98d3163c46a5fdc47ac8a31d82c5556a7e2a0203baab1d5bbf3cac5b57716d67

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260804-sa6mlagr21
SHA256 98d3163c46a5fdc47ac8a31d82c5556a7e2a0203baab1d5bbf3cac5b57716d67
MD5 9384415a14d4fa609cbec211c660aeda
SHA1 d8ff38123fbe2b865eda3ad33000612446a1711c
SHA512 c055e325213080c8ceeae6f96e73d3ed49a786b118dec0b214241871ccd2832e862f4e7846fc431f2b44e5ad7a233a39a0785e2d07abd3891ab8a2dbd06f5d69
SSDEEP 24576:aVGGTWBZIVukHvWx6T0zViHj+ZtW0I3ti8Zh:WGyWBZIfVTBHYMZ
TLSH
T1A365022232C0C4B7E9A3153059B0DA71693EFE705FB0498B6388676E5D707E2493AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4380	alg.exe
4304	DiagnosticsHub.StandardCollector.Service.exe
2424	fxssvc.exe
1364	elevation_service.exe
4020	elevation_service.exe
3372	maintenanceservice.exe
4420	msdtc.exe
732	OSE.EXE
4152	PerceptionSimulationService.exe
392	perfhost.exe
2688	locator.exe
3948	SensorDataService.exe
4344	snmptrap.exe
2540	spectrum.exe
5056	ssh-agent.exe
4312	TieringEngineService.exe
3396	AgentService.exe
5068	vds.exe
4104	vssvc.exe
1212	wbengine.exe
3912	WmiApSrv.exe
404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b4b3a106a19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e6a5712124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a9be0722124dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000453984742124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000844a10732124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e77f00722124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a494e732124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076eeb0722124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	2424	fxssvc.exe
Token: SeRestorePrivilege	4312	TieringEngineService.exe
Token: SeManageVolumePrivilege	4312	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3396	AgentService.exe
Token: SeBackupPrivilege	4104	vssvc.exe
Token: SeRestorePrivilege	4104	vssvc.exe
Token: SeAuditPrivilege	4104	vssvc.exe
Token: SeBackupPrivilege	1212	wbengine.exe
Token: SeRestorePrivilege	1212	wbengine.exe
Token: SeSecurityPrivilege	1212	wbengine.exe
Token: 33	404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	404	SearchIndexer.exe
Token: SeDebugPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1524	2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4380	alg.exe
Token: SeDebugPrivilege	4380	alg.exe
Token: SeDebugPrivilege	4380	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4200	404	SearchIndexer.exe	112
PID 404 wrote to memory of 3876	404	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9384415a14d4fa609cbec211c660aeda_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1904

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:392

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4200
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2009cb990569fb750e2d12737b360f7dad007a5a774af71f5af469512cf2731e
MD5 0ded4f677ca1c956e1dc59b15e802969
SHA1 70f6e3f3a17f525d7ce2bb4cfd157546dd14225e
SHA512 71a167b41a7d3eaf5ed1398fc4cde05f130cf18b967c338ce4e7d39bb454b23ba4cb8722335ce62f7c234f5bbeb94fc3d6dc291736518fbc9d1fcf3afe5af632
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBfVTBHYMZ:53q6mjBQVmi
TLSH
T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3f2d313fcb6d1ff85c20f2722670174f289e80528560c55698255fc6375cbd11
MD5 564f387c5f4b1d3d0b46bddfa0ca3e68
SHA1 111e160f86f4798715d91a8d50b6e02a333a94f3
SHA512 1d1416438dd4a35a0263125fecf4adc931efe68a92f83d4d227d5f06f052a5a074c1ca8f7810501a79cb3a9be7a6950731bd990d368ac38ac1b9e05e64ac2ac7
SSDEEP 24576:IXYfDtczAMVukHvWx6T0zViHj+ZtW0I3ti8Zh:ftcTfVTBHYMZ
TLSH
T13E75F12963D408F9EDA7417CCCB28511E673BC9183A0E78B03A4A5695F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 13bbe9c16049ccea23d59649858d28ae424cc56cde67ec8e09950f0b7f55000a
MD5 4dc576a07e99669ff0f4735ca9805bad
SHA1 f5687d0166ec1f40565eb2cb36a067771c89c842
SHA512 314258ddfb724c6c16f61843254588c7c8ae55af1390cc6a6dac59f810e939008979c8572b02ad34b2ff32ee165eed68a41cd8e4bb4fd3ee24fdb2d52d93f04d
SSDEEP 24576:30Le5ji0hmxNrM5VukHvWx6T0zViHj+ZtW0I3ti8Zh:3Pji0AHSfVTBHYMZ
TLSH
T180959E16F6748335D073C0B9C5D2A69AED72308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39b7b38af5943d9258a10992136223a75e06a22bfc78637fe88bbb36c88b0879
MD5 62296c8bac77a53e196734edae9db440
SHA1 1005a245726bc89db14f7db26adef0c196101f23
SHA512 c9517e792600dd36404dda5114031ca9259bf922c94d97f683034b641dd3a60e52390c4aac0dadb02c40f1a56046402880e1876ac778bd37c3c7369da57161db
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyujVukHvWx6T0zViHj+ZtW0I3ti8Zh:+/ezSC6vUzPv+Hjy+fVTBHYMZ
TLSH
T103755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b4407cb7348099dfaa4ac772bf97c4d4b81d2c5d0d717e1bb4339677273aaf66
MD5 f8c0e24b806a7b7a188fdbeda0cbe385
