176a2da7a17b563ae36225905cb7d6dc4bfb59fa38c7762a5b6eb1c69c371bea

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample260517-llj5eaas8p
SHA256 176a2da7a17b563ae36225905cb7d6dc4bfb59fa38c7762a5b6eb1c69c371bea
MD5 13e3a3939e474dd623186586adb64017
SHA1 a247a4f798d634515b48e5eaa6d9c0a590da462f
SHA512 a08d62380c7390f1ae6bbd95bf1148c1621b7aa3fab4a4edd9e19b143283b092f143048097c51b7827518aa4bac5009196ce0f38fc7dc7b3b7c7ea98a210c64d
SSDEEP 24576:G2zGxmsgixOFthHE8MEX1XsdIAhb0VECwN:GcGssgixO3hHE8MEXWI4bMQN
TLSH
T13965120177C0C0B3D9A32A3445B49BB16ABEFE701F7449DBA385172A5D742D28E39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5728	alg.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
1320	fxssvc.exe
4216	elevation_service.exe
1148	elevation_service.exe
4156	maintenanceservice.exe
3984	msdtc.exe
1856	OSE.EXE
5208	PerceptionSimulationService.exe
5724	perfhost.exe
3256	locator.exe
1972	SensorDataService.exe
6076	snmptrap.exe
6056	spectrum.exe
5232	ssh-agent.exe
2092	TieringEngineService.exe
4992	AgentService.exe
440	vds.exe
5772	vssvc.exe
2116	wbengine.exe
5996	WmiApSrv.exe
2436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\179ece845a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008edf1d2d65e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8bdb92c65e8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc30ee2c65e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006aa6032d65e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba5c982c65e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008858f52c65e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a698932c65e8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f432cf2c65e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe
3508	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	1320	fxssvc.exe
Token: SeRestorePrivilege	2092	TieringEngineService.exe
Token: SeManageVolumePrivilege	2092	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4992	AgentService.exe
Token: SeBackupPrivilege	5772	vssvc.exe
Token: SeRestorePrivilege	5772	vssvc.exe
Token: SeAuditPrivilege	5772	vssvc.exe
Token: SeBackupPrivilege	2116	wbengine.exe
Token: SeRestorePrivilege	2116	wbengine.exe
Token: SeSecurityPrivilege	2116	wbengine.exe
Token: 33	2436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeDebugPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4792	2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3508	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 4388	2436	SearchIndexer.exe	115
PID 2436 wrote to memory of 2872	2436	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_13e3a3939e474dd623186586adb64017_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1520

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1148

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5724

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1972

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4388
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07fa1829dfd1cfd5a4163f6eab93fd7e2a6f57c4298377b732af101078a97c24
MD5 3f8beaba1e15cc674787f15352efe248
SHA1 df309346ac7a940ad35407392c613d1ca4acae5e
SHA512 fbbf831a5c64c2c3e60d46da3449ac6e4d5e70a68d6c1b734b7afc94558c43e849c88daabad1167f12f350b351519cdd13ab5d1e1c63fefb3f8dc4383d615abe
SSDEEP 49152:Db+632BuPkFKRrdE6ohQstBhuXjfS4LWxnrixO3hHE8MEXWI4bMQN:h3q6tjBVo3tzfG9btN
TLSH
T110D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 13edcf0d6e1a8d6196409ae044396310abecf2a19574810ed33a559b6fd5cb9f
MD5 f779504befc1b766b94c72e9d9b3ff66
SHA1 2f21dd71b67de935bfe21e52fcc39a21fb8b3d4f
SHA512 e5cab18307fca4ef7cbef513f00f3dec5226131ba58d024f909589dc4e9fc33ddcf6b58ad00d166982ab5391333cbd625899f71b2194c7ec9b57c33fe9c1cdf0
SSDEEP 24576:qXYfDtczAyixOFthHE8MEX1XsdIAhb0VECwN:xtcxixO3hHE8MEXWI4bMQN
TLSH
T10665F12977E405F9ED67823CC8A28615EA73B8950760E7CB03A499361F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cedb8443491e4d2e060de455d2721065d6c9d98f99f9d9386c1bfafe1bcc13d7
MD5 6d1e65965d40ce474f383290b537ddfa
SHA1 d9951c0de7177b572353dfff868da7175484b491
SHA512 a6f6f2534fe6ef52e2330ed1608d8ccc9f2348cc09eab520d7c1004b4f3dd64accb6fe345951278908ca5f5a275356e0c74c008399b1d8a275c540370eda01ef
SSDEEP 24576:00Le5ji0hmxQrMTixOFthHE8MEX1XsdIAhb0VECwN:0Pji0AScixO3hHE8MEXWI4bMQN
TLSH
T172859E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f6d283ee5537abd995bdb0855f596f012ca8da1f72b827723f1f22e3908f2354
MD5 a1bf63c04f378e794cdfa65e3d43bdcb
SHA1 5ebaa950073662508b928c0cc0100770f5ce9bb0
SHA512 1526c67e5a02d6899867453fbb5002ccd59ff37d82cc76dd1888e68c3a1f6436d97025c9d5bb487926b582c3039182c638bb9ed8b8daff0651584730f8801c92
SSDEEP 24576:sa7/ezSC6vUyDZaqgrvWx6q8wyuhixOFthHE8MEX1XsdIAhb0VECwN:L/ezSC6vURPvMHjygixO3hHE8MEXWI4H
TLSH
