44f1b9d9fd19b9d69f0ae72e8d7f2917690643d4f60e6d9e695d5544dc8bc231

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 1.1MB
Sample260531-pz318agy21
SHA256 44f1b9d9fd19b9d69f0ae72e8d7f2917690643d4f60e6d9e695d5544dc8bc231
MD5 23009bd4e83ddcc245b65b9e0c157e96
SHA1 deb022b9a6fcd91297d9633f6bc6775fc3818ac8
SHA512 8b6e712581a4254875f0b5aab0b106bee49f392006630f3f86c916657d16dfe79d768c51e517ab3fa05318ec0b05cd72a9c8d839c3f6f159673d2fc2a004022b
SSDEEP 24576:so7w8UvNrKztqlxo8J8a3v1x37MFifLYCw:N79MlxRJ8yWFi0
TLSH
T15E45AE93FD49D061D5E615F0C8E792E2473B7D600D38809B725A332EE8386DC9E1AF99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3728	alg.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
4776	fxssvc.exe
4948	elevation_service.exe
4696	elevation_service.exe
3456	maintenanceservice.exe
2168	msdtc.exe
424	OSE.EXE
1240	PerceptionSimulationService.exe
2868	perfhost.exe
1680	locator.exe
3176	SensorDataService.exe
1248	snmptrap.exe
2440	spectrum.exe
1912	ssh-agent.exe
1328	TieringEngineService.exe
3248	AgentService.exe
1360	vds.exe
4352	vssvc.exe
3964	wbengine.exe
1656	WmiApSrv.exe
4784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ea1cab80c9945a43.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\java.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edb1e3a0fbf0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1f805a0fbf0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015b5c4a0fbf0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095d9ac98fbf0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a804b4a0fbf0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff9defa0fbf0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe
2832	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeAuditPrivilege	4776	fxssvc.exe
Token: SeRestorePrivilege	1328	TieringEngineService.exe
Token: SeManageVolumePrivilege	1328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3248	AgentService.exe
Token: SeBackupPrivilege	4352	vssvc.exe
Token: SeRestorePrivilege	4352	vssvc.exe
Token: SeAuditPrivilege	4352	vssvc.exe
Token: SeBackupPrivilege	3964	wbengine.exe
Token: SeRestorePrivilege	3964	wbengine.exe
Token: SeSecurityPrivilege	3964	wbengine.exe
Token: 33	4784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeDebugPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2072	2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2832	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 476	4784	SearchIndexer.exe	108
PID 4784 wrote to memory of 3948	4784	SearchIndexer.exe	109
PID 4784 wrote to memory of 2500	4784	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_23009bd4e83ddcc245b65b9e0c157e96_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5072

