ab43d2133a06622a44ca16f41e3cb5c00a33e5d277f23c9dac84237db56a40c3

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Size 1.5MB
Sample260528-xe4e9aaz3n
SHA256 ab43d2133a06622a44ca16f41e3cb5c00a33e5d277f23c9dac84237db56a40c3
MD5 558b6480d850cda25938cdd99569c965
SHA1 c096031983531c2b3119c7daf01491db906f4eab
SHA512 5c178b73a039f376965acde53b2c42044bb6fe2cb9f284db3b1796e29c971d322d8f5760dc841cf0c38712c40102a0be0aa643fad794388fc6658143690b2e8b
SSDEEP 12288:IaTlF7Qegg9M2Yfjy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:Iahv/M7yUnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1A67502107591C033E57315320D78DBB28A3EA9611F6196DFB3C41A7DDE343C2A636BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4620	alg.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
1808	fxssvc.exe
1724	elevation_service.exe
4432	elevation_service.exe
3124	maintenanceservice.exe
3424	msdtc.exe
800	OSE.EXE
4880	PerceptionSimulationService.exe
2364	perfhost.exe
4612	locator.exe
2672	SensorDataService.exe
2132	snmptrap.exe
3704	spectrum.exe
1640	ssh-agent.exe
4788	TieringEngineService.exe
3368	AgentService.exe
4764	vds.exe
4204	vssvc.exe
4740	wbengine.exe
1636	WmiApSrv.exe
3296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e84191621c6cb3b6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ee6c569d2eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000886c0d6ad2eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4d21a63d2eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b5b4363d2eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeAuditPrivilege	1808	fxssvc.exe
Token: SeRestorePrivilege	4788	TieringEngineService.exe
Token: SeManageVolumePrivilege	4788	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: SeBackupPrivilege	4204	vssvc.exe
Token: SeRestorePrivilege	4204	vssvc.exe
Token: SeAuditPrivilege	4204	vssvc.exe
Token: SeBackupPrivilege	4740	wbengine.exe
Token: SeRestorePrivilege	4740	wbengine.exe
Token: SeSecurityPrivilege	4740	wbengine.exe
Token: 33	3296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3296	SearchIndexer.exe
Token: SeDebugPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2152	2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1428	3296	SearchIndexer.exe	105
PID 3296 wrote to memory of 1140	3296	SearchIndexer.exe	106
PID 3296 wrote to memory of 1608	3296	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_558b6480d850cda25938cdd99569c965_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2476

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3124

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4636

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2724 2668 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2844 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0561a2cb5e90920be4c1d07c3bbc31f6585580c2cc956c64ea0e9f2d7fb9d49
MD5 444730e26748b0080d2ed69af19b3be7
SHA1 592205a074852a9203285d7f9b6d908e26026cba
SHA512 ab5fb03c6c010f6405a1fa3cdeb9d286962ffc38f6567eab71a98704bfad4e6477b792add37e61c61e2cce80eb99d65222557a10d408a888b056ee44c7ce5919
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlQ/lFTjN4:w3q6HjBZLm
TLSH
T104D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3cfa43b249c04dd39b68675a7c12e676add4345c996a9faa088d7e5fdcdefd89
MD5 926baad1461fb0fad12371f73fd16eea
SHA1 6fbeea149e5dfba5a86ffc1c03009a958b40af15
SHA512 11cd3413d290a95390be04aab6ccebe6082430d70528c3f0ee30883e79079b11aa43c16ddf20ff2f17cae9f1627dd00503e85f185d2760f9bd90479c91d8a19e
SSDEEP 12288:n1XLsswWkxy2lRq2czAiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:1XYfDtczAinQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1D265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d649acf9c546543cba16eb9f97f163afd7d2fe608ebdf2cd00a5a6478baebc75
MD5 e96617e84007ad385c3b755d09ea6a62
SHA1 d35eaca5d6c3b9c9b674eb88d651eb5c71422cde
SHA512 7ffa5dd2bded0a9cb738c3d8ca70021366d41c0c27fd29251ff2446032d203fac657df16e18852e9eb29a38b5d90ae5b1a96dbc92058d525ce88e678d860b535
SSDEEP 24576:J0Le5ji0hmxLrM9nQ/tbw/2Mkjy6Fr7g0oN:JPji0AlEQ/lFTjN4
TLSH
T132859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aea52529c04a36f712ea5e8e34aa5c7a387a6239e60f65c254dcd56f37b93788
MD5 f797260e60542ad4d45a5e1a708df996
SHA1 340c8ca0d87f8874bcf346fad1d0652623e20bfa
SHA512 6491c0fbfe5f04ab6758ec2188403f556492581d05d6110506f328e94ab118cc251838c43d7bca53da429abe7d7f254f6011b35669e955fe1cc7c77b8ca8ed84
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyujnQ/tbw/2Mkjy6Fr7g0os:9/ezSC6vUzPvxHjyoQ/lFTjN4
TLSH
T198755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6a3e3ae810be8c4dbf7f2604a78c4c59ca399fbe6cdb04f777ec29fad59d34f0