SHA1 1e8b4f9c2a49049b15314f5f6562a42aaa6ba5d8
SHA512 656762a8b62ae20fa4b39b0f345286a1307bfefd1c4b1424a2a63c4c1c4c90b44d12e1b62a7c6ec3bc0a4f5c197e0a3843dbdb22b3e98029980b9c575004a892
SSDEEP 24576:EVbqPb88hv/l+BgVukHvWx6T0zViHj+ZtW0I3ti8Zh:EVO88hXl+yfVTBHYMZ
TLSH
T102559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 c8d74d3db2ceca118726fa97270d5ca5cd34613e7f61fb27f45983e8d385e928
MD5 f8b3cb614b23c0dab112d4aa9c5d90de
SHA1 bdf6a28d7021018975e301de78129ac1f4e4f6bb
SHA512 f3af9e73ab3e866f9afaaae50a8f8c1c5a0f4b267c735cbfdb45b6f9f34619d77a6c6ce98c5a837a418f0c295cba081d0037dc3fb5da57124e815b52b15a1799
SSDEEP 12288:cz9vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:cz9VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T10E55232F058884E9FBE70174A872AE916477FDF1E1E045068908F6DC447AB7A85BF837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 cb9acb506130f25e8667564c052e7b494323f4b159e6b734464062cda9a53030
MD5 e5bf594b3608ab554f3a0e7a385167e7
SHA1 219031d51fc8fb43d4cffc4c300f7413829764dc
SHA512 78e8164052e390eebae7319b1dd6e97117be5441ce3f9ccc2ae30ac138f535f2e329f67e04be938252ea089405f9db2e9aada4dae7bee67e51aa3dd3b18d9320
SSDEEP 24576:SJIUYVukHvWx6T0zViHj+ZtW0I3ti8Zh:SJIUYfVTBHYMZ
TLSH
T1DA75CF3BAE28FCE2C27A4DB85A91C740D77278704B6193CBD164C24EDE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1036e6f8283d62f37474964b7e2cc35f924edddb9d2055eb7da446361200f727
MD5 5433dab0fdbc22b2dd1499271ad5487e
SHA1 c2865af32b27913087ae957cc6f870e9dd2131e2
SHA512 db1fb37dddaee8ba5735d2de3b0a1872c44638d807da3f71175489307e5a2a8f990954647ce62a0fd5eb44d083d79f130b39432c5dc5bbb42785f828c6bde7c7
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THQ:AQvGAdlCEL8c/WRNw5CTVmi
TLSH
T167267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7a67532f601555f6e61ece6a333d2bb05fdbf0256a9e47252dad90bd45284fe8
MD5 4ab20e3053449dcb5cd1e6dfbca0683d
SHA1 34a8f0da59a7bb5dbde8933363d495ed4bf5c542
SHA512 fac5a0fca31dacf3abdb01d77ae4d8f1e4f313468adf739daf2795fb8650819acb2e7ae1643cb4f9670b8f505edfe489f01f22c7f35f6493fed8afbd4bc7b10a
SSDEEP 24576:jTewsAjiVukHvWx6T0zViHj+ZtW0I3ti8Zh:fljifVTBHYMZ
TLSH
T14575E031FA74D036C7BB0DB61B36D716143DB9604BA11AC3E3A89E9D49702D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dad286aecf1e3798da8acee501418b7b50928eab30fa6825175ccd2c3e7d459e
MD5 82ff991549b2e2986ab7879ce12251bc
SHA1 b2df81a770a12190462f3f821ef7dc2298bb874d
SHA512 9a07174f711971b70d5841be73ebc9f8cde8e08310f95c30a9d8debbd32eb9060725704afb8728f16c7d7c7a9802de0baa8a15be7ccfa83e5b65b6f91001b21a
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHi:PUEtQevvqc2W1cpV20I32
TLSH
T14C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cafaecfbb122ac46128c7253ad10664a48938a4e1e0c6a06af21941375e7612c
MD5 df5106f9c7a86caf4fd52360a38778b2
SHA1 b5758d908e8a53656ea260e7b6071517476eea82
SHA512 e1b78e83f102cbbf58a40929efd1b0693c9e2cdeac6769b5bcb575655f9e705f235d5a60afc46392162060650cf46406fb598b9129c2ec5d09e209c463d5af5b
SSDEEP 49152:rCbRquA/m2yL5zTfFiV+XenmE3/zCfVTBHYMZ:0oquVjnmHVmi
TLSH
T1C5D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e03f57b28bc84f70d49e68ff959ed388126ff314b634aac4a1c54715ed34005d
MD5 747a9d64e588dc089d3611d4fb4d1b34
SHA1 64c72a248bf57eadc633a92f7b9c98135d70688d
SHA512 4278d7eadea57a3f509ee54c3421e1a695539c9891f3cc7cebd21d657e67947ca5fac77f42250e23f4a602010a07e398e0ef9d37fa92704acd6003d502e5f671
SSDEEP 24576:fAhGL6IFoiwtA5l7S53/VukHvWx6T0zViHj+ZtW0I3ti8Zh:fAM5Foiq5vfVTBHYMZ
TLSH
T145359C81E7F945D4F5F3AAB899B69570EA76BCA65E30C20F2150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ffc53b5f9b1cba57991b7bcb949c3afe13adb55c8cc2cef19351a0c21422f418
MD5 c6d6394bf07dc933d4ffee5b062b14fc
SHA1 083fe12c942e94a6bbedd12147444397c99e4330
SHA512 cc02bdff868984dccbee6cef0ea38fb4a928810f9359b7845535f9189203386c5cbdc5b93e5797cf867ed14a31081479ce6ae4eb43426f22efb5ddd6f9482989
SSDEEP 24576:MwuNOWeVukHvWx6T0zViHj+ZtW0I3ti8Zh:MwGO7fVTBHYMZ
TLSH
T18975F10A26A80CF9E9A74238C567D536F7B3BC522661C70F4760C65B5F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d03d19e7e006c95129ee3589781328c84f48a45091368ea0c42cb16ce98bbce8
MD5 8d639dac37c6aaa12a67f824cc409920
SHA1 78bccec1a3f7ce861663e30a9005d4e3bcd4a102
SHA512 78cac3190b6661aac6e12f0c700d7332b774310645c5a64fa720cfd80d790a2959ae55b3693087bd103dbafb1b39dc91ab41442a54d9d17e1bac6dee5a89b012
SSDEEP 12288:9dZ1IyIvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:zZuRVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1B365121E22D860F9E5E30278D8F15A45D773B8A263B143CF4614A2995E73BD60D3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09f8d0cc2148faa1a5ccc6f773b0cdf01a118703aed54770170694d33d6ec999
MD5 0bce8f0f3241aaedd5691d23867a09d4
SHA1 ebb16f8c70bb6cbad873d80602ed780fd8493ac9
