be895f724189cf7ca2af109da16ec3424fd3a180343bce38c09f294a97d503f7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260504-ngncdady4p
SHA256 be895f724189cf7ca2af109da16ec3424fd3a180343bce38c09f294a97d503f7
MD5 c8d598fe1cfe54525d1609b129ea54be
SHA1 876154c23ad5e8af3dead7b277220c7b7334f211
SHA512 e7923c8e5213e06bb13d9a45e857a169e6f258fddeb6f08e2f293267ae4d7fc302e971571c8c8b1e0becd8d24e15fb231f210d7718f20edb42bf5c67f27980b7
SSDEEP 24576:YgzGxmsTY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:YiGssT/Jz83Zxq0JXh6k/
TLSH
T150751260B2C0D4B3E573063006B09AB199BDFD706F6449EB2394277A6E706E19D38B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4844	alg.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
1068	fxssvc.exe
752	elevation_service.exe
5484	elevation_service.exe
4112	maintenanceservice.exe
5444	msdtc.exe
2708	OSE.EXE
3704	PerceptionSimulationService.exe
2644	perfhost.exe
5752	locator.exe
5748	SensorDataService.exe
2068	snmptrap.exe
1336	spectrum.exe
4312	ssh-agent.exe
6084	TieringEngineService.exe
5228	AgentService.exe
3036	vds.exe
3944	vssvc.exe
5460	wbengine.exe
1292	WmiApSrv.exe
4988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e7f385ebb9e5d6ca.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_82828\javaw.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a0b7449b8dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2947d49b8dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053aaf84ab8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000305e2549b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000705f0649b8dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063327b49b8dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007843ad49b8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cc0cd4ab8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf965e49b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c835e34ab8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063327b49b8dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000767114ab8dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe
2200	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	1068	fxssvc.exe
Token: SeRestorePrivilege	6084	TieringEngineService.exe
Token: SeManageVolumePrivilege	6084	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5228	AgentService.exe
Token: SeBackupPrivilege	3944	vssvc.exe
Token: SeRestorePrivilege	3944	vssvc.exe
Token: SeAuditPrivilege	3944	vssvc.exe
Token: SeBackupPrivilege	5460	wbengine.exe
Token: SeRestorePrivilege	5460	wbengine.exe
Token: SeSecurityPrivilege	5460	wbengine.exe
Token: 33	4988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeDebugPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4648	2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2200	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2892	4988	SearchIndexer.exe	111
PID 4988 wrote to memory of 2264	4988	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c8d598fe1cfe54525d1609b129ea54be_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1852

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5748

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02ed6c1eee3a80f3dfa2609c5defc09ab4c29bbba9a4db8b198d8f0cb15ac24b
MD5 c31ef284fe674ba072968cd2ffc46f2d
SHA1 ad4e80f8bb672275e384e492f8dbf3f20c7ca2f7
SHA512 2c96d184a50e1f843685ce17e26ae29149583e38698badac8268f4ea1e4c5f152b52ca7c5107b0550c1e74bc2041b5153bc15d72cbecbe7d7ba275f6586db7b5
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnY/Jz83Zxq0JXh6k/:k3q6HjB3/JAxq0JXhR
TLSH
T14CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6a2d9b7b4119028359cd12b655ae2ffd30991c46b41d538089dbc7b1f7639474
MD5 93c0aac97effcda6d5d1ae128961c3c8
SHA1 d539880e88b94a3223906f4e412b1f17706d02e2
SHA512 7cf3f3f52525d3ae6188d59019eb2fc0fb21d4a0fa6067473a211fffe201a20110b4cdbc39a87d7b511cf77403f235d6fc8c2e8d22dc83003ea07793169adb3a
SSDEEP 24576:YXYfDtczAjY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:Ptce/Jz83Zxq0JXh6k/
TLSH
T1AE85F138B39408F9ED678239C9A28511E672BC918760E7DB03E495761F333D86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 7d924c5960572c01cc104f78be5cef0c32679cfd656c624acd1d73b704bac2c9
MD5 756d29cc1aaff3c05c9ff8f2e2f9a598
SHA1 c8f69fe3e7e79bda9f4ed9cc9dd4fabde9a81f1e
SHA512 e3dddcd860cf1b3325e7e87c6ccb0d8321e4b309a64ec14b5f49ee92d80c5db4af1484f3b2397e90bdf47dc7642ece7be0b83f2e209ebbbf82101875f23a76a1
SSDEEP 24576:60Le5ji0hmxirMgY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:6Pji0AcF/Jz83Zxq0JXh6k/
TLSH
T1D195AE66F6748731D073C0B9C5D2A68AE97130815B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2c81bc034b3435069b9f9fa4cea37bfe566469af00d1fdae75462598eab97b5
MD5 3291415ee5f797b8bc3afb4da4c2f5ed
SHA1 8018e1650e9c67c567b5e51539723e117700ba3c
