6a2755c204a42fabe91a46b3f6ce2f02dd23750bbf977e42bc6e0a587d2c1f6b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260805-bb1passvg1
SHA256 6a2755c204a42fabe91a46b3f6ce2f02dd23750bbf977e42bc6e0a587d2c1f6b
MD5 4e361dc739551c68761cd3b91947a546
SHA1 ed5954b26fd918aab4edb62dc6c5ad9f7b635518
SHA512 3b38016b1d026e518e265f88ce60d012668a4635f7aebd898b702e4e004b60d323ee0ac979c0c1149b6fc960dee2e98b4bf24d9a06a73aa4af9c0b3174ca402d
SSDEEP 12288:JUYJ9biFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:SYJ9bAnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T15D65013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2080	alg.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4912	fxssvc.exe
3412	elevation_service.exe
4452	elevation_service.exe
2396	maintenanceservice.exe
2276	msdtc.exe
2728	OSE.EXE
2440	PerceptionSimulationService.exe
388	perfhost.exe
1928	locator.exe
4076	SensorDataService.exe
3488	snmptrap.exe
4760	spectrum.exe
1532	ssh-agent.exe
4144	TieringEngineService.exe
3084	AgentService.exe
888	vds.exe
2444	vssvc.exe
3160	wbengine.exe
2640	WmiApSrv.exe
2848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb26c3fa68b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee5f07a17524dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013da46a27524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6169ca07524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001828099f7524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000604fb6a07524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6169ca07524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073ad6f9f7524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047797fa07524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fecb3a07524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	4912	fxssvc.exe
Token: SeRestorePrivilege	4144	TieringEngineService.exe
Token: SeManageVolumePrivilege	4144	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3084	AgentService.exe
Token: SeBackupPrivilege	2444	vssvc.exe
Token: SeRestorePrivilege	2444	vssvc.exe
Token: SeAuditPrivilege	2444	vssvc.exe
Token: SeBackupPrivilege	3160	wbengine.exe
Token: SeRestorePrivilege	3160	wbengine.exe
Token: SeSecurityPrivilege	3160	wbengine.exe
Token: 33	2848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeDebugPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2072	2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4272	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2168	2848	SearchIndexer.exe	110
PID 2848 wrote to memory of 4132	2848	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_4e361dc739551c68761cd3b91947a546_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:444

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6b029a22740e361e7090141e1f24183b155a1a97690156209fe0d5cb43104d7
MD5 e7137a60dea1f3b0eb1dae9c9bbacbf6
SHA1 73d13d9e3459a2b3b8a77487d751d623fe7f223d
SHA512 8348849119831f0f9f2ec8c6811e282da4709d0b243249a4706f973b8f734603780d6e8da686a106129f203f2e024007bd05c2429318e8121e114e29a63d8ccf
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHQ/lFTjN4:F3q6HjBLLm
TLSH
T1EED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 11b4841f38dcdf4fb5acc849ba41a928129683eaffbddbddf5f26c686b4c1555
MD5 37dc303779bde9a59ca6298ff138df7d
SHA1 62f986e698613477eb3a140c8620a3990b70f3ea
SHA512 213badcd13ca02790fdd7d1366632c5f7f09af493857c6534ea89a79a94c37eb322f2a315dd8a90639912cc05aa37046c84b26e8a3c73bbfaac936b4f82d7b1d
SSDEEP 12288:M1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:6XYfDtczAMnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1CD65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e1970b2bacb1cc544a73c3625d2f7bbc9f8d28410cd91b9c46ee4bc1282411b2
MD5 c095ff53ede10c2511c4d25b150dc1f6
SHA1 f80d28084c6ccfe47270071f15dd45fb228cf22d
