b1a8756c7ae13e43059d00ab313f191a20b127368d022617c199973995c2083f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260706-tyttdadv5n
SHA256 b1a8756c7ae13e43059d00ab313f191a20b127368d022617c199973995c2083f
MD5 9d7ffc4d4e1b19c3815afd550df4b6d3
SHA1 c55086d7f67d3eaea628e1acde867cbf1a96699f
SHA512 f74916438e0030c102680fbb9947ab585d031627d6d09a31eb527aae67373d77e7a16226a5d3c77236a965418582bb9d5d9dbaa45dfc3a8672d603e510811a30
SSDEEP 24576:lVGGTWBZQnlr8/3nu+xXHFd9Wj3HghePjYyU:zGyWBZo4LzH6QMPj9U
TLSH
T16455022272C0C0B3D9A3593049B4EA712A7EFD341FA15CEF6384136A5E742D19939B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
728	alg.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
5016	fxssvc.exe
2000	elevation_service.exe
4852	elevation_service.exe
3080	maintenanceservice.exe
1452	msdtc.exe
4072	OSE.EXE
4332	PerceptionSimulationService.exe
2452	perfhost.exe
212	locator.exe
436	SensorDataService.exe
764	snmptrap.exe
3824	spectrum.exe
1924	ssh-agent.exe
3144	TieringEngineService.exe
3528	AgentService.exe
4100	vds.exe
1040	vssvc.exe
4188	wbengine.exe
1144	WmiApSrv.exe
3140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\352daf61f77cf242.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062ab3d7f640ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a71c980640ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023705384640ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079136a80640ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f345884640ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000884d8480640ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e89e7380640ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	5016	fxssvc.exe
Token: SeRestorePrivilege	3144	TieringEngineService.exe
Token: SeManageVolumePrivilege	3144	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3528	AgentService.exe
Token: SeBackupPrivilege	1040	vssvc.exe
Token: SeRestorePrivilege	1040	vssvc.exe
Token: SeAuditPrivilege	1040	vssvc.exe
Token: SeBackupPrivilege	4188	wbengine.exe
Token: SeRestorePrivilege	4188	wbengine.exe
Token: SeSecurityPrivilege	4188	wbengine.exe
Token: 33	3140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeDebugPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4464	2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	728	alg.exe
Token: SeDebugPrivilege	728	alg.exe
Token: SeDebugPrivilege	728	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3408	3140	SearchIndexer.exe	110
PID 3140 wrote to memory of 868	3140	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d7ffc4d4e1b19c3815afd550df4b6d3_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3656