MD5 1683ca972879a6d5e317b472f79faccb
SHA1 836e65d104c7c0d65390b8648a5704f14a218dfa
SHA512 21433851b2f8647c725833c63c7b23648e64794649b9d0cbd5c93305584b00d2f443cd30d9c0c014b618c75d8b2f6557b9b74c151ff7c1ce441f51443ec948d7
SSDEEP 24576:5VbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0oE:5VO88hXl+BQ/lFTjN4
TLSH
T140559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4c5b02f5b61ed66487227af35ea9d1b6d9c9411ad44dead20573c5d773264946
MD5 bab8144ec3ba50b9f1da3d0f692f5e7c
SHA1 62a320adda2bb0b37067afef307d3ba10d293b99
SHA512 0593f80da8762e7d7cddec96341be4732d23a67f273838129447906d9fcd85d275890d54b8976c176513af19695e682cad32783ab7c4fba954e3472c0e841c42
SSDEEP 12288:RzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:RzpnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1D25523696A24F897FF2B06B15C8284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c4d71abb354e1832e111e01a65d99404cd9bd15354356d7d25b85237a7e0935b
MD5 e28b3c5743bc71ac16ce32a742745548
SHA1 cd5d9d0e09abab2d861d257821c7f337630c77be
SHA512 6b000516cf9caf09ac3ede7391b7e5730d0334af4954393da6b63aa788d4764872c0542fb8a6f7738de282e6e47f17b03d8bb3ec18fc0424f3719075c9f83bef
SSDEEP 12288:TeBNUbTVO86UGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:TJIUmnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T12075CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5e13c97aa48facbba76a3f0de190b0c576e4eb78b9aad1b8c2603b2f2cace59c
MD5 6e9d96a5b76530c7e73998e9e6ce2f37
SHA1 a9e1019793d467fee2cbc8b550241eeb8396a50c
SHA512 caaac416795e03a80fffeedd37422b3464804dfdd8b9ffb968946b74469bf79f28cdede5d8fb2e1bf991e262fc7cd3c1e15eea178cb05460e7e5922d2a6239f1
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:1QvGAdlCEL8c/yRNw5C4Lm
TLSH
T1FC267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2dfe01af6aa07a131e18c1784987cf8144479acfc8610040fb2a95e9032b8080
MD5 fa760496cc49364ff94c86b33a8f692e
SHA1 4eedd222a24eb6b5d9d2982d52bdba30f86a6b6a
SHA512 796789d1519e0d166fb045d07586e46a14ef24c86b501104f670045e1be40d82d15c2c404f955fb004eb0afd7253b8f145e240d77120745ce8528dfa2d5db573
SSDEEP 12288:YAwSfxL/2Dc39DLLmt0LDQewsAjUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgB:9QewsAj0nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14875E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a050aa8a57d8563f12a64946da56d4fa7a72441773480fd8dde2e4ac42270579
MD5 c2dad9ef90a15216fbe2e0d85c181bba
SHA1 d9057350c73219c550be7b4b15f246b25ccbbb60
SHA512 3813016aa63ba171d7b0ad7b356eb2201411c7481764e1532d0f5d692d6d5bea45e1beff9e2830be28265ce0c69e2187f79d24f855b738ddb3ba1a063b49e360
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:ZUEtQevvqc2W1cpV2EI32
TLSH
T10C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d92093b2974ec0b090a800ddf4d4468beb9eeef2fd6b081effd222995545a902
MD5 af66d5df1e548f67ca3ab026286af208
SHA1 e24a558d7d6e02c52e5f5b4bfe4cc4a20087eff4
SHA512 a19ba556ddc49ce7212ee1bc5e5ed90e5e1ec64abb29ab34c699b4e4246b5395f29864bf05840137d964fe61d37db509e1db72ce2189553034d1b602dc400ae3
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zUQ/lFTjN4:YoqtVjnm8Lm
TLSH
T111D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c0daaa8e013b40230e5f8d16c154070cfb3209d5bbd3b23cf6c9f3985842f04e
MD5 04d9ff83bbf270f3d5ad1e46f3059bf7
SHA1 63a79d52728eb25cc3558462c1e985530ccdfee7
SHA512 1eb24ec49687971ff1eee90845ab3ffbd14b137551f6c261d75bb3a67705f47c3aac98eda142cab78921e2375bf0dbb46247da9ba6ce5ace109a46086096790a
SSDEEP 24576:7AhGLJIFoiwtA5l7S533nQ/tbw/2Mkjy6Fr7g0oQ:7AMyFoiq5HQ/lFTjN4
TLSH
T16D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c5d8978ed04c76ff78cac91b1f277d69756786cf3b7c0bf9f0721f372fc8f9bf
MD5 7b4262b32e63f5cf2494ef7afddd9b99
SHA1 2caa1651915058fd376feac2218197a56b4aa944
SHA512 8afd3d5e1e69c164c66ca6c1e0a340c00d37ac26d4e43a5fe779a2b5a033911be6abe326715eb50d7f7679ba5cd48f6bc5e5eeb60966f614ee91d4390fc656cb
SSDEEP 12288:gmw5HEjsChN2BFgl0WDm+CTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMZ:9wuHOWInQ/tbw/2Mkjy6Fr7g0ok
TLSH
T15965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f4a3f7e3f795bd60333b129b362d5da53f8d0e5cdbe2c187f557cf6edca050c3
MD5 6cb32a8ad1fbd2845e42b5f0ade5a51b
SHA1 40a8c8d210cb63afd5b52931e978d0ba75713bd9
SHA512 71f1079eae2bbc540801c99b0e9936fef6c5de530ed931b149d500cdac9f50e23379bfe78a342da003c7c3b6d77da8e9f8327c3fd274b6aff107980d43f6424e
SSDEEP 12288:SXZ1IyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:qZuVnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1A455126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c862eb837de7236d7fc60157ab1a0f8340b12036913382996b6ec23f47049843
