6fd6cb800bc1dc5c28001adf8c7847c4b920fa3233ebc587baa6724b3e407820

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Size 1.5MB
Sample260604-twstasay7v
SHA256 6fd6cb800bc1dc5c28001adf8c7847c4b920fa3233ebc587baa6724b3e407820
MD5 88249a9528191431169111148b1254dc
SHA1 a22cbe96f1a8604c9b5f64f1d42aa54ac6a56d4c
SHA512 e8a2853fb6075a5bea0a0264f1b1042da26a06a6a711d6f2fe6cad32001e7f52a32a6e2516d89dfee70716017b3f272c94ed7ddf4cfe93aac2d064aa9e813b8f
SSDEEP 24576:Famv/M7y6tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:smHM7y6tdnYz5d6JgCg
TLSH
T19E65F1507591C032D8B600324D68DBB5897EBD214F6189EBB3D42A7EDE306C2A735B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4968	alg.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
5384	fxssvc.exe
1928	elevation_service.exe
496	elevation_service.exe
4948	maintenanceservice.exe
5484	msdtc.exe
856	OSE.EXE
2132	PerceptionSimulationService.exe
5584	perfhost.exe
3204	locator.exe
1536	SensorDataService.exe
5688	snmptrap.exe
2156	spectrum.exe
3612	ssh-agent.exe
5404	TieringEngineService.exe
5892	AgentService.exe
1652	vds.exe
2544	vssvc.exe
5140	wbengine.exe
1044	WmiApSrv.exe
788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\484ec83ee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ac199b33ef4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8f42fb43ef4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093e981b33ef4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e255eb33ef4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000996fc9b33ef4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe
4340	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeAuditPrivilege	5384	fxssvc.exe
Token: SeRestorePrivilege	5404	TieringEngineService.exe
Token: SeManageVolumePrivilege	5404	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5892	AgentService.exe
Token: SeBackupPrivilege	2544	vssvc.exe
Token: SeRestorePrivilege	2544	vssvc.exe
Token: SeAuditPrivilege	2544	vssvc.exe
Token: SeBackupPrivilege	5140	wbengine.exe
Token: SeRestorePrivilege	5140	wbengine.exe
Token: SeSecurityPrivilege	5140	wbengine.exe
Token: 33	788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	788	SearchIndexer.exe
Token: SeDebugPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	2424	2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	4340	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 5556	788	SearchIndexer.exe	105
PID 788 wrote to memory of 4372	788	SearchIndexer.exe	106
PID 788 wrote to memory of 4684	788	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_88249a9528191431169111148b1254dc_amadey_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5584

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1536

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5604

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2900 2912 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4372
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2940 2936 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9255ae04a3e5bf633d60a65e97c724005c561fb009c382927991d2f5bf0dbe2e
MD5 7a23e2824903bf5bd7384ece63c69243
SHA1 9d27af0366e05ccdb4d258b5d25d8152270b7ae0
SHA512 3a3561b3a9a960d373653fd82356aa48d4e01adac0ed411ff3c3a3e9cbbc43b2702612c9cc4439a2e98d42aff3bc125001d572b3ae70b9a3bb65cace591a2d76
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNtdnYz5d6JgCg:a3q6mjBFz50GC
TLSH
T161D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c7b29c06b8aab58ebb300940cec81e73092f59635a7db93ebed8e0eb7846f12c
MD5 82ad0cdbe796ca96e72b92f7f39b94cb
SHA1 ddccdb8abf6f6ab1505dfa13567c842d7ebddd19
SHA512 5f859b15f147b54a1ba5b9d9478a0621bdde6a48934a6dbae21500cf6b0cb76e0b75ea038f7894ac2bd8034b7b7430df00276e860ac8a8d62315c721b0e35c9a
SSDEEP 24576:AXYfDtczAytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:3tcbtdnYz5d6JgCg
TLSH
T1E265016973E408F9ED6B8178CC62C501EA737C5547A0E6DB03E4A9254F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 60d53787e4c87bf2f7e0177a5f603fee42dea51cba1313f9c0022f8597cb2151
MD5 49af8317f3dde7391aa11e4de0d70d64
SHA1 95d462557c2e0fb8cd3cd43a1b5bac36168ee8a7
SHA512 66ea86a18774748e45975889cde0d4575c0f653299816ca47d3eca262e589b3a111d71abc51419411c9c9c3987dd3679f1bdb637b0fbfde5ad83733314e5d3e4
SSDEEP 24576:A0Le5ji0hmxQrMVtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:APji0A60tdnYz5d6JgCg
TLSH
T16B85AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7c82ac50dcde58989594493864ff8dcfa6c2b6cb9f253db211bf8536ee302714
MD5 7600f35558f40d574451899389abd3b2
SHA1 6821491eba6f56622a0ff9e9c7c21d7960298095
SHA512 8ee8557dcf3558267ed785854f65c9e0ac96554feb7b160ff6a4df16b13b845b264c81ad80d4ec0c6775c17286328a7335037dadba06ab718c97b4e1ce8bce4a