SHA512 9a87adc7fe9d34e295b97bf0f564cb2f77b718b89b14f53640091a705200fe7e876d63b37fedc5ac93753b209335f93caca40353a40b02a167454486610e7ac1
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uk:nQRQyi36YOcPDLvw2gAf+PN3cVmi
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1e897e729401b3e6e8d1d647a4252cbce58761b7c77078511c2802dca451cf7e
MD5 c0ab9cffb0fb88e8aa13939a61821d90
SHA1 d230edeb135746881643b6b9532c6b6af1a8cf2e
SHA512 ea3905d5b1da70a45db1c11c6a441aac7550cbfd27efc8663d6f79e704e888a90cf6c0324f4e850cf89673fbab5712b735581d70ba74adff9de0c6e72ff05740
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uk:WQRQyi36YOcPDLvw2gAf+PN3cVmi
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a764959e445ea193aec00bc138f50c7a6c1914a5168ed9c248c65c8e8b8b8a1
MD5 33c23d88ce0d8b89fe35fb6ead428447
SHA1 0835ebba07959473003e188551e783b76ec439ce
SHA512 c689b7f54b1ba14f9176d9e1d10040e025a9af83fe50245081efa0f8120ae7a4f16d50fdad9e7efaa3c22a5a195653bbd9ff4ae7922e0f4129e90a0ba9c47ede
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0BVukHvWx6T0zVif:068Qg55nhkeWu7PNU3/SfVTBHYMZ
TLSH
T136B54933B2F600A9C44DE1769F46972196D27C71CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7280a7407ad0f8c344c5eb0fa468148cd2a05cd4a19288d597ae5feca9b90c68
MD5 41f86720c9fff6c051b426c643a716ec
SHA1 2c15672321b2fc9d0cfa3d210e260100d9a34f28
SHA512 cd00ac4bfd935781880ccbc406a69169884615162b1135323669e2b84a5ce685cfdcaaf03ce582651603c7f4dfe4898401ebe88b192ec8d7f8baa7eaadf2dd42
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk996:Iy5112gYy5azzVvU69nLKnhZVVmi
TLSH
T140167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 253a968b728ed05718a2c52cde3063ccc4dace872885cf2fe2254df20d9a2d1e
MD5 0e1d0c0b208922e79a3c4ce0f4d1da3d
SHA1 d4f6d9361475f6e05a61cb00976c5f82aab963b8
SHA512 69408b45f81624009e3863f87cd1c9f5eda358533b16ebfa41adde1b296bf4a907c3771d19926a3cda336908222376c3caec56ff942c1baeb7356e2379b0129c
SSDEEP 49152:WB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8fVTBHYMZ:ku6JmIxd2dkVmi
TLSH
T14AD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 93096b0c08e4b5d8e3deff5fca286220b2ebe37853fa4725d1eccaacede73d7a
MD5 cdc62ca12c52416b5432fc0970e9803b
SHA1 cc3b0a95b41405505b4e47c56c6e6a7392b6d9b1
SHA512 6116562e19570842e94eb4839d01d559fa86ba8792d1989faf9544fe114f5724c264b93b2e659d9b0a77f31ba91d46cf4622281f92b4de0ed2f75606de10afb2
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4x4fVTBHYMZ:NmifPqRHVmi
TLSH
T1F7B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 edd93812370a15a2b8a19d4fad38d5782dfeaab0d635264b8623971cfce474f6
MD5 7919379071af7be3c4e47ea53e815f03
SHA1 69603fa54f271b0eac0e81775a1569be7c0c377e
SHA512 6cfdbf4641120140bbd81914f2fc5a61dfae0b2169175197122eddd529fba1391d091396e12bb1f262346b1aa20eaa0f7afb6063246594825dda5f830db0149f
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqRfVTBHYMZ:M5dKqi61RVmi
TLSH
T127C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c9786897d367bd6db26f8c417053d24f853ae569caca37ca296a3c90927b9927
MD5 fc5378bf1270be02c272abdd8a5e7b66
SHA1 15200617b34fbdad6d3cff082c7c1644d35f1fd0
SHA512 29d46e27854dc846a3226bc02ff984b29a4b88d9aa84a9757c51e7837ab7a5a317c0ea6295b2c70a7bd28af7bfaec051763ec63c356e3c2e6dcf11d6589af814
SSDEEP 49152:ohtSn8EApI0figjgiDn0AP5wMfVTBHYMZ:5X2iWphrVmi
TLSH
T15795BE13F2D900E8D05ED178C7568632E972BC160B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 0844b6d2c5fba395eb8f738f429c5d6e52c39de10e1856a36c822705a6cbcd30
MD5 9436db351d406052ae29bc0e84e2b793
SHA1 de8333dabfe8964966001e8312efa140ba18d1a7
SHA512 217852fbb7d278e67efc9f66e20cad149741f3e3c1faa06fcb0d37f7705eb0467000445416db177657bac0f17e9dee9b48469e5afd0291468cdbff3094e048f3
SSDEEP 12288:DFvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:DVVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1E855232F05C985EDFAD201B4D872AB95647BBDF2F1E041069A0CF1984476B7A01BFC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2b3490b495a43dc07bec9280ced44c41d3d76e805676ff61c4fccfa0251ce963
MD5 afcf8961b6369c54351efe4cf2733167
SHA1 aecd5212bb32f26a0dedce27cddcfa1e5877046b
SHA512 6c024dad0c1bf4356a2e43c72214fb0bba781571e25d0e59573b957b6dcfd5ee02bcd33d8020378167069ede59b1e87efbdaf5b081fa033f200243a7e18ab19d
SSDEEP 12288:YUvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:YmVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1AD55232F058984EEFAD201B4D972AB91543BFDF2F1E041069A0CF1988476B7E056FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 34b4f5dbf618c5188443206783fd99c7d56ff04bcad6f07de706ff73eb38b324
MD5 b9426341dce10a160de23e6a9898ab7e
SHA1 fbb658319e4ec7ddecd82b891cac6ee0b6a1de12
SHA512 48adf350b4c56dbad03d00b3dffe56df4f2f267daf3b4e2a66e33222f9d354771a4aab6d829d0849175cd69253ca9845b886de57fba6fe445658dcbb1d9c60ed