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2560 2792 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5e000d3f0100a5c697a9a7a159aa6e7632be812e30074c9947e7e553beb510f
MD5 84848a2f87fca45969d7c13617f9e8b3
SHA1 5b5008c98afa150f3fa5f89312fb80be7e0ff7a2
SHA512 154a33ee8eb1db318983c59b4d28c668f341a5e84b229f26b635bc4d3405284f87dd92508b1eb6f975bcf7934aebd55897678692e789cfcdd82984243cad8ff7
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEMlxRJ8yWFi0:Q3q6HjBClR8yWF/
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 db6b0f1f228dbe1424ed08a4f83a4106f138c8a9d15d73f94c67b69793750e15
MD5 9dc52441ff952ef24fd6a89d539e7e06
SHA1 e3a6b6df79ea7384228a0df8bc68542a35d351a8
SHA512 1c0276d19fd9cb1beeba9ffd46ecabc5c641cc520e0da0e4b3915cd6ae5f85aec3bb785f6d9fcc2fb1a690568b982f41bb6123204533039ce51225b78188ceeb
SSDEEP 24576:TXYfDtczAyNrKztqlxo8J8a3v1x37MFifLYCw:2tceMlxRJ8yWFi0
TLSH
T14D650128B3E449F9ED6B813DCCA28411E63278948764E39B03E499365F337D46E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 dc4cb2a5523f01e86f3a7b4d1d9486fd2faf5a17662b02c6fbec07056138f82e
MD5 b17cb4bf9333d9c616b7348f4336dfbd
SHA1 1203db0293ebee2566d240d1071b3891ad5f9e3f
SHA512 45eeac55630a8e25680d0e15b17ee9b4bb5c1a97d4055a0bdbdb672644d36f7bfbc7d4cbba157437c1639a0e4379dfe689d8c0a818545cc9e833ffe7a94f243e
SSDEEP 24576:M0Le5ji0hmxirMzNrKztqlxo8J8a3v1x37MFifLYCw:MPji0AcTMlxRJ8yWFi0
TLSH
T11A85AE16F6748335D073C0B9C5D2A69EE93130855B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1ab42fd974e9759156146589bb3b9159a957c4e0268959eedf2382c6a9c2e325
MD5 da677d1e1fddc05e23c236f6a580a17d
SHA1 0c231bb882e6dd5e3aab9c166a74f5acfc97ed33
SHA512 19173b283220088acd16a8d22567748f2b7d5479274f98a3d6aefdce049620a1b8993c8c5a650fc4afbffbe0498309a07a6ac0d1e87cffd50bbc7306b1a8d1c2
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyutNrKztqlxo8J8a3v1x37MFifLYCw:f/ezSC6vUzPvxHjyfMlxRJ8yWFi0
TLSH
T189755C15F5788323D0B2D0BAC5D6BA99FE3230865B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5da44880fb46b7824f50a7e43bf6273aa1ddd010fc72390afcf3c161cf8a2541
MD5 5253fe820f78afc1c51532fedf2e639e
SHA1 6eafbb55424c1fc2560df0fe82863da12fd02d56
SHA512 125a0ca13799006a73c6ff6cfbcc5349e0e4ff25e496bc122ab6281433eddd787766d9b3220a1098aac208f18c1db5397aa7c9707176dde13fd4901bb0ddf9c4
SSDEEP 24576:xVbqPb88hv/l+6ONrKztqlxo8J8a3v1x37MFifLYCw:xVO88hXl+4MlxRJ8yWFi0
TLSH
T1B2559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f350f89dac958c7e1f2a0c0e936d02849042ded92d6cad0a3c24a7dd221c066f
MD5 ccdf44a450bf0c6779e0e2752abcaa1f
SHA1 09a80d1fe6a344e4a20a892154b5fdac25892bda
SHA512 a103dccdaf1f2081f00a2a092ae3f74003c800dffcf76b45fc4950cc2a6c5ec05929640e43502b1b62f95483d18784d6c78eaa6fdda811b80fd7ecd83ec0226c
SSDEEP 12288:XRoudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:XR/NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1A3452309A0A4F9D9D7DE093675EA3094C2349DF8F45C432A58117E37DCBCFA1FA9A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a893a4a27de6560d922b899f250b0b57e03ac1616ef64fc21335f577cc95d8b8
MD5 f9179060d756038988e1857c7644585d
SHA1 fe664205fa66bf44b1a3f664293034d021c1d10f
SHA512 b99be5a61a559b683abafd05db7cdd4c4716611fbf046b8186ed3483b3a9df7c0db4cb50722e0d2642bf0fdaff32f9d3e3af2855197b08be59647610173e2466
SSDEEP 24576:4JIUGNrKztqlxo8J8a3v1x37MFifLYCw:4JIUBMlxRJ8yWFi0
TLSH
T1C865CF3BEE28FCD2C27E4DB95A918240D77278708B61A3CBD165830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77c99a26f16ffee3ed5718554e545e6dbb15587ca4e333d889f4bf84ec953184
MD5 56549b9a0fd5edd562497bfa6bf125fa
SHA1 a98e49c3add0165fecb9a30bb7705ca8accf1858
SHA512 b3c722cca2deedc6d71bf14527b92a0b02bc24f70c009ca52b5d4a19b6417b970db9a02f38fe66a401fbcf81eda1acfb1eda01fed02ea6f54c91860b3e966942
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:JQvGAdlCEL8c/yRNw5C/lR8yWF/
TLSH
T1EF267D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5256064066398922d8b8b0202ceba59159344ba8a34a38f9dea3dbb63bec3e36
MD5 d466c381f66d881c670f2fec4e42a77e
SHA1 35f158f64b80a67ceec42975fe7d69c939ca2819
SHA512 425365ddf8b80ce1ff1916f59dcc257b1805cfce9a1b9134564d17739cfbd6ad40c1ae6751543fc3f0a8fcd3635496350f57b73f4280cc95f6f33dceeb1a61da
SSDEEP 24576:FdewsAjYNrKztqlxo8J8a3v1x37MFifLYCw:rljDMlxRJ8yWFi0
TLSH
T1C575F031FA74E036C3BF0DB21B36D716543C79604B611AC3E3A89E9E98346D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1ee13f2a14584b325dca12ca46fc7059b458b50644041f15df11e858d076ea11
MD5 e8a7a0cc8f1ca2a92459556f4af6dbeb
SHA1 f637ab64a657e3c0975ccb73e19b76ed449e85cc
SHA512 35dd76ea54b0c049e8ed9634b7936f1ca7742e53613cdf9eb0bfdeac98745c92842ca7e639c967d08a6e479b1761b4ec062d95f8fbcfab12344a1f6a104deac6
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgz8:wUEtQevvqc2W1cpV2EI32gz
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9dccf338b42ee0479184a364bcbfaf3010e466266574956fc1aadec188da582e
MD5 75a5db20f76674814e47d040e8fe8578
SHA1 e9311337d14d851be62f72435eeac0f5750555ff