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyuLtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:a/ezSC6vUzPv+HjywtdnYz5d6JgCg
TLSH
T17A756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f703da1584584e2b053c4b18f442e40320aa81392a3c1228829979795e44ae3f
MD5 8c07e2e1808703ae6126df4fbf949bdd
SHA1 efe5fd13f7105dfea13e0dca7fc6c2163c44eb56
SHA512 8936ba66809af3169a81f698a197f0a203a0d930436ae7a871f9ab26cb09e97b4322d4dd977dd4fa3e28925af7107cdf9fb8ac41f58860d49bf8603e193630dd
SSDEEP 24576:/VbqPb88hv/l+B2tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/VO88hXl+UtdnYz5d6JgCg
TLSH
T1C3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6d0ccedbdb66c2a8fd1ef0276fae563d3c4432297718449c9c63c0cb331fccde
MD5 7bae50ca8d527b0ee4cd650ac3264958
SHA1 3d062e9ae25056640fb18a52b3b84ccf29ff51b9
SHA512 37e910ed5c68a491d77273a7a058a6100d45a3a5c5e54c872f5fd531db7ef501d02102ef09966fc84ccfa644d06768b59b77c2caac4512abb2d4fb1366e0f956
SSDEEP 24576:3Iptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1BB4523D3A65C54B5DBFF45B1980ACE04665DAF5988EA88B7E2643659887CCC0C338F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 00ebedfde333f0b37d4991cdb9f8a5934ff9e4ee1b4306e97d5ca1ee863348b4
MD5 233b68458b12bc78f6c88ed82c04080a
SHA1 3622c9fe61860d049084ea0a80c691566e4e988a
SHA512 fad1c85e571ee1ebe5969db95f06d2c2fdd63358b7aad60150582af903738d18b26cd140939207264361d4142891ae59f0e189b8dfc66e55b69349af4c596bc7
SSDEEP 24576:0JIU+tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:0JIU+tdnYz5d6JgCg
TLSH
T1C665CF7BEE28FCE2C27E8DB95A51C600A77678304F6293CBE164920EDE235D05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4a4a68b0aeec5cb91dee12c177bb27c19e74693d97a282917a03b3bc3bc3e9d5
MD5 704c5c2fee7989ce9e25f7c896ad3ecf
SHA1 f1bbbbab40a715b801479ce0d11a6ee837a78439
SHA512 fb7dfc6005722ffcd36ad1fffe4db36fdac97a0452709e0181c46d921b9b283eeb2fffe41fc32def073b0fd79c1d812f0ceec126abe1ab5d048a4f3bab208061
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THf:3QvGAdlCEL8c/WRNw5CUz50GC
TLSH
T105266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 347bcf9783103da11700b8f52bd8a8c7a3a9763d856b517cb5136361e03920b0
MD5 1071e70140872f67b4bc4626d13ca61b
SHA1 fac0035282b836b2be071081946cd127e66dcec6
SHA512 c671faee0495df077883b19da58d3b69022f9c451c0b58aafbfa66bffa715f814ac7e24c233e7ec3504f3178581437738425b208881923d58bbbc4aeb869e7c8
SSDEEP 24576:jEewsAjktdykir8q0Hsw47opM6g9+JVuOUj7Cg8:IljktdnYz5d6JgCg
TLSH
T1C175E071FA74E036C7BF0DB21B26C716146D7E204FA219C3E3A85A9D59346C22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fc20b7b52c0812bd3ea135d702cd187701525d890aaeda9ab1a10a5376eb7590
MD5 98adf5ace14b1847cadaf97523dba7a7
SHA1 7cc796c466d9883c9615a4f2af3869da3eec510f
SHA512 9e750606f3c375e6901858a980fb5d864945b4421b4837872a8fd9a31d4d6d379042eaaa808cc386f7e7ca0edd8fe34584e27933fc36b17961d1d9172dd140f2
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHD50:aUEtQevvqc2W1cpV20I32D
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b04acc8918c4e854b3f569feccdd9b2e291cfbd2a8885c752b5398e9c84fd1f9
MD5 24abc2dacd5204f33c0929614f143258
SHA1 963b94b2bf07ca651ff692726ccc4b3ab31d5849
SHA512 9ccc46bfccd347907d9c548458e881c24c1778b26c39b3156e5fbceed54004696f057ded794c53144d2c06d760b22e8f65a13c79967d28a45c2b452dc346f40c
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/zEtdnYz5d6JgCg:koq2Vjnmgz50GC
TLSH
T19AD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4728f4fe1bf32fdb3915d6b0446213b1f918a98a8e25bcb88adeec526cc5dfa4
MD5 8c5b55f84656b72ab19f5e41a2d34d7e
SHA1 d0918e877b16b40171999bdaac245a5255817920
SHA512 8434f21a7cc9f3764694ce4c203efb7ad8c663a234e6429605d64f89ca2c16259c7e2435415f573299d951b96b77a18c432ea5f2e40dc1b6d3c6be1f50f30b60
SSDEEP 24576:DAhGL6IFoiwtA5l7S53Xtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DAM5Foiq5ntdnYz5d6JgCg
TLSH
T16E359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 137a6d2449a01a42faba0ac6fa9cbc6e21f3715cfdb551fcb09e3751956b5cff
MD5 9b3ba358a3e39c839da5a169d3bddc4a
SHA1 89987ec87b86e8e78a395663f3ffed1bdd07b2b0
SHA512 43e1806697d0b227b7100a1a03b0e1b8673d2b69dd4d8549d9d2bcf201368cd21239d8b27f1718aebbb0c615e8120bf9e3ad31eb2108a33b24b3fa32b9d9cc88
SSDEEP 24576:Owu7OWQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:OwoOTtdnYz5d6JgCg
TLSH
T1A165F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b0bbd29d12aedeec4e032e336c4a7f7398353bb7448054b1b7c505b58c935e2b
MD5 b09e755487fd443a4cc40d9aad40c463
SHA1 153f0b11be8ac9bb8c92baf745460edae0f914fb
SHA512 a54045845c2c249513f6aad2dcda66c8ab286db60f755d309c95093c4d75e42232e4fba4b4ee9a238404c180c1077c6d4460fc2fb760d6ed032741d5abf0a1e5