MD5 24727b4d8896d8a100f2bfa6e9cc480f
SHA1 ff6ad90b56d42c3835eb6ccb45be8507fd90375a
SHA512 f45b038e8f384037f4047fe420502b9974ff554f7bc0c188b2a79d4756f4876e5883412b93c6d53510d3e13c94709861ca237d9ea6f4ecebc63f621891d8374e
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:UQRQyi36YOcPQLvw2gAf+PN31Lm
TLSH
T152667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6a70bcc08e895b1e49f82201fd4058b88077d0b3758e1e2d46b7dcdea8c89ad8
MD5 9a6e622bbe6b40c745af84c6f9cc216b
SHA1 63c7edc4e8bcf1a80b404ba11434b3d33b5baa12
SHA512 a7594459b7f629af9ec8728f018c4928602d18feeed229d5d34d9996dc4c5c98ca398c05f003c3a8df2345d238958400defeddf5866e2a429dc93d5fe11eb454
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:AQRQyi36YOcPQLvw2gAf+PN31Lm
TLSH
T16F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4b62d0747afe67856a6c6bd34053996f7ef34df3fabea1150c062128ac555cf
MD5 3b4037e262b1ac3f72a035014c9a9538
SHA1 b3b77d8282239036a41db15f075ca6cd492fc694
SHA512 a76208a72dbccfa86cb9fe0d170809a689ca853310fd59bd70680ff52aca3964e70c22b0878f1a004685a9261c7521fac944258cbcfed3cd47b0f8d3d8d369cd
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lnQ/tbw/2Mkjy67:L68Qg55nhheWu7PNU3/EQ/lFTjN4
TLSH
T198B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b0b0a4c732b8073b44918a96ed44185184ec3446d95cb12e75e91b951d415dad
MD5 8cde6c57af33cdf59710e54486403393
SHA1 17ef5e7098c6e15c2fd6adca214dafcf3c059a38
SHA512 590cede06b431e61febf0ca16dffe15a9a435a2af40cd60afe59b73a7ddf3436f6d13b59f0e50eea76752fc94784039e370eabda9ad18e60d3a6c8ead19013f8
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:3y5112gYy5azzVvL69nLKnhZeLm
TLSH
T1AC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0b0fe2d91c72a19b988a5f4fc7c23800562cb3cc407caa87848aef05ae475112
MD5 3c79066c9ef8373a0acf6394a3625533
SHA1 5bb2c746a1b8fd2744c2300e553d2f6a983a7163
SHA512 bbd4c49af78ce179eacf58e483c9704f0578aab418b548e87685aecd426ec0c510d9ef690878b36ede8dae0e6aa38f29fecb8dd299d47b795b76b58b0e5e2dc4
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyQ/lFTjN4:2u6JmVxd2d9Lm
TLSH
T180D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0ee510bdfbd209119bcfe65dcd3fd1e720dbcf98ada500558d301c53ab1b156
MD5 82b7190f27668b392d2d5e90bb1fb2c8
SHA1 ce5cb057c011f05cb6f11b107d4ce5322b301fad
SHA512 0178b9c4805f6acc70fca03c15798f673becf72da5f3359c98821d236d9731344dc18ac57b6cbb48ecaaf40c888effa042111a3d51518d57a61701fc0f7cda3c
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xGQ/lFTjN4:PmifPbR8Lm
TLSH
T18DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de14506dd694039398bbf849714139b400536dfed9c8ff46ce659ba53eb1d581
MD5 b6afb20299b3c5fc93c5ce0c3ba10af2
SHA1 c83ea3768badee51c4cab43a8333146404f89778
SHA512 4ca5b31a6cd99aa832e7d9e990de9633fc96a9dc99ef98d628c14fd0e60675db801ee395ae85d437a311ad4b94cbda20646f586f612d32f02e711cf00992d575
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqVQ/lFTjN4:L5dKTi616Lm
TLSH
T152C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4949b6be23c899bc2b31c4f51582f4bbfe2a47f646c9782098da2a3e3332769f
MD5 77e0a2d6b68b000f0736ef78b19a2ed3
SHA1 99ec25e0c7baa41230e45ad16889b6579658d18a
SHA512 5bc529b3690abf69ce042026140f7609a22ed38ec92a0918375e985e520a37d3bb860bbbb3b7fbf5590750e00008cd5c34c125defcdf55f61350e2f2a904d45b
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wiQ/lFTjN4:3X2iyphQLm
TLSH
T11A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a4ef2d9fe48b3d934e76eaf723732e86db60ddc8f1a506ce6087e4c0c2c95f3d
MD5 6fa00aa727fac4f65ade9a4395c9113b
SHA1 d9f927572005464ad92e998ac7b3584615e78a3c
SHA512 a4944d854c311df3853c72827d0fe4f4828147a715648998c8e3af2e3a4c207d771bf45cb2b98b8405636f0e4a28b9c6bb567397e6df8926f7701b65b799f3b5
SSDEEP 12288:mxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:mBnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1DF5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3a02b7f4d387122902d6373986c978d409f379f6d58c04571aa1f949b0c6d539
MD5 67ddd8031cd51cfdff8425b8c6d6b9fb
SHA1 ab24891e09d3971f92aadc228c421810ad347b79
SHA512 c82c378e74b3c8e523e1b4bb4d5c2b1bb67a7d243231b59c0aaf4d354b1e84fdc599b1e98679542630fec05247793c909e9775b197f47df6c00f25468bb59b9f
SSDEEP 12288:5wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:5QnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T10B5523697965F98BFA1706F18C828182973F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1aad2bf938d0167a4a8994a0e4d8b289792f8b3ca9bd924b5e51c2556d7fd904
MD5 a0ab8b0bc747b5a55a4c107360d55456
SHA1 ed8b3f497825b8786371373f3acaac9867ebad27
SHA512 f7edebe24ebbff8c7b9581f7da5acf26b0ce49132bb70b159e6e7bd70b5d3e90db937648736e55497b59d7735aa7058ca83c02e4ea00132fe5da613854cbda26