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4852

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:436

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4380

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bf72871a75222519cc23e28e9cb857f60b71f3123404e918166474681c485942
MD5 47329a90088c7924c4333654f364004d
SHA1 089cda1ee8b97aa4763fbe4a7b4c4df8fbe273ab
SHA512 5e891cc03fca23f6f0e45155295a2bd4563ac1ab23dd3d6e7267bb2ae1bb6f98430b81941e32bc0806fc63579f89055d16afb39e3476a8f6d6fe2abdb35c13c1
SSDEEP 49152:ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnX4LzH6QMPj9U:C3q60jB5LPMxU
TLSH
T184D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 56fb2ba70493553b50e386200e809a9ba763a03c4fb71165ee3368046191aed4
MD5 37ad647745da1513d14cb140cf54d277
SHA1 755401fcd6f1bea27c41e13a6616b98c226f4729
SHA512 00f2c9dbe163b20d83aeee010ad8917be44ccaf23bccd51c231da73440ac925e622ef8a3ee5a88edb64ec49e32f343edcca2d51ea729a76df3fc9212f656998d
SSDEEP 24576:/XYfDtczAknlr8/3nu+xXHFd9Wj3HghePjYyU:KtcV4LzH6QMPj9U
TLSH
T180650129B3E049F5EDA7817CCDA2C506EB73784547A0E69F03E485261F232D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5805d5f84d3d300c4908d5d58e1b9754e7c8ff6d003ebcc6e5722948f8c67388
MD5 a2958c316dc876fecc1f7184421b6ec9
SHA1 c0a10d68fc2bdb01daf90f089a90f666dd3da7ca
SHA512 80adaeeac1e21bcd8ef5e32a95dd8f0fce67af927cede6322b21c5f2773506fc2ebb84a26b558661c6694fa24a07d31e6ac0a3f5a231d003f231b529e6d254f3
SSDEEP 24576:S0Le5ji0hmxmrMxnlr8/3nu+xXHFd9Wj3HghePjYyU:SPji0Agu4LzH6QMPj9U
TLSH
T189859E26F6748731D073C0B9C5D2A68EEE7230865B3089CB4286D77C7E676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1268680243ce13eed51d25d72e1352bf8aa699f7d56415d9bc3b285305992ba7
MD5 8d10694262c705f3326d869136618c01
SHA1 1363c345d4e4f45d11e207ffd1ed1543ba2b5689
SHA512 cd20e20004dc160a7273e8c1e64bb4e4b8a3d9a9cdc1a4fb873bc5c03735e64e6b45ed1cf042fdb269be6632de46b07867aa681da8d6818b6f4eef05797a2d2d
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWr6q8wyuHnlr8/3nu+xXHFd9Wj3HghePjYyU:0/ezSC6vUzPviHjyK4LzH6QMPj9U
TLSH
T17A755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 503516a38c31367a43effd1a36b83bb0d30fdcdc8ff407d6f61e9144064f08cf
MD5 bfa3a097f768a918c622fc68a5492b0b
SHA1 b00253d7579bec6ab0e08eeaa721e2b64f095ab0
SHA512 522b900e9dcc48f1390437524ec93d5a43eb664e77f1827393b0ca56d8f81f94384649b46b649e1a46154729d0e380a8186e2cbc600dd473393f034e6e185ed5
SSDEEP 24576:pVbqPb88hv/l+b4nlr8/3nu+xXHFd9Wj3HghePjYyU:pVO88hXl+U4LzH6QMPj9U
TLSH
T14D559E66F574C331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 e846e4f03a37398b2fc6cef0b1a11d09d276ad926c168a26093133ea84d6d0fc
MD5 104a0806ce7769cd52bbf20d3fe39033
SHA1 12932529dc78c3023352611b8e6efbd4ff51640b
SHA512 78f06ef43e1d80c8f89db1172b76220e947ea0660e621aba1d439decf5e699d236f749c92d5899ebcf77ee13e73299f2bb81c86f52c36d7454873e65bfb2c8ee
SSDEEP 12288:fIC/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:fIlnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1ED45237BD714D782EFC9E8B19BD9B90A2FBA0D0C4DC15C2F4058A2624D391A8F43562F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 53c08f9cfdbd1f6a63ed01028f4e35d802c4a33a4dd3c5b57f8ddd55c5b2a718
MD5 20c7d1014db66c1571e4b8f0594c6aad
SHA1 efe388f502595f64b06125376a692611840c9079
SHA512 e65956b7a394ed716ab0dab67caa9355727dc7acd2cc9c25a28bef0e4137c58e24d627a078c506965dad15a538d4a948d06ab04ba64c1409b2ab4378a8bf1030
SSDEEP 24576:+JIUgnlr8/3nu+xXHFd9Wj3HghePjYyU:+JIU44LzH6QMPj9U
TLSH
T1BC65CF3BEE28FCD2C67A9DB85B918600A77278304F52A3CBD165830EDE235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3dd8052e0c3bd05de3c224af78ff9a53bd041e3c01b7ade71f1309fb12184a6f
MD5 d38a6de728ad2c421e90a8612c95a4ee
SHA1 2d77fda9e29d37bc0c84e5e96bf17eb677950438
SHA512 5c9d596f830950c7fd0895600682dc756352d086c1672ecdf704f3e66d28180ef75b19fab30fd081aec50340f237a928d9cbf7d419b7f5d9702323561fe3f2a0
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THB:ZQvGAdlCEL8c/RRNw5CgLPMxU
TLSH
T1A0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 04e5aa1482601c0ba37bf276c2b73a6f2eb1af905c9e5f082dd69bf46ab7c65c
MD5 610c018d7f20229f19da6627c849f450
SHA1 5d92033ea3e80d0828704122ddcc740db98c8015
SHA512 330ae5353ffb4449501bd0fb73b250e5e298f2a32c175478aac60206a2511815aecc1ba48e11029260eeb4e7fa5464d3f8266a2c692ba50127e13850019de675
SSDEEP 24576:rfewsAjmnlr8/3nu+xXHFd9Wj3HghePjYyU:zlje4LzH6QMPj9U
TLSH
T1B965E031FE74E032C7BF0DB61B26D716187D79204F9119C3E3A88A9E59342D26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0a78d8f0960beeda475fbd53d61aed4ac34a1ae2b274ccfc72d64927e34b2183
MD5 52e7236b72b36aafe9c46937a243afa8
SHA1 0866149785dae3b99a6facfa52d9fb2aee6abe5d
SHA512 6eb8f6a20ee6557d8c96beb249c6840071f6af819d5c191fd2419a9ff5aa41a815ecb58a55e6564c3e0c7d6d613fa5be072d560bc03e84d7e8c5987ceda8c601
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHvLk:kUEtQevvqc2W1cpV2RI32A
