ty7tLY2NlSzswJCAQPWNzS
TLSH
T10E55125AA3F454E4E2B60E38D9638160AB367C609B1097EF21D0F73E9F366D5AC70B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7d1469314417d0fcda6a706d3790e9780e91054781a50a065732b33c13d9e1b5
MD5 6f12ca5f47d7eacdf772ed52b0f0fcd7
SHA1 edbd2928f7084a02d0fe79bc8dbd184019d67a5b
SHA512 e762078f87179e583e6d76e767f7f804a393e965dd7db4a5821d0ec03102397f9e25478eebdc8379f367fc13049c9a3c3b64cc3c3685cf097fa1f86e5f1b4bd7
SSDEEP 12288:+PYtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:KYtLY2NlSzswJCAQPWNzS
TLSH
T1994523AFA7F054E0D1520D71C42AD071B3673DA4A710EAF726C8F7B5CB3A186ACB5548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 693b55299ab140e91cb0619f6d91dce3da3d6a898e1aa84e6a77409c6e4e29b1
MD5 017b30f2aa7d6e9dd154e9d7f4748a3d
SHA1 75568d0ed75267e23cd6ccceeee329ccc5374c32
SHA512 796ce5eeac0233d9fce6627b220969586b680564d5ecc460bc308e669bb3e006d899b6861c34183b2fc5b3b14c0484e36796614e996f1fb051e812ae349ce251
SSDEEP 24576:yC+TyQIu93VAumZr7jmRtLY2NlSzswJCAQPWNzS:y/TfIq+Y3nlSwwJ7z
TLSH
T1EA558C1DA7F91DCAE276C675C8A34493E633B871136186CF2044C17D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 75d11fc77c6687c0c377e1d2f08c24498917bb0d93da6924a4c8977355d82fd2
MD5 67aa8303cc2044a6d2fd206a83b6ed4d
SHA1 67e5591aa75142804f23328f3331d49e91717a60
SHA512 05d6318f7d62b93c4cc5873dd3e2b0418c5d0877de1a209659a880214e386879aac90190dd11173090711d0aed052bfa0c53780865686bf73741984e5948c2ed
SSDEEP 12288:XcyrWOstaa3kcsctX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:uLQikZctLY2NlSzswJCAQPWNzS
TLSH
T14165F01FB7BA00A5E1A78238C8868152F7B374745711A7EF02D0C77A4B675EABD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a33ef1eb188299d9c0c716db34cf907bce0469f3fef2ae36183b72886637dc7e
MD5 72e99f9622fc7e5c351ed4b29229ecba
SHA1 50a660f3222cdee86783358dd4b90d1df083088a
SHA512 91d36a9c3bba148744b96f2576d5cb8de3e627308d383b237ef31ae5a9679d2ffc8d5f16d78cdabbcd033c0c10840ddab80476514f72d0dd3965d326eebfa210
SSDEEP 49152:hpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPJnlSwwJ7z:ypC7b4+80GTkJ5JP
TLSH
T15FA57C3DE2F800ADD8AA8775C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6acf6c4b310e350bcb7f64d3a5f05c338d8503960552a638eabb1db1d68c2cc2
MD5 ee3995377a2e9f153edbfd4399fbe9a4
SHA1 61494fc3e5c7bc8f79706d25af10519539ee6f13
SHA512 c8c2f397d931230b40275fe755ff4c9bd4fab371acdf1f1adbc6fb0ae1039d4a598307107034dc74f3885548b8ac11b2efd571248ee4da970b6d3b6c0c71c574
SSDEEP 24576:RSAwJPE1IDAo+4Kt+l44135UQztLY2NlSzswJCAQPWNzS:RqPCIo4Kol4/QhnlSwwJ7z
TLSH
T1F755BF2AA7F946E4E17ACB74D663C511FB7238221331A3CF5290917E0F169E89E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 b8870d0db8f752866fa40e5e63f4ca9ed235a24e2ad3872806c7e240f3f252c6
MD5 eaf6b49e7da203f05ec5aef6a60719a2
SHA1 8aebff3299132dce256a1f4bd5e53f602fad100c
SHA512 8e50a3cd3a46f46e3c4e7e7ac423d811d02feeff205c9a6236fbb638e52c7e9ed3219530da4e3fb5131ecae9f637b30b744a2ce496282979c90cb824fc37c47e
SSDEEP 12288:8SsyLCFBoPLCRyf6NQ4tDtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNm:0yLXPLcM94tDtLY2NlSzswJCAQPWNzS
TLSH
T17F75D13EE76D04E4E47AC27CD6A38506F67238AD0331A6CB15D491791F6BEE4AD39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 745fe2aedc408a50553b92666fdf3400a77f575bd088e61d73d62a3cea5d4fb9
MD5 ef285cf807ba60caccd3b623a77aa415
SHA1 c8b544c5ab40e2268ed548df2c5fa51c31125882
SHA512 64c9b7264826f99ffa4f2ea208d45f228f72ae7b776bc525a0a12051cdb733673cdaffa65d908f8390a167917db22bb4c530d793fa7c4b9732a5d3b3672e08c7
SSDEEP 12288:19lyvj3IkxjbBzMtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:1Wv8qjpMtLY2NlSzswJCAQPWNzS
TLSH
T1F265125E66F464E4E0760A34D426C121A2727CB52720EAFF31C8E6BA8B356C5DC3EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-452-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/484-137-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/484-288-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/484-454-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/612-252-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/612-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/612-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/612-82-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/700-127-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/700-254-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/724-102-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/724-301-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/724-96-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/792-164-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/792-291-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/792-170-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/820-194-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/820-196-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/820-190-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1260-174-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1260-180-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1260-292-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1420-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1420-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1420-58-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1420-456-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1696-41-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1696-54-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1696-80-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1696-35-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1696-77-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1700-289-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1700-148-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1780-295-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1780-214-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2052-293-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2052-204-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2392-1-0x0000000002940000-0x00000000029A7000-memory.dmp

Download

memory/2392-451-0x0000000000B90000-0x0000000001192000-memory.dmp

Download

memory/2392-8-0x0000000002940000-0x00000000029A7000-memory.dmp

Download

memory/2392-302-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/2392-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/2496-436-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2496-25-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2496-31-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2496-43-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2696-290-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2696-158-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2696-152-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3304-55-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-46-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3304-52-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3304-455-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-91-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3336-85-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3336-300-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3512-106-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3512-112-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3512-303-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3768-224-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3768-218-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3768-296-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3876-234-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3876-297-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3980-457-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3980-245-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3980-304-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/3980-298-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3980-272-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/3980-256-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/3980-239-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4228-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4228-13-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4228-19-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4228-421-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4800-475-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-479-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-462-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-465-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-466-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-464-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-463-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-461-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-469-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-472-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-474-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-470-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-476-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-467-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-478-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-480-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-468-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-477-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-473-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4800-471-0x0000028252860000-0x0000028252870000-memory.dmp

Download

memory/4940-253-0x0000000000400000-0x00000000005D6000-memory.dmp

Download