SSDEEP 12288:Z+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:Z+nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1545523697925F98BFA1706F18C8381829B7F0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 75c43c623826cfd45c7d14c728f25d3133cc35b368fdcc6138ab324df616c4fe
MD5 e1eb68722385c5a577064e0407dbed26
SHA1 94756efe96bc7ef8495c4bfdd53cf2fbd3f4096e
SHA512 524611840386a14f6e0ddd07b04571a0e22fe22348249d77bfeaa68f6c158c6d3b58f09f43177bb51ae3bc2cec81bdc69a95931d118d5c8d0565140f12793bd3
SSDEEP 12288:RV3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:DnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1605523693A69F4C7FD2742B4CC928142E7BB3DC5BBA193CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f477cafb1421209ce2b9c82840ba7d1d5a831a54c3c1b5c282eeec1731d097b2
MD5 ac33deaad70172213e189aa4c2e6b618
SHA1 d8a90646cf417f0adb7c83a99ce7c33a07db5224
SHA512 6842e1cdc3d1aaded2efb0df38b0c98e3e6a4d0f9962d409e630e619b966e53515de7d644c73ca50c79d1b3e7a76a4016fb66749c5cf3e92cc59bbf547eae134
SSDEEP 12288:2/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:2fnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1085523697925F98BFA1706F18C838182973F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 db98e4a698cff83bea57d3a792729ab173dd6c2dbfd4f194b0d2f49b2f64b560
MD5 1b73b175b176e1022219a021e3c34c62
SHA1 83f34f7c843e54fae36e74fe9e3a0d3efc121d32
SHA512 702d8be2b3d18aceaa567425ab3df421b24d1fbfc8551dab0419d7112cd9f0ddb841d6d12e0d30562f1aa3c5cd38ee4c13bd72033d0473cf8e572df05da695e3
SSDEEP 12288:3sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:3snQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1C55523697965F98BFB1706F18C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7162d8cd4d7bef8558de59c2dab7b642e5505bdf759c67416eecc6cd204d758f
MD5 da4b45f19732f2c8526c000675843882
SHA1 94e9dd789416b05a961ab1ce9934e85dad856eac
SHA512 e2c1853d1afdbd63b30c13ad269edc8ef777daaeaf179163b301a07828c1de4661336d9dbee94431a1ea8bbbbd8ebfb141d400434e1f7ab08fe2e44c4653aa31
SSDEEP 12288:SYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:SYnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1005523697965F98BFB2706F18C828182973F0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a2cf8441d9c4cf8af7548004fa8cbabb7984876d5ec0c034554e1f19e50589b4
MD5 d724b28ec3072a01986898415b9767b0
SHA1 e5e7a5c3265c35b2b14bc9e99a4e98f9d3d7b2c0
SHA512 b9cb4218fe915169e419c7258742356d6793a0e7a3e96e9c335de67034797f75e2a54a0ec356b16eac3c14be6fa93813e4029226fd2329b2b39af59ab9b13bfc
SSDEEP 12288:biZwbDzzFEoS2cPvyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:GZM3zFVSOwnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1F57501A5B35058F9EC67827ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 798df10f0c3ba46a1bb942f42e0abf363a64a69a7b763bbf4d5256ad4c6d77e9
MD5 646afa1f7a62d42d944bd95962ccf365
SHA1 b93e0d6ccbfedaab5dc56e2dc726775471c2f74e
SHA512 2324b60a389fea396de9228e0bfa1ef3a0ebfe5bc29be3eef8c290db1660f9c0a463e106ef9ae0cac62ff80098d2b47569086121514e35927db78ab27e2bdfe1
SSDEEP 12288:4lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:4FnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1435523697924F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c02662c72859ac921f3264d77ae3cc118dbfff0bc4b8d29a7e36693eb409cc8e
MD5 c4eb4e42538b7f56d4997f9e4bbf05b9
SHA1 e999851602481737742d2fd1eb0f8305967446c7
SHA512 8f019679439f21bde10b16b15f8d9a29c6929771a22660ca3c2aeb3158b95bfa64e499a5d4f5a77cd614e8e63e2a771c8f3d6fb6970ec56f80dce1c488c026af
SSDEEP 12288:gJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:gZnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18E5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6f486c8fda02170ed33a25459be36d71752ea46247b475438bdee70d1a09a931
MD5 70aa1b0e2cfed182b63090cbfe81d2ca
SHA1 3de26c6c4e2b4cd8eb27500e2ab05c4346bcc049
SHA512 a772c88fbfe75abf71eb667ed586ce3c8d66b58bf01a6becb27ade4b8106fb44d715d7a36354b8ca407a609bf1951882afd2b9c68a2846cf9591f4fefb9e9c62
SSDEEP 12288:QyPz5L8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:hzyknQ/tbw/2Mkjy6Fr7g0o6
TLSH
T13D65021777A570FAE537427888920A02F77678725B608B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 59a00cb87869a7735ca0b8199a5c6082aec525f2932f9e3603882d81c443aaf2
MD5 ac25df9bb729e3172c82978efe19e97e
SHA1 f1d17191f9ea8c51d491ac6c5a2fe74e54d2e1dd
SHA512 a66560eebf2e3b2bf0938c363c58d8af9860fb9b66be074af1bfcc4a93ea49143e088cf60475b986ebdad432a3303341b18d404bf15ac1a31d2f8eb79fff3d39