SSDEEP 12288:zuvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:zQVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T16555232F058984EEF6D201B4D972AB91647BBDF2F1E041069A0CF1984476B7E05BFC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5a82d68635303862b76834b930f640012b6c6f28b237e3859faf4ec4523a09c9
MD5 ae21d6588763540a7063a8eca888175e
SHA1 d5a532d45eff349203e795a0c4ab88de6dae3819
SHA512 a8ba4786bd5516ca2f43d56754d8b0bfe00c03bf91c205f1d368803de9ae55180ff81777c587e843b220841c87cfc201590f59c3348e7c6e20c33a036aab1ee6
SSDEEP 12288:QVvvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:4VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1D855232B069D80E9F9E242B4C872A651E577FCF1F3F1420F8A08B5994C727A9047BD76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 33fb97cdcb4051a566b657bdf940d944c4181931f15f4006e37fc6197ce17a5b
MD5 a372baaa731dd8b72afd2f48923f27db
SHA1 5b245adc8031e931f797e2e998b1ba8da3f37ec7
SHA512 1d09b07f36d12ff248ae24aa0afd850ed1a11ab2422fdd7711f65d464d295bb4af5cf032d38b7c459983ac4789e3f4dc40d8e60f76ba8569abb426b37fb9d850
SSDEEP 12288:9HvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:9nVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T15C55232F058984EDFAD201B4D872AB95647BBDF2F1E041069A0CF1984876B7E057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 8e93fe7b7435a7116c91e373227084dc70df356442afb9012c4dd46f598a1a08
MD5 07031a17f53df842305177a33c21c321
SHA1 be1d74906ae2de5749da71346b1c95d82c512f53
SHA512 6811f344cba049cee38e7b8b5dbe73c2b8072672538d2f57daf0da4f92e77a74ab11fabac4ae1c591dde5e55fc55311539bbf3c312db1456af1724d709dbfc79
SSDEEP 12288:cgvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:c6VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T15A55232F058984EEFAD201B4D972AB95643BFDF2F1E041069A0CF1984476B7A057FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 9d7cb59e3fe644a99d0292c4b60fe115be8509590c1676f3a097c621e1a207b0
MD5 5115b026b0e37a794a53c9064bf0efba
SHA1 85777d7b63a4478becf8f6257b024548a859ce0f
SHA512 670a5bfaa6ba84721cc8de33501c4196d0c60e27d813c3038927d4807846b8d271d24d211366764b76966d27bd307fb4b6cb508781036da0894d4ebe1ad5074b
SSDEEP 12288:BMvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:BOVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18D55232F058985EEFAD201B4D972AB95547BBDF2F1E041079A0CF1984476B7A006FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 33e40cc50c5c4521ca7f80f66566cb461aedba82beeb1efc9d5044d212b6c6df
MD5 903afef62edd85ba4e8ef7369fb2eb68
SHA1 6afd1f71ef52d67145907bc59be4a0d48f0bede5
SHA512 e6cc3a00bc696e47a6dae00dd2b8bfeab0f4624676838d82e7deb4368079bf4acd77d0f52c79124fdb069930fe1ddd3d4a79da30436e5f30cb09607515a591b5
SSDEEP 24576:zZM7zFVSOGVukHvWx6T0zViHj+ZtW0I3ti8Zh:zZM7zfKfVTBHYMZ
TLSH
T19075F169739008F8ECA7413DC9619906D6B3BC6657B0C60F07A8366A5F733A10D3EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 74daa19d9d35b85eb9cc4f0cca83519de7804fa425c1c148bf1c338a094309ae
MD5 4800f13e6388536f5b040dd7c438519e
SHA1 261ba7ce90073fcd93448c0c5f5a0e6ceee1ad1b
SHA512 04b1c4e8d8b229120f9e89b8a9d1af0415fa1c4fe118e225908b8529af1b238297ac3b8bfc911062bb2ff0840168546f687009c242acbc8035ab9ae571c6215f
SSDEEP 12288:qJvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:qhVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1A555232F058984ADFAD201B4D972AB95547BFDF2F1E041069A0CF1988876B7A017FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 8f091202f0eb1204897321493f2814321902cb60ecde9a232fd42141aecfd958
MD5 ae0c4e90b506be9ea0d298714241ce40
SHA1 3726188b7470486503d474468df230f06a610e56
SHA512 690ba83600fc67461952676296825b8ec9e94e5108127126660fd0f81248d3223d77f62bdc90c7862f2848a7779c1ac25154485e676851e9b52eaddabec2db6e
SSDEEP 12288:tNvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:tNVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T11055232F058984EDFAD201B4D972AB95543BFDF2F1E041069A0CF1984476B7A05AFC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cbb10d363ef5bab447053138a89dc2533b9177bfcead3714e6a6ab370f895a47
MD5 ff47659a42ff9591f5bca6af49aed348
SHA1 ad295051e6aa7ea02e49ed9471fea50690e5634b
SHA512 1a40bef168da7bc4737ec9b489b4e16dadda4947474d8011e422978b9f9b7d710e70942e8fac56ec56def77be7726532f602ebac53733dfbbca1172d37d3ccbe
SSDEEP 12288:XyPz5L8IvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:azyyVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18F65021B22A520F9E1B74238C8A21A02F776BC7257608A5F575453BA1E377E14D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 4f1ce482a903afd9d8327416ea08a1a1866b67b8dff4786d8802f3a0ea56c1d3
MD5 f5627eff6b035fcabd2df2c93e73878a
SHA1 11939b6be021db8c2f01594c7fd01a11b1d7a69c
SHA512 896d6f0ead23a867593c72564c7ca2afa9830b47330a9fb9ebf695a9a35ad62dbeed07fc8a976625660e11be85e31f291cfd88f9b6f876eac2c529bfb92513d5