SHA512 292b6d54c850c1746f34e762683fbec7481c3e7e8d752bff2e2253f9d37b9612f3a84e3c0ee4c921b02d71d1f0fc70a790e6bc515b4d16173d881e592cc877db
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuuY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:L/ezSC6vUzPvxHjyR/Jz83Zxq0JXh6k/
TLSH
T161756C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d9cbcf688eff82d5cc2b655874fe926e4c62f10d53b45407f13f7eeb00c4e2a3
MD5 adc29ef2f928cd1f3d9af9432a9ff501
SHA1 6c6088336718ed3e926c0b3eee8ebc5a956b1cf0
SHA512 cb7e59f93cc86b9e3d75437acfe0d83567aca126b17cad001c9396a81a10c11bb42935d494071c3db44b7f33c4088ed5cab1d63235d0932945fd8b1032c21c9f
SSDEEP 24576:0VbqPb88hv/l+6HY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:0VO88hXl+c/Jz83Zxq0JXh6k/
TLSH
T13955AE66F6748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 53986e86f285f0adb1d440dcd30f03c551e13f7f144a5f5b928a6da914513c90
MD5 50682210f176170623f6dadd82d87e59
SHA1 197e23689c9e46715efae7f23cf717df6f26a558
SHA512 772476f8fc1866b7d8e0a3bbbb04533efc74a4371771dbca679183dbf910736fd9085d537dcdcdf04b3f6a6b9af2e167626bdd5438f6832040926a1a0cb2fe95
SSDEEP 12288:TRUY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:TRUY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1426523F5E304BCC5F763033222F15AD2C6D18CC0F95858A64294B2B6BA7153CF4A8AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b6bee003b876d35eef39181816ab4b8aa7c6c6c30b4f74e3223e20d5db18e3ec
MD5 d342498ec2301281a8cbcedaf382c56e
SHA1 cd3ba08dfbcae404274918af9c278ec16f2decb9
SHA512 5d26932298c607d141c1d8b6c5434fa379524330bd925b46298fb82d9ffafc0eb96de65c7e418a001430660743af644f505509426e5b519aeeaa02ed48c91b73
SSDEEP 24576:5JIUvY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:5JIUv/Jz83Zxq0JXh6k/
TLSH
T10685DF7BEE28FCD2C27A49B957918640D7B278708F21A3CBD164830EDE235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d7b1fec44d5d299353e30e94414927343a07526fa893a7731448c2593e9a477e
MD5 0122fab11334b0e707613b19e1f5f23f
SHA1 f50858b25a1554b8c9188fa9290159c29f388b7f
SHA512 14c47ddc8c4a2353022164a6137c287477ef79a0f7095476002cfe5324bb640e9b50c5ee28575875083b247a0827e5a5ad0b5dbd82964ea3b2f0955a124d1827
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:nQvGAdlCEL8c/yRNw5C+/JAxq0JXhR
TLSH
T15F267C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 06ad68acc0657cf4d1b88757b83c686a553c570ee90c7ef860acf3a7216b831d
MD5 7dddccbe320cb5a0a9bfa6cf75f84b38
SHA1 8aee22bfaabc44f0d8a7f606b1c3f4524f30117a
SHA512 3c5d6de77bdbd8bdf80aea142562f6f3c29c3b1bd71ad00f11f585c632f9e29fba68fec12791c3a9c969c6d081c1d9223ef9d275ef25d7f1cf0dc82fdbc44fc6
SSDEEP 24576:sdewsAjVY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:0ljV/Jz83Zxq0JXh6k/
TLSH
T16F85E031FB74E436C3BB0DB21B36C716546CAD604B6119C3E3E89A9E59302D12776E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8a475832d0636bf89af4a55933059fe445e0b3481a33ef1742d34e07ccfaab04
MD5 9882f6f7300c8a4dba17eaad7cdc5bfc
SHA1 025e1ef278cb1517fcfc1a85a609eb76544e4206
SHA512 0edf7ab7a8a95f908e832f63b5c2f5b7c7755ce4ebea1eed4abf489d1f87bd011d655590cee0e1fcbd9074ca3169ba5faf4aaf217ccd03e4b516457b48acf9e8
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHtRAc0FX:WUEtQevvqc2W1cpV2EI32Qc
TLSH
T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c17dede3ea744dbb9af76180f49cde3038145b52408bec531383d75cf25db3db
MD5 675cbdccaa1552cfc786ddfc964ac9b7
SHA1 e763c2c5abffbf7b8dc66761f13d3c439a9d174e
SHA512 5a6b82d34972b3329711bad17534d2c237e32aac594f675da91af4657d519b1fc77cbbf71650a33854b4fc4b8abe4c2d5252973eabd3acd1d2414efd5ce29722
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/z1/Jz83Zxq0JXh6k/:BoqtVjnm6/JAxq0JXhR
TLSH
T105D58D1976B8C1E4D1F6C37886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5349784d44bb60a701f551e443dbbb3e29c41e9aeebe3600acd6c42bee72f5ed
MD5 ce0f7c1177f66ad4efddc7980df959ba
SHA1 f6dd7b8ef74d44eb37e73bebc7967416867fe875
SHA512 e26db6a0059ff3fbd97a1398617a2fb2c1eaf1b2df4c3033d73779bc0b2a04301635f693db9d5772da37ea9ff1854b2ecd9df07e10eb913d14c6d9eb9a988d9e
SSDEEP 24576:PAhGLJIFoiwtA5l7S53aY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:PAMyFoiq5K/Jz83Zxq0JXh6k/
TLSH
T14535AD80E7F955D4F5B3AA7899B68571EAB2BCA65E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 167adb1497a41b18734a560eba4f0c0b5051c7bbc13658a4b7c8ccaa0bc5461a
MD5 bf0c0e71fba4011c00426e6b61621a6b
SHA1 b3c94b04b68872b6fb30b60cbbe52b441751ea7c
SHA512 d47340b0223fae3025a51631c164595e202bc3ed165bdadeb605e46c1e821c413a8991bde33ff17682777ae07e99316f48340df0df7cfdd8be78a36c546eb2ba
SSDEEP 24576:iwuoOWxY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:iwDO2/Jz83Zxq0JXh6k/
TLSH
T14975F19673A41CF9E96742358697C536E7F2BC413A25DB1F0360C66B6F33220AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7183704922535d3081b5001b0e51ffe4140984bd25e27aaf9f29451cae0ecc83
MD5 25bdf2de002620d99f10f88b5e3e9d66