SHA512 199e48c9e72e7217d640eea86cad5b316f3e8c68ae1fb72d1d13ee842acbcf8c364d400e9b765474cbedb969d23a10d3b0c8fe30015340a62b4a7654a402cf44
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zjMlxRJ8yWFi0:UoqtVjnmLlR8yWF/
TLSH
T107D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fa163f98ba7a035e2978200355f87a67f01327f82a6c09f4dca81fc3141b3094
MD5 e8c28ec071714ce7585b1901e2eef034
SHA1 fd4bad3df3e6fce19e9457515ea9e8096469ae39
SHA512 5acdf8f145e8f36cb8b143a7edd24c62191f00cc053e7b2ff7342aa70df976c541e8038a7695016c8690bcb38c8dbb18ef70339a501369f02851c6fa57b93e58
SSDEEP 24576:qAhGLJIFoiwtA5l7S53hNrKztqlxo8J8a3v1x37MFifLYCw:qAMyFoiq5qMlxRJ8yWFi0
TLSH
T176359D80E7F955D4F5B3AAB899B69170EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0c083882db5b39bcd3d7f3de0e0cc33e3419d0f86693b2075c646d51977caf43
MD5 e5d28076be2220215da7c3321957c505
SHA1 b51a4674a3c9796f7bb288593c91539f11a3cb02
SHA512 cdc800ce7d704308b81cb69c1b1898f8dc44ec9a4af771b9ee854c9e803b384b258b02675bc1bf5e5bafc775bd7d7a851e9277bf9f09f79d23e50fb6af856e85
SSDEEP 24576:RwuoOW8NrKztqlxo8J8a3v1x37MFifLYCw:RwDOGMlxRJ8yWFi0
TLSH
T15765F14972E41CF9E9A7463985979035E3B2BC513A24C71F1760C62BAF37361BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8227aa52f6d1142bbe415ced697a0e6a3dd39576ba7b5c908b6058cf44e9d0b0
MD5 ec6de81083c0b10335c5624ffeb3f4f8
SHA1 72249afe44093a1e749c87acbdf3bac0e9d0eb16
SHA512 6a3a9c7b577b0c6732901f5e011614298485e05034c12a10fbbbfdfa9b2521d9d4c262f0488b99a2232c1e47aa580f4fa25f7a6fe88f181389b58f0a1479b961
SSDEEP 12288:IBZ1Iy7udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5Nitlgym3:2ZurNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T10755124932E4B1F9D2A7063DD9E52544D33178A4B33943CF15205A2BAE76FD2AE39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f9f55a5a888d20562f88264f81a1768097c7ae35c42d0bd943f4cfcaae554869
MD5 734e59e75470e28bb3e895bcbfcb4d2f
SHA1 a07a307961e197722fa5e57213691be894b9e10b
SHA512 a228e66194b613a8ff959f33511eb73e7a433d994cdd8fb371be936743f13031a796d53ceca0d1552c98aca2ecaecb0b58ce246e812f46b3616c3382ccdc893d
SSDEEP 98304:KQRQyi36YOcPQLvw2gAf+PN3WlR8yWF/:hQyiKayX+PNGz8
TLSH
T17F666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 23dcf1986f7a613099ecab29ce090f327fa312d3f455217f8c4eb44a5670e4e3
MD5 57a98e8d777a616f84dde9d3b2772528
SHA1 ac273967569eaa7834135394c7c018c44d4bbccc
SHA512 f5195ef2b1b9e150ca8935e907a6eb4a26425e174597978d4b133aa5e03d78772d8a37b15aedbea89842c48f77c35979568b3206ddfb236ece65378b3943c1bb
SSDEEP 98304:pQRQyi36YOcPQLvw2gAf+PN3WlR8yWF/:AQyiKayX+PNGz8
TLSH
T14B666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 588d76638d8b991156d4b84d67e78ec51f4e12cf4626319c92b11bef34d2c963
MD5 2036e325fb728efce0a7fb557af3cc59
SHA1 652c5761daf2e801966a2f6dcf79387cbe8c8aaf
SHA512 12c0404082da239a8942346df172ab45c9e7835eaab9c484f7ff427d8451c3ef470c59e8c8d5abde20d0959b0b5e4219e023b934fa4d1e59668a5a2ae8c1298d
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0bNrKztqlxo8J8ae:P68Qg55nhheWu7PNU3/TMlxRJ8yWFi0
TLSH
T19AB54933B2F200A9C44DE1769F4A972196E17C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9b8c4989cf6a5d3098931206d18cdf023f85344db4403c457ae4a9124e1e6559
MD5 78059fe2b2a83cdda03282fe34837bb0
SHA1 eaee386f4582ac1b13e6d04f7ac60cbe18f40196
SHA512 54acda39e1c2e624137f02b887a1a75041c6c049b637e2afe787b8da7848982c21bd8c2183f9511d27de463dccd426ad30f0fb05138598ba409ddbd634bb4ff4
SSDEEP 98304:Vy5112gYy5azzVvL69nLKnhZNlR8yWF/:4LIHmWhzz8
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 428e79895a0a958951f1d263e4a360bc2601d6864e9a9116e39009057a08d8f4
MD5 392d0e63c1182fa3eb020a67e1e61a29
SHA1 8a7e50f17976bacc287b08fc71c0fea022a4bc69
SHA512 124bc9731642d8743377c28fcde1a3ea30331631a55f24e811cf8f8eb14ff43f33ffc8904cbd54fba4f15aa0dd47f73f2e8b5e5c18231d4e23e13716cd61ef02
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1MlxRJ8yWFi0:Vu6JmVxd2dOlR8yWF/
TLSH
T1ADD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 978e07e3a38012b277c1c26895afe024b4027b4bb9953cd9af65563f5bea259b
MD5 a48847689fef74d862717bd2a37700f8
SHA1 ba60f2217a63cc4dac0c02b9232ecea6f798ae3c
SHA512 bc6618d8e614a7c2c7441a1f94f1512f8a66f89cb8b622c6d09890a7cc5e29f5d2ca8e8c62a63b270da1b88a6da4801dbbbfe4f231e94ed7707aa92aa13ca890
SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4xhMlxRJ8yWFi0:BmifPbRLlR8yWF/
TLSH
T105B5AD13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40044dc4f220b7e48e0bd26d557b4e6c178c7d06c37f944998ea03aea44e7b1a
MD5 5e3a16a23c39ada3793424b22d0dfc16
SHA1 0b2fd717913e911ef748febc5a5e87b546ae1c6d
SHA512 b7822832a16a7c09f45959aed0d7f01d74565e77baaefcdda88008d43126d52809701124a39cc7bad15e9d8d0974d4554e623c53f2d2872948e8ca8402c9d614
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHq0MlxRJ8yWFi0:q5dKTi61BlR8yWF/
TLSH
T1D1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 14f9a32b99a948a60aaecc0e3f7681cb2dc7630b902089ab43fd81d30a4467a8
MD5 9c10833c2ba25857c39b99b680931e86
SHA1 6ddd1e4174569dee5708fc4a1c47b18de3f692aa