SSDEEP 12288:wlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:wFnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A45523697925F98BFB1706F54C8281829B7F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f5e09c55cca4f305f52890360232beb2022a1fefb78fca0691c983b32a87cadc
MD5 ce47ca724dad9a5a2dceb95f64887dbe
SHA1 bd49dd38c04138a0dff0c93626213a8178144d4c
SHA512 3e6941222ab327bf6c5f5f43b6eee08a33d270ddf8d1db21c2e9196a368091d889a1da820699383a26aca1aab5e2779b36675b544ab7fbdd3ddd93a1b925206d
SSDEEP 12288:zlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:zFnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1C35523697925F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 108fbb83c8f5c0419abee50468e0f2f49450be951d4c5f531699903529dbb9cb
MD5 e265b727c0aba666919b37943e7811e3
SHA1 ce27454abae565e8bd9dbbc6ec803925e873db2c
SHA512 583f8974739bd97dd64c08206a038bf247f7a07e0edb30c14dc5a81ba632310db8e4a95815a8cccd68ba0aedaf3f307761cc936a1c8c02e75edb963bbb1172c8
SSDEEP 24576:JCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAKnQ/tbw/2Mkjy6Fr7g0on:JCUxPTY+8Wg2lIL8lrIUJLWwfQ/lFTjG
TLSH
T10065BE1EA3EC0896D4BB817589518A06FB72382E1B32D6CF2160C33D6F27AD55E79F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9f8f7de3c0b8c885ee2c5dea7ab85705f98e925fa9b5a25abbe31453dfa06330
MD5 bf484575f2dd259a7a2a2013564a206a
SHA1 e8e7a5dd496dc514d90b3272fdba5d9d6bc4650d
SHA512 6d0e298a0715478b8fcc658f35b7c764a331074dc33f619f076f8d5eadd15fcf6a5d4757e819c3815664f27c4d85a3f611c4a2761119a23db1155b61e42626db
SSDEEP 12288:yssf1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:kVnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T13965F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dcd10fc15951ca9d773809e511217b575d0f354d9c361395d94a0d2ae70eb9c7
MD5 847fa3418eb335b4b4937a6a330d801b
SHA1 bb6813ac694b77bfcf6d9ab03f5818caa4e5afe7
SHA512 420513ff81e2ab6479066c657a4ac9e9263299bc3baec3afbfdf10f2ae007815d1fa856ed133b2ed0df058bf319d5da68b918dc6c2e98c9d62674795cebc4575
SSDEEP 12288:FeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:FenQ/tbw/2Mkjy6Fr7g0ob
TLSH
T11E5523696668F94BFA3B06B048928111673F0EC5BF91D7CFB7082229953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 557edd4c68957202d14c871880c675c34bdc96cc228446ffcf1e440c4680852c
MD5 b888a73926d525013a57c8ef8a77a782
SHA1 92970b60ed6fa926151f1883b68586d4267b454a
SHA512 ad6059bab402abe54ede6c65b7286b6c830c2c84495c919a03b592fa9c0d3c2cb00a01195d360770d895004f27033f7229c530200d001e18050314f37d859dc6
SSDEEP 24576:S8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCUnQ/tbw/2Mkjy6Fr7g0ow:TRZwQCyiHiQEaaPnMdQ/lFTjN4
TLSH
T1CC85BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 36cbadc5033c366da9d6af633580555e86f8e9809f4d0a15cd0ff7feed009b40
MD5 5a05a465115acda7af065bc04038e2f7
SHA1 9fa686b7ef2295a3aaf0bd6479f5282429d4d5f4
SHA512 a003243ee49edfc3e133a104a84c1004cf0692f9848a90c81bdeaf3d7c1d8e56a8415120442497dbc495c1b541fc30f2dfcde4e8fd815c7373264a170aa82390
SSDEEP 12288:qbxA1U7KOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:qbxA1UGOnQ/tbw/2Mkjy6Fr7g0of
TLSH
T17655123E66AC28E6F536917D88D28106D3327C56676193DF2284823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 82a945c893d72857ef96e1305b05989c2bdc5ee3a8d125cff5272e487d80107c
MD5 7a655e7383f0f749c1f87a3f185f2708
SHA1 92ab34c15261f050f8ed5e939a0fd6733db85647
SHA512 a970306a51f376ae7c092d5710616050f6ac0e1233dad6822693d0c06796bd066c87d36dc0397a914aa0f7917d395a5cf8b409e377b692f0bf1eb77977e167e9
SSDEEP 24576:xjsmP0yHaqrVqHra44KDzMsrnHnQ/tbw/2Mkjy6Fr7g0oQ:xjRP0yHfVqzlAsrnHQ/lFTjN4
TLSH
T12145AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5acaa3c3ae8dfb09b87a1f398ca79a49dc1579b9a6c30e88a01e550e4a7bfd78
MD5 dafd4275327747b2b03b5e5ada350d40
SHA1 fb449c1628f7e57b339a5f5a7af8d2e9ce3ba97a
SHA512 9c9b87d47bc12e0409e90de1c75ce6cd9e6791925c6ae86d1771271bef503d3afd6f8e609110fde4b820ab4f01f4b70ce99ebeb518368d9778e9f703150721ba
SSDEEP 12288:lMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:lMnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T12F5523697658F98BFA2706F548828142673B0EC17FD593CF7B482129967D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d958f1b9f8dd2284e909c1646414f3e74224e8a33aeb74e7934281e359f3c4b5
MD5 a5523913e6db216f9de1e447edbaa510
SHA1 6feb1a77e7a681c18d4e6c0ff538d8397bf43b8a
SHA512 58d030c1485bee86bc9d3baf92abce1620117aed699cf81d77e21b388ad00ec80b62f37b4f663784fa7f761e8dd97864a81ef9b6f53e367e0293e406c41106a6
SSDEEP 12288:vOb4A4LWO+vAYFTiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:wwLBUTinQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1C275F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cc24c2170387c395cb8eb96fe7a34c93c6d3d70f2f0556ed28e546e3b532715f