SHA1 36454fc82b0620d35de60334f2192d4d81ffd099
SHA512 d471f1816146f43b05e3ca0eb9b5d22af43d8b6ed6b01278c082c82fc9f7b018a9c60e6fc88c09723137b03858dadad60d488eb7e4b99902d5be3877e5772fe4
SSDEEP 24576:9ZuoY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:j/Jz83Zxq0JXh6k/
TLSH
T1046512AA739474F9E2A3023599F14A85C7B27C91B73543CF026492B62F33AE46D38771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 38a11881ad1a4de441b166656bf0250d60edc9b1891e263e6e36390937964323
MD5 7244e12cd68d3ef72be9b68a11c1ca13
SHA1 f7e962a9d227709a0e312d14263bbf10d4d9e0dd
SHA512 c7da329101942dd8f0d4d85e5a5b56061f61c9e8ca82ac128495840b47145e312a725005602c64f4d5554521c7d3213ab9fcd7665a656a24d97925b12bb80331
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN3L/JAxq0JXhR:tQyiKayX+PN7RAc0FX
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2c060de261c2cfdb8b46f283e376432518ffc4ff99295d85c39ee93522c04f36
MD5 72ade68b47673afb76d184f86ce34f06
SHA1 53b6dffb543a57ba40345a9596753c62636e9597
SHA512 8940df792bb6558620303ac5f2fad82ee1c06c9a22bc2130c639e4acf7608fd51e63f523704c6855e6d8402b4588dd89d26831a03fed044875a798cc883b81cc
SSDEEP 98304:1QRQyi36YOcPQLvw2gAf+PN3L/JAxq0JXhR:MQyiKayX+PN7RAc0FX
TLSH
T1F3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 00823394aedcc02bfafa302f7adfa73545739130d88348b1e800c99d7e9fe67e
MD5 85b3d241f0208e5f2af6d10f3d63d6ae
SHA1 1c8f92a272bc811f0bfb525ec367b6818a858265
SHA512 c34d5cf0a5a218cf77b6a1a883d66c53acd3ea5a7bc574912c67c56cf925d3207e1f075db848be92fcdaf134ffa036a74ce2aa6f4545686cc1b33917d74d7877
SSDEEP 49152:y68Qg55nhheWu7PNU3/F/Jz83Zxq0JXh6k/:wthWRc/F/JAxq0JXhR
TLSH
T152B54933B2F600A9D44DE1769F4A872196D27C71CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 37677b6e10c162d8e08b5188acb91c21cf48f3c7818bd7a6fecd2b8123d06946
MD5 52cb349a08b2ff93209f1787bd1ed83c
SHA1 34bdc7229e25e4cf0fa26618f6e0430a2881b8ee
SHA512 937065013f89b47541379e9a5f81325bbf76a7b0e34f51f4990181ef5b47474ea620f712a564ae0d7f5cd3ef7ebd7871c8e01426b717640f541a7b681d301e59
SSDEEP 98304:Oy5112gYy5azzVvL69nLKnhZU/JAxq0JXhR:/LIHmWhSRAc0FX
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0119857e1ccf35bb4d5d45c054cc4b4044204547d080ab06038ae9c7efeca934
MD5 5ac0e17e5f2cd5ce75cdaf4a4977166f
SHA1 3369d920dde666320c876f4bf75810affd9bafb8
SHA512 9e22792694f1bf5c821bbefd45f91ca581e4fad7400ea698c8755541f290210a6c609f59d81765484eeed39b3c8194a3630dfa50b0279a6639c4d7a7968aafda
SSDEEP 49152:XB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glT/Jz83Zxq0JXh6k/:5u6JmVxd2dT/JAxq0JXhR
TLSH
T19DD59D13F1D901E8D06ED179974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b78dbdfaef4da3aeb266b6d41f03561595204a76484d4e762c30792cf57b0604
MD5 753e26fdd22116d938ac252e06b6e34d
SHA1 9907b3a39540da5e394665f7da40380697e735e9
SHA512 39b71126bcab105b9ab473f372e62d0900928b1dd5f1ff92c639db78bc22089f9fa03ac9d5dfdbaed1a7146518537fc4e6813410e6d740cafe4f3fe25f78cefc
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xP/Jz83Zxq0JXh6k/:CmifPbR6/JAxq0JXhR
TLSH
T1F5B5BE13F2D801E8D05ED17887569632EA62BC450B34B6DF0A90B7962F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0797ecbab8548987edd0fe0fc935aa17057447c37602de56d78b0e71fe1298dd
MD5 e9517a064e057d80ada6b99bff1cad70
SHA1 1df95e52dfdbce8b49a921a262480aa9a31c40a4
SHA512 df6c9fcbd4d55bd7ab13125e606e6bcc05f11e6988a9e91b0933e164a4988ce0360d02c23849425d83c2a2ca96b3f717992b577eda02f1a2e3adfac4112104cd
SSDEEP 49152:aSuZQIY0Be2KRRVtOnks6NMHqo/Jz83Zxq0JXh6k/:E5dKTi61o/JAxq0JXhR
TLSH
T1DEC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b87f40e71bf38ed9a4bf40d0bdc127f3566806fbbe36bcd09f6f8e0d11ffc4a
MD5 ddb06d391b2a69625bb776394321e0ee
SHA1 6f76d27f0af4e2f8278852286eb60fcd32ff6184
SHA512 579d75d3565c244c211a456384bcfc2eac6a6ba6107212181c183633bff427e51813c389f68d9505838178772e13dab88d1e6a765de09e1aa712a1297e76cecb
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wj/Jz83Zxq0JXh6k/:ZX2iyphW/JAxq0JXhR
TLSH
T14B95BE13F2D900E8D05ED174C7568632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0b8bf2238c3c266fe2aaa877f36439507fd2bf1a3fbcb8149a02126c47f18a9a
MD5 2d063a75cf1816a9e3543d915da98b6e
SHA1 1f9fc7ce17430954659e2731f9cbb140a38f618c
SHA512 ae1bb4ebede35e89d9ad4f399640052229f9f29f90365e3d2ca431eaf06ef4d141593e5996e5f858ac28b218dcb432f72f6d8af3bbe102caf4d250c90e54fde6
SSDEEP 12288:QcY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:QcY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1266523F5E748ADCAF213037212A14AD5C6D04CC1FA5854EA5399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b6c29ed319b33272a5625c35059457838034d3cd04820dfb25c40674e2dd586d
MD5 3f8af16f4afa42c98725524fb8f43e95
SHA1 70e634fb275a18bc234ca24319e1e239f38b8296
SHA512 e79c27fed2488a81c4ca6f417e157d40caa7b87ddb8296c0271bc441ba36b42edf6d5dce5980d0aeb67f8538c28e3f1ce50d85298cf04944e75f8cd9d32cf795