SHA512 75455b7f0a2711c58037655f7718786fa558273cfc4ac4e4425f6c8352b3721f1fad0d9086492fce5dcc5f7ac4a11bc02ebba5c6ebbd5f77ae1230e39222c5f2
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wlMlxRJ8yWFi0:QX2iyphHlR8yWF/
TLSH
T16595BE13F2D901E8D05ED178C7568632EA72BC150B38A6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6633c81b3044ab062db2e42e35e342a318b6d4803c59c39c20b46fbf6f538704
MD5 62169c3dd7470ce1d82c36de98da66b4
SHA1 d994026419daf4a7a9114d540fd2ebebac7526ec
SHA512 60b5b98b35369c021b76edf41dc89b92ac1e816ebf0aea1111e04a560d4d8917f869eda2abe8b86d46e874a2146a237faf9952b4d29a5e197c88d2e97f9ace3f
SSDEEP 12288:GAudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:G3NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T16B452308B0A5EAD9D68A0976A5E530D8C1385DFCF56C036E68157D33ECBCFA1BA9D01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0f20dd8c2d22ab4ebfef7589aee13935aaac33d6c7a12cea61e23bab2a143e44
MD5 96df1db4ba84502b47dbf99eb14d5646
SHA1 ae1db3e20d16f9bd5aa4074c80f8d8c4733eec00
SHA512 ea3e56b0ad1d683a98ca38e7c56f58a422c8a81fe17c4bb34ed439bb814d7671ae1467a28b4c0fc1557fa71d5feeaecaced46266343ce6ef4fd9239d5546ee63
SSDEEP 12288:ivudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:ikNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1F1452308B0A5EAC9D68A097665E530D8C1385DFCF56C036B68157D33ECBCFA1BA9E41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 893913b906ae734118e7da81b063e75d9d4f069dacd2f812405b31f530ff6ee6
MD5 1bb6efc16c010450b8a7fd4ac6f95e61
SHA1 feb3f0281f251384bada3e2bd7374b81a420ff22
SHA512 c605e8c4c287c67344fee1f8359bf0c376b83c687f64dda42093429170d128cdc8747cf09f3751c9cdfa4ef2d7f241f58e361460f6f29327f45ba8cce3bb16c6
SSDEEP 12288:LVudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:L+NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T11A452308B0A5EAC9D68A097665E630D4C1385DFCF56C036B68157D33ECBCFA1BA9E05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ffce4ca2fbc66b1105b622df7fffa1207c59a82c18a5957740be6bc98742435e
MD5 3d628904bd658b368a09a84b39514d1a
SHA1 f8b1429dd76923bb4427cc889835031570a23f6a
SHA512 902869b5802e210ad15bcaf36199b1bc6316e292f5b9d037882732c9ca293f95ee4361be175982fe877e4323b108d6962dd95830ab67b5d5fc152c6797d47f29
SSDEEP 12288:aV2udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:ENrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T10445230971A9E5C9C59A4679D9F62094C234BCF8F73803AF59002D379CB8FD0BE79A18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2b62437f90a85331718996b2d91a8a315cb57da371537e34b59aa14df687c476
MD5 5db76cd99525051c9ebcfc4d5f6e1b23
SHA1 9e1bf8f751a7533212f066ce9f8fa5d21cc13c2a
SHA512 c02ad4150b0fb363a4a6223234b6ea09cc543203c6665a2d9f122d527d1e94c800560dc21cd89fdb7f07673a9dfd7fbee45f995ac90ca7d662af0377c7809994
SSDEEP 12288:l+udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:lpNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T13F452308B0A5EAC9D68A097665E630D4C1385DECF56C036F68157D33ECBCFA1BA9E05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d16aa9bc28a93c269cc3613a3f7a91906354c0b17c510ac771bcca7287e87f10
MD5 87f940113a9015b9add08dca2c5cdce7
SHA1 05304379f988473019bcaa1601ce9993679d3d2e
SHA512 93370055a4cca0e925c737e5cc3d749681473b530e32f0c4c1c360ddafb89b2d675ddae6e793f60cc236b339f0b2f450dbdff88b91caef9c174c0bb93e516f71
SSDEEP 12288:cjudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:cwNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T131452308B0A5EAC9D68A097665E630D8C1385DFCF56C036B68157D33ECBCFA1BA9D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 775b42934d11b3526b3d8630d65dbc12318eff6cdd93481f59698887c583df65
MD5 16fb348212915bea56dfab1a22e9a3f8
SHA1 4420fbe5b692a4d7c6833e47e040686819110145
SHA512 0877b88d0606944e8d1e2da7365e758f3e39e5628bf9e96640b6d731d334cfa246b31dd36dc12fab730b8adb5504ef267b3ddbcfbe6fd9c1547e48b751efca52
SSDEEP 12288:x3udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:xsNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1EF452308B0A5EAC9D68A097665E530D8C1385DFCF56C032B68157D33ECBCFA1BA9D41D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 629c769f4fc2de6b65abb79caf24f111d6afe0e33164b789e31d6dcef3bf4900
MD5 bd02c069749adca1fa2804747357a4c5
SHA1 99d10ce16ad2b29f4338e238039398b2a31d4916
SHA512 f500836915c6a915eb93c469bf1b9b019994ee2bb90fd41c0cafa2341fab61cc7af8a3c88398572553d1997d967a7c78c331bb61b090ef9473245f079750905f
SSDEEP 24576:JZMSzFVSOENrKztqlxo8J8a3v1x37MFifLYCwD:JZMSzfrMlxRJ8yWFi0
TLSH
T1F4650198B3A05CF8ECA7813EC9655805D2B27C695B70C21F03A436275F737A11D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5871e1d2794d62665a793161e44a94a3dcfb895753170b2e4fc7c195afa0ea4e
MD5 661ac468dd417c3bb74b7b5e1c5938ce
SHA1 33d5117659dbab14300a173f486c75a673644c53
SHA512 11a4b8c78a882aaa86fcbce27c99c274ae04d7033054deb9f3748db3cfe2e15dea6532f152f5921f1779f474be94a1ed87ef474289aaf17d614b75c699bf2b9f
