96ca29e349f037498dcdd630d3c28412dcbd3df6d8e489416fd775b1f0f5fe98

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260505-qrfrdscz9j
SHA256 96ca29e349f037498dcdd630d3c28412dcbd3df6d8e489416fd775b1f0f5fe98
MD5 f7df598315edf40640f9b3c753561143
SHA1 b52b0e65adf021094a8a283ce57813a24170ceb0
SHA512 e65c859619000a5664a4a3be20a8fc60c481823b034cb191c82e94a5200e49b8b9151b196b9e314fc286edfb39d2aed4f5c09ae231864e348758ac18e0f4499b
SSDEEP 12288:vHPrGxzQ9TA1ubv6Zc3f45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:vHzGxmvgYz7KEMdX6keYnAcer+
TLSH
T14075121076C1C4B3E86309316AB0CA70593EFE711F644AEB7388675A5F742D28D39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4116	alg.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4476	fxssvc.exe
4388	elevation_service.exe
1364	elevation_service.exe
4012	maintenanceservice.exe
4588	msdtc.exe
1124	OSE.EXE
2476	PerceptionSimulationService.exe
2120	perfhost.exe
4336	locator.exe
1088	SensorDataService.exe
3436	snmptrap.exe
4736	spectrum.exe
2888	ssh-agent.exe
2968	TieringEngineService.exe
4860	AgentService.exe
4928	vds.exe
3396	vssvc.exe
4804	wbengine.exe
4628	WmiApSrv.exe
4952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e8b2ffbf66859a32.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db55993c93dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009082354193dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d02cc24193dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010d0513c93dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abc0003c93dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe
4560	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4476	fxssvc.exe
Token: SeRestorePrivilege	2968	TieringEngineService.exe
Token: SeManageVolumePrivilege	2968	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4860	AgentService.exe
Token: SeBackupPrivilege	3396	vssvc.exe
Token: SeRestorePrivilege	3396	vssvc.exe
Token: SeAuditPrivilege	3396	vssvc.exe
Token: SeBackupPrivilege	4804	wbengine.exe
Token: SeRestorePrivilege	4804	wbengine.exe
Token: SeSecurityPrivilege	4804	wbengine.exe
Token: 33	4952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeDebugPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2480	2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4560	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1800	4952	SearchIndexer.exe	111
PID 4952 wrote to memory of 2700	4952	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_f7df598315edf40640f9b3c753561143_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4228