T1F8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c84d82e3858165e01836eb1a06348bfdd2a1539e138a06d186254874f8e395b2
MD5 e02531934d2771775a2d1cae3e475541
SHA1 41d391438f6fc1ecccfd87e9b431f0659a567b84
SHA512 6667cc00be732bd1f4577438cbc294ddfbe38eb71298dc0dc639800a8508ce048099aa00db7bb67aeb35b5fe815d18d4ef8d9deeb39088c56b44870615c7eca0
SSDEEP 24576:QVbqPb88hv/lV7uixOFthHE8MEX1XsdIAhb0VECwN:QVO88hXlVqixO3hHE8MEXWI4bMQN
TLSH
T12D559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f04eca94bc49ab3556c618c6b6c8f49a2013c3d55c061a23a9e10760058c3b9e
MD5 c264d4e7ad5ad8936c6508c8c90f9a7c
SHA1 b1dba47f82af2a808eef10a9fde3ba99a32bfc5b
SHA512 b65a58915901fe5dfb591fb3f5285fa923b7fe909579c1eb6d157f4a8501caf12dea62523a2a577c7653ce02772febdc6c2d735bed73c2023f282b81c803d23c
SSDEEP 12288:e495i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:e4/ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T10C552343ABD481C6EF8F2B3C60AA67FD66C2DED0185449C3C2533676647A2D6C93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1886b396818880800563e23b48ffe5bc73a33d6bfc23209760e20273af15f8b9
MD5 82bc6a23c382ca9a14b68c9764b9e455
SHA1 f2922c5db50d3f41504099b732958bae3e83374b
SHA512 455b4deb410826a05a8f525b46f5d796e8ddee5e8c66ae84a08639e248aa41c98f9261a376df4c3ab6cd5cdaf202280d93677a37e9562e1b5d693421530f623e
SSDEEP 12288:neBNUbTVO86UO5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:nJIU2ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19775DF2BEE28FCD2C67E5D7856918740E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 314ea6fc7585fc102a9a5917c9a092ebd79a37adaf4a111624ea8b7ab8e5e827
MD5 ac6c5d392b4451bf96ab06fa8c07fd21
SHA1 f272a21e3e94a8566785ff6bf790ce77af4e4fba
SHA512 b9682d6e292d9876d47f2c1ac079b111c4c06fdf897d5b967fc17852464100c3f1039287cda9b470bc84a13a2b019033541fa02f8a19d192eae37a18af5d9970
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THh:MQvGAdlCEL8c/pRNw5C4o3tzfG9btN
TLSH
T117267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 debe79b177110f377d127abd1c003b947c51ee1b8ee0470f9420b7ca381c137b
MD5 c29218f99038a2ef3b2d3ca57aa0be4d
SHA1 846de0b703e157966904001c76d35536a3523006
SHA512 95b383dee136814a00c1d44143f20bac81c1a2f8d520a9865e5d27503c9cb0dfdba669dd1e4d36437976b46a2e02cd94ea8d047598bb43ba5da4385424a43b9e
SSDEEP 24576:63ewsAjMixOFthHE8MEX1XsdIAhb0VECwN:cljMixO3hHE8MEXWI4bMQN
TLSH
T18175E031FFB4E036C6BF0DB61B26C716146DBA600F6119C3E3A84A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3e704fe63e4b9164f1956364dab3ad493b1d1dd580457e3e4aeb976d6d2d669c
MD5 f313e8f6bc8408bccb2c259a28812b63
SHA1 96af38fb6f2177401fcbd2714e1098566f4935ec
SHA512 fc5db872afb832a37c1354d232511bc8f91f00e07d6670b33a3b212b5df132e2a70f1c15c3f04a3329cde31431aa894d70ea900daa4d6b92a1a90d6cbb4743f8
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHA3U:gUEtQevvqc2W1cpV29I32g
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e97ffc0010bb39947c95d00e02477654ced81695a3da771beaae8d0fe78057c
MD5 7ead0b53a1039318b115972e2fcac5b3
SHA1 70ff74c0d58700c2695408c7bf6eb91759cbe56d
SHA512 c1cf863b192e1a25b2a1c46f9bf83b11baadb15b879757c5915c9d4b76f0fa051096bebbaa10fa5fa2dc8b436e266eaf2850275e408ae123a077e726bbcba6f6
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zsixO3hHE8MEXWI4bMQN:CoqtVjnm8o3tzfG9btN
TLSH
T10CD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 edf004ebff5b899b03f935c04a414e8e99914475b5dd80496635790570e71f0a
MD5 9dd12e471990a64100dcbfecb0537696
SHA1 df5bf8aa3e552d56f240c7e59096068281ea46dc
SHA512 ce1cd187f1bf2d913cf08129e2537bd8c7341383987f6a256fbe467d5eeef7177ba85ca720519bb435ec367f4ccbb497e2733eb2c25f8efe3b776fdf8c411a6f
SSDEEP 24576:CAhGLmIFoiwtA5l7S53lixOFthHE8MEX1XsdIAhb0VECwN:CAM1Foiq51ixO3hHE8MEXWI4bMQN
TLSH
T14B359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e19c5d8211dafced40eee05ff9eb6fa282b633daa47de45267d2b0a703a4a74e
MD5 d21f4c4d8aaaeac1f6f734be3f1ec5a5
SHA1 8c926b9dacdcf14f02edec0718190aa6ceaa32c5
SHA512 0991515e3498f046ed2e67c3acc671ae0d4e8d8180f2d89a309fe40ce1b0e390acadd7dea8200788b19d0f7b4fc762b0df4581d3ff72dda66a2ad76e88b01c94
SSDEEP 24576:IwumOWAixOFthHE8MEX1XsdIAhb0VECwN:IwROJixO3hHE8MEXWI4bMQN
TLSH
T19F65F14677E408E9E96752388557C236F7F2BC112A21DB1F4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 21ae306a959355e5dd112c03b2bbb4e7c0a03b01c97c8548b90210a5e451e351
MD5 fdebc40f7a99ef17401a1744ae76c774
SHA1 e8299a9e6f19a90bdf8dcb699d88f0d3d80cabcc
SHA512 1b2a996d84e2059ededbd4f36cba9e2eef6007af9cd6da0c87ef2e9d555a6c7a8fb936d8eb7dfd79a309cb4ec877e2f77c3e4dfe5d7c962d462b9bca04f82504
SSDEEP 12288:KhZ1Iyk5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwNH:YZubixOFthHE8MEX1XsdIAhb0VECwNH
TLSH
T16855124A37E461F9E597123CD4E55799D7F2B8A2273143CF422202662F33BC65D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 28f5d7909f865e5407acd9cd94f7503592a3c814c373b9295452119f000fbbd1