SSDEEP 12288:pcudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:p7NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T14B452308B0A5EAC9D68A097665E630D8C1385DFCF56C036B68157D33ECBCFA1BA9D01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8bdcd2974c05d64028e622778f4d94dd9af01a7e586843913bbc789a0cd39c96
MD5 c2f16b0e40ffc4ff9877f65f5f19af7c
SHA1 9d53e3ff5462ea82c2321c568a574c5b76dc68ce
SHA512 db322d784305a4306961f1a533d6a6b2fe6f862f7c74ab1d3bff886ce32a9f70e351e02f36ea7350ffce89c04cb26a5015d00b3f2ffb581735dfbc4b64870f6c
SSDEEP 12288:vYudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:vPNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T191452309B0A5EAC9D68A097665E630D8C1385DFCF56C036B68157D33ECBCFA1BA9D01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2c037e4c3bcbf59cc2e8a5b9d5b393933281186a8e41508fdbf744ee4c0acbe0
MD5 54a0488b888de6b69d32310755cdb70f
SHA1 5dd65bde662123b1648a1ceb44bf498350469635
SHA512 426e037b633783cc545808fd072621168d01bc7a48fdd8d628261a788badbe98ef7366e4138e8f8ecb9d14497ee0c147cd9f5413718992baf7a0e8d87e81f771
SSDEEP 12288:OyPz5L87udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5Nitlgyc:TzyoNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T15C55120B72A171F9D16B4239C8A21941F335B875572487AF17601B376E37BE1AE3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 288ed07f2d7509c0f8ff9efd2d8908e483cd07c6f00650e468571cb6aadc95ed
MD5 eb5061bd756f224e5ba15d2a49c39469
SHA1 72e96b27125c18895e7608077202fb0d199f7680
SHA512 8a984c85010da8fe2455614e34eafeb4bd3fd17d641494beed83c07c54c7b91d2783a246a38793931d5c819536897c1f2acee05c7bb7ece6eb85ba48f690c6e0
SSDEEP 12288:tcudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:t7NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T15D452308B0A5EAC9D68A097665E630D8C1385DFCF55C036B68157D33ECBCFA1BA9E01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ab0afe2402ab27129ecac44d643b0a58678cbe9c4ec6caca96e4995e16bd2c68
MD5 7fd1137c3057a2942d1c0698684c16c8
SHA1 16b5d429b863feb1d1ecebf99931a5af8854d5b6
SHA512 18fc07edc72b785f947b2e40717a5855e468ac9505c6da974c35039c54f669747fa2ac595460cd4bb187cc0405903ee31552f632cec483c385d030358d2cd389
SSDEEP 12288:WcudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:W7NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T168452308B0A5EAC9D68A097665E630D8C1385DFCF55C036B68157D33ECBCFA1BA9E01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3137c8adde132e200deeffc1f6e2efd8c312ebf75bf0a64cb9086b90be3a16a4
MD5 54bddd882b964d41b49130ca183e66ee
SHA1 760d80a37bda91fdae1dd7a9bcdb34a18548ba82
SHA512 194f6284bc461b3d7799e224db9d72148ebfc1f6e332203e851558994ee0282a637993667b8378d1915ed2909115d0d7a8e1718859fe6ba2570928c2a7d9f3be
SSDEEP 24576:yCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA6NrKztqlxo8J8a3v1x37MFig:yCUxPTY+8Wg2lIL8lrIUJLWwCMlxRJ8f
TLSH
T1F065BF1DA3EC0896D0BB81358A518A16EB32782E1B31D6CF2160C73D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a842a123ba94fe88a9e299c1ad771dda030bddb54fe5fb8f2af52c1ef78a61f4
MD5 109693e31b2ffcdcc351ebb00c8658ce
SHA1 6eee63ad87d3f420172c3d52888915513a070994
SHA512 d887390f39ff4c0f0fa0911193c3383b4329a5ebf539b34e043f050f196411ecf76ee3f7d8d72eca16d125eef910e26572edf7bdeab745ab5e326ed097bb461d
SSDEEP 12288:/NsfsudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaLc:crNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T169550109E29852D8C0AE5279C7961640F3337C6493E5D3CB56D0F93E1F79A90AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 da7450a6aa72c9f73c0b1b736d746c3aba21e1be4659b62515bdd934c7bbc8d3
MD5 7569bf5c269cca800a097305c363a2aa
SHA1 6c8959c6237c104abcbc0d76c17cb8bcc0d9ce43
SHA512 46c1652446cd5743937393acc414792389c03441468a9788c91275b6d265f3d4410ccfdb62d959dee1731f8f4b6c8290ea0d90cfea08f607ea8f102cea9cf1d8
SSDEEP 12288:21udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:2eNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1D7452305A198EA89D5EE097564EA3064813C79FCFB1842DBB8013A37EC78FD1BE7950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 daa80b2d4b52f4421672c2eb8717f806b66e307c2fd35e89b2f0f714fae19908
MD5 251f8aeac90b544110dc98e2fbba69f7
SHA1 9201565ff2598f6c062908fc8a4c49b307113460
SHA512 5da97cda7411dcb3a1353104a51c66640248eaefefcaec0195c5f1a1f87502bd81b7b284ba28847b687e7e6b4686e1873d0b06c606d01b1e8ea6866d12f5faac
SSDEEP 24576:48RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC4NrKztqlxo8J8a3v1x37MFifLYCw:pRZwQCyiHiQEaaPnMcMlxRJ8yWFi0
TLSH
T14885B01E62DC46A5E0BAD278CDA74407E6B27816573193CF1190C27E1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 57022368f96a545b8e58ece2be514150610095e158902a46ef655c60c88b88c4
MD5 ac3152f534d43d45cac51eebe1d0d64c
SHA1 20474418a854bcb4a4e1d35eef772b85ba7b5867
SHA512 06c75293eece7caa8ff592dfd3377fc2f0dd987160cfb604262b0b78190b49c7bd8c686d1e575cd8f62e042783b61275db3f99aa2ee1f3d13872d13d08779c08
SSDEEP 24576:abxA1UGuNrKztqlxo8J8a3v1x37MFifLYCw:abxA1U4MlxRJ8yWFi0
TLSH
T12955122E61EC28E4E1BA953D99D64005C331BC69672493EF2491923F5F3AFE0AD39F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f9e98d41e16e64a002b05df62288e0d85751f27aa418e0703f4de6545b5fc15d