SHA512 0490ebb10b11106ad812014d480a905e2861a828530a20ad5d980f71441879db152ec1fd412bc5f4fea3341232e4f371c06687b86c28681273843689f209be87
SSDEEP 24576:70Le5ji0hmxLrMfnQ/tbw/2Mkjy6Fr7g0o9:7Pji0AlaQ/lFTjN4
TLSH
T13D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ef38445123bd1e941eb0319c58d38502603f93c59faffed1c3fd20c9b4d5e4ce
MD5 6533b42ceaa33af1f3bafd0161f1d15e
SHA1 01a227f02e55d6e5e0b6f15d4a8600fb9a97f2ec
SHA512 6efbe39bf25676a379dbdf073e6e3619f202dea6bb915cc8ea9cabee9376358bc435539781c55dd3bc8b9f553f3ba0b7b3d78c34124123f95ee0bbb52bdeb151
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0oo:9/ezSC6vUzPvxHjyuQ/lFTjN4
TLSH
T125755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1dbae6c6beae65c0d066aa1bdbce3e33d605e1208594162c7ee715a436e0cabd
MD5 d89e8ee4e384229fd186fc459882bb4b
SHA1 5ee02f790955b544e28434de6dd499b6ce719263
SHA512 146ecedc125646122d7e1d3ca2864409084051c1015344251f56866af77a2b6f6bc0d01b28a14b8ef521884b196305371c90ee60fb9820817d3c2d45449e70b8
SSDEEP 24576:4VbqPb88hv/l+64nQ/tbw/2Mkjy6Fr7g0o4:4VO88hXl+DQ/lFTjN4
TLSH
T13D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ea4da126e4133fb51d0e2aaf2d1196581f0f8044d9fb6b9bca4fc2f02b27cf9d
MD5 cf1845fa1f7567f8c15051b4be445bd3
SHA1 74d6197c7adf7ace965cddcf72d489a7f25f0dc1
SHA512 ca28acff17a19a55344259d1ecd2a12b0ad83c3882d634d8856f26f275b345f5254b4b9e214e59c791941f6e9b08696c44b45de9797e3a3c8532ae8cdf9ebc33
SSDEEP 12288:uz7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:uzrnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1425523796A24F897FF2B06B15C8284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a6bfb64f794deba35411676f6a7b3c359679cb04c77cdc070a372a98d2564fea
MD5 275dc55bbfbafa06eb49bb36de26d9a9
SHA1 2744c23f5b8fba07f5f7080fbcb6fde326b5c96f
SHA512 ac1f1a5f8ae3aaedd25d77e28b29c763ca6b9b3d86c6c9d1d7f829c44b37cbd1a315376fd9736e68ac829d4b5e0e70b91b74b5ee581c50f99960fce3210c737d
SSDEEP 12288:jeBNUbTVO86UwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:jJIUQnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T12075CF3BAE28FCD2C27E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dbf4ffacaaa096e9661f1e3e7817f45ef5076d3d4e9c1ad61d45af59e02dc191
MD5 75e234f9beb88a7b664a2f80ac5dce96
SHA1 54c7e0fcf9a8b6d29fb656099291581670e18a55
SHA512 80a547b85451a37c42d07fcadc60f1060f1d7bc6a5efea5085edf44e7c4a9afa3acad62abab18c001627136c9b6233c5fa48c340803c64d6fbd037fc1c210d90
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:BQvGAdlCEL8c/yRNw5C+Lm
TLSH
T18D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 07f82d009f6acaaddc6fff0c7db15b3f9b88682ccad8563d5f58036a3ed69ecd
MD5 3f3cd559deddd440febf688e246ddbff
SHA1 c2f4349cf2a54687ac29448551fbc12501bb2307
SHA512 c42043c096aabb5b069afdd2c5e7e28bf45336803af2887ea6ba319c198d149a912d230e53424886da985a33d494e63897da7a1d980e32ff80bfc68ca6f39584
SSDEEP 12288:7AwSfxL/2Dc39DLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg/:kQewsAjqnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1F175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 54b998641715644f60bcc2dbf093737b9236f829166314e43b2b1f7ec0fffb74
MD5 d85d899602d73ffc79236f74f5b6382d
SHA1 c93e2707d05455d7a6d4c01ab1258946d74f9549
SHA512 e69c6703df584507e4adce2a98190da718f60d7d73a185b3eacf86f9dc1dc4d4b100e1895e3920335c6591dec663bd27cbe931a7c644b9db009cc32ddde8e36c
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9L:6UEtQevvqc2W1cpV2EI32
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fd4ffdf4d856caf1d0d1cae0f28a97cb6076593264acdaccf8d2c5fd619c423c
MD5 cd86657792ea210730093e2ca792966b
SHA1 fe24afc1c38ad59015be2774abf5ff6163a1b13b
SHA512 5e10378da8cfd636657163af6237670549682e6a83602e2817acbcffb1ce15ad98a6b7521c2886eb66a6c43274d03d561cb24140971cba8ae7739687971b9668
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zKQ/lFTjN4:EoqtVjnmyLm
TLSH