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4012

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1088

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f1d6aba2340b1644158cffeeb740010485a8e12a2a82fbd3e9270f7ffe861ead
MD5 37129d73fdb22a41fce432e2b3111b64
SHA1 df344a33350dc8f61efb0f4d0944204a4b3cbe5d
SHA512 768fa4f35f9103c63568faf36213360fc115ae9f039dace7f3c494a18f47b7a728123a3227d38b7ec49d29e8bc4fc0d86e4f2913b60feb22486580aa6dcbc0da
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAYPKEnSG:l3q6HjBFYPKES
TLSH
T120D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ee9d63f0840cb4d8cabfdf495ac20412e1a00e3d3be707a53076bf727aab5e36
MD5 e19b0b12bd83bdc3b7a57afca59f76cc
SHA1 6ce3c1122bc0db8129d4080550aa5b08a2f69c0e
SHA512 8f2a677110a4fc1d4814801b969a347c5ecd101bffb16ebe90130825016eacd631ddcc290b0946460b6ee68a1f9b39d6dc92c784218e8bf96ba62ed027feaa3e
SSDEEP 12288:61XLsswWkxy2lRq2czAXS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:QXYfDtczAJYz7KEMdX6keYnAcerL
TLSH
T19A85012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 845ee4770df5f853babe7d859ef3883214a98fe7bd9bc14aa58de92ec48491e3
MD5 69ef36b4aa9c318f07fa42879116d4bd
SHA1 fdb2dffaa801c0475a1218c04804ef592dab608e
SHA512 3c98c6897107b7e19db13ef25adb080cf32d204f7e55ef2e49adae906041be7fda2ae6f797aedad099a4a47bc60c2a249de6a2d86de24604fab7d67c8d5c1215
SSDEEP 24576:A0Le5ji0hmx3rMYYz7KEMdX6keYnAcerA:APji0AZjYPKEnSG
TLSH
T127A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a9d657342253c434dfed7205424f29d04923ba3aa493f12f4d5c23c6ff2c1dfb
MD5 e74d730609a31484d7cb528d8e139617
SHA1 4e7d387d5a575e9ba24303a7217e7a2d5e82f138
SHA512 59c59f26d52d841493c6dc44f8e30c2fa50181d3a39a25eee42b72f1f7e5e65137f4529f677bc46fca1ca5274c278058c1934465fc27c41e3cd519abb396254b
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuWYz7KEMdX6keYnAcerm:P/ezSC6vUzPvxHjynYPKEnSG
TLSH
T196756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ac72f766585a66aaa60ff1cc4951f170de604e070e5c9043bb18135910efcf9b
MD5 d668010316b2664c0b209bfb78261311
SHA1 507b08db073a039b0aa07c4b9642ce5a9e386413
SHA512 a1eebd5d60248ac93d682471887fbb64716f9037e370439bc8a2b2e4e0573f8cf884a3a4a89e4ddb1eb6633aa741c3c78627bbb3d7019d266445553a5b683e67
SSDEEP 24576:gVbqPb88hv/l+61Yz7KEMdX6keYnAcerX:gVO88hXl+8YPKEnSG
TLSH
T10C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 87f9de0f0099d67d07c639a142c782f1311b335b14102c3c97d7dcd38818c13c
MD5 b42f5129503f1f79dc5cda720fc652f0
SHA1 bf59738c0e10e7f1cb0f932d603bc29d8599f1a0
SHA512 b462d79f50ed0738e0dffd39e0cdcc3579bdb9210cee81d2cf88a8604a678b0d92b1b3a6167db68269f5f26872192c1852cff39ff399dd08c3f3b02e12252496
SSDEEP 12288:WXQS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk6:WXEYz7KEMdX6keYnAcerD
TLSH
T15A6523048B1A89C2F85F067BFFF5895089375DC62E8C9761C94CFA4293BE222C51679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 4b5e061f68d3d8c962fe6f4c0402326effcbacf660ea74402fa89f9991c6ebb3
MD5 1fc1a2c3d7251fd10a02633bc437cbc3
SHA1 f07b819cd1c322836005edd01dc9b9c7b9aac80e
SHA512 00f945ff608a91caa27a7e6411f62aadb6c7c5e16811bf2a2cc8766300068d2b330ca20213b48e9581f2a5084acf7ff791294cafca50d777334262022015f634
SSDEEP 12288:4eBNUbTVO86UzS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRku:4JIUtYz7KEMdX6keYnAcern
TLSH
T10F85CF3BEE28FCD2C27A8DB95B918600D77278704B51A3CBD164C20EDE275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 abd6ae313f5e2d11937be1619656e745afe70824ab99c86f3d13230ce29e3ed9
MD5 08c7320291a9f1cb42165a527f7167c0
SHA1 48d5b0f4e80eb582e713998cd0649a2ffa444a83
SHA512 dda3b6f41d2237bba250268ac4a5ea2522d846107278c276077cc3290f2f024a97364e0ed9fffd5a693880865a95912ad439fcb1046a6de21754a8943f3dcd99
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:sQvGAdlCEL8c/yRNw5CGYPKES
TLSH
T153267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 eee584aef24d0f66a6c60d422833e3ec1d4e057c8be61133fb4f39b3bc1b12a1
MD5 9b8c15c4291e0422b3edab54193c237c
SHA1 f3284baea3cc3e7bdbfbd73f52edad2fd251cfcd
SHA512 fde16a0acb90388db7dc13d6bd50d72c43157ae5bc29f2bbd1d9ad88b5338d5e050f83944fefdb2e42e70ddcb61a39021f320bb873ff1651895a31b6eaab68e0
SSDEEP 12288:jAwSfxL/2Dc3BDLLmt0LDQewsAjdS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRX:ckewsAjTYz7KEMdX6keYnAcerJ
TLSH
T1C195E031FE75E432C6BF0DB62B35C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3ccd3af4d01c014774caea13f5880dac9f371c84a567ad2cbe0552cbea4759b5
MD5 921fa28359efbdfc04a95f939092754b
SHA1 c549315abb7ab2baa63af0ac31d83b69d4eaceff
SHA512 da60bc81b0873010f8542ff7d350f345bd71111c523e53d4e80dd47373f852b0b4f82775afb2caeaf70da92eb03cf85b93ea8d28601d11ee862b4cfcf703c891
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbcKZ:MUEtQevvqc2W1cpV2EI32bn
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2cb4cc71d6f80eba3f52b193ba0f39f8b9a0e4b4bef4cb8a4ffafa3f944efb20