MD5 fbd91d701990293dc9129093bdc8a257
SHA1 a38f55a9fe3c4c273073ae202d0257c571e347da
SHA512 e76fc081ff20d856e5d685d695a700166d626921b40f42468d6b0ee114cf73e6345160d25c8198169d53941c6361d9ddfd2d94495eba5a41d34d7ba66a9435db
SSDEEP 98304:MQRQyi36YOcPuLvw2gAf+PN3ho3tzfG9btN:TQyiKakX+PNi3U
TLSH
T128667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2f136c8327d1871fd4fb73d1dd58c3ea633262bb45306b1370a6f2fc6ace78bd
MD5 a0a4c6a53d80e3f0aa0be65916533ae0
SHA1 41ae9cfcf9dae1b6f146612b23c05da7885d114d
SHA512 55e02c1cef6f0b968948c97d12afb0cbc779257fc5e74c67700627235589340c67559308d5680004ab370ea031ed14d7de113e7cb39bae6957ef62620143f21d
SSDEEP 98304:VQRQyi36YOcPuLvw2gAf+PN3ho3tzfG9btN:sQyiKakX+PNi3U
TLSH
T1EA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d14ed7527d2db043212ba96387e06edee2b69901e8fdec49ecc300325cf05c0
MD5 ffc293c23c76f517cca8f1609537fbd6
SHA1 595962e29b222256300e071d2958375ef273bcdb
SHA512 cb20e777169daf0268809aeba63dace785f377dad1ddfd32d6d270af32456f02e95f1226616e928a11fb61a4b270b6f6f30d856217258edfac26797cd5bbc8e5
SSDEEP 49152:P68Qg55nhxeWu7PNU3/cixO3hHE8MEXWI4bMQN:JthGRc/Ho3tzfG9btN
TLSH
T157B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a7b6721210744735705d41127cb1a5eb04b2ffd5991938a81c6f0d4fa07785f5
MD5 1e27e6903ea545424d6aab8cc21753b8
SHA1 42f5a68c582b98e4ee051a400cf26ba2d31824f5
SHA512 f67ed644f6d706d1104f6262b91faa33b526848ee00c3d2ce48f8a1898bcc3248b8089f77ce4bc97cdad067dc58cf4f2d12a9abba62182c3579d74d1055feec3
SSDEEP 98304:6y5112gYy5azzVvD69nLKnhZKo3tzfG9btN:jLIH+Wht3U
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 64fcdbf9e19a1430d7c1eef384441502760afd9a319b426a2e9268747dc8db0d
MD5 864343c8ed8688f1c845dcb33711d1cc
SHA1 08666c477f6854449e8d798727aa689fe824df15
SHA512 28e06d4b42f407d1cedd30862d72ce8bcb1429fe7049df44fce7f5a21173ddd1a86e00d90968911402399908750dbefc8b4a704ca5527044941b6d45bc847115
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCixO3hHE8MEXWI4bMQN:0u6JmQxd2d5o3tzfG9btN
TLSH
T109D59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3423cb8bb4aefabbb274e7d84bc998094a91ff924ed712c9686b9bf76c3f0393
MD5 6b888e26d57ca8cf3ed564d8d6bd624e
SHA1 bd7ac1de4bae846171fd064803dacece5038c8c3
SHA512 275e462a4e3ceb9720c0f6576b57421852293cff533bb0f550156a27f0a0dddeab3c61c8df51460313b610f48e47d65731d160095b2b25bf90663d178c01f465
SSDEEP 49152:Z1hpsNoJpF1A6yU44CwH7R4xWixO3hHE8MEXWI4bMQN:ZmifPVR8o3tzfG9btN
TLSH
T121B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 656ca442c0c42a5462f5da7fe89884a9e0e3f4bae8d2429cebc44b66d5071c37
MD5 bbd465895a8a390fafe32b2695f416fe
SHA1 fd025d48a291ef2a8875b1f801568e1f1c24637e
SHA512 f8d7266971bd61c81994d5251db5ecc266f8f7ff8646361536ec257bbcbeccce26f20dc0c0f2f99bd5c29e6af775b91b8623a9feac476ee174d92d1af7876df9
SSDEEP 49152:zSuZQIY0Be2KIRVtOnks6NMHqbixO3hHE8MEXWI4bMQN:x5dKOi612o3tzfG9btN
TLSH
T16CC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1ec584522e673acd5233c9be83df6c1c429577d6f117eb5a5aa559a1dc2af01d
MD5 3b42c569a6097f36e1c843127aa445b1
SHA1 85fa530b71b95aef6623c5d16624caf01ec0cfdb
SHA512 f3c1f4539a25d317ed1641013b9abb8cb86d7f6a0096cf4b46acad9656302d4a787dda749a5ab64e2621f63b73b9c924327cd621c111b98d6022bdf779fbc089
SSDEEP 49152:LhtSn8EApI0figGgiDn0AP5wyixO3hHE8MEXWI4bMQN:KX2i/phAo3tzfG9btN
TLSH
T1F095BE13F2D900E8D05ED178C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0c64d8299f1c00be007960f02f16060470bba4ba0339babac29529c639c392d4
MD5 2aca4a88500fec20aec356b438b50ac0
SHA1 bbebb96889689b7abd669c465ffedece79319710
SHA512 2a6f3d1d936966cb816300678cdf6c9da490a5163f051033653467a55764145ecc2918fec787f3151e3eb64e85d8bc6af1fc6a00d51b7599b00a73d3b050c82b
SSDEEP 12288:2F5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:2HixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T179552343BFD5C2CAEE4B2B3C909563FD66C6EED5281405C3D257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ac69b9cee6b942ae4b4148985bd7fb78edd362b87fd3c4c76c09e5ffd35f760a
MD5 8270897db64143b96d052d801fccd195
SHA1 feb9fb952b4db1a73083d632b37fd3b1c684a264
SHA512 c07b2084de2c4fbe679e834f32c3f5551d597b593ac951479ac6554e172c6eb4ae789be0fb55cbe0cdceb3a11a4ae78ee7005fbd278f953e90eab5cd0e0deb52
SSDEEP 12288:9I5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:9YixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1AD552343BFD582CAEE4B273C909667FD96C6EED5281005C3D257203274BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c0a51aec06394d72d2c12718c03716d4141a648977f6cb434a1def82821bf557
MD5 b5960addd0c92be622d3d1e5715a64e8
SHA1 f942e3341cdf73cd1e53fd28157df8241183aa6d
SHA512 bfc6be2acd97a128e0a957c096cdfb6f2170941bfbe8aae3c31a058c82d8e9ace100c3b303330c5afd647b129e7779dc3ed3c397c21768b0d5f3ae11012be357