MD5 da253df1941e429a9d7f1c4cee3f5871
SHA1 892bff70939a381bffc5e553e1a19192657f9351
SHA512 baf552df7630cab716bff1ba014843d42f451158c7b50f935a7838c042bbabe03db09b5e6765bf8a929b3d487c3e953681067f97559f52ce1f1ea65cc06702ae
SSDEEP 24576:/jsmP0yHaqrVqHra44KDzMsrnRNrKztqlxo8J8a3v1x37MFifLYCw:/jRP0yHfVqzlAsrnqMlxRJ8yWFi0
TLSH
T18B45AF2EF2B910F9D4AAD136454107B5AB71B42D1F209ACB0170C635AF0AEE49F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b8200e24e03f0557bffd1b86e7eee6b1a77c1a58d69598d07042a4bd0fc2a60c
MD5 b5afa4dc55a89fe570ac4aeacd735b02
SHA1 9b16c0ad0321e8af8f7866aaf4712e311d5b0734
SHA512 8366de64782b81015d4e6c049196d125f928c97bf4a38256fae9c11878a39fb13901916265cfc6ef791e6186aa9acccb512beca098943756b7b223ee17e11990
SSDEEP 12288:oDudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:oQNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1E945234CB095EAC9D68A097565E5309482346DF8F76C03EB68117933DCBCFE2BE7A109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6d8b80c9194e07245e245b73a8fe70132c518a4b81f19ca734be56816431fe3e
MD5 04bd90cc30ff01518d42e91437d8d9ca
SHA1 110265e0826811eb8916247158857c808d98be57
SHA512 1271514cf14f13da138f5e8bebfd22dc8c3bab3bb0403419faf6c19ad9c3c840126cb87564e736be8166d0b91e0d898ede68460615641da6eddebba00e32231d
SSDEEP 24576:7pLBUTyNrKztqlxo8J8a3v1x37MFifLYCw:7pLBUBMlxRJ8yWFi0
TLSH
T1F6750155F3A440F9E96B813CC9B69516D272B8AC1364E3DF03A84F661E637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 58d2c05e1bb89a9633389042e9977b77f967165bbbff2f71dea2f8a34daf6a23
MD5 766f1a0e57ca5278e80377e8aab85bec
SHA1 d3c9b8d2e70bc037ca5679af9de75c83898b664e
SHA512 60ed88684849974fb61d62828d16984eb8f79cfa0e56c8e1bf63c0481605184a612d331449c5ae646fbb193a4d5864764ee44603217cfa3957bf1579464f0e16
SSDEEP 24576:krYNH1NrKztqlxo8J8a3v1x37MFifLYCw:krYtWMlxRJ8yWFi0
TLSH
T13465F11EA2AD1CE4D57B917D8AC38109F23278A6131593DF04B0827B5E27EE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 124677047eb223c7905eabebe2b19e55d1fdcbd2972db1d29fd77ac64634ebf9
MD5 69aeae29810955dbf3487336ff59f957
SHA1 289d27c09cf05fd874a8448511cbad904ae3fad3
SHA512 860da5ff174dbea5f49295df0d6c88dcfe69744af43edfa51b862c2682469077fe541f3c4fb7629e098c430b25cb999d9a9ef15dcce6ccecd7b325d3a985cd91
SSDEEP 24576:+nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKx:+nXoJJYH84VVS6AmEcJas+cHBjSSKHP9
TLSH
T17765BF6EA2BC04E8D5BBD17DC5C25506F5B178651331C6CF022182BA7F27AF1AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f33ac5f04a2a7731fcc6d0773c1c43cd2c7b73146c81e5caf3434c7b98c73a52
MD5 bde7c277ed2f676a0c28381515736888
SHA1 447bfdb80bf6e59768d535e55074242c68033b61
SHA512 766c3a5d3e843be2524df47b8f37e40a8310207fdc8d44cb6f9992c9425c531bab8420914d908a6e1c940b5330e6324c687f03a88675c1e3dcc495d3e5e11583
SSDEEP 24576:Qv7Xbxd9Tuycf8M/TYlSuxwr2PCfNrKztqlxo8J8a3v1x37MFifLYCw:QDLL9TuJ0M/TYW2P7MlxRJ8yWFi0
TLSH
T114858D5EA2EC42D8E0BBD6BD85B79046FAB2B855273081CF1251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 975aac462a69d2fae116d900d07f46ac686b78bf1890c5de96ed8c8f82d7f5f8
MD5 6ff2d0aff5035cb9bdbafff75f85a9ed
SHA1 693fef66614935b7fc419bcfcc0ea68ca6c31ad0
SHA512 6aff3601f588a186887152c7d0d65496ccf14dda2944c96ab1030a9ba7ab09db7300a1beccf1b232c4a079e08bed90ee2a6c241bc5ddad0f842a5ad86f50a55b
SSDEEP 24576:DegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wyNrKztqlxo8J8a3v1x37MFifLYCw:DngOJOmPOHhlMlxRJ8yWFi0
TLSH
T1DF55CF3FB7BC15D5E07EC17D8A968816F6B0782613255ACF0560827E5F1BEE46E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8e1cec0519d3fd5b9b5b8c7c8e6cb80b184ef575343f3ae428bca35b7b8f28e3
MD5 7ea11fdf2164efd5acdc328d079d7643
SHA1 a8b648233f069d48ed9f1b7b60707253b6ab6507
SHA512 8c3c2337c66094d8b4c77c1cf5ce59f507404472fec2083574ed4a88db761e881b23e6c8b3036d999460d240bac8d9b25a2138669a9ae869d11325935aa5938d
SSDEEP 24576:lLJnJiTk3R3waE4JrOwNrKztqlxo8J8a3v1x37MFifLYCw:lLJnJK8R304l6MlxRJ8yWFi0
TLSH
T18C75D02CD2A810E8D4B7C2B4815A2656FF31347C3B256ACB59B4D5317F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dcaa5899ed970319a8852053ca035f0eb66480bf38b9b8601ff8de6156142019
MD5 c7950c785a9c0a987984be0f05556634
SHA1 e94df7fabfde6bdcfb9843d2804f29554f2d32ec
SHA512 858fd8e13ee3b34118ebbbf36f201bf95a5569f5998d13c530af5a39a0a57607bfa6ae450cd5ed03c808226355f8343dcbf44dbedcc85090ebc10c304cc77372
SSDEEP 49152:m9GqCzDScAZmlvTcFg8Ph6PMlxRJ8yWFi0:Y3lR8yWF/
TLSH
T191955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 be0b25d9367013cc28c1cf3a320a9405eac1a61c45075c8e43e0925beb55458e
MD5 983ed8b7683c535255035b1b6aa7385c
SHA1 56265a71062d10c75feeaa5d110860c301c49837
SHA512 d027dc2388aad07b814a37f64c66e4424f5eedeebd0135d19c4519c21d47635ff3575d6891839059546b2b8ec8e077c9341beb1f051145c4db1dd9763c9165a0
SSDEEP 24576:OlYJeXm5jUuECNrKztqlxo8J8a3v1x37MFifLYCw:OlYJeXmRUuEVMlxRJ8yWFi0
TLSH
T1A755124D71ACB0E9D26E857A95E20454D330B4B4A31523FF54E0D63BCE6AFE26E3DA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b88bdaaa0c30724c9624411a66add6b7a9da4703d19892ffd355ee492e18d6db