MD5 09945200471fbbd4f220583f45c49c51
SHA1 6b3bb75a1332d22096ae29d28d5ba5874b07f41f
SHA512 839d589db3ee741d663527b6abb829bdd17f05d83cd86a595b9d28bb6d716e7a06de3a9ab5a4a648e0624bff1e7e6029aab2041f5361dd292582ce64f9d55504
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zzYPKEnSG:QoqtVjnmaYPKES
TLSH
T1FBD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0ff1996c91340f8079d4410fb7e57df2aa4afb359fb238c3fb7f0ee6c6ae1a90
MD5 abe84b46e70c4a47e9b0676d96fe8017
SHA1 78563b5a7ab4447d8e9837f84ab03e941a35196e
SHA512 78b30866a26b8c53ac13beca8f82f8ed9bb2e1b1727a21b61e4a91e5fb39ed5df32aeca2d4b06613f73006e583952b159b56be14dda27294bde0b5d57ea60790
SSDEEP 24576:cAhGLJIFoiwtA5l7S536Yz7KEMdX6keYnAcerV:cAMyFoiq5KYPKEnSG
TLSH
T1E8359E81EBF955D4F5B3AA78A9B68570EA76BCA65E30C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 86cb0e533c26e185a3211ea73c8c9b8dfeb58011e8ac93724b9da5f27a7db430
MD5 5c3f12f9648814b0ef44ff1c1e3c22ba
SHA1 9a7bf8f0a39d43639a363f7c81094c7f1dd66492
SHA512 db6243c63c4b13983b3c7b9fb188a8b53fbb3b3a3c368ba19fcfcb6ef2bba610dd646683f728d3fc2cb4f7179becd71aea217402c4f5869ff70e2717359db683
SSDEEP 12288:5mw5HEjsChNzBFgl0WDm+CmS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:UwuSOWHYz7KEMdX6keYnAcerE
TLSH
T1AC85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f255f30bb3664a36afbed2e40848c2379a1d2009b9de069ce3158d1b652a3917
MD5 ba9b252fc09c33bea2435e5725f6c398
SHA1 fa73da05f0b33053b39fe55b5654a09ef8897570
SHA512 abf7199f706653d86259e1b045590822069c937ffae0f37bee1eae947ac144b6fa5172e1e5696f54879ab8cac04e12b7f11c80bb7ceea7a0556dcce9422e7484
SSDEEP 12288:sjZ1IyNS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkB:YZuwYz7KEMdX6keYnAcerU
TLSH
T15875124927A860F2E0A7423EEEF14601D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cbf76516a96685c2d5433ac22a537608a378d9a1740459602249cedc51016c96
MD5 6a3bcf88a189b3aa36f4d3a92cfd5e23
SHA1 f0ac9f5b504f1635518ee7a9c774f5dbe001fe8e
SHA512 862d82faf166caa01db86d5d1ee76d329a235bedb8d8377610579ba55966329f9941cc360d1a3b7d83404870fc7252a44c155b9ab2917501bace32b34eb1e644
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:xQRQyi36YOcPQLvw2gAf+PN3hYPKES
TLSH
T1A6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8955c4ae41f0bb96cc7815e246acb1045228ca58fba196bd0ac2fbd4afaf5d1
MD5 edf884d75f0eb87d34403f404a910f48
SHA1 5b27e6741d474de949187cab124a3a2bd0b90e8a
SHA512 1fd88330e4cb517bc49cbdbb6bcaf0aecfbe7b245c92ed42a1d4c49961c5894e4ea504a45050e2c0e6e23b99cab54fc601cb5b677fee690e5ade6cf0d6ba2ed9
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:6QRQyi36YOcPQLvw2gAf+PN3hYPKES
TLSH
T19D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b58e957272d32a82562c1cb7a189b69906f00a63ef31a88e499d1c3d86a56873
MD5 bb767f0b28410d7edfe2b99dd1fd54a1
SHA1 d43bdf57797ecfe62c02c0a4b15564b13f7d7e7d
SHA512 f2c0428d5b819ac7e73c97dcfd29baa2752f86bbbb566a7540afe26d4bf707046f94071dc4b7932661bddd154a7e1901c6c555231e8a32cbac07fd69052a3317
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0AYz7KEMdX6keYn6:968Qg55nhheWu7PNU3/jYPKEnSG
TLSH
T1DBB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fe62fac80c2026f56f6b6756716bf1bef71a0e8178b9b3fb1d1b55e12f09c454
MD5 a96a9b732fa753a256ef8f16434bb382
SHA1 c1fe3cc4c493f2b7b156d67c141ba260fffb7334
SHA512 884a0e48d0c9e28f821bc10eaba4603960fa59ccac9ea0204b686fbaa5d845a8eec0f5624c3d55550a2ca0bcac1a68a20014ef6153223670d81f9a52d7f17e3f
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:Ry5112gYy5azzVvL69nLKnhZEYPKES
TLSH
T1BC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2613a155cc7023947c3343872cd6fcbe0f038915cb619bf4296e5c00b7cdecd9
MD5 e8084ef7bd6a5075933537a443fb9330
SHA1 b59b692b3f56a0025563e482b0e732d33b7dd777
SHA512 0b058090048f65e5a906edafeead504cf1e48e96a714ec4e409a3e2833dfd22b4addd62a26e478a80c6c7cb18752ddc44528086a2a00ca403bf4624beb1d4911
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZYPKEnSG:6u6JmVxd2dZYPKES
TLSH
T150D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f6c69c371ad2b3164c0b185acf0ffe941cf2ebe0b3ab6393d390cd74da001bce
MD5 9e4ccfb0e2a6c2372b2a52aab147bede
SHA1 f39011b18644010a81973a52592ad978c66cd443
SHA512 699c115df71a5df584eeed67f11bee439531e0f353816611a3a616dfc7f92e13891bced7671def3b4eef66377de60a35a9bbd2fabcb9df392452912f62c9760c
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xNYPKEnSG:PmifPbRaYPKES
TLSH
T1C4B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 774ca55287e002a582973e3cb676fc33c2524a8b3205c8e9dccb13d989326b26
MD5 a0278135000d4d07c0ed07c819a238dd
SHA1 6b4bc7adca3eac8bcdc6d28c25d059470a9ae280
SHA512 bb1e86c569c1d7e1b1e80bfcc538c902671d4b9d5442eadfe5edd5a8b9d0499dbf65dc12c2d40222a772ffd2b9447063a2360182ad94531be03bb3bdbc6c98ca