SSDEEP 24576:wZu9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rtdnYz5d6JgCg
TLSH
T10E5512C633E820F9D5B78278CC958A04E7B67C5657B683DF226422695E37EC04E38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c7478dd7451635f47099574eac529d6a58e20aa7af3c0d86dd6df41bc0d9664
MD5 7b6e8b4cee455d159872d05a52022f68
SHA1 e122eaa28c56e16472ee287787ad688ddbeb6da0
SHA512 3dd60a2019f8cb8889001b9692ca24b5d37b28351b8618cec9b1a92deb5cfc71b8146135127e19ef589d7d24e2c6ada5e355d0ff56496f1ef6f586c9d36c07cd
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:1QRQyi36YOcPDLvw2gAf+PN35z50GC
TLSH
T15D667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fef40cf3d4f042008612cee3fdc326804a80d4ec792b24d931875007798a8f1e
MD5 9aa73a3d3231fe1be773d8bc10ef749b
SHA1 026435c15c23c1e61a75b7ae244643f78494274a
SHA512 9c5de75493a8887b9ae35f12badbfef4ac09dd9013d38863246cb8cbafc68a3329be9f242915b7a52724fbae6c596dc962e34f4a5f9164e7e902c1a4350fdfbb
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:CQRQyi36YOcPDLvw2gAf+PN35z50GC
TLSH
T17E667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 70db1dbac99a2bc86d3fc66babab244d45839a164724224ffe688bab61fe3457
MD5 89209ae8bd629f6cb09a4318a765c605
SHA1 aa5fc23ed3a148937bda021bd6998c60fdbb48e8
SHA512 50130a769146bb3164021ebe94026fe6531647bd2721398b0bef824af52557cf36a16df12b7e42256c43eaa81f5ac62261ad1399db7259a3c6b8f0293086f203
SSDEEP 49152:Z68Qg55nhkeWu7PNU3/0tdnYz5d6JgCg:nthTRc//z50GC
TLSH
T1E9B55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4b748d3be1994183b8d2dc5580728782ac5f81a4ead45b5905772085fc3dc7e6
MD5 c45beee8888d1c859847b2f73e8378fa
SHA1 f890820992cf8e31fecab2d4d5906a5aace9aa8f
SHA512 31828198949d8f1d608f89910e7697a911bad44b53ed3ab177e2a4a34e3b056b638921dce0f7a743d0cbbaccbd2ff0f54edf8c8079769008f792971fe7fffc8c
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:ay5112gYy5azzVvU69nLKnhZmz50GC
TLSH
T16E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba4284f403d0c95f68bbe2c0e0998a1515051cde88f99b6aa33f556dee62c768
MD5 ce22ab56fc2c219bd7c6fe5c2934ac57
SHA1 6341dad79fd91896abb4028e5ecc65e41569298e
SHA512 9525d8be2971ace6edfd1b1b8c8944bd49ba975d04f9a1f299912b2b4828a01c928ea4b1d42678f9afe3d5b4ef59a1c3d8d292d6a8cf126171d47954bd16c4dd
SSDEEP 49152:7B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCtdnYz5d6JgCg:tu6JmIxd2dxz50GC
TLSH
T10CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 598a48e3f10a7ed9434b0f6c57e05cdf42b0151162e439aa8f7a11717f13dfc0
MD5 0744305d9e72619d7d7e41a021741d4a
SHA1 b8554604d913369c1c8c858413dad96aa1383108
SHA512 45d21d7c3ce6b898a2502ecdbce5633f6ce6abd71aa38d9f0cc5a47e979c325a57eb7225c64f3daaa1bf6279afd80f71fb302ed93e4f46c3a32ced78c1421861
SSDEEP 49152:p1hpsNoJpF1A67U44CwH7R4xetdnYz5d6JgCg:pmifPqRgz50GC
TLSH
T1EFB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a09e073caf85d89b9085c287efcca0cae9835b75628ad87d90adc576c26440ad
MD5 06ac341e01955e822b7d37ec42b858b9
SHA1 b6e82b7830cc0017093c44e129e5aa8fb96203f9
SHA512 6425e0b3d4deb31572e95aa088bbf94b7172dbd6bb045af6f35f97af8883ae21154360963ef8d9dff16c38f86f7e3501f3cb49915485db6cfcf30d2a1ad9ac38
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHq9tdnYz5d6JgCg:A5dKqi616z50GC
TLSH
T153C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c0dd108faf73c97a56fece84ed87506cf41b1590c4a962984a27991533b49a3e
MD5 f02a642c13ee8b0170acc42698c47365
SHA1 a3c4721f68b03f15ec15b86e7f3669f5f04099bc
SHA512 fc36e8bd6d488c2b6ddf889393947280b119eb64e87aefdcb0fb0968e9cb7a2fbd0c846f5e0b84abb510bc88c310c0f542819062389ba45dd8cba74e20f5c13b
SSDEEP 49152:mhtSn8EApI0figjgiDn0AP5wytdnYz5d6JgCg:nX2iWphcz50GC
TLSH
T16995BF13F2D900E8D06ED174C7468632E962BC160B39A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a0d65ec3bd7290edb27970025b31e60892bde3e9a80070f6049e6691652f52b9
MD5 7afde87ab345bab50281e49b33f08aef
SHA1 adc8e9552a789c6425a031afee37ecdd91cee3ba
SHA512 104beb1846f9829c09ff0a741b801ca0ea0ec2f2ba5eb0f35cf716d59efbdee8a4bbc28059839471f605621b82f12da0f4bf456e4a7634e46ca96367eab38781
SSDEEP 24576:pRtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rtdnYz5d6JgCg
TLSH
T1564523D3B59D45BADABF81B1C80A8A44659D6F5BD8EB80B7F3583215887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a8a84b3ad4717c1cf0cff1e6c40b6b86d6230f1fdc564bf392891c93b4d1fc91
MD5 2b7e3dd820e5f4ba79c20d2560513427
SHA1 4de820fa3e6027d3f870ab12cc5fa7cd8150adee
SHA512 7af766b63de4cca5ca829a0c5c59df59213feca51adbd2b5d7f7d11e5da8480ae0ad8c6bb779365f40c25c547bfea121a10271261b1c17c3ea8c6109530a83ed
SSDEEP 24576:motdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DtdnYz5d6JgCg
TLSH