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69c18d34fc1c024a88533891a00cf76bc3cfbef039dfbd4efa3bc11250479f6d
MD5 15eaa5d104d5f42e2e8fdce03c291bf6
SHA1 cbb2e1d0a4e655691ca18c3f080e0c74aed103de
SHA512 4a82bb8db33581e1649019bfd124fcc65f82579209d3f873df064759822365e4b020703afe63b563f6dde882c25208dcceea1bfa44e8dddf003fdb32288f28f0
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/z+4LzH6QMPj9U:WoquVjnmMLPMxU
TLSH
T138D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ae1816b8b1e42d46c18585b9d53bcf9df7348a8a12ee67cb2ccee8a48aeccd49
MD5 bf2d4145a6988c59f33eae230c2a9813
SHA1 8b2093eb38191d891254c6500b923bdbcabac50c
SHA512 4ec19557f9b095086c5d24d1c9cd376496228b2f339ac020006807b5f040293adb40a00ab0102fcfa01ec0fd8ae3878a80421d68ca235c5e30bdb92042d14649
SSDEEP 24576:9AhGL2IFoiwtA5l7S53jnlr8/3nu+xXHFd9Wj3HghePjYyU:9AM1Foiq5x4LzH6QMPj9U
TLSH
T11D35AD81E7F955D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 61f122b783eef380b7e624b491633cd011f9055870f9deb4eff2d16cf6667909
MD5 9e02f9020d1a81259e64e4a2475fa365
SHA1 71143af91557e91e67d0ece61937b6c1a72a23b2
SHA512 c1d43daa933fbc87274806ec152cf99d6c35aede83b9274780283036ceabc25c29c8f1737a74cfe08b0312c92fb6c8ca8eded6406465aac32e1784548550b216
SSDEEP 24576:8wuyOWCnlr8/3nu+xXHFd9Wj3HghePjYyU:8wNOd4LzH6QMPj9U
TLSH
T16665F14A77A40CF9E9A69138C697D536F7F2B8052A21DA1F0360C25B5F37261BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 414649a8ade07a7356f9cae0140706665b94c7e51d377da3ef48d78255c112f4
MD5 f55e6c585a85a46614b4165ee1c15ade
SHA1 1ab52784d42dcd8b05e3c958a020dc55507c440b
SHA512 b3701ca6fe24f38f6edf8ac846e8fdb38c0e99a627815639a6b92a5b5c14562a9eccf9983323be57007a87e51036f77de6cc49b5df51df92e08511355604cba0
SSDEEP 12288:44Z1IyB/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:jZu5nlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T18A45126F33A461F1E6D79178CEE5A60AEBB2381A177243CF015482661F33AD46D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4325f151d93abfc7983b343bacadd3dbc6700e3057025656491542eb39e38af9
MD5 bad1b032358e2dc473d7149a93a54569
SHA1 d03f0a0845b76e2c408b0749f0532ca29e87cd61
SHA512 324a0aa3488121a94b9bd345d32d06c3b0a92ec33a7c8d07e8dfed54c6148149ac93d563e098b3680837bd768acec5fb85b96f9808c78c84bfbb9848db765e01
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:JQRQyi36YOcPhLvw2gAf+PN3tLPMxU
TLSH
T12F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 453b479511eda6ede98ffbd6c60bf1b971ace380b12453c4e45f0b22337372b8
MD5 c74b1fb71cef8e96b49769588b9f6675
SHA1 f8f2a6527d379fdbfc423ea6b770ac488d0f1c38
SHA512 a30d2cc5c8dce1d8d0ccd4f9d35855d2e6611d16e22d0027a587c3c81d17069950ad3b540ad983dda99c29ec2b5d31944f3926e05ab3287c345d1cc956e33839
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:AQRQyi36YOcPhLvw2gAf+PN3tLPMxU
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24aa76e62713d59214ed7b3b1b7885c8db0d29fbb0441d65e155ec89dbc3701b
MD5 e50f58a41f48fec5ac4ef642954ddd90
SHA1 4ca77f8b3e166aab7fe77cfd319c4db17b7d37d2
SHA512 65b6ee9ed897fcd15c6eba53bf55794478a01742ccd7ba3e8d80f3718e4f24a4c9f9989bf7eb9d0f6d10d5dce9165fdf7a86578f9cf16abb2311456428a0fd00
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0Jnlr8/3nu+xXHF/:z68Qg55nhceWu7PNU3/u4LzH6QMPj9U
TLSH
T168B55A33B2F200A9C44DE1769F4A972196D27C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f28336e6de7e126f2eaedc3a12e4bd044ce8deb6a25763dd94670f16b7f5849
MD5 e7c9c1368b9335d487e59ed94b03cfb6
SHA1 81807f072a75121b5a25d436d9efcbbf8b356dd5
SHA512 c25ff70ceca8fc78ccda421447d450fc99fd5bd5c930bdad116f55562e5427a2cc06d7f964992dd145dd380bcbb48b9582b75735c47dc8af9cbdd37205de01df
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99D:7y5112gYy5azzVva69nLKnhZ+LPMxU
TLSH
T1CB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a34fbf0474444f55ca97b4e448c92e6460c48bf22f11980d5336306b4d9fe1c5
MD5 0c51f14ec40567ae62b2594ab1691c6c
SHA1 c70f143cbcc71f8f6115fac3c3d28e285e9996c4
SHA512 2a3081d43ef896182fb402d97742481b243919c8d8bae40c9488ef93f9bd52275421c5d4d1388a809121af336e2aed1bd8ec2df580e54332f131b9c65305da63
SSDEEP 49152:AB+taZ3usBWOBr4tEG20bqx0z+n217aau1glc4LzH6QMPj9U:au6JmUxd2d1LPMxU
TLSH
T118D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af7009bb6999ac11276fd77376ed41694a63fed6665f027427b0edd154ad110e
MD5 8e215c262932e183a716b0da2284c70e
SHA1 ec1f903cc1012e9b6932ea6b16f9993f7d417a92
SHA512 0d85273a7d55575204f6c774e51686874a50c863aac7bed3cca297fff148b5b6a0926c24bc3ba69d893e16809184792925a684c6fc47db416ed50f492cd83c26
SSDEEP 49152:f1hpsNoJpF1A6BU44CwH7R4xY4LzH6QMPj9U:fmifPkRMLPMxU
TLSH
T168B5BE13F2D901E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ad9efe59bccb9b39b503a7d4133cf94b979cb9c8669ad4080953a89384526b8d
MD5 9389945b1a4feaafc2295f5505191f4e
SHA1 4e65a92ccc9d82f79dc3db8399e4975324a1bdb2
SHA512 a803c17aae5102af6caa04bf6b644206768cb923c4533b2eb7da0e10ce62858295c05397d9b9784d0c8ef96d777779a44977afd185ca9178096743c48216e967
SSDEEP 49152:MSuZQIY0Be2KNRVtOnks6NMHqH4LzH6QMPj9U:u5dKvi61SLPMxU