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqwYPKEnSG:X5dKTi61wYPKES
TLSH
T1C9C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 810cd31c5ba14dc565ab8179d910e780fbaf8b07c58e3eae2cd11c7106617678
MD5 0ee7dc2e28bd44b1397e31bf7a4ebf39
SHA1 6c084cd74a59d5b2d2aea782e8d6a68ab3da1cc8
SHA512 45a3d35cf3aaf748a4f766622ea25ddf8bf45ff3b8959bbbc530070b79b960ef3092c889f2b84d1c6155d6cf2a3b71a45e610d221706d4c392daa69226592bef
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wJYPKEnSG:wX2iyphuYPKES
TLSH
T1A995BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 2da20c630d7280914c288a0310177c0c5003ab988a733f458fffb1b4739b2c0d
MD5 6bbcd2de33111c34a40e2972d6f49539
SHA1 e7b5e3c0dc75ff1c94999223f0985e6cb986a223
SHA512 4ef43ff1d951a62b1d6cad759672ee419a98ee8916df2337df0eb09a5e4d0af85be370d83170c8b317533501f0cae40ec07401d1e7ba317a21781214dc6ed7b6
SSDEEP 12288:MYS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkA:M8Yz7KEMdX6keYnAcert
TLSH
T1FB652304895B8AD2F84A467BFFF04540C93A6ECB3B8C93A5DE4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 52348ddd545f4abd82632ec7650295b309a7eea334c65988104c01cbec1e969d
MD5 92d0405ba64a2f44f34668fa408c01aa
SHA1 f221298909d68ad0715a8c95f3f4ff1d4e6f870f
SHA512 73b5771f1bd7882d0fc20451b2316129a40c80ac1601d48a830d90a708112fa4ee15e83a622b14373c78c85ba670b006d3b77e2425a2bff6c469b4cdd262c915
SSDEEP 12288:MxS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:MvYz7KEMdX6keYnAcerE
TLSH
T12D652304895B8AD2F84A467BFFB14540C93A6ECB3B8C93A5DD4CF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 c0ae3699cb85192a4adaf5cab41331ed856ef43737af9fd7748572edb5aa6c15
MD5 a76f217feafd1d3fe11ca9c9521a0b4d
SHA1 f73f4aee4f4c230aec680ca70f6cafe50d0d87a0
SHA512 5629a83ab0c10dca2064b4f6d4e0b5af5e6f7cc0a74125590b117db734389addab3705349609fea3a4686efcadfcbbaf857b81ab6b5257be25cc8b3434bd42a2
SSDEEP 12288:4bS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:4FYz7KEMdX6keYnAcerL
TLSH
T14F6523048D1B8AC2F84A467BFBB14540C93A6ECB3B8C93A5DD4DF50297FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ba5741d6c44945a5bd637a5a3f1b8801a5a676b85781ff96d8a635f658ffc4f4
MD5 e7a504a7cf93e541257e14f4c246cde2
SHA1 524602826588f440d194c7b77c95513624d513ec
SHA512 74ba73fed6598ef821decc9556d1f8d5504720ff4481de22ae77132eaf58d4ebb88c39bd2b55970f313d722d43222086ba36c3a88ef3dfe55ebf876aee495847
SSDEEP 12288:mVyS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:LYz7KEMdX6keYnAcerI
TLSH
T1DC7523045B5B45C2F85AC27BFEB18500D6767DC63B2893EFCE08A5424FBE3615824B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 807e4fbba847793d90259435af4dd1e316aacd7cfa8ebf1ace9a87696ad654be
MD5 2c87184b58a824139cacc18aaea6debe
SHA1 f1db98769551bda272360a8f16bab6bec4f2c5b3
SHA512 e95456d6c268406866e1ee41631ac373a221793681ef80794aea0eb23c21deb042251b80f1719280925745e42fef06003abda663a7dc17014e9d0b5183e53d88
SSDEEP 12288:dKS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkI:diYz7KEMdX6keYnAcer9
TLSH
T19A652304891B8AC2F84A467BFFB14540C93A6ECB3B8C93A5DD4DF50297FE6224505BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ab97c2e121960901f997868af1ceaf6cfc51f0dba30cfeb81f8d59b9634cd2bf
MD5 9acab644783cb1f454d896f317052e9e
SHA1 3f0bb94f982c869bc3698ae697ff24a209b1d678
SHA512 ee1e1dc9178f8b0099391ae2071105b938fdebf1e4b8132b7c2e6c7fdc9f1fbc6013829ec7cc4c2d577ac6bbf5b993c25450d995f1ec4204ee0d54a7df05efdf
SSDEEP 12288:WlS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:WLYz7KEMdX6keYnAcerk
TLSH
T12D652304891B8AD2F84A467BFFB14540C93A6ECB3B8C93A5DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 5cb985a14304f6ab2ecdf6edec38a7b3d5ec67eeafce56d03a334ff1dc8149e3
MD5 4c0fef1ef55809345fd71b3692fc0b9e
SHA1 dad941fbcca6beddd9a4e154c2d4201c7feacf8f
SHA512 31e733c0f6daf9afe17c5624fdc94a7af017a99d5c6fdb172f9dc3dedd4afc781bc44df16ce0a8a4a6bc79df3a4c91cbbf859b5f2dee2f4ea938aa12571c4f16
SSDEEP 12288:0pS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkH:0XYz7KEMdX6keYnAcery
TLSH
T1FB6523048D5B8AD2F84A427BFFA04540C53A6ECB3B8C93A5DD4DF54293FE6324505BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6c43179f12cf731e0679b6e91ca3cd38da8fc07ec65fe34992a8482ba824e248
MD5 35c648ec94f4dad9689266d43bfa493b
SHA1 2dbc351a906ed5a7c28ab81c6e2c7b24fa7b1947
SHA512 6f3bf210f3d4f92060eff54c1019625ebf1f0a88df1a320dd5f46dc37272427049eddcad20310140aa3af5885090d90aa9e56b92931398767dea0fcd1dd6f1d6
SSDEEP 12288:piZwbHzzFEoS2cPvyRS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:sZMTzFVSOPYz7KEMdX6keYnAcerf
TLSH
T191850194B3900CF0EC67823ECD658905D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 2b36f75bb8418cd4d04dbc07de96a104ed60b81b716213d9be883695f7b92896
MD5 ff8f22bf5a65c1a2b0c0f06ec6225ba6
SHA1 cdb682cd7b9ad2e060d42eb4840179d5bbeb27e6