SSDEEP 12288:CJY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:CJY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T13E6523F5E748ADC6F213027212A14AD5C6D08CC1FA5854F65399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 df1ab8f63c6ed8253db0167506fb796d2609079c9da35d06cce6e813f2ccade8
MD5 df3208a6b286f109ce8d13069f4fd432
SHA1 5eadc01aa2fc8f7a4ce98eb761b65bf41eddb657
SHA512 2aa703147c52f27bcfb7516ce739ebe50530963fe1c0a6c62a1e092c8fc2ddea9ca0bd9b71db40b12c532a57b0263dbaf9cf45163cedbe3852cd371783aa50b7
SSDEEP 12288:f3Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:f3Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T18F6523F5E748ADCAF213037212A14AD5C5D04CC1FA5854EA5399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 7585c9662c4f3b16dd38039184e92f10e8d9711251e978d368fc71bc0e3a41ac
MD5 9f3273e8749a3e885afeee339e2d7195
SHA1 cac3be0b7283880de6d26ac8d34a442657945769
SHA512 cae289b844a4662a5989938299fd6bc069b46ecb9e9f1677c2820051a1fc2bf9e5e980bcabe25a95260a982c15fc74febf04fd881f99a3ff999e96f66a659aa9
SSDEEP 12288:EV6Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:bY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1F36522B5E748A8C6F563433286B14692C2E1BCC0FB2456EF534061663F727787878FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5ab921a5b626c2fd1889c16d5d98fa52c6b003d66c19e1125a2bb980b28bad32
MD5 92c813743e42bf41329a12b12be4bf24
SHA1 53f7963b47b4933d23ff97800ad9fc672941c953
SHA512 6cac0c2962d3524155b7839f8f7a09432693141d344c95f93af2b534011a22c5ed6bad0027e812d8b6fa7ffcddc517f7e27fbdc78cb7d0773af26d2270c72700
SSDEEP 12288:nyY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:nyY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T14B6523F5E748ADC6F213027212A14AD6C5D04CC1FA5854EB5399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 48ee49bf1d340e80257edd360b014bddfa0cdb282781c31048cbcb42adc9fdbe
MD5 9cf38c183fe638f0906822585707f8d5
SHA1 16dcdaef4b801b85bb59ca8ef6d95aaf0df43dda
SHA512 dc34a69eb4b810f8d5e382593390c340bdfd8e1c5afe2384ebdb40798f1e358f113f1e9c949b7a2c0c410f8f9174b049b131a1ace82db8775b8e81e724c0d73f
SSDEEP 12288:t9Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:t9Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1C46523F5E748ADC6F223037212A14AD5C6D04CC1FA5850EA5399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fda07ff148b4467a88e8a1076bce011c679f024a12a0e2c79853dc3b7ef4b717
MD5 d670c3526361d44108b4335072b3c5a2
SHA1 0af36413cdb8a9a7f0229ce183a26ea4c85eb40a
SHA512 7e6d5f2ae86de22d502ce6c5188d6d8b9aa60bbc8ae796066013d85176c0094ececfe0f5b073493456fbe0edcaaac63f7aa4d719ef029b40a84145ff7e777342
SSDEEP 12288:ghY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:ghY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1BE6523F5E744ADC6F223037212A14AE5C6D04CC1FA5854EB5399B172BBB1A3C7468AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ff894ed70336894e5c4fe2d1588a58f8c347389ba0e5d7c1771ea4c509dee5c1
MD5 a7bb5754373e7e790b16163f95ecdb79
SHA1 9af50ab5ed4e0a1208f6a964bed00c574272e74b
SHA512 300ee367638b2799101a58b3e722450effbe3e03ac4091c159960dffed4e4186638b3fc3b87cc1de7660c97b145d0a9869e675c58ff08c258c5ddb743b9f8447
SSDEEP 24576:oZMSzFVSOpY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:oZMSzfN/Jz83Zxq0JXh6k/
TLSH
T14C8501A5B3501CF8EC63823AC9658946D6F27C995B60C65F03A436676F333A01C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 699b2f1a9deabfa698d07c5a490cca087eee14a0f331c8cce8706880688d9c68
MD5 add5e277c578cb73643b5f9421c41453
SHA1 171d596a002748c9224356837b73b07d20851576
SHA512 718f03a842c8e13d2e887e7ecbe8869c7c0d779c26554cfc2b6527873501be084f1e8532a616b98f47fac39d32413fc78771f70fe735f9ac4f677ab33b86740c
SSDEEP 12288:W4Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:W4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1BA6523F5E708ADCAF223037212A14AD5C6D08CC1FA5854EB5299B172BB71A3C746C9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 99cf974cf2ce9fcc7393ad13deb78f4032a7d36f8aa9a832d3dc5306f12eff15
MD5 018852569403d27e7b188ca3bd69cf9d
SHA1 33f64f3c03cd58daf1517e43e4832ff4b704b454
SHA512 b8de5ff4475ecb23617e1cecb94c55e71ca3a6d2eb01f08ce445493add4b6ae2792cba3eeaeed6377ccabb555b2ab3911f72c74accec7465ac3ef8d987d6f0a1
SSDEEP 12288:SkY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:SkY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1D16523F5E748ADC6F223027212A14AD5C6D08CC1FA5851E75399B172BBB1A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 09bfd572bac654a202af7ebe717c2009f3b229bc6a5bc362d5af7d79c331c78e
MD5 425b72324abb491726577613a3f6442c
SHA1 9917f17ef6006d835fb1e6d709bab79cba3d7dbf
SHA512 29866c30713d76158c549e9fad55239fba4a3f0b118abce5ee7d958255df7b317bc3c66452f88b257389627c9e66974c9420d1a33bbe80f47085b9fd81ade78c
SSDEEP 24576:OzylY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:OW/Jz83Zxq0JXh6k/
TLSH