SSDEEP 12288:LJvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:LhVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1BA55232F058984EDFAD201B4D972AB95547BFDF2F1E041069A0CF1988876B7A017FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 12ee25e817edc8a3fdf5131f431f7bd6983f4747dbd5e8c8bd032ba03a4f05fd
MD5 d009f6b98b1de45c118b8334c63ad4d7
SHA1 a43234b5fe5d5366ce6e2342c4eb565384478943
SHA512 6b1055fbc4333c9a68136791d87658e1dda01aaf9d196ea24d0a3e6f8fbd880b60bac45bba0d27809343a61e3187d4a873548ebbaecbc9c7e6c06a1f370a3333
SSDEEP 12288:GJvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:GhVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T12855232F058984EDFAD201B4D972AB95546BFDF2F1E041069A0CF1988876B7A017FC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fff59fbca6d2f89cfc1046565b7a7031654972c12c741cb649c4ef6cd04706e8
MD5 c9ff52297ccfc5ba760445df4092e2f0
SHA1 adbf9524c022e6083d482cd849f45858a8a1d69e
SHA512 c4bb8a0c58a82efda2f8f0341195d4a7e8499a745655220e5590c51729b91b8e63a8e3a01c366424f4aea05c4e3c21f9ba3ddd032fd32516189f3d40d3bf3c41
SSDEEP 12288:uyPz5L8IvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:zzyyVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T14565021B22A520FDE1B74238C8621A02F776BC7257608A5F575453BA1E377A14E3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7b8421e1e7dde2eba26a9fa70fb6e7d65860cc26512696093e066c53abd0aed7
MD5 18e8c242a0062708cd5b307c8cfe5308
SHA1 7b0d2ab2eb3c1b22dd4587c28d3f9f85ef1d6f9b
SHA512 0655ff969d5f417191d34f54d3ad5c6e4ccdbabe6a2b8dd83e3c99f9f36759a5e27ddd81ff0575e94d0ce62106cd5849bdbcfcad253d2bdd687a0cfb9833beb5
SSDEEP 24576:RcP4mcvIjkGOxhKP2l71SNKbrh/8KBpVukHvWx6T0zViHj+ZtW0I3ti8Zh:GP4m4IpOO67N8KzfVTBHYMZ
TLSH
T10765BE2DABDC0096D0BB917485658A49FAB1742A2F3286CB1160933C7F77EE54F36F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 db56443cf77c7ec46e572ddfc7cfd9964292a922e66fa7edbaa86006420dfc86
MD5 95e2eef3297867c07fd3be380a7869ed
SHA1 ca5b9d5de3f5f276411db95b1ed376eb946297e9
SHA512 39b943c6e128ed61a4344695382bf281c4ed40bfaac4471c49a06eba4fcb698867451bcd00ea1affadadee8086b435310c67ec73a1112d4af2e780193f3daa4c
SSDEEP 12288:/tsf5vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:cRVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T15B65011AC29842E8D0AE1275CB629A41B3377C6193E1C3CB57C0F57E0F766A45DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 b9f46477561884396341a03064df9149b093ebebc4b9f9373818def5c3f0afe1
MD5 ed194cbe98de2f9859e06389e04ec136
SHA1 16b28dfded1b8d0ac6d51baefd1c7b62233a47f2
SHA512 40a543498e4aa54442a19b6d77ef9aa90064590681357b5b44a718ffd98e0b74105b2ff31cde6de480119621681a41e26c5e6229b7e65e1d1223e5aa1cca8675
SSDEEP 12288:TZvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:TxVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T1A755232F02CC859AF5F612709872D661643FBEB1E7E08107A90CB1D84475BBA487FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 229bbfd8eebc070b5bf72d432000273e397932ee9dcc2254c553d70efb8bdcbb
MD5 0ff9211a9152bf527faba6f066e2a7d9
SHA1 bbc2b6816b76f83b94047d2d71bdd6821ccb4e13
SHA512 94ca2279721045521875e22d784c5f7b6552258b6ad84ce38a25883ed3331ef1a713f78bd0a13090ef3f3433b19fdb57f052c8975446570b7bf00c3e2a15faf8
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQnfVTBHYMZ:+a0hNYG4JwyVmi
TLSH
T1E285AF1E67DC82B5D0BAD278C9A6854BE6B2B4221B3156CF1150853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 88fe613e54ebbbb89ab764dd5a440ba171de6aa56750e0e80f1da38e196d2f8f
MD5 dc46e3bb35275350df199ed6f4be0306
SHA1 efc5caf4c21b22efc521e375a7087f5354a9d068
SHA512 9fd72d67fa4b87393ad7f5db0340ce0bddc01ee57a6287efddfb9479f905a4b6b6d6fd79acc3c54f28b109de8404b6dec0cb2f80eb0309d07368d1be3ac2eabb
SSDEEP 24576:ohbHjPWVukHvWx6T0zViHj+ZtW0I3ti8Zh:ohbHjOfVTBHYMZ
TLSH
T11065023E16AC10D9F5B2927C95628646D332BC71636193CF1684D2BD4F3BEE90C3AE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 de72e81c590be7a61c5ff823d3f844826b407fc3eb1cc8ac062b10dc146bf010
MD5 cbb8f12ba13a55b719aa9684227b9d87
SHA1 aa638f1fa58319b130e55abcab7b1c4c06330685
SHA512 14e5ddf7a8887afaf87ff3754201dc727626e2c3063dd31d1c63cda87c91feeb74bb87edfc046504d5351496be74d0b7240d5684f3307d1ede64370ea8e74c58
SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/eVukHvWx6T0zViHj+ZtW0I3ti8Zh:PIgnaTk46ppR/efVTBHYMZ
TLSH
T19345BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 6269fdcb7c3360c9f825d6517994894406d12cf37f94e9699fdf83be55ab41be
MD5 897c645bafe4123d9f33fabc82465c48
SHA1 d1ba00a29624ecfd19cacf591394a0220e8eeca7
SHA512 6d92ed5fa5265acbf2172ff84f441a67831b826d93554fe4c088c8bf28bb33444bfed52ad9e118578446bad9e009cf8c0303f352bfdbb9f586746062ff3dbff3