SHA512 720c0a1cba588e31a608cf93a1106be6caac4d8c7512f11b7027751485f6548b16cad7491122d5fc2178294365fc4f596ed49f3aada6c6ae6824531b4ec7eabc
SSDEEP 12288:j0S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkM:jgYz7KEMdX6keYnAcerl
TLSH
T105652308891B8AD2F84A467BFBB14540C93A6ECB3B8C93E5DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 3d6653fac78962ed74552af62e78635bb49ea6646a706817525fc7a5136b14e3
MD5 ddd845960912fc0131eea9ba28615f65
SHA1 2267f209f70dc0dadf54505fae5139c7c638bf1f
SHA512 51cafb4ea8b3fe6d77c3960af0dfc905d4f15d83cbccd615687fcb938743e5f27e567e3394fff48fd0ffdcf728ed13734971aa0d683a488984456809ab689939
SSDEEP 12288:XAS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:X0Yz7KEMdX6keYnAcerc
TLSH
T146652304895B8AD2F84A427BFFA04540C93A6ECB3B8C93A5DD4DF54293FE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 206f5dbdabe7a50cd0a7897d9d32c204eca09a33a09c9de13aedb42ead22aecb
MD5 4e8772dc6845b776d25b56926dfe7357
SHA1 0885435d956d4a93b805e5457fea9f9d948cfd4f
SHA512 b3124293745b26b4a6dd108760805483221e40f0c16c530ed3a70d3a463a6c5788895ca88ea12b6848ee7188edc858b9dfd54e639cc83236bac49ffcdd77b4a2
SSDEEP 12288:IyPz5L8NS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkH:JzyDYz7KEMdX6keYnAcer+
TLSH
T1F575120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 3affe4df2ed4cf70f7860b61ff6c6ab4df8358f449bf4a059a0748cf1e01e5b4
MD5 f5f09879467b3fd8109b999ec3c618fd
SHA1 b63fee678bc97d2af02b3c9bbefae9ac3ff0d7ee
SHA512 a3b8aaabf50ee6ce61b2d8e377acdc976bfe4ea613e6ab94d87dc403cfd682a292ad414242685ee090dedddfcfd13671d5e01fd81f0aad3173f10084c3fe0ea2
SSDEEP 12288:p0S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:pgYz7KEMdX6keYnAcerC
TLSH
T118652308891B8AC2F84A467BFFB14540C93A6ECB3B8C93E5DD4DF50297FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 61c0d7f6c27f44fe7dc784af71d8a2dfef7888fa26f8847282354d04d9aee4cf
MD5 b769b523a04d9930af9dd50a68a52c61
SHA1 1026744fbb8ba6db91a3a60667c798d6fa190bb0
SHA512 116fe99e76faadff458f25a6cefebae812218e323eded586e0e5dfc6ead5646cb2f65d856aa02a360ea492c4813dee0f7ddc822247c38a581e2bf60c208daa2e
SSDEEP 12288:O0S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk0:OgYz7KEMdX6keYnAcerp
TLSH
T11D652308891B8AC2F84A467BFFA14540C93A6ECB3B8C93E5DD4DF50297FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9a96b88129fd1e4f382e8d8aff860fd331bc67ca48283bbe4cbe6a7bea6bac73
MD5 831e7b5fc5bab784ab2551b350ee2d9d
SHA1 2d8b9225a59be04ebc8fc8773cc9ddc70160b4b0
SHA512 2b958c1f6c5c8d6744fa365e346177736c0a39680564829ad8c8ae9c981f0c77010f47d848a6f2083b9fcc93e39d8e3c8932311cb57234ecc65fa868661e02b9
SSDEEP 12288:4yPz5L8NS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:ZzyDYz7KEMdX6keYnAcerM
TLSH
T10475120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f27e86e6bcec8015312d802231a8747a8b64dafb3857948dff33416cae2885f6
MD5 b54c729242b41f45bc07e138ae0a4293
SHA1 73faf94e5ae562e308a5fa19cf32f67023275bf0
SHA512 98417680e1f40d6e9c71ec156c4f56c60d27107cdf1b15674af84a48b3891610b73d4fc93aeec2588b80a79ae58569bddfff856f796e834d69085abac37f3954
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBoYz7KEMdX6keYnAcerI:CP4m4IpOO67W8KGYPKEnSG
TLSH
T16265BE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D3F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 fa50076d96fbf4c7a48d31dd66581f579cb2abd3fb88b04052cd454290cf2e80
MD5 b23e7112d68549cbbf4e4caebcb1b368
SHA1 74624d07dd5cf7effc4df629cbb34cb70082dcac
SHA512 c47723bf887d7975e43a3227d855cb1513663e0717a5fa3164689f2e71f9dd142e45820fdc7980a50efeefcf6621621866c4b2950521c49720bc687d39f64602
SSDEEP 12288:MzsfES45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:LwYz7KEMdX6keYnAcerx
TLSH
T1D6750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 99d6e93bee68a913e34cf30c47108d90327e7f525978b94eb20f9345367a3d21
MD5 936952a6a8e2e1ae9f49a5d6c9214000
SHA1 99b73f88ead283f27fd30f3586a1498ea9e44b45
SHA512 017449c047e0218161b4ec2535a68bfdf1ed0b98f3a7e57258ee619fb79531c65f43b85a1c2fe9d497bfef3df576eccc1fadcced1e474214d99cc0d910362eea
SSDEEP 12288:MkS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:MQYz7KEMdX6keYnAcerY
TLSH
T1027523048B5E89C3F46A4677BAB58410953F7EDA2F48C2D7E90CB24293BD6628C2571F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0af9982867d92298758dbadd7b0d6a81776be8cb2095fc511b92e60400829079
MD5 daca72ea9a939875645573c6e8332cca
SHA1 9f8a0a37aab98749e79c457a0a4b13b1bfdde710
SHA512 0cacbb21e4d1134d6054c5dc6b3cbd3f7ad664193138a6f325bada8c7b60d220d0f469864135e1cd6231cee41e2a73cd0ee6e2c02353097d0dd8b3da5f40cb9f
SSDEEP 24576:PoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bWYz7KY:Pa0h2GEkuAe73q3pp46zwwQiYPKEnSG
TLSH
T13A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 2843422b274e5c488250002953f15b545ff70551a9d02eb9bd465db2a9b26d23
MD5 192a410b195bf21070e9543a30233cf6
SHA1 64e8326850ec1cb97ee650e516b30db880c8c3cd