T15A4523D3B59D44BADABF81B1C8068A44659D6F5BD8EB84F7F39832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a8a618511328c178a81018149e7d4087cfafc7fc3f17810dc4213ad79a28e3da
MD5 b9bfefa5ae25c71ad167cb4552cb0533
SHA1 26d1f773bd1f6bf5dad9a133d9e66378797acc03
SHA512 34c4a07642faebe0b49e14dd9ffc9887fb51d0c7640d81878fc8752400da5504cea66ff2e20d12c98a923b2adcc30a70d3dc753ae4e507d002bbf75037b2d7ea
SSDEEP 24576:FGtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ktdnYz5d6JgCg
TLSH
T16C4523D3B59D44AAD9BF85B1C8068A44699D6F5BD8EB84F7F3983114887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ad40365a338509c95acda7ef821f3cf8ed1b6627c777066bdabf7033f7f707c6
MD5 4d5c50e9f5eac519b532dec741bf7d61
SHA1 b3929719f9b0329c11dd207fdd1af4405d936df1
SHA512 a191234c6e8650789718cc32c6d4246a1509c696364b419b75acd49953e5d67505cb04d5d113dc7cd70f1ec09b858126e1b6e96ba5eb41ec6d6cee1a8fa5ed59
SSDEEP 24576:rtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rtdnYz5d6JgCg
TLSH
T1755523D377AD40E5D9BBC2B1C8168604E6ADBE5ADAB684FFA35035194C75AC04338F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c28b4209e5be1ae966078d34d7281027c5fb077b4c33e4dae6401335fb1f12ba
MD5 38f81be71d3f541993ca3d50624cc3b2
SHA1 59235700ae050ef4a9086945839e49b37b2ec344
SHA512 a65a43462d078b8e2806c589154bf912c46f1e2aeda60a2ade98acd613f079b7137f60cdde4e88acdc837fe09e6704d2980c18108b407b275c07390f60479e2e
SSDEEP 24576:yvtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:etdnYz5d6JgCg
TLSH
T11E4523D3B59D44AAD9BF81B1C8068A44699D6F5BD8EB84F7F3983215887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e7ac29d18b68df70f4d34997850bb987c8e1303581786090ecc430fba506a70b
MD5 657543be4e770a45789c283fb8eae625
SHA1 b4cf6a75059e516a2e7df1bbf475a6293931db3a
SHA512 d63ba7016f88bbed6d3e14b11f5b109106e3f3c75e858b0790752ec1b6673d2350061090a0ca19cd7a61029020faef6e3dff0ebae6c5c85d8abed8e36d1ac821
SSDEEP 24576:istdykir8q0Hsw47opM6g9+JVuOUj7Cg8:5tdnYz5d6JgCg
TLSH
T1564523D3B59D44BADABF81B1C9068A44659D6F5BD8EB80B7F39832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 063736070f8c33556913cd3097dac11ab6abebacb3a8f7384a6b8ae8e3a69dbd
MD5 a055c666bd9397d9f7a4d4fe53c3a6d8
SHA1 24f1aa63b6566aebd19cd9cca24897918b1b708c
SHA512 b9f65ac0ce18e1d0e1fb96aa102c02bfe56ab0f56a9c774fde5a5b9615ce30b91faad02b23587053b423ec180648349567aaeb44f17ff290bedb5c91847f4120
SSDEEP 24576:bgtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:stdnYz5d6JgCg
TLSH
T1884523D3B59D44AADABF81B1C906CA44669D6F5BD8EB80B7F3583215987DCC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a9502bebbdc44aa54e702acebff947033b521cf7f8173ec34e1eddc73716e0b1
MD5 7dcd686407506a30a4fbb746ca415c31
SHA1 8ad4166d596758cb75eb693f9390569a346ab26e
SHA512 d46e14c12b1a9d4a01165d620b74b43a33c0a6e9f61318bfde0bf92b55fb6c457bfbbfcb16a8883f5f88e802dde11c7f784116134d0e64cb33c601b6ebefbc31
SSDEEP 24576:wZMxzFVSOItdykir8q0Hsw47opM6g9+JVuOUj7Cg8:wZMxzfctdnYz5d6JgCg
TLSH
T1AE650195B39418F8ECB7823ACD158905D6B27C5A4BB0C56F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 45685439e266a32129af365bd804fb2a949c031644a8760b01f1d37035fdfb74
MD5 1d3856649f8b5b210055dff16e30d350
SHA1 367435b7b99a346b6f1d044d12ffc42ad867ca17
SHA512 d5e11274ba6cf71c89d6b2ad43b8522044042e98355aa4ab2190e2e8343f5e51f1a09996b800c8aba651977add87318255ed8903009604c9e6448f602d30e0d2
SSDEEP 24576:Lttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JtdnYz5d6JgCg
TLSH
T1E04523D3B59D44AAD9BF81B1C9068A44599D6F5BD8EB84F7F3583215887DCC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a4ca9d59445ebb6eb435636fea0dbb9266b484b11888ff77530db7cd0ff36e50
MD5 bec2b528cbf2dd22250379f1325b6052
SHA1 815e5398e66f574ea609193f9ac195ed97f18a48
SHA512 6262e0c9622962f3520997f452de3506f5cab0d8780a87dc8c9a96f197251b3e36797a93f62fc02fb40158e194285b4579f16103b6033bb46e4d2b5592bb5a4f
SSDEEP 24576:5Ztdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vtdnYz5d6JgCg
TLSH
T1854523D3B59D44AADABF81B1C9068A44599D6F5BE8EB80F7F3583215887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7f0087181a9f98bea644724454833ca5586594cf17df468222be48a096415ec8
MD5 f19e7af8476ce670d521afcbda2d064a
SHA1 e92d348f6cccffc8713f08b08abc54f86eae15fc
SHA512 b44c20e3e32a795a8e0cdbb0e223f680f0c2901dc409ce79f252558730fb74c4218cb0c04934a8bb391d9b703076605f534b34a9e040366d5b01e2fa5e8a5724
SSDEEP 24576:YzyUtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YztdnYz5d6JgCg
TLSH
T1AF55028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c3d021d9dc373c909baa53820f7c2e7804afa2f0e04379df8a431f979ae536e5
MD5 38df4455f27d3b5c77722844b74288bc
SHA1 ec4e4c326c15aa9aa7d2a2c8fa3dd03c79aa117b
SHA512 7e2d35ea3c787044892c05fdb69eeb6c132b385999c4f0728f08a6df674cea393be42de7705067bc719629c6e0db2acc938dc476671eaa0768c2786bbd8b6edd