SSDEEP 12288:CdvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:CdVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18055232F018988ADFAE202B49872AB556427BEB1E3E14147990CF1D84476BFF057FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f2e0b90813c34a59bc7e235f0e6da470d7da81adb0406904862b370a958c16d2
MD5 5544e009ddbe96519c8c7e7e5f4431da
SHA1 c515bd7f548bd43b6159ca0332d75c73639bd10e
SHA512 9495f072a1314c5ba0dc37d31f05b6f120e526d18341b2f88aead89717795e74cd5bc11b7931e19c7295938dd21e8a2f7563c8b03cf9839afd1a79568162f2d8
SSDEEP 24576:/UL3UTMVukHvWx6T0zViHj+ZtW0I3ti8Zh:/UL3UYfVTBHYMZ
TLSH
T1BD85F215E7D400F9E977813CC9729A16E272B8AD1360E7CF03688B651E637E64E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 880e17910eddc0a6356020d5571043770dbf9c155cf5b4b663d0f70bf4b8cb05
MD5 e7b429bbd69a393a733d3f5acaeb0e12
SHA1 5255c14cef8f2eb0bb06ac2d786523905d2a9348
SHA512 29d814fde30c722b88b3c58946e7443ca3a50503876a67a2a96ecad4ec1860b715a19817cb3284d38e444752ceb3bc47c9d2a48a44f78944f035a647dd5fb06c
SSDEEP 12288:UpFtjOmvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:QO4VukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T14865022E22DC10E9E5B6517C89A29349D372B8B2536143CF469091BD4F73FF85C3BA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ec5b24e2a22aba926f72f61ec56caa63bb23fbcb2315501b363f08886d56ddb
MD5 0d8a2bc10e16ff3af757dbf2912b0ba6
SHA1 d61579b4cb2cc38a239dc4dd64b05e79576d291a
SHA512 4ca72e1aaf1a458657cfb3a1bd8f0082b5291a109fc6b36be447a742b2ff4ac7df483619028a989b450d4e09d7ee69b0845fa721a9b12182ed8ef4c0ef1504c0
SSDEEP 24576:u7NM9YmZqmWMUkPjZM48Mv6bEhshVukHvWx6T0zViHj+ZtW0I3ti8Zh:u7cBWMpPjN8DbEh2fVTBHYMZ
TLSH
T15B65AE2E6BEC81E5D577D13DC9A28205F6B2B4611B318ACB1152833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9befeeb6cca80d2154a4094d80bfb08247bd3e1a1ccf506eae95983fceac1b02
MD5 47193ed0929c5e88f94c45c47724d942
SHA1 52d0f206e255588db15ba6804fa175efd66b1366
SHA512 49e19ef109d8c5f09efcd1e498e1684e70d85efc6cc46dd4890313bb04db9d72319c6c508574dbf31fff2fe1a949283959bed80d81f09fd34f5842e623ff6645
SSDEEP 24576:YW6BApg2YuyuNDYTabvcRvNYf8km1LVukHvWx6T0zViHj+ZtW0I3ti8Zh:YF2YuHNETovcvNYf8kmBfVTBHYMZ
TLSH
T10B857E2A27ED80A4E0BBD27D45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d8ab63fd8a16fccaa7125a840d280d3680ddb5b81914f57e49c603441e8d8d1f
MD5 f3b15759ef99f3d24964f775b7e7d384
SHA1 b47840588d2be9329a66fc1ab89e168708d6d1c3
SHA512 ea9d6f3745e5caf48589671ac93941378278ed73368b56bbe284ecb174af1654965e69b4e090249a3420ae4a3fc046d9959f918db396345c41f091cd0969b3d5
SSDEEP 24576:DAFs06+Omlf8NXEbToEVukHvWx6T0zViHj+ZtW0I3ti8Zh:MFs060loXuHfVTBHYMZ
TLSH
T19A65AE2F62EC00D5E07ED17D8997C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 ed47a9d754bfa7fb4c63bcac965b551dc611c2396465e1a95e0ecae8dd0b3371
MD5 7b35387133911a87aa818ed13d110ced
SHA1 e10feadb630565f2d2b8e20d2a35689687bb13cd
SHA512 50f670f080e23997e6541dbe1439414a52c00828484c23efd8159aa1cc03d6363613998b7bd3fdd0fe50266b9324369d23f36f0381dd286577a24b6889289377
SSDEEP 24576:gJnJ5D3WZHVukHvWx6T0zViHj+ZtW0I3ti8Zh:gJnJ5DGZHfVTBHYMZ
TLSH
T17375D03DD2A810E8E4B7C2B4815A1B96FE72387D2B2269C72874D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 22101ccebc1d00908c3c9c0ea5b3aa84bd20a8ecf93f0b460e24fe3de006cbbb
MD5 8db330a114f8e67007dbc1ccee2f00e6
SHA1 45e5df90882589e11aad23a621a71b7beb116c5d
SHA512 f6bf466532ac95b463dd92ce23d20d2cbd55b2677d5e6e0d4cbb6b92d923cea3d18fe8700b6580072f80c4b235b691807781a175e86a31d2c6b22129babe8141
SSDEEP 24576:jEPohm6/7IIXdwcXrif7qQncjlP65i3VueVukHvWx6T0zViHj+ZtW0I3ti8Zh:Eo06DIKdwc+eQnSt65aVVfVTBHYMZ
TLSH
T12D956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 fdc5dd75936e282bc264e26c61414e2a0a10322bb5628977d042f0965d405b7f
MD5 0a467a32266adcc8118c09a99cbc65dd
SHA1 4ba2a0c89a1b87827f301ed3b840cac75f6cc87b
SHA512 c1f30e41cac4b0b3df9ed4d88dbf6470de4debb4fb5fff843b86c59da0407e175bb1b188c175d490e3cd2c4b38dd87e8cc07d65eabc3bbd475bef83cfaa290db
SSDEEP 12288:NEP3RvrvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:uvDVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T12665122E279CA0E9E1A6507CC4A18645D373F4B067A213DF4684E27D4E37AFA1D3EE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 31a9b7ba2ae32b35ff07953e9e454dba4d7de30d3a307f7638f8b2dfeaf0d418
MD5 f6136204a1ca457faa917ce3cd37d257
SHA1 bdfe8575e49defafd164b4ba45d929c59d2c14c1
SHA512 5826ebbfb53c1c7c623615c68a078dc92743d86e7fb59983548fdf2bb4c5288a0c0931f2719ad7a36d3d680b1277505d1b0a6bb13ee21e3ce5ff866b839551ca
SSDEEP 12288:8jkyUvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:8IymVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T18B65121913C890D9EAF60278D97382909936FC70AB6043CF5580F67E5E37BE5583AF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 8d6ab9506dd8a833634c80e2da6a796d07ee5988204c17113a426e187c7d956d
MD5 7f53683c284d0721241a6a678b08cbdf
SHA1 f2799834c384697e11dc8c6f500b19f27d1a500e