SHA512 336739826d6e4b97d582ccadeea141c8b4678313f30ab33210481d0e489bc887a832e8ef2d93dde3b0b5c659f388a153104410b7ef684012b0f108f096c84a84
SSDEEP 12288:YhbHjfXBS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:YhbHjP/Yz7KEMdX6keYnAcer+
TLSH
T1A275123D16AD10D1F476927EAAA18506C332BC662B1493EF56C5C27A4F3BEE40C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e600e883abe7f247c33c039c2981722bbc183d4969f8401e1e5344b6283ebb76
MD5 3108c610e2d5a621909442697353ac3d
SHA1 f0f5050713420e30ffc679d6998e0cd139e6cb04
SHA512 afe982a4d5d82674809cea1cccd31f6421029e2e5cc61c9acf806317cbcf9980fa15f9bdaa1f0e40ae6af8d05e2c189dad0ecf7d6c09a6bc012bed801224c603
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/HYz7KEMdX6keYnAcerb:bIgnaTk46pBR/HYPKEnSG
TLSH
T19D45BF2DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 dcf2a6f23f70fbf8102b2941362c80b7e09d50f0cabc8035efeed46ae732cbb0
MD5 db92df9cdc1684bc75c58de1d51afe23
SHA1 f81f15dbf824111ca3221ea57a9b1e7d44c4b841
SHA512 fcf59855baabc2f88fc3067a637ff8a04235b5962ec10f1cf84390c56e3adfd0a9c8ece53a264b6b795eb35c6eab87763af29ea46064f1ad7de1a5f352df88a2
SSDEEP 12288:owS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:okYz7KEMdX6keYnAcer8
TLSH
T1236523088A0B8AC2F85A467BFFA1850085366EC63B5C53E3D84DF54293BE6F2453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 402574c7dc7d70fdea4ab7281cea2ec6ecc0f58f32c05d95eb578fa0ccfd82f5
MD5 4f20ee1f5c2a1e71d5caca28e8853b13
SHA1 4f9632f4bc5d37f27836edadec013f7b3ea90313
SHA512 b04e1854dd0374875945db70eebb2bc50328fce099ff19a10d5ae51461f404b9df1e87302f483d835e2590e58d293a5f2d8952b4218cfdb154d998bd3626d5ce
SSDEEP 12288:uObMA4LWOsvAYFTXS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkC:XML3UTJYz7KEMdX6keYnAcerX
TLSH
T13C950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 178fadb3c232b6a05a92515d7a71dc8da2ddf966496a411528daeca8f70d06ab
MD5 d39625736bfcf2a55dd671201aae8ddf
SHA1 6d05437dc1a783e2532b116ad27c720b0e138608
SHA512 66e81e39af8307d2c851aec3817e458087c8077c97575a91595f51ea98d331277a68c6e465aabe052f6b49d8793109f9e6cf41d984680a0d55ff6bb689556cc5
SSDEEP 12288:dpFtOOTS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkC:qONYz7KEMdX6keYnAcerD
TLSH
T15475121937ED10E1E47A913EDA928209D372B8A61B1153EF46C0C16A4FB7FF85C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 382309fc5401404d3f88f52ff2a25014cac3884ec19940c376be0272a06c88da
MD5 15fbc014d9d20a7dd8919e2023445198
SHA1 49aa84c948b567d1c008a736d0631320e5403f76
SHA512 0fa7161686ccdc9673b9261f149434019299f931d337c9f46ba77e634a70517bc7ffe83375f088861fc4b78d4b2567fa4399f8b766214be97b4231317eefaf7e
SSDEEP 24576:f7NM9YqZqmWMUkPjZM48Mv6bEhsgYz7KEMdX6keYnAcerP:f7cBWMpPjN8DbEhfYPKEnSG
TLSH
T1F065AE2E6BAC81E5D477D13DC9E28205F6B2B4611B318ACB5152833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6082f668bf8e664519c1425b03f710bd585e0d10536a3039ccc44d585d7b46a4
MD5 dcdc4d91454fb2c928268fff750db279
SHA1 7e4a64fe72a1c4b6d61d783c0154dce22b343193
SHA512 783af739382e9202b4ed8fd9c23a0902e2802fde322d997b8c681427105a9b27870a6cbbc3f7f03545b3f5f13f0ee8a92e457b5507cdc9b56d7e5067ab566358
SSDEEP 24576:jW6BApg2YuyuNDYTabvcdvNYf8km1+Yz7KEMdX6keYnAcero:jF2YuHNETovAvNYf8kmAYPKEnSG
TLSH
T17B858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5975e3623fbe53276a605de2abc48fa34b387b0f0da2707cc22c55df21064618
MD5 94d05cb18e0fafc68954c6494830ca63
SHA1 7c9a53696717e11fa2f5caf30283749789ebbbcf
SHA512 fb55032ab35d4a29a57b67dd739d7377eff113fc707d381081539d773644d88380ace4b349d1cfadda8bbc73972e7ea287c90bad191d9c7294082822b0844de4
SSDEEP 24576:2AFs06+Omlf3NXEbToBYz7KEMdX6keYnAcerP:fFs060lVXuCYPKEnSG
TLSH
T18B65BF2F66AC00D5D07ED17E8A97C91AF6B1746307255ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 94a43d18ab3f744dbd357be5352cfe825de30234e3ee149103c574175b51c64c
MD5 259357b62406a01600d0348d63577e5e
SHA1 0068304cf22d288ebb7ca27e02297c74e5f291d5
SHA512 14153b17ae9f91373a1b0a4dca44e02d78c801fa134e50004f8b5fc6ad3009eaaf88722b8353e9281841e06fdc4cc61a2f5fc868f623bc84282eff314ad88375
SSDEEP 12288:KCJnJ5D3VkrmzxUS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:LJnJ5D3WOCYz7KEMdX6keYnAcers
TLSH
T13D85D02DD2A810E4E4B7C274829A1745FF72386D2F226AC728B4D5353F16FE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 988e7f20f51903859bfb2372b23fdfd120736134983c492019f46d82d826117d
MD5 6807dc8d1212f2023b907c508176b456
SHA1 9ad0970eee2525734278d7bc199b2cede2402243
SHA512 32981dad5f37bad10b03a902058f9865f1b6d32f1dda7aaeeacbad6d3f0cf900f84fa5a3a5c6e981b2eaf96ad4bc99bee93581c1e24186c1ad61efed8587870a
SSDEEP 24576:dEPghm6/7IIXdwcXrif7qQncjlP65i3VuHYz7KEMdX6keYnAcerL:qg06DIKdwc+eQnSt65aV8YPKEnSG
TLSH
T15B956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 41af7daf7ccc5e262bcf609aa3aff18d12f2cc4b9fcd703f6c735879c32088b8