T1C8750257B39430F9E177423589A20A42E7B1BC7157248AEF13A453762F336A4AD3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 720ac8dc05c4d4981b3a88cc44e81706d3efb0adf51ab710963a406699eb780a
MD5 316aaab7567c63cf388481f34615b650
SHA1 c93836f3d6122d2835741860e014f0108ac2536a
SHA512 fb0e6fe2a3e4abb89c7f1ee1a5b98585a93d48c0ecc18d6aa858e1a7f92231cbd16b0a228abcf9e69fdac2167cc5008aedf97ee4b10f26d607684b9e70308676
SSDEEP 12288:M4Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:M4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T15E6523F5E748BDCAF223037212A14AD5C6D08CC1FA5854E65299B172BB71A3C746C9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 045c1555f3e99f965d2d770194e09dc2b4fd9eb697e6bc327f3d363fbb5bb6a2
MD5 1e968eb24a23fcaa73411dc1a2c9127b
SHA1 1a902aa94bf61c72fb8c270279c348c37fb88b22
SHA512 adbfa659b5f8b5ee8f633df94af97795ee3a66e0ba99fe8b6f78fdb407de9d80e22e9d00549ae1f607d00240a8382a4404f1a20eae95561d4f031622aa158d63
SSDEEP 12288:b4Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:b4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T11D6523F5E748BDC6F223037212A14AD5C6D08CC1FA5854E65299B172BB71A3C746CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f38458874014999c32408f8c58a8141af13e1db0181e569a31a8450bd0f1e839
MD5 9e778a5e987411420b43285d51c9cb42
SHA1 ab41a7617554cc2f11944f8d471a845d602f1066
SHA512 582fb0fbc2635477971ea4a8f52ee70941717399e7b2bc9b469d6babb8f74805778d4ab75a167f2570cadc3e85591c104437524e39b551e9bbbb5aa5f61c72e2
SSDEEP 24576:hzylY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:hW/Jz83Zxq0JXh6k/
TLSH
T181750257B39430F9E177423589A20A42E7B1BC7157248AEF13A453762F336A4AD3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c3e345ee592d6d39decf550291c23180b12ed5946917385481a052a623384202
MD5 9321c3d38fb29ee5df4ce0aed5fe3a1f
SHA1 abe23a05e831a15724f17722348f5eecac4b2e6c
SHA512 9dd99bc7479d0449e3f5ea6671592db09c1035767892ec851bf57af9e13420bda3dac97bd6931dcf3a34b0ebd9b758eb677d110c087636ab3c7af22fe117a60c
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBQY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:AP4m4IpOO67W8K+/Jz83Zxq0JXh6k/
TLSH
T16B65BE2DABDC0096D0BB913485658A4AFAB1742A2F3286CB1160933D3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 4683434744fe309eb939601fa7a61ada01294028e8eb84abf7f4322b36b08603
MD5 05974a812cbb9be3c57926edf394fa84
SHA1 9809cc8faa8314856c04828dd84ed049c6a47239
SHA512 80661b6632c56c42d909abd204f56c52c8a52c13965f2652eceb0752fd7f40afe55937fe568cdfcd6bfea7cf45c53f589c33b49044875108a9ee6350bf90336a
SSDEEP 12288:NNsfoY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:ioY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T10475F169D24812D8D06E1232C7914A81F3637CA1A7E0D3CB53D0F53E2F766A4ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d92c716b3ad6a1e224ecd6a4cbed06f43567476d6b32bae4f6a4ab4371a1ee50
MD5 97ffafb6b5aa5d0e3c57f1c8f3be674f
SHA1 0237b8e6e0913eec448ec80f2c37d400561b493e
SHA512 4c75fab657c54cceb95d908dcec28500bdbbdbb01286946231d33a43ed0fe547f725a95dcdb049e6c54961982c1e9607ae194b7be466fffb0c447e95dbb0f5af
SSDEEP 12288:gIY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:gIY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1926523B5E348BDC6F173133212B186A1C2959CD0FF1490EB6244B2767A71978BC78ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 76d6b204010cd0f75eaf1bd22882111b1543bd046638c18f7f4dc3de6f0987ad
MD5 edf8c44af9c47c4f90b64ab88cd66c2a
SHA1 14298b986f930f32334c8ef6b89734d70fcb3187
SHA512 9c6ac9a789ab379cd4f5594bd7ddc3133255e2fa4713341c07fea8bc364316b115eb3bd676937eeee47964cd3587372360e17f5d09aab4ea2da75e97d83c8498
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQy/Jz83Zxq0JXh6k/:Wa0hNYG4Jwt/JAxq0JXhR
TLSH
T111859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE84D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 4de644562f2bac368c02bc100060ee8a2f9675c2fcea94dfaf9cbe6f4a9f9904
MD5 a78d2d80fdd2f9051b2db408818a400e
SHA1 3903d33316be985bb55d46a6032b04b0ada60e56
SHA512 75026275f6848e4107ccd149e5ad9cc6dc738baf883c182362da853ea1ea3ca6eb0623487dc2190ffdd80463d6148e87f5640bfd759c2e1290cce538adba6aef
SSDEEP 24576:ShbHjP5Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:ShbHjh/Jz83Zxq0JXh6k/
TLSH
T1DA6512BE639C24C9F172927952A18646C371BCA1271093EF13D1927A5F37EE86C38F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0c5e13058062cd7ed7760deb9ed6c24a1cb8fed785135851b97ed845d43a89a5
MD5 237edeb0c689e6c56081fa8117d6dfd3
SHA1 6a144d8aa49523de7c9050964491c8f94d628bda
SHA512 970add4e753ab5c0db980405fc8625149b936a80031ead307fedd81b9b7d37a3f000b25fea2cd9ae5795cd6d7b53b232fbc6db1f4ee4a1d44134ccc8363a6c57
SSDEEP 24576:43YgnJcRTk4yti+R5dBR/xY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:4IgnaTk46pBR/x/Jz83Zxq0JXh6k/
TLSH