SSDEEP 24576:9ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ftdnYz5d6JgCg
TLSH
T1664523D3B59D44AAD9BF81B1C9068A44599D6F5BD8EB84F7F3583215887DCC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 42c88c1ed55f2fdc9dc9f0703dfdd8cb15fc08bb036fe57c64f6b50a42ec4022
MD5 0b8de74666ca1ea63abb0618567a8cdf
SHA1 282a57059e15346604cdae843564c2c3e689d921
SHA512 365695516c65e1d9ea7e8a00e8e2423fc05b1de79c60d13f843c3902e105d15030ba00761ab8ef23a8feeea049688c92ea85d477103797f100ebab46714ca965
SSDEEP 24576:attdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ItdnYz5d6JgCg
TLSH
T1A74523D3B59D44AADABF85B1C9068A44699D6F5BD8EB84F7F3583214887DCC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6ab0b47b7d4e7e3e3d7ac8a5edc2b34367fe63d0bb23bee8cd7cde5028774742
MD5 ba883dbf451509433206fea3b74e6477
SHA1 1e6c14a4936e46fa48497196cd1e8a4742834f4f
SHA512 34a8632d2e25e4c7c48818c3dab7abadc302670b0a17f5172dfe0ef064a07a32a8663c4decacb2c59520fbe1d62a1923d7c50b326d4144a3bd3704e5c24b7827
SSDEEP 24576:vCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAqtdykir8q0Hsw47opM6g9+Jp:vCUAPTY+8Wg2lIL8lrIUJLWwvtdnYz5D
TLSH
T19A65AE1EA3DC0896D4BB813589518A06EB727C2E1B22D6CF2160C33D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1edf304bc2f6bb082bad88322694f7d6bfd1ff0e3dda4ca790ad6bf51d505bb6
MD5 cc9e4ddb52598c88b4727c6e406b08b7
SHA1 99e5a3a9e515c9ab1e60a0d5c74137ababf408e7
SHA512 439e3feddd8fabe2320e9745a201e1f0647d6c7e918468bd2613f4891768baa252aef249d16c31c961cf646d218610c552074de81302465d4499dfc0e1097d2d
SSDEEP 24576:I9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:itdnYz5d6JgCg
TLSH
T1FD55F19AE29801E8C06E5175CB468A40B7677C6587E1C2DB63D0F53E0F7AAC05EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9f1a4ed71e7b1e991a5e808b6a083aba55daa34bc7e65eba9a55bbb7f71bfd3e
MD5 31b83d5a1a24f61635ccf48275705666
SHA1 eb9e8391ca23da4f117fae5003324e2ad0a3665f
SHA512 17714d7db8ec65c3c41576528ec241e137f8981b31c16eb6913b88ee58645c164b5dcf567b728e398a2c84061d358515e9eae239c831026a7dd9a108ea332118
SSDEEP 24576:7mtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:7mtdnYz5d6JgCg
TLSH
T1034523D3A39C44A5E9BF86B0880AC614665DBF699FE684F7F24432599839DC04738F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6dbfb681aec64ffdf8577bfbadc380a5d245fa64f1d9adf97b55db1d8c3cc949
MD5 4b5a0a4b7ed9d4cf6a7ed4c966679abf
SHA1 9c17b6b43e2553782bd223c929e68bf0684e044b
SHA512 4838bcaab2c47ee287b5c2d7cee88b394b249804bc300bb22ed7740c4a901ef9cf5b84a361aa815a219188d0d362e010629519549753dbd7e0ec310de999713a
SSDEEP 24576:B8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCEtdykir8q0Hsw47opM6g9+JVuOUj74:eRZwQCyiHiQEaaPnM1tdnYz5d6JgCg
TLSH
T12085BF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF1290C27D1F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 516e0e0c7fcb70fecc275361efdbb5e9430cc7174c02d08fc2f54941c5b7124b
MD5 5316686333a0744e5a55176579eb1adb
SHA1 9461a38c1f5c008c8e4e2c5349e5e71c363e7b51
SHA512 476bcb9c6c0c8b9422758bed68ee950316509090574bd8666ebbd215de25cd668795913dcc71381a52d0b566be555d5666724249e3cacf31f7c7b6eb7dfa68cd
SSDEEP 24576:DbxA1UGWtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DbxA1URtdnYz5d6JgCg
TLSH
T19D5512AE62AC14F5E5BAC17988868105D332BC2A577183EF61D0A27E0F3BED44D35F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 50954fd07ccac5abbe3f734da0ee75a9ef7fcebc78fe6fe108270459bfbf88d8
MD5 aef7a58ac819c2f4d58084e1592a8b4c
SHA1 7dc98b7f28c37ec6b28a34553b52104644c5324b
SHA512 930b07b3ff456b4b64368a35a6dfe69bb78fda898f593cf8231ea439efa7925a3cb87ba2ee2f4585b259c9fb521972d08048c1b05f60a08022b6f6eb7cfd2ae3
SSDEEP 24576:ZjsmP0yHaqrVqHra44KDzMsrnntdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ZjRP0yHfVqzlAsrnntdnYz5d6JgCg
TLSH
T17445AF2EF2B910B9D4AAC176450107B5BB71B82D1F219AC70170C634AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 156b206f677d322fd26bc739f46de86ad64e995263c43fc773b53a8ba7684823
MD5 9cff23308f80e01eda87d230f5e86070
SHA1 fc32bff641b8aa9855f889b2d3371f63159365bd
SHA512 a6376c9900c97fc090e4d61b2bde1ca507664116d96ebd51bc2107aa2bc0c690982224ca72890aafec6b3b644ac74524fa56ccb6e2e319edefa9637be1136eae
SSDEEP 24576:KMtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KMtdnYz5d6JgCg
TLSH
T1375523D3B29D44A9D9BF86B1880ACA04664D7F5A9BFB44F7B1A43215887DDC04338F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 efa35f8d3b32f3a64a1d230ef225385ddbdf17759f27171bafffb541613fc0b1
MD5 52a2eed6feaaba87d6727752778cc817
SHA1 ab36d61e643d59d80afd6656045e2cc1cf9dd77e
SHA512 17c051132ea8e1732f90de71adc93f0b357d3393b3f4d55ecef26f25b4585916372f9f4f9b2cd5d2eb36ba1b9b02c09399cb90c5db81dfe915ef7739e636a4e8