SSDEEP 12288:BW5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:B+ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1FA552343BFD5C2CAED4A2B3D909653FD96C2DED5281409C3D257203278BB6DA993BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 64918b6c33abdac46ec0e473f4a475b1d4fc0b82b8a0bf07ac923bb5b0b1c46d
MD5 427f671284c1b9d729c953ed0e3d206e
SHA1 597b755d577aac65528a7898c6f86bd07c423c11
SHA512 0445416a17730403bf7f8b11b743e2499ef5ebc46bb00bd7e3cee3b07051131b2b036a6d5efd88c57fc5c11a9345395bd83b7c9e4c34f480feff0fdf7a6ab307
SSDEEP 12288:MVb5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:iixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1945523437BE981C6EC5BA73CC0A693A9A3E2FDD42A3156CBC20315261D733D59D3AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9ff971ffdb6c0b3fbe3e800a88c8d347c214f767e2ec686cdb5473465eb30014
MD5 6eab199d2bce4a29b01b92f1a8017f33
SHA1 3f21bd5f5b871c6a6474908652f9b07e69101010
SHA512 77e8a80b786515b1972fb9604152dfca41984eadbceb4881fcce8f4822ffd1c1a07a4ad4de394398730ce38196963a9facb0c21da3749e4c2973b5606c970139
SSDEEP 12288:Lz5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:LdixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A9552343BFD5C2CAED4A2B3C909653FD66C6DED5281405C3D247203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ac68bc4837e2ab6e821ca8ac27870bcd3f96c0363541458c60bc2c35207703c7
MD5 fe8a7791f4c8c9ca0f6731dd874bc290
SHA1 65c13d7c9a467eecf2948c138a81aaf09dcf6495
SHA512 500cc98f3804f8506fb4178a878042312c0a14c05bddcb8d96589f55c8949f4afa623990ea0ac19a016c421b6cfdbd72393fd5051fd02d23625ace694513b74c
SSDEEP 12288:Lc5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:L0ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19E552343BFD582CAEE4B2B3C909563FD56C2EED5281445C3D257203264BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dd9c702de8ff826cedbec9025f75c933d5a6991bbbefd0bfe8fd9b99b8068a3d
MD5 7639a37c5d6da269abcc5fe4f8b597ee
SHA1 de097f65f94c5287c1c57fb62587ab8df0522078
SHA512 dbfcef1f39b5fbce1e4f0e7477c195765ac9783c6f7ad924180b7912f1d3290d116a439c1da900c705d7e89c8ad2db04a6b6be850eea98e146420330ea8aac9f
SSDEEP 12288:SA5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:SQixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D7552343BFD582CAEE4B273C909567FC56C2EED5281445C3D257203274BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e154aacd62080323d48e6ed46a17e815dcede5480013b5b7715757bc9b4089f9
MD5 4fda79b02a931f90af2dbb44d318b3a8
SHA1 3e60678faa32a8f37f32a555234f9a064e2dce30
SHA512 6f672c5a7e765ff69efa172dc6b7c00f8fdb5593a3ea64c46275658c8e2a9d05b70373b05921eb9d01156a95e19dae37fae0f06660cae5b0bc76c20ad3484e85
SSDEEP 24576:GZMKzFVSO4ixOFthHE8MEX1XsdIAhb0VECwN:GZMKzfkixO3hHE8MEXWI4bMQN
TLSH
T118750195B39018F8EC67823EC8558A56D6F2BC5A0A60C64F03A536275F333E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32598ea83e26b51925c4eed47c0e81b668a6a4b511d1739d032518be083e9e0f
MD5 8259d1ab61c77c51626f1326acf6f9dd
SHA1 3baa5b162eec7af4fd180f129f7a3ed078e6447c
SHA512 277d8eb5d532f4b4468937ab6cbdfe6d3b213a57b37d2be6def376dd73a431a32bd44d5f55cd190490f9e2c780b60d7c528e8154a77f1bc2e440bdd33c0ea03f
SSDEEP 12288:nh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:nLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T117552343BFD582CAEE4B2B3C909657FD56C6EED5281005C3C247203278BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8f772d9ff11605f59cd49538ec6dd1d667ad3d28026afce6b69003b5d1f2cf5b
MD5 713faa14af54a736c5315b997da53a6c
SHA1 c044569d6d58dc84012a3538bb7b5baec157b3ec
SHA512 7fd9fa5f0e6618deef4525feb11ef9ecb51e1f6301c3898a15adc93eaa676c08ce98a341a732ddfe3a8ab4f7f7bd0456df2caebcc4db49c87dcdec7b6bd7506c
SSDEEP 12288:Bt5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:BvixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A0552343BFD582CAEE4B273C909567FD56C6EED5281005C3C257203274BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7170be739583921175642b5137dc987bff3d73d8395b76b384730b480c8153b5
MD5 0819b9a82c361db10242dba92101836a
SHA1 12e4be274cb81ed09c59d4bfc5ef26d7642085c6
SHA512 020229846de5fc5394eddb2ad5a0924b29afdeed0c1e29d4a8f8f8654454b9f59d0d179e83ee6673ad8b8b7e17905177369de2206dac7903a8ac594d4c9df7b3
SSDEEP 12288:iyPz5L8k5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:/zy8ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T16965020777E120E9D5675238C8A21B56F7B2B8720B208ADF536502762E376D19E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb1fefc87e0609a6a80d01de3ed9259a1723a03b89707e246dd3206db325ba82
MD5 3d11ce5071911e94856f8ac8de70523a
SHA1 c526e2e070d92bb006140cf050d069f885f852a1
SHA512 21135ea1630733e1ce96d0d9cef5135f66bceeaf7772fbe6db10419c7e92ae8c493e2cdffdfd588432d3d4a91e6c542deb2a9348b3e1c472a38f68b4b8e24e19
SSDEEP 12288:kh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:kLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F3552347BFD582CAEE4B273C909657FD96C6EED5281005C3C257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b09792a9897f6af4a3ef8262ba008401ef1c76c0ca792fe212c59f91126d00c7