T1D345BF2EF3B910B9D8A6D236450147B5EB71782D1F209ACB0170C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 41bbeb52e777a1a06d8e4dd9f55205df1053f6c5056687d294386b58059b9d26
MD5 a44bba94a47317dc9fe688a29bbd415b
SHA1 b16fbe91a129203c5711aadf115cecd5cf691ee8
SHA512 2e3f65d21a874222cfe9be260fd22ecf47aaad07c59b9b1222cfddac6dfa12f0626085ff37801b043a2894f9f3981ce582846e05a1ba3ab93455c624be9b5b55
SSDEEP 12288:g0Y4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:g0Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1696523F5E308BDC6F523037212A14AE5C6C04DC0FB6455E75299B1727B71ABC7878AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d7ad18b05432a6730be1575855504fe2bba6d967ebaab4246a93c609565e3e7d
MD5 16ba4604e6384e140bdc345e1ace173b
SHA1 45edb058b2f69306018a37041d28855777d4c813
SHA512 c9473a22cbce389110f58f146af8db9c48b645ff9bd442f31c9646c99a50302348069391df6b25da9c20ded67ce25a1bbb05275076eada4e6edc13d1b4fbd750
SSDEEP 24576:FpL3UTjY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:FpL3Uv/Jz83Zxq0JXh6k/
TLSH
T124850155F79404F9E977823885B28A12D2B2789C1764E7DF03A84B652F237F54E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 058504390ee850929d4fc172aad9a59b4964e79bced6352b8c02ce49e9d9c731
MD5 b470702387dd4fe7649a1dcf6a113115
SHA1 6dfccb3c2daa4cd407ca6d8c936712cf3df8085f
SHA512 2fae4b4175f965669bffdcd1b641f547e98dd9d09a211f3028904c80af5cde9a1b69083e5b52619ccce3cbaffa1a15e721e2bf3b9221b008cc5edf86612d8cdb
SSDEEP 12288:tpFtpOPY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:FOPY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1CD750269739C24D5E176523946928349C3B1BCA1672153EF02D081BE6FB3FF86C39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2edeb395a1878c4d6825ffbd91b6f92112e0bdd9befdd262d404dd2a39f6ce91
MD5 5690b130a07f63aca3546ebac4292561
SHA1 c95af92fb44a92b4975d592d7c113e79ed94b7ac
SHA512 72b882deb5b74dd684aea3708726a3d98d69f22510cd75f466d97f736d6573b999b7f666a2f3bf2c1c623af10230a1dbcdfc4610724adf6407d1d9d3a74a9711
SSDEEP 24576:Y7NM9YqZqmWMUkPjZM48Mv6bEhs4Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:Y7cBWMpPjN8DbEhZ/Jz83Zxq0JXh6k/
TLSH
T1DE659E2E6BAC81D5D477D13DC9A28246F6F1B8611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7b53552b2eaa4dd28d5cdcf15296e2f3b8c5398cffeed714ce561a0721a339e6
MD5 e291bd6663f81d9c5a3d51a25c03ec3d
SHA1 c230694a2cd143abd7d855c8a4fee9b753a5c320
SHA512 3313249609e785efb3c31317f335b83be2216fbabf3c445831c9983b5ec0ac15d7504bc58a180950ae65348b109f417dc38ffc1278f47b4a4e05be96efe60aea
SSDEEP 49152:OF2YuHNETovAvNYf8kmY/Jz83Zxq0JXh6k/:/6BCf8kP/JAxq0JXhR
TLSH
T15F858E6967EC80A4E0BBD27D45B6D286FAB2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 05af4ca91a0c5f0ac9abd49d20d56f31a03cf89ebfd2c4272877b846e7bdfd25
MD5 e0a377d13c8eb47c89817a94fd510468
SHA1 e91224cb61a2fda9725e87f4402d7f6de522b4cd
SHA512 87244230cf8f11f2e485228f624643a924ba0fed3ec707b4613f3b112282fdd7a4406a1e97c62e083536392ec3162a8d76b1595ecc901f12c7d7e1514d0ced8d
SSDEEP 24576:lAFs06+Omlf3NXEbTorY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:qFs060lVXuS/Jz83Zxq0JXh6k/
TLSH
T14C65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 398967ebfa61e0d174ae65165a0308509ed9dc50d976cf5ed682bec49578507b
MD5 f3bad63c64eac09ca06e56ff2c9ba8d7
SHA1 54912ba45f4f0912d3fa9830ae1365f59bd662ac
SHA512 b0c79d0455acc4ea4a35cdee2526acea466bdca479c562c5fea2d40ae16f29639bed8de9dbd9c76724f83540f3684880799fc58224deecf9a0e9dcbc67df4b0d
SSDEEP 24576:pJnJ5D3WXSY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:pJnJ5DGXS/Jz83Zxq0JXh6k/
TLSH
T12C85D03DD29810E8E4B7C274819A1796FE72386D2F2269C714B4D5353F22EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d0c85b5d8cd6e43d2e83847364bf21917e46f1c2ce40d93111fbb214b82afe92
MD5 55f7ae3c00040af3758100563687fa81
SHA1 6c39f01d7acba538cfc978d471cf75e91658dc23
SHA512 3ba25c3fba647b8d7693145d2b59b8a62696100a5ee7af1f31a6e206f86bedd65684211bac4616172e021ce0704843faba7d1f0429b5a55174d44156a85c83a8
SSDEEP 49152:Og06DIKdwc+eQnSt65aVc/Jz83Zxq0JXh6k/:Hm/JAxq0JXhR
TLSH
T15A956C15B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 4c57d8af91ae7580e6d85331981b4f0cf5800b741ad0fa8da7bf806a54b0724a
MD5 5e7b97b25155ff41ddda950878dd8bc4
SHA1 bfdb36ebe0debbc91dd1177220456ee00068b644
SHA512 f3eba1133b65c2bbbcd98a16c7230236ce72fbf94d0fd6ca1b84940da1cee09ddfcac422ee22f6d06d84f85fdcf4392412976af0f04c343b8f5c8eb5b9ba6273
SSDEEP 12288:AEP3RnOY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:bnOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1D66502BDA79CB0D9E126513942A18645C3B2F8A07B5127EF1291D23E5F73AF82D3CB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 8c78766438652017dff9103c842e84aae1baa1bf95c82608d5fc3aa5a3743c66
MD5 07d68ce7259a4bea1baae39849d95bd8
SHA1 c8f0eece6909612b01d4808f60f4a2ca92689e97
SHA512 c03942827f72f8addfb02b57d5fc73cc7b52aef5b1bd41ec4a7ea6992c1e17d3168441feed90518d643f2452a6670d7e83a5ca9175a370b46a5a98dab90b7020