SSDEEP 24576:mSLBUTytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:mSLBU+tdnYz5d6JgCg
TLSH
T171750155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1147252a6d6247086c427a478ad1432dad6c70f66bcab653ec0b1ad6690981a0
MD5 4680578dc1f2fe3136d38e1f3fb89096
SHA1 522eb3deab13e0082837f563dd32f52206912b30
SHA512 f54df8829393bff25b98d3275c68324a59831aeae733501d2a6e6d60adc7e45ac485fa5a1f962db69a5c367e46a4aa197b9c4d91372a78bb52ebd5ee697fd6e8
SSDEEP 24576:qIYNHjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:qIYtjtdnYz5d6JgCg
TLSH
T11F65F16FA2AD08E4D57B9179CA838609F2737C66175192DF01B0827A0E37EE87D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 76dd1a55a75b88fe4b3340424fedd150078dc8f7eae6d0ac74eb18afe62950c7
MD5 0629236010bf1e35029e886524c10cfd
SHA1 ae08820b0ae695407e183100d6d682fd5456f53f
SHA512 de010972e476624297185bb1e1c4440853b23b2f6969601e0f35e21fc7f05378b98fb164db90c7cdd6008beb36d3a84296aee567a1ca6b98bd26a7d6b310d489
SSDEEP 24576:XnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:XnXoJJYH84VVS6AmETJas+cHBjSSKHPN
TLSH
T1CA65BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e3ec25b92e845ed8d6a5686f44a7d88e1a5c76bd4e08c7b6d0b4b72847fdae7a
MD5 038d79d05b1ee90c6ef421c22b69926e
SHA1 2a9a4040071a70b60ad1e3f63da7fb606b41f85d
SHA512 497efe81960a7a97d9f4b85006ce24519f84d74202ddd46ef9cd6fcee32afcddbda58923a9e1c990be5b11500a1829c26dafc3cc01426fdba241d6959dd06f26
SSDEEP 24576:zv7Xbxd9Tuycf8M/TYlSuxwr2PCJtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:zDLL9TuJ0M/TYW2PstdnYz5d6JgCg
TLSH
T1FE858D5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 49a035f8cbc1672cd3ff7a474f7d49a2243b25e91e52f91b5bbd6289d2b13966
MD5 c2ff3c730ce27820137da582b2656ca4
SHA1 55ecaf3cad5d7dabc1b1379fbca5375cdf8498a1
SHA512 d1305673bd813d77ee6e56aabbc95caf2a8c41d4b277f3d87b50b7a394b29835778678c21dcce9178538fb167ecbb7509bf1e793c4844e6a1d3eedb1ba3ffe0e
SSDEEP 24576:5egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wytdykir8q0Hsw47opM6g9+JVuOUjc:5ngOJOmPOHkytdnYz5d6JgCg
TLSH
T1E455BF3FB7BC15D5E07EC17D8A968916F6B1782603255ACF0160827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 47ef7bb5e258cabed9518ef89fe0943fb5386ee5c472f0bb7635bb3f97f1cc1e
MD5 1599299421bafed3a228a9ca3076c970
SHA1 f8682a843ad6201f0d5e7a0a857eea52e58f3602
SHA512 511e4761d7b34e1780416f4ebe9d95de7c4e86627739411c90d1a45a5eeaef31cdbd3fb3c78e9a99d83f34b5c6395384036da50d41628900d315604f3d10b4b4
SSDEEP 24576:WLJnJiTk3R3waE4JrOstdykir8q0Hsw47opM6g9+JVuOUj7Cg8:WLJnJK8R304l3tdnYz5d6JgCg
TLSH
T1F875E06DD2A810E8D4B7C2B4815A1B56FF31387D2B2569CB65B4D5313F22FD0AA39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 90580e244b256ce16e8100547bcc4cff1b49a89c544868705ea126ca38bfc588
MD5 0db5c852026c0edac09c8def431138bd
SHA1 b10abbc7d7eaf17d0fb34d163f515b8740451850
SHA512 ad07dd979ffd0da2fa1faa6b5105b2f27cbdc8dbb29db6b5a1c3c0180e0b386c8edd61bd2420d41d30bafceea8772e8004873dbacb7482acaa1af8c78e9cf002
SSDEEP 49152:W9GqCzDScAZmlvTcFg8Ph6gtdnYz5d6JgCg:oMz50GC
TLSH
T1BA955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fa17f001ef78fb2d44d571cbac1b362722610663b0cdc99000989521d6b6903a
MD5 952325626c0c618edf32eb4273043923
SHA1 aa73ae6ca514d63f9e8108ad735764a0685bff65
SHA512 e09687957597794ef3ed24466e9992c86118a8a03944fcf271b01fa44e8f5a1ff2490a1663ddf76d07df7d04f82813e4c5050fa1766535a8349628896443c40f
SSDEEP 24576:3lYJeXm5jUuEitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:3lYJeXmRUuEitdnYz5d6JgCg
TLSH
T1CA55129E76AC20E5D17F8075C8528A04E376BC66579253FF62E0E2798E3ADD01E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 81dda4f56dcdb7677a9eaae351093bfb5096d8e9cb2cd2929bb74f84276de103
MD5 5bf56bbe963d0340c0fece00700f735c
SHA1 f3e9197ec806ec377df78cdcf3d4df7ba676da7f
SHA512 439544142aa15b436c8477d93f5eac23b68a19c618076e86136f7c36eea5770bfa119d0f6fbe20f1f9b3dcb8c1c4944a596ad68ae64148fda0ed421ad556e5f1
SSDEEP 24576:9jtyHtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:9jt4tdnYz5d6JgCg
TLSH
T193651281739850E8EABA4674CD5382509B7DBD258F6581FFA1E0F33E5D36AC09634F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 faed035e34d9e8b65ada483346216aec4bcbbeb7ae07453adbd4682518b831cd
MD5 ad4c2d283d450a2026d84822632e4d06
SHA1 212be8d7ef998fafe1a03cede417689e16fd3e0c
SHA512 fbba9d8455d9eaf257ad98feb5d4bfc079239f379d86838c4c98120dc03545c09e57397d367876a4aaec9b2c9f0023f3c7c857886b3bc00f2f6660478d81ca86
SSDEEP 24576:Hytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:HytdnYz5d6JgCg
TLSH
T1C75523D662AC54B9D9BB85B1880A8A00665D7F399AF644FBB1E4B235CC7DDC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5349548b3251646d484962b5eea70d7d75208e677cf8627665822675b40a4f80