TLSH
T1AFC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b9d6baeeaa203d2168cd636cc21ee8a21a56e9a84c69abb694a58ee9bef2c3f8
MD5 3fbab8aaad02173e8dc9220d9b82a357
SHA1 13ab8a08a4409fdb2f8d43004f39858044eafc87
SHA512 2fd6965f343d29614ee295cc80c057d53cc117b88d4fa55dd8e93cd609bba51472ef7ddb9f581249c25b2c4b31263eb12b0d15db3a489903824cd6afce80e63f
SSDEEP 49152:1htSn8EApI0figXgiDn0AP5wM4LzH6QMPj9U:EX2iyphYLPMxU
TLSH
T1E495BE13F2D901E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 973c7494c65c91bd19e3f004e36d25169cece70f26a529f37d1e59cce0a164e3
MD5 c5bd6b95898d1d01f28f785dcfde3da7
SHA1 c3d8b34084498043be0d9301b4443cd79afb397b
SHA512 3e5ecd62a70c6fefec1cd70fa8007b3e77082bfd29304a6133567caf8a49812d6836d139ff68120eb8cefe55250e9c40043e6f0651ca1c3b3ebf9f414e5b2fad
SSDEEP 12288:7q/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:7Nnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1BC45233FE651C782EAC4E4B1CBD9B54E6FBE0A0D9EC2186F604C82225E395EC703556D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 85af2502c3d45a6add94f1140cf964d2afb72c135f85ebb9ea5b5e6bee4e7aaa
MD5 09c11eb7efb0f83ed32bcbe9170f4f55
SHA1 da0e6871026ef36e320a7bbb97a32a914729238d
SHA512 c7aa90eaf322d360ad76f82d3dbe0981febfaa5b8752d5a751634d0b07adfd46f92b05791c94e2d920bc935ca8da25fa5a6534ba77cb96a36bf3e8da03b994ec
SSDEEP 12288:kN/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:kanlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1B545233FE611C782EAC8E4B1CBD9B54E6FBE0A0D5E82586F604C81125E395FC703596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2345b64f0a4d6040d64389fea86819d54a93db5b2810800487a20a74ae7a1bc6
MD5 9df6e02d0b3adffaf79af0b2f61a49d1
SHA1 1536b557f2d1ac8e5050026360ba2328c9ad4095
SHA512 2b10d845d5a983f8c980cb22131760be4b97bdb2fdac6208aa38dee31718820fad4b35c8e7e12cbafebc27076918d45e8b2e51e50730d411fbad4eae3fe0d3ab
SSDEEP 12288:yL/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:yInlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T15545233FE611C782EAC8E4B1CBD9B54E6FBE0A0D9EC2586F604C81125E391EC713596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0bd01a7b7b1893ecac0d33d4617fd8e943df9e62223fdc4992e94d0a188ab752
MD5 3b71cc0ab51c45d8b94e6209a4f7c85e
SHA1 a113abd98e1426356e9555d03662eb4a0918ddfb
SHA512 15a917fc201b99f84efb4eb781e555cfeedb24a5202cd61b82d7af01fcb5a3e3b0c2d316dd8d852a83b41ca3d78bcf932c9a74d5bab480b78cb99ff0020ad7b7
SSDEEP 12288:FVg/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Dnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1C745233BA765C3C2EDC5E4B4CAE5B10ABBFA3D0D8B6258AF510441520E353E8B434B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 442dc12da48bb058d08087f791c1f969c8e6176db42c6c7d2c1681f705a8af42
MD5 557e48cfddb2e7c1ff56f04e3caf9db7
SHA1 e598c67d47f6f6dbbfaa32850e863d7dff9e056b
SHA512 954bdf5efc22ac27f45570a0f7eb3c383b5f731847052d7e28bc1a56427ad57b8f653113320e766285c1686ba4b2648722793a8d8564cd3af73edcbd8ce52962
SSDEEP 12288:qY/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:q7nlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T14845233FE611C782EAC8E4B1CBD9B54E2FBE0A0D9EC2586F604C81125E391EC713596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 93f76fee364cf185b6347a0966b14e70c48fc25758598cd929a3fa2d4a9a35cf
MD5 d73ccb00284031d7452f491e0b7c129a
SHA1 8dabd50b300073b5ed67e06833bb129448de20bf
SHA512 ccf0289ac124b0b1f6cb2e13880d929362ffbeb0808054636af4248e185307aaa256724a3e6ce5b4cca16e05313215691d02336f65d69eaeec084644ab0a8602
SSDEEP 12288:45/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:4unlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1C645233FE611C782EAC8E4B1CBD5B54E6FBE0A0D9EC2586F604C82125E391EC713596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 478cb104d2112753fad9e3acc3d48b80b9fd56f584badc7fe97c50ad959c1138
MD5 1e686898b8de51b3b83a14dcab50a893
SHA1 0965ac8d14ea0e0e9d9f1bb92c0a526cb60968e6
SHA512 10a16c0372e8e303e96880f609dc59694d4a93acb0f99067710876ec26c7cebb2cbe20a3ec85d7b9c960a242dc126e1ec9bc1605881e127b8fcbdce9b8de5fe8
SSDEEP 12288:Xl/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:XSnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T18545233FE611C782EAC8E4B1CB99B54E6FBE0A0D9EC2586F604C81125E391BC743597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5ac41e231952d1c84d1bf6b9d1d01facddfc80372d85cfce5a930fc36075641a
MD5 73b3edf617d1b76874cc907c78b5fd81
SHA1 33ae6c48b2e85be89382d9ff7cd41f2a8db0e12d
SHA512 d1d25480908012e2262a96d8113a207c69e1fea090a0bc7c6b9d2f151eac958f3c5bca784827d4838a2199d40d3b88e949d595647100799271238e3412ae1065
SSDEEP 24576:cZMLzFVSO6nlr8/3nu+xXHFd9Wj3HghePjYyU:cZMLzfG4LzH6QMPj9U
TLSH
T1C76502A9B35059F4ECA7813ECD559906D6B27C190B60C91F13A832675F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 85218a904fc670bbaef508e4779773032003ac599c10ace2f664dac6953a8c8b
MD5 b4c0ad5fdce14ba657d2039d685ad02f