MD5 5956b24d2e49a7f7712b581a2713286b
SHA1 bdc76a5202c7d8e0c82bb098e4fd8b13651d4f4d
SHA512 ac392e7b89264c1e3792f4abbe6d22a26c6f930e089d27c05f73df1dc6db10036ed232fdb569d76121b2f623d69323974c98c87eed639e5822869bee8bc94558
SSDEEP 24576:AVtyxNrKztqlxo8J8a3v1x37MFifLYCw:AVtXMlxRJ8yWFi0
TLSH
T1D955120872E4A5D8D6BA0A3899A35094C734BC74AB2443EF5490FA3FAD79FD0BD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f0d0d5fc35704e98c7a5ddf16f6111e8a62c3aeaeb2becdfcd594ed2d3d26ab2
MD5 1872851c25a1c1f7aa0dc6332c2a8c82
SHA1 1c4aa581fbf95676f385f7ac625154f4214471ee
SHA512 abd184d5ee567bf3a359fa3b687a8fe7f1207b1208a9a94f3ad6f8640d792442038c00d4346bfa163b8445c3dd0a72bbe08d2201e21964ff6d6fe0376c15f168
SSDEEP 12288:MPRudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:8yNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T15845230C60A5F5D9C58A097565B62094C23879F8F72812BF2890B937DCBCFD1BE79909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fbf093aab6ede6e7bbc8cde576d8937763a565738a74532dc2422eafb2f552e8
MD5 b7de4e5f17b0d021e481296b535e5a1d
SHA1 f0125bd803322ad9e67e26fefc409b45710c12b4
SHA512 4e0312161301aeff73e6d80ccefb3b10187fc1c81111a99aa9991b266f2ae2d77e270012327d81b43c0a1f959c32d3ef8cce8cc30d9ecfcc3fc07d0768e40bc3
SSDEEP 24576:lC+TyQIu93VAumZr7jmLNrKztqlxo8J8a3v1x37MFifLYCw:l/TfIq+YUMlxRJ8yWFi0
TLSH
T13A558C1DA7E91DCAE2B6C675C8A34493E633B871137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 70e5428634729d7fab25ee7420a30835247d02cbecc0b3e9543c7c483b809ace
MD5 9a59be51c1a9ee8a66abc8e8d29c3714
SHA1 8c26dba9c1ab81be6d1a0cb6f1a3b31c794c9b87
SHA512 cdb3d0e1f84cf4c518f37f049fa6094e211d42969423f280f891df82cd2197880e21593c87cc27097277354d0b6edaae81fbe2485a5d61775842b51c4497cd54
SSDEEP 24576:ZLQikZ2NrKztqlxo8J8a3v1x37MFifLYCw:tQikDMlxRJ8yWFi0
TLSH
T14665010FB3AE10E5D1AB813C88954155F6737474971263EF05A0CB3A4FABAE6BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1dba0528e0127b2346b3f017c1ff883d337fcd54a045f9a7a510b26221d7045f
MD5 b328f116febd933d5deb08c9f1034b4d
SHA1 3bdd0ce4cca550f5ba5981cace35e425c6604b20
SHA512 977810e4a44683f8b93b81e63e54095b4792c2466788359301e2c04d35954ea73036ff3959ec751e6051bd1c3a04e68e08c6752b64d31cbfac43a01ff683a644
SSDEEP 49152:ZpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPKMlxRJ8yWZ:qpC7b4+80GTk8lR8yWF/
TLSH
T186A57C3DE2B810ADD9AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9ee902509e596c3378080986c0c597af124f2d17c69095112d630de77fff815d
MD5 f34990f3b2c395e4cb2a4a6bcc324034
SHA1 82acd5e55f77e57724c871a7bfd5dc413be2fcb1
SHA512 dd77e6adf3b7bbe08e4776f300447604d2efbe1bcf1423781706759dd185c28e17ccb5f90cd881c9e3e235dc3be9b7ead1c03e4616fca67d6baa0ee24ba9cb04
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l44135UQJNrKztqlxo8J8a3v1x37MFifLYCw:dqPCIo4Kol4/QiMlxRJ8yWFi0
TLSH
T11B55B01AB7F956E4E17ACBB4D663C501FB727822133163CF5290813E0E16AE89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 a60ae6c944d14458b3a9f9783bf81be81a9b8023bcb5d1ced5c032f6542133b5
MD5 7bd23f1bbf435cf67fcc26a16c781a9c
SHA1 89dd5a8090ed0b9770c1d76846b9f7743b079acd
SHA512 703a91583a9bf256b89ffd8615dc7d9f99679cd06e3ee2bfb767599598721799bce3d2100eded8b0a119d1b7e6c80a089d9f25e257ad1c7f877265b0beaa6d5c
SSDEEP 24576:yyLXPLcM94tZNrKztqlxo8J8a3v1x37MFifLYCw:yy7PoLtSMlxRJ8yWFi0
TLSH
T1E775E13EE66D08E4E47AC27CD6A38506F67138AD033166CB15A0957A1F6BFF4693DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 b4c9aca28bfaf3fef5a5f7a42e3d72c41245c904efa601e40d21713e0746915a
MD5 93bdbf21ffa5046987a92a521fd24adb
SHA1 c707cd5ac983cc1b722da369cd1a200d81365494
SHA512 279ab1ca42d71fe3d5d6bb7a3cfb294453b5666489f14ce76a63d81bcbd036f64671ca2f38c4866a2931ad754ce7011d13b0fd6e53a14acb001e7b6361516fea
SSDEEP 24576:EWv8qjpmNrKztqlxo8J8a3v1x37MFifLYCw:EWv8aMlxRJ8yWFi0
TLSH
T15765124E62E4B4D8E1BA4634E56650648130BCB9636856FF34C4E93B8E38FD1E93EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-361-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/424-76-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/424-82-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/424-85-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1240-95-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1240-88-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1240-362-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1240-94-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1248-211-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1328-168-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1360-204-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1656-207-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1680-110-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1680-364-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1912-132-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1912-138-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1912-212-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2072-2-0x0000000002170000-0x00000000021D7000-memory.dmp