MD5 4a6b2b9138065d7dc0114c97c461ae0c
SHA1 db476a6aaacc1e6bef66fb47c7ea1babb27a0840
SHA512 1023c85241c3e975b418efc516e63ce70cfa880bed28628ffdfbfb6f4f4d890ed143a037f90ac5e0351c007c2d320897316eced877d7dff5f7d2f29df3cfbd09
SSDEEP 12288:L70VmuIYNvUyBpBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:0KYNHLnQ/tbw/2Mkjy6Fr7g0od
TLSH
T12365F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0ed30e1ec3009298f3fa907633dd00bf85f9933a9533dfd4e36cbb91b38f46b
MD5 41d2e9ae26cd3eeda21702f824a99baa
SHA1 b54ae612ac1f8684149118e02060e3df2a2279f6
SHA512 9c74208acbed14fddc3bd10c6bebf9163c68e8975231f65713d7049b47e35518339b2451b36fe4739ef2784291769d6011841a780010e1a30c992914159b6559
SSDEEP 24576:tnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKn:tnXoJJYH84VVS6AmEcJas+cHBjSSKHPW
TLSH
T19B65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc45a87a130c547ee91627ca50fe1dcbf3c969f46f84324beab38342169abf2f
MD5 7a8814351feb06640f2518486e980dbf
SHA1 236ee12fe68e6d788bc9ec676f1fa88c2c7d391f
SHA512 50adac694e5bb50de96cd004f330c32d47f308e56c35e0d98d4a4f16df97d9064f6d2b12375ae193a8f0c66990462afc84fd25b3ab697f0044815dbe7de949ac
SSDEEP 24576:xv7Xbxd9Tuycf8M/TYlSuxwr2PCJnQ/tbw/2Mkjy6Fr7g0oT:xDLL9TuJ0M/TYW2PsQ/lFTjN4
TLSH
T155858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ed95a113ed51cde522a1efda47fd826ec6bbc270e3d9bfd9431c5add470729a2
MD5 71f25aa38598689f94b2755c545b3df9
SHA1 147ab25a074375cf3e29814bee8bd548f1b0bd15
SHA512 01a34e3e26113701632a59930cd18948dba9309786d1b460ba984999c131846070ec2a20c469b98a7243d771d0eeb6728891f84ef35b1456328039e38736498e
SSDEEP 24576:uegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10winQ/tbw/2Mkjy6Fr7g0oE:ungOJOmPOHhiQ/lFTjN4
TLSH
T17155BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 cfd0ccb3f1c0b8619d748361b14702845f39bff5e892749d08013d92b5509fc0
MD5 f3f2b256cda67b861d02371ef9d6756a
SHA1 02c774ac7dc3a8033e6b9f6a24ca57dd57e79b31
SHA512 222df880d8129fce57f515ea97d0f56c62290583afa3c23ff3ad1159cd9151ace8a843ef09e165f9553bf15017f1b8bbe29329aac5d48571edd9939cfd9baed6
SSDEEP 24576:mLJnJiTk3R3waE4JrOsnQ/tbw/2Mkjy6Fr7g0oA:mLJnJK8R304lXQ/lFTjN4
TLSH
T14475D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1efe2d2d2e31f09551dc227310c13456bfcafd7972011b2462482453b4c6c6e4
MD5 d220930b2ffe2e42c40f72587eaa30cc
SHA1 7d6eb14dfeb674670a17142e2d1fbffba7051e42
SHA512 1f15ebd2d4938118b3e8ce38f9c6bffc2d1c8b8897ee221448ab66766e3278f3ea87256c23875972a4481da5054047f9b0b79abbc783d2b92aed1978f494fa81
SSDEEP 24576:yA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p6nQ/tbw/2Mkjy6Fr7g0oP:N9GqCzDScAZmlvTcFg8Ph6YQ/lFTjN4
TLSH
T110955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 86fe5cf84de34e4d64870f55d0de2ebac8201a9e5dc8889d437c1792dbcfb701
MD5 b7c21710e042b19defe14e25d8a25a12
SHA1 62642622c88b21aab7b99b63838e7868792196b0
SHA512 e91373aa5141d5cd25cb168a5b81e9f2ea53d9afb86e3139c55d540e68a4fdd6cd8b4aa2e9471c165b8240c20b795896a61db3e228ef00a725d98361032f31de
SSDEEP 24576:5lYJeXm5jUuESnQ/tbw/2Mkjy6Fr7g0oc:5lYJeXmRUuESQ/lFTjN4
TLSH
T16255126D366CB0E6E22F41B988928545E372B4A1274163EF62D0C17D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 9f162df6e1896a80cc96c65d40c8679b492bc94057336e5151126216623a6e79
MD5 6ce571be3fa823bf418da35e1ff43c51
SHA1 0c5db92ba44c6d7fc8f7dbae3c93103350012feb
SHA512 07313030a03cfbf36a7f8abf7c0e9ac5c5ecfc00c42eee0fd4bf487a1603b58cf22b9b3ff9c11d64c237b8f9b732974af420c1e1ff1a5dc1a79c92260803a941
SSDEEP 12288:QFu6kyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:QUtynnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13E65121833A4B4D9FA7A0678CDA381819B3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 2572b18e8cfd54a98bac2e7c69e18298b0b10afe91cf1b53fa14cf9bc638c16b
MD5 c16cfca25eee36f11993531569f083d0
SHA1 35f066cc53eadce2fab81587d19e5d9d44e01c28
SHA512 93fc1d76d5de2bbc4cc347ba313a786a0450ee56147e737a8540242d2aabbbd45bc1d165470d1e18e98ba93c47d0eaa2a7dc046a77771c16886c74a3ba40b2d6
SSDEEP 12288:zPiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:LinQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1ED55236C2624F49BFE2706F448528542A77B1ED17B91A7EF3684A138CB7D3D016F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0f7f121fa84fb75c8fd6562d6891fc0b5b47ff0029f34df977308f9ae8e7762a
MD5 d8320fa0ed429a7db8f6d0b01da6f2ea
SHA1 f338c3498e7ca046f38d64949ecbb5ca2a11e164
SHA512 8e7c5560470e688fbc90862966f110527dd87213f556e81c7f97b2c29ef2d3555ee5d516aab8957c3a59e5a720b08aa7441d52edcef88cf9ab4fc4a47a986066
SSDEEP 24576:mC+TyQIu93VAumZr7jm1nQ/tbw/2Mkjy6Fr7g0ol:m/TfIq+Y1Q/lFTjN4
TLSH