SSDEEP 24576:NIyJY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:NIC/Jz83Zxq0JXh6k/
TLSH
T1DD751254A388A4C5F676023556B242D5CAB1BC60BF2052EF5190F23E7F72BE8AC34F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 4ab308d80247ac01311e96c52e5945cd848e4b08b68d83188d8a5682b39077b3
MD5 c2c373fe0128b3bba5b1e84e529c3c26
SHA1 329c1694f2f391ad65b0a1a74e0020af8cdee5b0
SHA512 640988cc40105c76c92b0be434bb09d018c598f66d475f9dd529af983fd254161c3badc85ac25651622f64300b6763a3742f0966c3af2b6028835043ab078253
SSDEEP 12288:dyfY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:8fY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T1906523B9E344BCC9F523027212B14AD5C6E06CE0BB5464FB11D4F176BB726B87478EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5f8915b6ba4a09205c4233167a17675b6da5f32c5e9fbc65da8c697592630c91
MD5 0bab535ffde87d398bb8ebed4a4b5426
SHA1 1827176a3d843688e893008ffb8ec9d44f3cc7b9
SHA512 1bd54b3aa513d128c9d5a80a187f033345a3ea49e07e5abbbee177beb0ed93c14bf8f2d3b9a78f2fde6ab821ed0faf0972fdfe625ea88951f0854d4814ac20c3
SSDEEP 24576:aQ9MxZKdcz9dw3AY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:aVKZA/Jz83Zxq0JXh6k/
TLSH
T1FE558C2DABE9198AE173D23595A250C3A673B4301B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 b0573aa1ffe87cd04796a0748b38321990838285b05885999501e000f83015fc
MD5 68d46e6b4bc440a4b0648aa3ec59cc05
SHA1 c06f4cb1eb56356bc9b90ea48abd714ea6b8b9c0
SHA512 0aba5631e924c24ffdb8d665efb26f3588b57c1eed33db6011bb7931fcac47e5f888cdcebb022119a5bd73d49f85b905ccff7d1f98df6500db48352e34dad88b
SSDEEP 24576:CyocDApVY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:/ocDApV/Jz83Zxq0JXh6k/
TLSH
T17075E06FB76940D2E172823889818745E7B3B4706B6253DB5291C33D9F33AE8BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 65596fa599f788df414da52eeec6d7a8505b6ebadc09064494268e6f4f293a26
MD5 74f580a2ef3664611f4f4560c117f84d
SHA1 52eb0691cc222dadd75006ceec818a196eaf2284
SHA512 3664a25370273b546a8f5100798e85d275e2ca7e334005ec7b907f386b5ef851ec86ec2ddb06405bc86346e382b48e1086c57ede7fec184a1a2f40457587a790
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKV/Jz83Zxq0JXh6k/:i0zuNIj/JAxq0JXhR
TLSH
T149A57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7dadbb704e1509a8e0fce4ac21fceaeba7d608d4e8d62ebb42cd5c4e8a6c25fc
MD5 d58f35ee170240eba0401d1b2895d383
SHA1 c7a191ddb7fe3f674b12e6bd223af62986e96e68
SHA512 209735d38cb8c952842cede03940864032931e97b18d98b79e1ca02f536b8149cb20ff83f36f961f651cf84f395557a34f20fae8d8566174257edaaf58cd8b5d
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqbOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:PTDxR+N5YzTfjMv/Jz83Zxq0JXh6k/
TLSH
T18A55B02EA7F815E9D17E86798A23C512FA727861033193CB42A0C17E1F779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 8af248298d7831238a3e3b74fe2f5bb06f96a1ff425095b1eed447bb7962c24f
MD5 aa1e59294be00b1d10d305cbc8c8c68c
SHA1 957f78fe2b7c9d782031e8bf141d391867d59f53
SHA512 38bb425fe63406df42f82c7edc29297e136de7c91c3977deb305e7f07af28b53aa65517ffe921b70bd697ef3d99117aacca66623ff5a0ca2354d9e0383546362
SSDEEP 24576:UTMdOz0FFS+imSL6Y0Juaz83ZxXVk3MHJlNh6k3QGjdQ:c0K+imSL6/Jz83Zxq0JXh6k/
TLSH
T1A385F17EA36D18E5E47BC27D96538906E6B238A10321A6DB02D0C1793F67EE4393DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 74e0f07c7d7c59b340481474210d90739acec64c7afac8ecc14534287995b32f
MD5 cbde4bd150deede01fc4805ad404e470
SHA1 b73a57828f1e216c1886b9e43e49f3628f2ad402
SHA512 13ae63f5adad2875c33ffd6e27248ce2d986fe1a3487a3111c80f3f70bdd78a558dede01fbb5f52d910b3300d325a395deccbd2edf7d25f80357393c4c36197b
SSDEEP 12288:W4KjY4NJuanz83ZxXVY9Jv9n3HgRHJlNhOyqfSMmIeQGjdQjS:kjY0Juaz83ZxXVk3MHJlNh6k3QGjdQ
TLSH
T13965126DA3D838C4F473523196724695C2B0BCA1772456FF21D0D27A6F33AE8A838F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/752-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/752-387-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/752-31-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1068-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1068-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1292-200-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/1336-193-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1336-115-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1336-109-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2068-192-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/2200-22-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2200-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2200-24-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2200-352-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2264-376-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-386-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-356-