Download

memory/2072-84-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/2072-0-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/2072-6-0x0000000002170000-0x00000000021D7000-memory.dmp

Download

memory/2168-352-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2168-69-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2440-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2440-365-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2440-127-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2832-15-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2832-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2832-24-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2868-99-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/2868-104-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/2868-107-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3176-363-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3176-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3248-146-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3456-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3456-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3456-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3456-64-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3456-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3728-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3728-106-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3948-374-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-372-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-390-0x000001E9F1490000-0x000001E9F16A4000-memory.dmp

Download

memory/3948-379-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-378-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-377-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-376-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-375-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-462-0x000001E9EED70000-0x000001E9F0C8A000-memory.dmp

Download

memory/3948-373-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-385-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-389-0x000001E9F1250000-0x000001E9F1483000-memory.dmp

Download

memory/3948-371-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-370-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-369-0x000001E9EED70000-0x000001E9F0C8A000-memory.dmp

Download

memory/3948-463-0x000001E9F1250000-0x000001E9F1483000-memory.dmp

Download

memory/3948-464-0x000001E9F1490000-0x000001E9F16A4000-memory.dmp

Download

memory/3948-384-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-380-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-381-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-383-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3948-382-0x000001E9F1110000-0x000001E9F1120000-memory.dmp

Download

memory/3964-206-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4352-205-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4696-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4696-269-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4696-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4696-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4776-67-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4776-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4784-366-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4784-163-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4784-157-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4784-188-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4784-172-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4784-213-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4784-208-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4784-386-0x000000000C080000-0x000000000C088000-memory.dmp

Download

memory/4948-268-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4948-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4948-37-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4948-31-0x0000000000570000-0x00000000005D0000-memory.dmp

Download