SHA1 5bbd93be8778fb84aa4e3e14563ce67e41dd60aa
SHA512 76307f89493e04ef1c28daf3b8f1ab84e8bfe367aab36ab590d66fa0375799447bf7f75cbb89af029148e3c7c814fafd6b41547e2ca9eb46905ad75173ae14ef
SSDEEP 12288:OO/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Opnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1F445233FE611C782EAC8E4B1CBD9B54E2FBE0A0D5EC2586F904C82125E395EC713596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 e69ef75021419c7c44ee5f24111646ee05113b34fe736863c292335e4d8cebb4
MD5 6f58b12486f97f4f10df79f590326830
SHA1 4300a64a4c6b51b897ac20f68ea0f9d57b63a496
SHA512 cfa47ca679a7706ab4376a193ec286a5efb9285fdb9d5f8098c6cad30bb43cccdfe98f5630705c20a8e7278d4bf0bbe4bf5b62c97606e1ba94839a168b491ee9
SSDEEP 12288:BS/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:BVnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1D645233FE611C782EAC4E4B1CBD5B54E2FBE0A0D9AC2586F604C82125E395EC703597E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 628f013a47ff248df3fc749cbe805547d259a25bc2c8547f404b20c2d42cc087
MD5 3dcd004a2285b6518a3243e594155c3f
SHA1 4d67f3814df742dbe36f3bdfb609c87daf1348e1
SHA512 ae08c05bc7e894b27828880ddc65fadba9cb31c4909dd26818c8e3c077769f5f75192738e4fbe9cc2aa3c64294129aec8657ed663861408614e6b5d7c9018422
SSDEEP 12288:vyPz5L8B/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:CzyWnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T15855121B73A131F5D566D178C9922A06F776783A0B608DAF139443731F272E4AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 fe40d85d2b3bca59c091c2f1037abf7e19da9b5a01b47b550ccc399d423f78ff
MD5 241fc8d25f4a660623d25205a0ba5602
SHA1 fe081762ae815fcd3b9c1c60eae08e10534036bc
SHA512 0f45092b91a779125125a14f940d2f6259a0dc1fa09f8def80ad6f28303949d559842b6b8ab6b0e40a8954cea889d6b42396bb802833c611ed7e57dc37c366f2
SSDEEP 12288:nO/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:npnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1B245233FE611C782EAC8E4B1CBD9B54E6FBE0A0D5EC2586F904C82125E395EC703596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 eed0738d1ea00274d48119c70cf77deefaeeb9ed74ce25383283cdd9df13d71f
MD5 f6715d1e7304c49f5fd350d6f8c1b1b7
SHA1 f6996aafc13938cff2879001bbad569e58e98034
SHA512 f4094a0ad2420ad0e430df332e1d075c6e6b888dce4552ac308507931aade8691638acd6adb4efdd925c5b3de27eacafe3610a1be3bcb2a3a26e15e947224f56
SSDEEP 12288:5O/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:5pnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1DE45233FE611C782EAC8E4B1CBD9B54E6FBE0A0D5EC2586F904C82125E395EC703556D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c730fe9bd7bd663d42417a5206c035ad9be80296cd7b43482ec3c63a63229ac5
MD5 ebc73912e7603b37dd54b2dcc7c882af
SHA1 d26cdbab6f5e9c34e7ed26c6ef80faec7b0594cf
SHA512 883eb12f718b2003d249857b1706a2901d69a3f854a2d7359c2ddde0b14869fc4b87ff3a6aa2dd95597d00e8ad5ca5dadc6e7c37948872dcee513d9159eb541b
SSDEEP 12288:0yPz5L8B/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:tzyWnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T19D55121B73A131F5D566D178C9922A06F776783A0B608DAF13A443731F272E4AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 394a0ad818122241d8e390a4de15ab809630fe6554a8c715f8c17a68c940b6a4
MD5 2fb3f4616af8cc7e7f81950a916c522c
SHA1 23d2db9b5a10bb553ed8004845d68b6d8b61b95f
SHA512 96b69b97ba544d98f0aefb7f888964bd0ee092c44b5add3d99268bb07c86ad81c55b1547b73d058838f4f1796c92d00d0249d04244ca7c88486db4723dbf959b
SSDEEP 24576:JcP4mcvIjkGOxhKP2l71SNKbrh/8KBBnlr8/3nu+xXHFd9Wj3HghePjYyU:+P4m4IpOO67N8K14LzH6QMPj9U
TLSH
T1EA65BE2DABDC0096D0BA917486658A4AFAB1742E1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4477b80f7a4f37fcaaa4ca80feb6d22711064c323784eb3ea5bfcf9388c91fa8
MD5 0dfe2d285ba68385a1f687a4095f0dae
SHA1 7e05b72cf4241ad1aedc2ca60ef442d05d2651d4
SHA512 add6d49a553bcd3e93c147e8ed937bb8262912b38cf06f94378cd57954c266c3d1c24a011da2403e757b9c077ae20308b2fa5f527ff2ad4f1ab92f1a8a6aed7f
SSDEEP 12288:rxsf+/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:M5nlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T10C55F11AD25442D4C0AEA175CB969A05B7773C2987E1D2CF52C0F13E0F3A694ADFAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 9d8e9ad9db92f8c24c287fabadad6c3cd3a9e3667eeec235759216510f01031f
MD5 d43b04b0bccd884e827d2a02ca5692f3
SHA1 a207633ce4dfdbac89a22b98b41dee0a41fc2deb
SHA512 71730fa481ce1d628ea20e5bce9a637ccf4895eca58c860f4e289dfc8f18b0d57722c7b4329a9ec5da819a79ba800d32bf45781559082a8dfaca67fe42a986d2
SSDEEP 12288:Se/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:SZnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T10045233FD354D742F9D8E8B08A99F5193B7F2A1C4F81985FA04882625D385E8BC3562F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 88266e0f3af530aa4ce3301b8c0627cab87a46856ae8d3fa36d80a4f95ac4e44
MD5 22a2890007ee81131be8ca94f01264b9
SHA1 4526ca16367ef427798a5d346917ef2931b9ec69