MD5 57d892c3b5370ce47fbe03b43804144c
SHA1 2bc8c189a33d08ea8148cbadb3fbf9dd3fd3fc7f
SHA512 2533d97e60e86a315a5f6c8f05b57b06469cee5280f4f4a9fe4003f1ffcf636b20861ecc4ddbce1f471c62894e8422572dd103b2946e53f53c3138a41e62dc21
SSDEEP 12288:/EP3RGmS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:EG2Yz7KEMdX6keYnAcerW
TLSH
T1A475121D2B9D60E1E42A913EEAA18500C372F0A12B5163EF56D4C23E8F7BAF51D3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 336d2d22827e876debdb929a25b70265e8b20b09b6f5a0f05dc01db5218b4599
MD5 deeb5eabac404b3052564f6a8168344c
SHA1 339d35ef4d515120545c736bcdf87ef042201d69
SHA512 a9b589d2871721b273cfa2bda4d30821a14ed33c2fa3d7250858080794ebd7ae8c145434d9ede515be60a9cad997c28bb46456e2613d670ee5478597eabfbe15
SSDEEP 12288:ijkyxS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:iIyvYz7KEMdX6keYnAcerc
TLSH
T1D5751204539855C1F8BA4639EAB28190CA35BC612F2493EF9484F63F6F7BBE05C34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 bac043baa49b8359ae8c8635f6bf5f585086143262a010271ed428ea38ef2d12
MD5 2340dc0eeb11ab111654091608c58a89
SHA1 9b8044cdaaa7aac76a5b30c9ca29a410e64581a9
SHA512 a07225a20eced149f9a81dc2aa4c4b3084bf4c8535fa6a42eddcd1c00c728cb194b93c7cae5d4809a2048ed45c46c39d547bfd5d889da3f83ce599a330974a24
SSDEEP 12288:kQDS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:T9Yz7KEMdX6keYnAcerN
TLSH
T17C65230C461B59C2F81A427BFBB14940853679D63B4862FB98CCF162C7BF6A24435F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 afb907fb8c21dd4f961e022be75c181332ac787c22125178bed89589d021ef23
MD5 64b1e3eee384e8de9d96204eec32ecf3
SHA1 45bc1b63dedf09d3cdf540b119b15c24c5480e29
SHA512 e3928df8e6eee023c1a4e6fb23427686ca34b8ea769bca46e449380ed9812049ec04c63cc6e3a5cbd9faf6ccfb7b0722531b434821e6761192577771fbcd829d
SSDEEP 24576:KQ9MxZKdcz9dw34Yz7KEMdX6keYnAcerd:KVKZ4YPKEnSG
TLSH
T12D558C2DABE9058AE177D27595A240C3A633B4311B35D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 2ba2b11a6da6eb4550acde14108a676ac6e6963d08040de81585865b4df405e1
MD5 27b08f2b7262f44b3754bbd298b537cf
SHA1 8112bf80925f91ab58f21f70dd625157fd73ecca
SHA512 9afc1a2b94ebd22e631572b2110015bfc298fa818269842a94e4933e91859b16cde5d06dd5ef2de76eb3d296b27d2a1f94f667c52c70d84eea96f21c8673af81
SSDEEP 12288:tyoKo2oRple9pdS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:tyocOApTYz7KEMdX6keYnAcer3
TLSH
T11E85E01FBB6E40E2E066813C89858745E773B0702B6253DB5581C33E8F67AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f605c77f632c3043e650cbc03bf146cf68b8b28bc177dea483c44cb4f7b2d85c
MD5 86cf93ea860eb9538d248feb655962f7
SHA1 41772e3c7550eb8d0d6fa61354bd07cb2e90767a
SHA512 4d6a6a2e6850e1185b6a63c800fafc4cacdfc9fb492a1bf4332d058b3094d427a8a7ee92ceaee4a6073d985cd072c3050e7b0f0cbb7098009ce64c3becdd8e21
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKTYPKEnSG:00zuNIJYPKES
TLSH
T165A57C3DA2BC00A9D8AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b8bb664050c136099b68cafcd3e07afb2086b009ed4d99f9d88754487ede6909
MD5 d5a0ad4768bb4af73ab3423022ba73bc
SHA1 3916a5a55acf8d6691e4b62f1f06e7128bb601a3
SHA512 ce3c8140c537aa714b6fecd1063e810377ac185dc2d08bf49fd0f8dcfaed16d0ae1827bad1be7e6314a137186d5f122272a6c5a72da3e6f6a2fb229cde95a617
SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYtjMqb2Yz7KEMdX6keYnAcer8:dTDxR+N5YzTfjMtYPKEnSG
TLSH
T19F55B02EA7F905E5D1BE85799A23C502FA727861033193CB42A0C17E1F7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 7be988293633e51e705c77f1509ffa975ddc4381266d2319cf636d862f53a6af
MD5 5ed8a2f32997f931d5491cc50f59165a
SHA1 108ccbcab87dc3e3504c8ad187d384f5b808156c
SHA512 64f3a58b45d44e48d01643b9cb8069cf3bcdc91909353a1369318b01ac5732f646506ec0efa921caf5e7c76f9c265a43d14ff7d7ca2ed58e1b95e3d744376489
SSDEEP 24576:eTMdOz0FFS+RmSLaYz7KEMdX6keYnAcerS:q0K+RmSLaYPKEnSG
TLSH
T15585F13EA36D14E5E47BC27DDA538906E67234660321A6DB06D0C1792FABFE43939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 3896db34d294dbfe41986b804718803ab2c0f1ebe1c87e29bbf96c998a763b81
MD5 b70c7e76f0253b0c56c5708e56708350
SHA1 69a01acff5e4b64c38df1d3bf498a6c4ee52ec36
SHA512 282a73b912313e1671ed2c703da2d6e2f04076d77cc1b28dfda912a64cf4b26eca217969ff644e23f29e611381d8247f43200da2a26c212d2e902db59bee1c7d
SSDEEP 12288:d4/XS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:UJYz7KEMdX6keYnAcero
TLSH
T10E75120C17ED24D1F466823AEB764101C631BCA6272857FF38C8D5768F7BAE18939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-197-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1088-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1124-79-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1124-73-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1124-192-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1364-356-0x0000000001370000-0x000000000149A000-memory.dmp