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-357-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-360-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-359-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-358-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-361-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-363-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-367-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-368-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-370-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-369-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-366-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-365-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-364-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-362-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-371-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-372-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-373-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-375-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-374-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-377-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-379-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-382-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-381-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-383-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-355-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-385-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-384-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-380-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-378-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-394-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-389-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-393-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-392-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-391-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2264-390-0x0000021DA6C80000-0x0000021DA6C90000-memory.dmp

Download

memory/2644-98-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2644-93-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2644-189-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/2708-187-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/2708-70-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2708-76-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3036-197-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3704-188-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3704-86-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3704-80-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3944-198-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4112-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4112-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4112-64-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4112-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4312-126-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4312-194-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/4648-353-0x0000000000CF0000-0x0000000000D15000-memory.dmp

Download

memory/4648-331-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4648-1-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/4648-8-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/4648-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4844-351-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4844-12-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4988-201-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4988-150-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4988-346-0x000000000C9B0000-0x000000000C9B8000-memory.dmp

Download

memory/4988-349-0x000000000C9A0000-0x000000000C9A8000-memory.dmp

Download

memory/4988-166-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4988-184-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4988-347-0x000000000C9A0000-0x000000000C9A1000-memory.dmp

Download

memory/4988-437-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5228-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5444-202-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/5460-199-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5484-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5484-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5484-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5484-388-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-191-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5748-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5752-190-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/6084-196-0x0000000140000000-0x000000014028B000-memory.dmp

Download