SHA512 a87b9b59d5f0fc3eeeefda4d7d1c33cbea581ab692239abf67cf9882719b56448e7703f823eb659dde1a870dbe0ef27450391bd6e94200243b4940d2a1d96a5b
SSDEEP 12288:U82vsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:LIVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T11755232E019994EDFAE201B4D532AF915437BDB1E3E0444B598CF1F88977BEA007BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f581df56f7c69b11aa8fcfc22b0d76813dcc57579319a71cb6be5d530d2fc89b
MD5 9996ef540c57fba30a0962468e0b854d
SHA1 e25b529c46ef2e349d80be695553091d0d375c89
SHA512 646d409b1672e9ebead3edcd36a0e9eac9527c17b19377bf0b362b38b3e4b905417f5614b04b2565fc7c95d3961d58630a1f028268c9c7af0d7c383821ae122b
SSDEEP 24576:oQ9MxZKdcz97w3ZVukHvWx6T0zViHj+ZtW0I3ti8Zh:oVKXZfVTBHYMZ
TLSH
T162558C2DABE9059AE177D27594B250C3A633B4311B31D6CF2448D03D4D7BEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 9f47eee8ef743b294b32ed6841d6495e376c794b970c905185321a463a4b0b15
MD5 505f29dba41ae67e0abd9099bcbe1a8c
SHA1 69ea01aea1a13d60f83abe51fdccf9251b13822e
SHA512 ff06b2ff2e79eae1dc16160c9805ad50acbbfce243f2566587cb0898458ec80b4384756b91892216aba621d5695c3a1252648d1cdd06cdf95c37e81a4419a584
SSDEEP 24576:nyocFApiVukHvWx6T0zViHj+ZtW0I3ti8Zh:yocFApifVTBHYMZ
TLSH
T11F75E01F77AD40E2E1A2813C89918745E773B4705BA253CB5681C33D8E37AE9BD39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6359be642ae4319ad5dbb5fec176c150b3a4ab032a3a5b63b2a23b1a08e4a12f
MD5 8e2498c7332248ec9f36062b9e05b89b
SHA1 6c273e5e37ce30dc45252a97a9f259c5a3a713ae
SHA512 d32d4aefc2c57316d75f967c44a780c0783a4d7054debbfbc382ca90b501c0bdae178f7e2d515ed08e95d942ab28bf9be58d4258e166c1b518e7840a66d2c492
SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKifVTBHYMZ:S0zuNIOVmi
TLSH
T18FA57B3DA2EC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 269a23f749e12769b4cf65cff709ddd301b250e75ed7a3e5b8a9f48fda0ec8e9
MD5 83a0c5b2104b2306edeec39378166165
SHA1 b0824395128b51ea23c4b6bf27624d95c485d137
SHA512 d22d12f4a0bb4eeee0787de2b2b8ccfe788dabbec174e6effe5914eaa9336973b7b00552e3da84a7dc04794e3446151c2841fd00684be8a9debad89bdb8530e3
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYzjMqbDVukHvWx6T0zViHj+ZtW0I3ti8Zh:NTDxR+N5YzTBjMYfVTBHYMZ
TLSH
T14C55B02E67F845E9D1BE85789A33C512FA727861033193CB42A0C17E0E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 fe5298eb26a1feca46f10bfb8d144c6575a13aabf4c2be83a7ea4d5e6c95d379
MD5 d31b1d2ee3702b374900d672a2b7e978
SHA1 8c805e68cfac57134713f28ce142f2dfaa4b4919
SHA512 b1c77d60a466b6930f6098e902da417b775fda2c20ff056778afac9a9b4384c0eef276941a9b9c748ce11b9232c036dde735e5064e345ab52abfd422df92560e
SSDEEP 24576:XTMdOz0FFS+wmSLfVukHvWx6T0zViHj+ZtW0I3ti8Zh:l0K+wmSLffVTBHYMZ
TLSH
T1B275E13E63AD14E5E57BC27CDA538906E5727862032166CB0690C1B92F6BFE4393EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 b4c9c3200d6b6fd9b8594f781239030d598b2550ab62e028f1f360542a944d2c
MD5 445d7baed46d4d7f1e516e4635a9e93d
SHA1 48e274589baadf907dae59534bed7e2848bf8b6f
SHA512 472dfb22557a63d5054891a077bf9220290dbeee1e08f0343e1b70346736341a55214451976b849c0f97c4ff307b987e925dad301806f9529019092b6ef3ab6b
SSDEEP 12288:94/yvsyVumP+XmH48Wx6socvv74S/D0rXXj+Zt/OD0I3vFiC3M0h:UMVukHvWx6T0zViHj+ZtW0I3ti8Zh
TLSH
T19765121E13DC20E8F4B21274CA3256519532FC7263A056EF29D4E5BD4F37AE9853AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-393-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/404-245-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/404-277-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/404-251-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/404-419-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/404-294-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/404-571-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/404-261-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/732-392-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/732-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/732-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1212-416-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-230-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1212-224-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1364-56-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1364-453-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1364-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1364-50-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1524-75-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/1524-0-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/1524-1-0x0000000002270000-0x00000000022D6000-memory.dmp

Download

memory/1524-8-0x0000000002270000-0x00000000022D6000-memory.dmp

Download

memory/2424-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2424-47-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2424-38-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2424-70-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2424-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2540-399-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2540-166-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2688-135-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2688-129-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2688-394-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/3372-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3372-82-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/3372-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3372-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3372-90-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/3396-191-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3396-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3396-200-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3396-197-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3876-466-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-469-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-458-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-457-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-456-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-460-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-464-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-459-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-467-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-455-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-468-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-473-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-472-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-471-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-470-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-465-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-463-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-462-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-461-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3876-454-0x0000020501EC0000-0x0000020501ED0000-memory.dmp

Download

memory/3912-418-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3912-240-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3912-234-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3948-489-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3948-145-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3948-396-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3948-139-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4020-486-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4020-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4020-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4020-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4104-220-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4104-415-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4152-117-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4152-420-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4152-123-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4304-421-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4304-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4304-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4304-32-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4312-181-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4312-187-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4312-404-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/4344-156-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4344-398-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4344-150-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4380-21-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4380-13-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4380-110-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4380-12-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4420-522-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4420-92-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4420-98-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4420-91-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5056-177-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5056-402-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5056-171-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5068-210-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/5068-204-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/5068-405-0x0000000140000000-0x0000000140147000-memory.dmp

Download