MD5 d0d9a214bc3963ca37bce30f8c4d2cac
SHA1 25b113219e8a8d3e454e55c883bd6ec1e93e5ecc
SHA512 972b7b9f3704e10df9faac3a2b8b318a85c30770795f0a01dc190fc04aa34c7dac810e129ad6fa898b949f72672cd4f72482aeccefd655db9a3cb20109ddcaa7
SSDEEP 12288:Ch5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:CLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F2552343BFD582CAEE4B2B3C909657FD56C6EED5281009C3C257203278BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 45f65b1c85194d798fed8a211a27334400021cb683d732faace9d0f20594dd86
MD5 e23896acfb53823e0dd54e49f77131f7
SHA1 a0645e19e38fba39b0c2f2ea2ebc26f8d70f8e4e
SHA512 c9e03fd1ec8cf0a8f13f4905d7c0357b2206292d8a863cb7f92f1589a4f38292f978f7595fa0ebc2092031441ede5f8626fb35b4ae1f178ddf96c1680c3ddd08
SSDEEP 12288:yyPz5L8k5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:vzy8ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T13A65020777E120E9D5675238C8A21B56F7B2B8720B208ADF536502762E376D19E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b83a9908e98f10c5b27b3ee8429ebf4167d4311a1f8709062bc6b72ed5313ca7
MD5 49e051fd64abcb9683990bc1335b647d
SHA1 39710a391c1b128b60b005e6512b018c9052489e
SHA512 17a21259dfbf7cc62a4b9a92214465f78dc587e28a1c813870dcfc959a002eac553f75040a0e1c3a2a9f502ecf17b452dc1bc0154c1a8a54c69ee25c8a3626e4
SSDEEP 24576:tcP4mcvIjkGOxhKP2l71nNKbrh/8KBjixOFthHE8MEX1XsdIAhb0VECwN:SP4m4IpOO67W8KRixO3hHE8MEXWI4bMq
TLSH
T1D765AE2DABDC0096D0BA913885658B4AFAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 22acbe23b1f719dbcbc5ec3123628d9d94e28354ccdb1e758ed56dc656ef967f
MD5 ad77ccc0e2a8bf5dba6840aed3cc8b76
SHA1 c1859126c8fe3c394d09293dd79a32b0724ac27b
SHA512 1e05a5d8b515ab85c0d3933c55e2ca19a5773afe830ff3de8ff33995a7c4bfa6415cc3d449b555ffe4bac48674234f04344b20c97c571bb1520c34de520bf276
SSDEEP 12288:3Xsfx5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:ebixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17A65F10AE39842D8C46E2239C7564B85B3A37C6547E1D3CB92C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 70b01e5b696be972a31f58aa278fcac0447aac9a1a0599280aa350b2f96e7450
MD5 1b238a60bee9f20d546ed79d0352b9bb
SHA1 e3f6515a8d467cf6d9e9dc9c8bd6337db794a91b
SHA512 d74b8766ccf116efa2a93067fc8d2ef126ab93b86950047554b854ad1245d63b255d0aab83606ccd1e5363e65e0b4a72393a3718d2692f70be16441bec449755
SSDEEP 12288:/R5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:/7ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T10B552303BBD8C2CAEDAB3B3C505A97BC26DBFEA41E1485C3D103213664766D69D3AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5c6f32bd4e8e73b17c0156e21641eb4d1b0ca1feec5a758b4a7d4be5f4610479
MD5 f38861d9f3d61f807e56c03711d13bd5
SHA1 2119ce395730419fca6e897678cc1f2da218102d
SHA512 e482043e40c2d7a84210e523efc1f204fd7e670149f710d938e1bbcc39e34c826469bc638b28b512415fb1a538b61c6c7447aba4e7f81d82103e27a0de0658d9
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQdixO3hHE8MEXWI4bMQN:3a0hNYG4Jwfo3tzfG9btN
TLSH
T113859E1E67EC82B5D0BAD278C9A6814AE6F2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a0460ed2ac3bc8e5e5a35d17fa67e760a2e99f4d5b77c5fd668fd600e562d835
MD5 aece91b8c4bf427f197c0c1867162d6e
SHA1 9236067e2825695e031f6ff380aec27df528d2f5
SHA512 4fa3c135ef79aacb8e85fa45354d19f65a3057d594ee0f695fbc690c4f8d0aaae00e9c1bf3187a13a62a9b9502169f30855c401eebd036bf57a0722d43a6d97b
SSDEEP 24576:yhbHjPoixOFthHE8MEX1XsdIAhb0VECwN:yhbHjQixO3hHE8MEXWI4bMQN
TLSH
T1C455126E27EC10C9E576A23C9196874AD3B1FC651B1193DF5382823A1F3BEE54C3AE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2fde192e3a5a0599e83557edc7e052c1339e3220e5b4816b3f56ced9c85a9570
MD5 3682b1701057d20822bfa9f0556b88a3
SHA1 63eba3faeb48e193e858d2b09ec437cf5c4d4851
SHA512 fe727a39b14c034f6a2085b7fd9efefbf7af19932a6eac004d53f8fe5ae4666a4fb9662bbdf76877b5fee2795546c9e4013077558f97eff5dd9df57d0641ff77
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/AixOFthHE8MEX1XsdIAhb0VECwN:GIgnaTk46pBR/AixO3hHE8MEXWI4bMQN
TLSH
T1F945BF2EF3B910B9D8AAD236450147B5FB71782D1F209AC70170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e555756a5fffc2771d442802e00bf4d2a7056f66427696ae6d923dc00343f450
MD5 be3700cdb1f7b5dc9e2c98769c110762
SHA1 b1a6f1d3eee61fa21ed2d0dd083f4d54e3702e97
SHA512 350066f2dd6bf7570df1012d8bc1389dc3ad05ff3377945b745eabbe1f1dc5a70de452b8741c520fd2651a35f1d7c90eee7a75c22a3ed30f409651cfb260eb32
SSDEEP 12288:Ed5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:EfixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T14D552346BBD582CADD4A3B3C509A97FD62C2EB901B210AC3D1572132647B6EB9D3AC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 bc39457114874fa4bfedd51f8dbb6cbfc39d21afd6cfa4cc8ca13a75c477f5a8
MD5 1dd6e5256382b88d31b63ea7fca5c381
SHA1 4bf153dcab47bce11ce8470cf629b1699c26b886