SHA512 439e628f23c9ff961befd3fa7788edfe5d30a65c7fb2473a1fd6c3b978fcf7bdf01598793e7b18bee1fa443e818242089b1a6520b68a20949f13a97df01dae51
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQJ4LzH6QMPj9U:za0hNYG4JwvLPMxU
TLSH
T12A85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 491846fe7f2a1432d9b2bc58ace394ec1ad73e75a68375ef8d9b4e71f69ae749
MD5 844dad67c181ad15f98070db99c660c0
SHA1 bae810aafaae5d7501c120ee68c2d232650c565c
SHA512 39fa653a007e0470192b0db75b209e13ded39549913153d4e0601868305525103dd036015ab358b52e7701872ee81a922095d3156db9628c897487c7c4f66471
SSDEEP 24576:xhbHjPqnlr8/3nu+xXHFd9Wj3HghePjYyU:xhbHj64LzH6QMPj9U
TLSH
T13D45127E27AC21C1F5B1E17C8695950AD77178290B11A7EF22C1827A0F3BEE86C35F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 460fae74125c01d5544d2fd8fa13e8b057ea3e077dcedc850b0c8f2ac8b21c30
MD5 b4aba629fba29ee6ce3508558f3f4b15
SHA1 7dad8d27b04c3780c97a1bdda25f212fdd0d4fb2
SHA512 e3bc534ae772792fa7b85ec10637ccb8fc0412d38db0e02641cb324f8923eb15a2efee4c26d9969d79959443a241fe279f68b6e9bd9bdc05f5e3c73129105ec4
SSDEEP 24576:o3YgnJcRTk4yti+R5dpR/Cnlr8/3nu+xXHFd9Wj3HghePjYyU:oIgnaTk46ppR/q4LzH6QMPj9U
TLSH
T13E45BF2EF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 56fe6a3bfa482d3d7f5928814a77ef3939cdc90766e9da47b3143e864648d5d7
MD5 d819d8700b006506a166debafb5e71a1
SHA1 29f7f88c38f369590c859e1d1ad874d0efafa5b3
SHA512 533965994f0469518f6e01a00224c9e6e84d7b60805c9c5585bd92a6979250796c9e99a4531f90b238126a767faa753745a0e55a648ee32aebba675973e59f8f
SSDEEP 12288:Ni/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:NFnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T1DE45233FE314D782DAC8E4F58B99B50E2F7A1A0C4B8218EF504C92625E395FCB43556E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5b41e456207aba2dad3ef1c0aff4abf45ac74a5ffa6d14121fc5b0b94d87303d
MD5 03265ccc6185dad3af641d375f1ed279
SHA1 69d9d12bb4c8ffb481aa7396cc35676381bbc767
SHA512 9222e95c569eb909dafefdde307ddcd5cbd849496048be59bafd291b41d24e2a91cfe8f6f8f58ff5938f3d8c9991aaab8303343b83a8f2c870ae2e41c37836af
SSDEEP 24576:C8L3UTknlr8/3nu+xXHFd9Wj3HghePjYyU:C8L3U44LzH6QMPj9U
TLSH
T161750119F7A400F5E96BD13CC9A29A16E772745D0760E6DF03A84B661F233E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 45f80f7ff10d941fa5b47cbedb79338671c7f157f5129d8b806a5b0bb3817358
MD5 644ed5e54925233fdd8ba289f8d976d4
SHA1 0d4d225a50ab4411f638e021228a98edf6125e97
SHA512 b56794fd28a9bd6497a60023c94926f5b375b69dd8f897752076b25e11a863f0363f16b2d64495b57ae7620bc9fcfbb95fb7441cdb3365131be218aa7c25d253
SSDEEP 12288:TpFtpOD/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:rOAnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T18455122E33EC11E1E5B5E17C8A92920DD77278290B1257EF01D0817A4F67EF86C3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 467b2dca5e09617dfea3652863a4faef80d69dab197727a53818ec2e60c53e2f
MD5 7cadf6e83e3b2bc215a77777bf63102b
SHA1 b62e66c334157779c189bfafbec6208d2a7d66a6
SHA512 f20db1844683f76989bcc4c84c6ea88fc719b2fc2ff83275ad62cf6c08c321fe5450b80d99c3751efce4b28767190512573450fb5d08c48ffb8e99a836c09cce
SSDEEP 24576:Q7NM9YmZqmWMUkPjZM48Mv6bEhspnlr8/3nu+xXHFd9Wj3HghePjYyU:Q7cBWMpPjN8DbEhC4LzH6QMPj9U
TLSH
T1BD65AE2E6BAC81D5D476D13DC9E28206F6F2B4611B318ACF1162833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ddb578ddc3269725a9ff1248ccb1bb749bf416cb23155c8cfa3b209049d76769
MD5 1ffa8908683535b02978f8d9b1aebcd0
SHA1 46cda1696e5dd834dcf4d0880532db9edd88aa01
SHA512 3950258bb38ad469484839e4da0ab7bc48179375f774fa5c834f7724cb9ec0bf05206ce7bdf395d8d385dd13cf89ae6c544e0a4e1c08294810f1bc94ca6ebba7
SSDEEP 24576:3W6BApg2YuyuNDYTabvcRvNYf8km1/nlr8/3nu+xXHFd9Wj3HghePjYyU:3F2YuHNETovcvNYf8kmX4LzH6QMPj9U
TLSH
T193858E2A27ED80A4E0BBD27D45B6D246FAB2B8551B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 22af016adfd1ef11a66e6d06c2a23ed7ae080463f169b38a45797df0083081f6
MD5 1815dbc325d42fcf114fd089e460bccd
SHA1 1a2ed3b9f4f5e9bbef0d1e3b25eddac457b542b0
SHA512 93645ae0b558d653c113474984e662e3b834d8583d2c2bf04abe5f4245bfe74c48ca8c8b31aa8777c0bad3ea3e41c41735bef37065cd4673ec00013a79630f32
SSDEEP 24576:7AFs06+OmlfQNXEbToMnlr8/3nu+xXHFd9Wj3HghePjYyU:0Fs060lcXup4LzH6QMPj9U
TLSH
T16565AE2F62AC00D5D07ED17D8A97C91AF7B1746707215ACB0160863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 7ea596c9f7d13e1c29e529cad0e05d0f292f8360e7a9e4bc79434d87e8a6a595
MD5 047811b568a69da6ef25b5d07f601685
SHA1 2f9ce95c02af6460c6ae9bdd78feda2db6645de0
SHA512 f313c0c94aaf3069ecbcf7acbdde6806f6443a44872acdd8fc0cf219aabe8daefd2a86be7b4b29491af1d69451d94f6488c78833dde752d791a7a75bbea25fb0
SSDEEP 24576:tJnJ5D3WHbnlr8/3nu+xXHFd9Wj3HghePjYyU:tJnJ5DGHp4LzH6QMPj9U
TLSH
T17865D03DD2A810E4D4B7C274829A6746FF72342D2F2269CB24B4D5357F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b7dda48bb86077b9295b793fd9ced9561ba840fbe5d0aa95675e9fb02cb5fda2
MD5 11c0cb341c2dd4f35b29f57912b8d8ee
SHA1 cf0a530dc6bdc3fff1702cfaac6954c2d942de73