Download

memory/1364-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1364-409-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1364-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1364-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2120-195-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/2120-101-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/2120-96-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/2476-92-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2476-193-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/2476-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2480-8-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/2480-305-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/2480-1-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/2480-353-0x00000000008F0000-0x0000000000986000-memory.dmp

Download

memory/2480-0-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/2700-386-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-383-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-359-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-361-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-360-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-362-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-363-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-364-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-366-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-369-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-370-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-372-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-371-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-368-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-367-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-365-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-373-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-374-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-375-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-378-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-377-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-376-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-379-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-380-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-384-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-358-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-385-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-388-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-387-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-357-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-382-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-381-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-389-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-390-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-391-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2700-392-0x000001FD43D10000-0x000001FD43D20000-memory.dmp

Download

memory/2888-129-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2888-123-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2888-201-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2968-238-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3396-241-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3436-198-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4012-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-68-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4012-67-0x0000000001590000-0x00000000016BA000-memory.dmp

Download

memory/4012-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4116-12-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4116-348-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4336-196-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4388-38-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4388-408-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-355-0x0000000000740000-0x000000000086A000-memory.dmp

Download

memory/4388-32-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4476-42-0x0000000000890000-0x00000000009BA000-memory.dmp

Download

memory/4476-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4476-43-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4560-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4560-24-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4560-352-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4560-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4588-246-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4628-244-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4736-199-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4736-112-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4736-118-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4804-243-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4860-136-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4928-239-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4952-165-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4952-149-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4952-185-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4952-245-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4952-350-0x000000000CA00000-0x000000000CA08000-memory.dmp

Download

memory/4952-426-0x0000000140000000-0x0000000140179000-memory.dmp

Download