T131558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8b6bc7fcb7824fdc64613f4f19f25813d94d168ce475571a173361bbed576ebd
MD5 8064a0a22ed6f8065858e73bdcb684ed
SHA1 c52dda9cd9bf4020ff91679ebf0a9168ad132ada
SHA512 6c433f7a9830cff9a7b0b70d3ed7e3464d3c6884c1e3e89ff2bdb1d0670c026dbb8a1953d38b69448d890c37b12e3be892a7f9dd8c23eec1ddc51181cacecc55
SSDEEP 12288:GcyrWOstaa3kcsWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:fLQikZ2nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C265F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e175ae771d215b697922fea03a9949a1dd11c51ea761716ae06db42b84849f2e
MD5 f3fa87d09f8457b6d04ba3a295682312
SHA1 5f2ee71f5f389232bcf7ad1f2154f746b857f728
SHA512 5c738909e858f35f91c8124829fe307054d36e443545a658dfa3f2285942edea066231f7f0e44e2e803bf133001307933f250d5423963f5537f0e64e71054981
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPnQ/lFTjN4:xpC7b4+80GTkTLm
TLSH
T16BA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 298dcb0fd0972f9525f8eaea58486bf87d5fffaf4b7a47be548999baee529451
MD5 42c57a76fb7e7b7f68d20977d7280bb3
SHA1 4165a7d6bf8f781b40ed69aafce6ca363d25c469
SHA512 5d9d6f8f4ca4c3882836383d4cb495f863e458e1b8f0b199816630a712caee071088128906465e4f4bc44f558011affbdfae0975a93cef5eddcd9f686233c8d4
SSDEEP 24576:zSAwJPE1IDAo+4Kt+l44135UQ/nQ/tbw/2Mkjy6Fr7g0o0:zqPCIo4Kol4/Q/Q/lFTjN4
TLSH
T1DE55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 85dc59119e2f70bce84a727e1697bb4990d996a4aabcc28facc6f534e9d17bc0
MD5 0e814f23dda4f9e9c78facbf8917d1ca
SHA1 d8056fe03385543cf9acab873f5af60bc52f366f
SHA512 af09fec953b9ca71d5e0d15061c32a65f38bd17127bf20852d5e2abf9b80f181dcb4070c57929ddbc7c77acd8640b208fa1fef46732db15ca1a3923375bf7dcb
SSDEEP 24576:8yLXPLcf94tvnQ/tbw/2Mkjy6Fr7g0oM:8y7PoetvQ/lFTjN4
TLSH
T14C75E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 b20381384e98772f978b8c61e277f93456dbc5d98c6882d9909aa154e1b9613d
MD5 f1dc29596db6442e7d09669dac14a9b1
SHA1 096cddc64f0426f32e3106401f3cb1ad8d147143
SHA512 8897bcf2ca59c69dd05d1ecbd1631fec2367edd7b729145a2eeb9211532480ca6ee446929f8721ffc6f758f1c0414c8de8fbad250aea1a5d796e2ae5a2e1f24b
SSDEEP 12288:a9lyvj3IkxjbBzmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:aWv8qjpGnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T18465125E26A4B4D9F53A4274D863811692767CB227A4ABEF32C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-80-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/800-106-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/800-74-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/800-157-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1140-420-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-396-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-417-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-415-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-414-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-413-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-411-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-408-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-410-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-409-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-407-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-406-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-405-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-404-0x0000020941C40000-0x0000020943B5A000-memory.dmp

Download

memory/1140-419-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-393-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-394-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-395-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-397-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-398-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-399-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-400-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-392-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-391-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-388-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-389-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-424-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-423-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-422-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-421-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-390-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-412-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-416-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-418-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-385-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-386-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1140-387-0x00000209441C0000-0x00000209441D0000-memory.dmp

Download

memory/1636-379-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1636-170-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1640-359-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1640-142-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1640-136-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1640-134-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1724-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1724-32-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1724-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1724-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1808-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1808-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2132-228-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2132-119-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2152-82-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2152-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2152-2-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/2152-8-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/2364-162-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2364-98-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2364-103-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2364-107-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2428-16-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2428-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2428-111-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2428-24-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2672-182-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2672-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2672-378-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3124-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3124-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3124-66-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/3124-55-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/3124-61-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/3296-209-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/3296-381-0x000000000BCA0000-0x000000000BCA1000-memory.dmp

Download

memory/3296-193-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/3296-401-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3296-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3296-180-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3296-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3296-383-0x000000000BCA0000-0x000000000BCA8000-memory.dmp

Download

memory/3296-380-0x000000000BCB0000-0x000000000BCB8000-memory.dmp

Download

memory/3296-226-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/3368-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3368-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3424-156-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3424-70-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3704-130-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3704-293-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3704-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3704-122-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4204-376-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4204-163-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4432-44-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4432-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4432-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4432-50-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4612-112-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4612-169-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4620-110-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4620-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4740-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4740-377-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4764-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4764-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4788-374-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4788-147-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4880-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4880-108-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4880-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download