SHA512 47f1aac47a47ba2df474aa9dfb0ade5069516803e8aaa4d66f0f327c096f7bc2b8bffdac096116f2077f6fa32182e8339b344e98f9ba4b216915151927391cbd
SSDEEP 49152:2o06DIKdwc+eQnSt65aV74LzH6QMPj9U:PoLPMxU
TLSH
T16A956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 573b1e5bbce8f64f593fb7c76ac5ebc8a0ecca416f8f0f5d2d35f44ee389638e
MD5 58221a5177f548ea203832cf6373c973
SHA1 a49d33eca714f9aa3495c497987d61d4619f9205
SHA512 667207356346bb0e1b7548c173aa594d3433ea0dd5f25dd9416ea6b916c614ac1d5286105253974aabab2760faa67f8f59ba7522c53e5f242d5849f56b921fe5
SSDEEP 12288:AEP3RKM/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:bKnnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T10F45126E679CA0D1D56AE07D86918609D7B2F0281B522BEF11D4C23E4F37AF83D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2ad9579f9e7d3cb1070e06f07bd3430d3003e9f694983ae5d396991c7cdf7f59
MD5 248e871745607952b715200a61d76510
SHA1 833db357a4fec4cd407e15d7813c74b8a9c2b4b6
SHA512 f6ba50954c1c250f3dfca98fe55cd3c3c6f116477c333d8799b86847d5851ea21999fad4dc5c3408443fbbbddd3da76c1312d258c32913881f2f5acb8a61eaa1
SSDEEP 12288:tjkyN/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:tIyanlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T18E552219A394A1C0EAF99578CAA391855F797C244F1155EF5080E33F6F36BE4BC30B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 9f5a21e3760e2d93da5a2f28a0ff6816cf1fcd9faad2d5b5706b5dc953699ce5
MD5 22288a282e5c6c5f28f6abb566d7d663
SHA1 9af924f404bd9271a2e5331e2d477cc865ec135e
SHA512 6a5e9b5b0a5154aadc2d279b926a04047dab852d24fdf8f74961d687ebbb5c0c77a24f8a4f99e73cf321d050dec9b52914edc0d4285d835bad44bfc9395be85b
SSDEEP 12288:sKT/c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:Vwnlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T17745233EA325E681EDC5D4B48799BA0A2B7A352C0F8128FF50D8D2728F395E87035D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 96db2682f317f38ba6b51eefd44c181c83ca55b1862edc5a147285f43456f657
MD5 822b37c234a4a127afcdb72817f0bdd3
SHA1 dad11f8b7da0c66bfdfc66338d1478c44fa3d8cd
SHA512 704bc272320d0f25bdee5dde1852f50269f84160e1f27d15cf93d9082da42d25e197d53a31566c3eb8830f091540dde5b394163585fccfee06fd5ec7a2630d60
SSDEEP 24576:9Q9MxZKdcz97w3Rnlr8/3nu+xXHFd9Wj3HghePjYyU:9VKXv4LzH6QMPj9U
TLSH
T171558C2DABE9058AE177D27995A250C3A673B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 0df823e9bd1afaf1ab746b2f78b0553f17985ab41c5720cb5d800663b40ad24b
MD5 672f40e8dca6b48c60694d862e58f0c7
SHA1 00e149ff294fee3d0d06c3aea783bdf0ed98874e
SHA512 f1b53128a08261191437a4cb22a174592cd7142b50e96012666fc556f27ef057db9aee2d8ec135c2f891db6f7cf85a0bec3fb0f361133efdec0c82cf3d798ea7
SSDEEP 24576:Gyoc0Apmnlr8/3nu+xXHFd9Wj3HghePjYyU:boc0Ape4LzH6QMPj9U
TLSH
T1E655E01FBB6940E2E166813C89858745E7B370345B6257DB6191C33E8F27AECBD34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5dcfa0973985e960370f6190c3eace79af45708d37b6ace04a33a553fc92318a
MD5 df52dd459187ef994692820db536bdd7
SHA1 118f449f5591f8118a6d3542f9c448f1fd1b1158
SHA512 b9668b178a8673e5cd374a32d07d595e79a3253e1cce7307d472c036605ff5f14f618514ae481cdc5ab6cb21b10cd066a34a5363a503d2c4bb8247584e9d98f0
SSDEEP 49152:fWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKe4LzH6QMPj9U:H0zuNIzLPMxU
TLSH
T10EA57C3DA2B800A8D9AAC375C5451366EE71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 49df9f01f3568a3e6e020f44c21119d72fb0f625b8433a921a5aa721117c8069
MD5 248abde60aa6de5cb63b560c04b7968a
SHA1 27fa365a9fd1c3578b2d4ff8b66f186fc6005be3
SHA512 41939d2be731773af6e32c90554141619531632dda60e461fb02adfe090bc0f1ed44d3c9d65bb5645fe57192d7985601105037093332f189005a4a7f3456ed1e
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYsjMqbnnlr8/3nu+xXHFd9Wj3HghePjYyU:pTDxR+N5YzTujM44LzH6QMPj9U
TLSH
T18F55BF2EA7F855E5D1BEC5798A23C506FB727821033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 b020d17cd48c0de89d4d00310279d87aac38dc7fb5fa723a2d990abbc25b24ec
MD5 11fd6b916eb73ccb3922666f37b51f49
SHA1 0651f47f2ad0eb1ba3ed949c24da4f835a3f571c
SHA512 654a323c8e50f6eec519849b7b78f1c4806d38fa6c46f454518a2a402e069ccd47765d9755afea4ce63e6f3b45dd5792a51d42eb0d5a5bdbde308d37935ebe47
SSDEEP 24576:FTMdOz0FFS+UmSLDnlr8/3nu+xXHFd9Wj3HghePjYyU:f0K+UmSLB4LzH6QMPj9U
TLSH
T1EB65F13EA36D14E5E47AC17CDA439906FA7234650322A9DB06D0C17A2F5BEE4793AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 d81c74859dc05e43809b93708452e7faa4013e8bf3d268af2b9d022567dab73b
MD5 ada2fabd588d74e174d8ddaf8013d060
SHA1 47a0ada511d4d3b37000e4754549ebe37476eab8
SHA512 6971641a5b06e291e56a99d6a89f53658b270736a4501828c81e4fd6ec8c2b06ae415ec76a22c5ec3e10407e7b8ba13ff8fa8db3344c814e0dc21f24bbd5efa2
SSDEEP 12288:C4E//c9nQlUlr8/ZZC2u+PpXKYvFd9Wj3HghI0h3ozB+5CHpV1OSdIFym8:uknlr8/3nu+xXHFd9Wj3HghePjYyU
TLSH
T13445222E63E871C0F8A2E174CB66520A9B717839175168FF30D4C2764F376E8E839B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-124-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/212-388-0x0000000140000000-0x0000000140128000-memory.dmp