MD5 b6955b8c3b5ac89ef876b3021e718324
SHA1 f183c69727ca5a3eeb9cb03e728c58dffe84974b
SHA512 8535a7c992ec4a698c4adb8e43e7499ecff791563993bbfb0531f01c40d63fdbad6261893d1b85ff1f6773116894e45e52e5fdba5f9307e952d77d7d18f1b3c8
SSDEEP 24576:3C+TyQIu93VAumZr7jmdtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:3/TfIq+YdtdnYz5d6JgCg
TLSH
T161558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 bb5e1001b3e513b20a1323d8f3e420cc5ce36013b517f589b62e35bd0ef40348
MD5 e90930dac363580c39bb6481aeaebf28
SHA1 2e3d99254ae5e87f04f423ac7a7499b2fb1ff6f3
SHA512 32538bd9eeb8e5926cfb306041fbcfa4987d214dfa333ea1948a9829581a9374e162677f8935bb605021b78b0b6466db3dad37ce3d3a045734bb71c4da05b506
SSDEEP 24576:qLQikZOtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:AQikktdnYz5d6JgCg
TLSH
T10965F14FB3AE00A5D4ABC178C8458201F6B37875476262EF52A0C7794E7B9E97E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0a58171b7f56dc081055648ddd8b6cd424380a881ed3582073f5d19d0fc7ef25
MD5 22039a3c2c55948d04b3d7c44d3e75fc
SHA1 e3877e5bb279e611c22e37fec4d0ac19f8ecc706
SHA512 a4e5c48f4ba12059177154355f2df7c7a97e70e65a6827319ff000e34c890362c456bb8943cfdb6f786fb488adde5285b8522d16cc9d012854602674ec6aa028
SSDEEP 49152:qpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPHtdnYz5d60:HpC7b4+80GTkTz50GC
TLSH
T18AA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71e7070ad5727fd48fa1366299d445d80c1123c450f85e4221f64fe6e08464b3
MD5 2a1165434acfcb0ff041d9581c032a82
SHA1 9933de0d8aa13da0a3b41e6ab607f8825b6049f6
SHA512 2fdb02a43ac8c30906ff3ec0198f12f5f5b2151a76456d271fd7a8bbf231020a1fed14e75eb28513c0f0b5fca3579a056a1d833adad033f45b7e5cfe2a2fc6f4
SSDEEP 24576:2SAwJPE1IDAo+4Kt+l4413lUQPtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:2qPCIo4Kol4jQPtdnYz5d6JgCg
TLSH
T19455B01AA7F946F5E17AC7B4D663C601FB727822133163CF9290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 552c6058163a79976e8201096d170d9613256bab68d464be951f7ee21234bfbc
MD5 4c779b3ff929f02afb42ff9ea6fa2072
SHA1 7991c246fa56547e096bf902823fc12c6293b135
SHA512 c60da18d34ef4e2722e2a6c68c1eda67de01841edb14ea414b4f58bd81b1061a71138b9e92924f38b09c6fea28dcf7cf37ff01bf3c96a5b556bdd69999bafc1f
SSDEEP 24576:wyLXPLca94t/tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:wy7PoNt/tdnYz5d6JgCg
TLSH
T1A375D03EE66C08E5E47AC27CC6A38906F6723CAD037165DB15A091791F7BEE46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 a5417202216dcf0aaceb0c3dd0a334c34482b09a7dbc30cd2a97da1cd10c1f76
MD5 f301975d8d567a75ec24293c5a4d3634
SHA1 f109b8387a3485b1b44ee3067ce58fbba5e9ed54
SHA512 768e24bf3ebc0c70ebaa09666929fd52daa8d7498db7ad084ea790e9f755a71630ab24c8d9f3180a74ae414580d59821c58d17c83600de9738c289effc775597
SSDEEP 24576:/Wv8qjpetdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/Wv8XtdnYz5d6JgCg
TLSH
T13865129F62E824E8E47E8270D916821481B9BD7617B998FF71C4F57A4E35EC0823EF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/496-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/496-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/496-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/496-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/788-166-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/788-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/788-373-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/788-221-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/788-187-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/788-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/788-203-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/788-390-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/856-95-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/856-80-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/856-74-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1044-177-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1044-372-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1536-367-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1536-371-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1536-128-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1652-179-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1928-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1928-142-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1928-33-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1928-39-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2132-333-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2132-87-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2132-97-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2132-93-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2156-368-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2156-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2156-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2156-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2424-82-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2424-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2424-8-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/2424-2-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/2544-175-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3204-112-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/3204-366-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/3612-369-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3612-140-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3612-143-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3612-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4340-108-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4340-16-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4340-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4340-24-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4372-383-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-382-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-396-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-395-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-414-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-413-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-412-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-411-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-410-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-409-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-408-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-407-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-406-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-405-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-404-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-403-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-402-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-401-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-400-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-399-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-398-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-386-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-389-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-388-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-387-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-385-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-381-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-384-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-397-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-392-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-377-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-378-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-379-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-376-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-375-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-374-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-393-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-380-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4372-394-0x0000014DBE550000-0x0000014DBE560000-memory.dmp

Download

memory/4948-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4948-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4948-68-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4948-55-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4948-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4968-12-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4968-107-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5140-176-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5384-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5384-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5404-147-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5404-370-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5484-70-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/5584-111-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/5584-105-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/5584-100-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/5688-130-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/5892-174-0x0000000140000000-0x00000001401AD000-memory.dmp

Download