SHA512 e43281a02b87e42ddc3e799be5a7013940b47d7b4e888dfa8ce299737ace60133e5375fdd59eb5c2ac47d2f4875421688d3b4e5af01065288390692fd82d5006
SSDEEP 24576:0KL3UTyixOFthHE8MEX1XsdIAhb0VECwN:0KL3U2ixO3hHE8MEXWI4bMQN
TLSH
T135750145F7D400F9ED6B913CC4A68616E2B2B89D0764E7DB03A94A651F337E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f796c0c488e6af60d76ff024c8d7278b9f60b8c091146d7c632819df8dbe6357
MD5 e3dfae53a5e6443f8aab1f4786df9cec
SHA1 e14f97fddc077926b78d98517809a8557c75bb6d
SHA512 2a8933be37eb06149ab668e8f51174102e3d9c366b9ac50103a889082ced4f373351070eecf101f53615fd92569d7380499b1f24743403db5133d48140265e3f
SSDEEP 12288:zpFtdOu5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:7OWixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T16C55020A37EC10D5E56A623C8592835DD3B2B8A10B2257DF4291817E1FB7FF86C3AE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b26ecf30da03d8c1b93a97d5eca0c85f145998565d960e22b1f59aea6fc5424
MD5 da91a26969006d27f456b59e249b5eaf
SHA1 3fa77a133bd554930e816cdd854c78a5b8739fb7
SHA512 5982802871d83ccb38acdd8d3001fd207a6f630b4aaf48c2e1ac7b52a0dfaeb30ebad5144e5091379d1e75a1b16340d1857805a8887ffc60c241d44622888a86
SSDEEP 24576:z7NM9YqZqmWMUkPjZM48Mv6bEhsLixOFthHE8MEX1XsdIAhb0VECwN:z7cBWMpPjN8DbEhIixO3hHE8MEXWI4bD
TLSH
T1B165AE2E6BEC81D5D477D13DC9A28245F2F2B4611B318ACB5152833E6F37AE44E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ab1410903f4700bc5288a802c573bb1c7aa0588fed62979719c38cc0eaa88cec
MD5 d9ad9e5cdf45762d569fc54c870d8b95
SHA1 3b0151dc39e96be1c2f30c5d8311a93d0d5dd324
SHA512 bd0756ab0080e24128d833665fc74763ae6fb260b3d428c674ac6a769cb98ba678da4d2ceb7ed5fe6e351332ef36b2ff97377fe29a1730443b5e32ee9a3666bf
SSDEEP 49152:yF2YuHNETovAvNYf8kmrixO3hHE8MEXWI4bMQN:76BCf8kdo3tzfG9btN
TLSH
T143857E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6b857c261528ed1d7cea733ae3ddbc482c51ba5c35a084919ce1ea3dfd89a2a0
MD5 b4ebd1fc08834151bfcd1812ba653a4d
SHA1 ec86c15bd8208084c214c8a13da128214e1ec395
SHA512 41df453d6b408f4990c13361f4a016eec14dde5dcc2c54b8d209c0871ddd92840a3e5fe983db2f8605b3e49e7902e9352059e1e6a0d6825791c36058c59d7323
SSDEEP 24576:mAFs06+Omlf8NXEbToaixOFthHE8MEX1XsdIAhb0VECwN:PFs060lYXu9ixO3hHE8MEXWI4bMQN
TLSH
T12D65AE2F66EC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9ce5014438c4b163c8f32ec7e33988bd6a4e7ac39f76a15696be020ae7d5116a
MD5 bbac92a426f48e4055ce6389e1ff1cb5
SHA1 81b2e45695fd7fe570319a5518685c66a07de769
SHA512 82fcfe0310a6a3d4097ecd1c650fad74ee2a7d2040b1d9d4a12666bc6a8c195beae853b1f1a9b902d5d3e11c28ffdc70d1b205d1ebced7f63c79ab8d37345e97
SSDEEP 24576:LJnJ5D3Wa9ixOFthHE8MEX1XsdIAhb0VECwN:LJnJ5DGa9ixO3hHE8MEXWI4bMQN
TLSH
T18175D02DD2A810E8D4B7C278815A1796FFB2387D2F2269C724B4D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 198dcbf53fe09208049dd36db564357a876002631cd9cf242a24584981a42c9e
MD5 bfcf813e9b9d9eb814f7d8530ffc427e
SHA1 96400237c41e81764036445db20c6b6df6a1af1f
SHA512 1d9ab352ecdccd692e245ffae3847425d9be0eebea392d459ee8206c7ef5ff56201db94461458521f5ca3c5371da047ea3c6086eb68a39fd792b6718c52106d5
SSDEEP 49152:ag06DIKdwc+eQnSt65aVHixO3hHE8MEXWI4bMQN:zQo3tzfG9btN
TLSH
T104956C06B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 cacb36eef2e8ef22f5320f08cb429fa4f53f65aa98cf1086543032aaf1210ffd
MD5 cf99dcd56b06c210f2d62a95061ae266
SHA1 9b97a220fb326b52ad475c1016f35949931ed81d
SHA512 0fe1cfa9349bc247371b3acc75f0a15487391f30c446b47fa549c4df1dec62be01c75bacbf4cf7e4c00201eb23c2ad314500babf6489461e6175b3062cb78a9b
SSDEEP 12288:2EP3RSP5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:1SBixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17555125E7BDCA0D9D52A613D80918759D3F2F0B02B1227DF4292823E4E77AEA5D3DE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 db9a07a993a4b928b70b96cc18053ac713c8db20b5bdfcccc5d190750ff63d5e
MD5 7e25a9544b50d222b8f2175cd722ea87
SHA1 40dab039e9d84d6288a8c49afd7ec7bee5197999
SHA512 d391246dfb0b3c78a827c5aabd0c03491f0039981509a7f3067147b77cd7426bfb62acd8e421b269e834e1817d1f81249cd2c4b313c11b020b520008bf0d50eb
SSDEEP 12288:ejkyI5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:eIyYixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T10765120563D890C9EAAA163C956383E49BB1FC601F2056CF9181B63F6E37BD5AC35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a227a0dcfd39ede1b05368ea8adca71626e35c9589674efe0f684921432487d0
MD5 b02684ac0374a214203520638ec11d23
SHA1 bbe629b46e2b019384d3c7ec069f88f6ef41accd
SHA512 7a6e882a064333210b11466e5edb2197b70e6b175fcf3e2eff24ff5827cae04513e5c6dd0d64a30840da512d2b53ad2fee31f8a3698669cbabad2609759aa5af
SSDEEP 12288:q0e5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:FGixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T13455230A7BE5A1CAED4B273C506657F952E2FAB02F1018D780D3A132A97B7D79937C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bc86cfc1fcfd96cd5f4e91d667a3f919011f3a949a2ee84ce98d2c2037037c53