Download

memory/212-130-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/436-390-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/436-451-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/436-140-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/436-453-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/436-134-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/728-21-0x0000000140000000-0x000000014013D000-memory.dmp

Download

memory/728-22-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/728-450-0x0000000140000000-0x000000014013D000-memory.dmp

Download

memory/728-12-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/764-151-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/764-145-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/764-391-0x0000000140000000-0x0000000140129000-memory.dmp

Download

memory/868-466-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-460-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-464-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-465-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-468-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-469-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-461-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-467-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-463-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-462-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-472-0x00000242AB950000-0x00000242ABAF9000-memory.dmp

Download

memory/868-457-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-459-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-458-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-456-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-455-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-454-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-475-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/868-476-0x00000242AB8D0000-0x00000242AB8E0000-memory.dmp

Download

memory/1040-209-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1040-215-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1040-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1136-34-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1136-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1136-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1144-235-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1144-229-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1144-403-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1452-405-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/1452-94-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1452-88-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1924-172-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1924-166-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1924-393-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/2000-470-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2000-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2000-50-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2000-56-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2452-386-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/3080-86-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3080-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3080-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3080-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3140-277-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3140-404-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3140-246-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3140-261-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3140-471-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3140-296-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3144-176-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3144-394-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3144-182-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3528-186-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/3528-192-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/3528-195-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/3528-197-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3824-392-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3824-155-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3824-161-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4072-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4072-409-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4072-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4100-395-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4100-205-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4100-199-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4188-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4188-225-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4332-115-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4332-109-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4332-385-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/4464-8-0x00000000020D0000-0x0000000002136000-memory.dmp

Download

memory/4464-420-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/4464-2-0x00000000020D0000-0x0000000002136000-memory.dmp

Download

memory/4852-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4852-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4852-410-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5016-70-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5016-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5016-47-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5016-39-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5016-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download