MD5 bf8ad09da8888fbd1f7651ca9bfe653f
SHA1 2131a6a83f62994e78ce17a7d9da1334e5bfe353
SHA512 23f1765f54f44f57846fa6c84434a9100c4c10f93281acd8c181f119861162f51aeb682b041a7484a3aa6f8fc6af8542c7dc110d96ff1b19507fa956f5005717
SSDEEP 24576:uQ9MxZKdcz9dw3zixOFthHE8MEX1XsdIAhb0VECwN:uVKZzixO3hHE8MEXWI4bMQN
TLSH
T190558C2DABE9058AE177D23994A250C3A673B4311B31D6CF2449D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5eaf0b4eafba5c17762c760f95e07be630e711e327040deeaa15a244ff6449b0
MD5 6a2b01e94be520b33b47f4baa591bcca
SHA1 d9c2f302774ca25039fd63bb6ec0f89236222884
SHA512 e0c27193eeaf33361392b56794e906e8537b5e8e2d1df8f2c6967588fb7554955e01ca81e7987e3df27ddd21954dfcc3b1924225dd6708e486d3869892379316
SSDEEP 24576:ryocSApMixOFthHE8MEX1XsdIAhb0VECwN:eocSApMixO3hHE8MEXWI4bMQN
TLSH
T1A165F10FBBAD40D2E166923C88858345E7B3B0701B6257CB5192C33E4E77AE9BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ddf3121f49f871078878536e49f42f322e03d274f5be704654c5ee2ec7d307dd
MD5 ea2c975b240acec0a98f17c4fc2707aa
SHA1 becad4f677b6b3b6dde0d6f7dda9954916e35de9
SHA512 7508487cc2408e0b40539c3993a2d5c3248a74727e3837f70fbba5d0720d91095dae03e419d843506901350a140cdb92f3e16d8957d2bd063bec2fd13f7cd67b
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKMixO3hHE8MEXWI4bMQN:J0zuNIJo3tzfG9btN
TLSH
T145A57B3DA2F800A8D8AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2062a30e12ccec587d205ee2a3e495d1bf2c990490358e65d24c12e990299713
MD5 004d742f4d652b9645c47b68c1180525
SHA1 e13d391d86e21d463764fadc72569149adf94e74
SHA512 b4fca44482bacc671066d513a8101a23cf4232d80b6d7ac4e4e4bd1c45448df1e708567e8f5d41cab38123dddd9fd32c20e699d45a26fef8e44f1f6469a92897
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYqjMqbBixOFthHE8MEX1XsdIAhb0VECwN:aTDxR+N5YzTEjM2ixO3hHE8MEXWI4bMq
TLSH
T1DD55B12EA7F815E9D1BE85799A23C512FB727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 dc041226f1b2da924362ce783f8762e2868fe015f149591e1d5966880f8d5660
MD5 dfef1cb8d9f65603f16df18344757d3a
SHA1 41ced8ad315eb3cded78480b07c4d48fbbf8b1f6
SHA512 a7e838d20268f937ad419184ae44dbf0a95271e0baa23e41a01884460fbaf079392e395e1e967cbc2bb70dd00b34f54b827506db5f8b1b90eb5476ace9da36ec
SSDEEP 24576:oTMdOz0FFS+qmSLFixOFthHE8MEX1XsdIAhb0VECwNO:g0K+qmSLFixO3hHE8MEXWI4bMQN
TLSH
T17D75E13EA7AD14E5E47BD27C96438A06E6B27461032166DB0290C1793F6BFE4793EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 212a669e8ab18164a9f6612faa3451b3d24b2a771eadb58aedbf6fcbefb54a8e
MD5 fc5fe06651968f7d1f3ef4a19be13759
SHA1 f4263d6148ff921858e1e9130f21407be804bfd8
SHA512 50c50cd46ce3b788681327d98cd25d03bf5173e6cb946ba17101aeafc4fbdf7ca9cbe81ca4bcd2cb7d9850ad2e6aaeb6925fc08935d8a39d597f203024d7fca4
SSDEEP 12288:K4Ti5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:pyixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17A55120E67E870C4F867623C856643A992B1FCB127201AFF21D2C57A5F37AD58939F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-154-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/440-425-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1148-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1148-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1148-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1148-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1320-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1320-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1856-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1856-157-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1856-73-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/1856-80-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/1972-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1972-460-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2092-357-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2092-147-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2116-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2116-459-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2436-208-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2436-462-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2436-359-0x000000000CE20000-0x000000000CE28000-memory.dmp

Download

memory/2436-170-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2436-169-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2436-186-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2872-361-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-369-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-376-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-375-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-374-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-382-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-392-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-391-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-390-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-402-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-401-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-399-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-398-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-397-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-396-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-395-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-394-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-393-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-389-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-388-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-363-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-387-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-386-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-385-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-384-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-383-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-381-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-380-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-379-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-378-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-377-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-373-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-372-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-371-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-370-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-362-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-368-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-367-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-366-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-365-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/2872-364-0x000001619B550000-0x000001619B560000-memory.dmp

Download

memory/3256-116-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3508-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3508-112-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3508-24-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3508-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3984-150-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3984-81-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4156-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4156-56-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4156-65-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4156-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4156-62-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4216-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4216-134-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4216-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4216-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4792-82-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4792-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4792-1-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/4792-8-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/4992-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5208-161-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/5208-90-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/5208-96-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/5208-89-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/5232-329-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5232-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5232-135-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5232-142-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5724-100-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/5724-113-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5724-105-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/5728-111-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5728-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5772-158-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5772-458-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5996-165-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5996-461-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/6056-263-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6056-122-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6056-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6056-123-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6076-120-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/6076-215-0x0000000140000000-0x0000000140141000-memory.dmp

Download