T1D6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4d6c91c9ce67e3c7132d7ba4e27d521a72832d5c67efd0dbb706184ca276893
MD5 6e053f43ca394e0a99480cb1c068cdbb
SHA1 377e92c097724826bc263a26d300c59d44ae1e64
SHA512 60fc7bc0d99801538dc807b58c420a4b3b9fba4d9bd604a0fb1c8ed05b0b046431b08ddf47a5c4ab10a434e4eaf8404a4a0db883f219470834eb9cfd188b826b
SSDEEP 24576:4AhGLJIFoiwtA5l7S53dnQ/tbw/2Mkjy6Fr7g0oE:4AMyFoiq5NQ/lFTjN4
TLSH
T19635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2c84c407d0453770e77dc7e5bc5c4e8c721045e1fb514ebe63dd7d95b733b8de
MD5 89d6a036e118a4e610f06479f46eea73
SHA1 2023e824e413b21f095b32d491a3e5ff412b182d
SHA512 baf04a3fe2b96502e18459d397febe8436c24fe20a27e5c0f28a255d5e221d16d8e86f6d570f03070fe61bd4f7f409eab056eb76137ab44d1f3d91b49f6634aa
SSDEEP 12288:6mw5HEjsChN2BFgl0WDm+CJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMI:TwuHOWOnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T15165F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e18ceb79cbdba126b115184820229640ba39efc05ef29cad07a994d316b8c2a3
MD5 608fe9ff630e88d0032e70ea366cac30
SHA1 249dc798102ad2ca416a4756c16efc0f16bcdc40
SHA512 a8f3e8988fe1e981cf818d2aa6c131e2eac78cb4c08b6cafca3a783b6439dce33feca35ee2278b1310095270efb776f0134ca7c73b6f4b464b84518c97e16d06
SSDEEP 12288:ZXZ1Iy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:hZuXnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T19B55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e7c12b3484b0fa2c571ba60b3517f0b14f5bfd72cca146e05f05f96349f74c50
MD5 e5eb539edcbc534c9773021f504b704e
SHA1 3f8de0d764d890f3098be324b304ea91264d5e1e
SHA512 7e3637e0a55a09a7ca5e734596bed247db5458387ca54f5d52fc14be0d9bf9a61a4be78dc0ab2ff816ee3ed48f785a762fe702902f2459d00c606b5fbca2ba6a
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:QQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T180667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b0e952492318bb1e469c0fde401eb67bf3ee4197283bf4cdb7b749b7b12933b3
MD5 18aa02224fa16461856c7e6d36cdc0c1
SHA1 0dac6679b8b7a8533598e0d18da391fc08afca52
SHA512 f300fae14e49831ba2162b8e38f366b77a9dadc36629cd46e3605257846dd9b184db3e6c369c20b97aaeb2d500f5aa57f0e3033e18fa78672dc30d967c830413
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:HQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T147667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1cea3fe5bfc66dc774207261062912e13d44b816469ebec1dc16a6a53976ae12
MD5 bb3462e26585895a3043b1af35d16d2a
SHA1 eda10b4499f9fffc4a13eb90190c5e8d7db82a35
SHA512 3bfd2a72619885be7434cd94a08b8a21a395ae681a1e570240df7c424d913cf4eefa4f743e14e87fba93f348886b179461d4885b032f0fa77bbe9ef69bc49c97
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HnQ/tbw/2Mkjy6Z:+68Qg55nhheWu7PNU3/aQ/lFTjN4
TLSH
T17BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c743a89f3c22a2808370de53605011247051997b5546a773685d0c4a17afe357
MD5 5962b9f4b384c80c29ebb719bc15cff1
SHA1 da3aa270b478f0f36fe934a631e5a2ac65b9b447
SHA512 72e2f30f906596f6df4a15382b7153cd1c3786df31299111320aa78a8882d20306585192b72e21e7c7b4857438ed8d98ca2b7a75f910a18aaeae60734b01f991
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:Sy5112gYy5azzVvL69nLKnhZgLm
TLSH
T1DD167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9c961427ad2bcd85201182befc97fad53035a31660741b615c1eb4f2834aed43
MD5 8edb22d106c171806d0c2102ed54fc9a
SHA1 1480f5999148a290cfa1a0268e8ec747818ec2ef
SHA512 a4477f8d66b0988e9fdbd68447ef6d79d9e1b85af696a0e8461e9b3adc20a314b838cb2328cef7302a826c5c7f8d926119697ad60b6eac114cbdaed1aea24421
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Q/lFTjN4:Fu6JmVxd2dfLm
TLSH
T17FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9e7510f63293f7c14f27dacbdb2226993047fbdf75a5f147f9aabd9d2b62349d
MD5 36a9df7a86ee7ac3c4f301ac9adedf51
SHA1 c0f8aa59c722850bcae868c069abe9ffc99361c5
SHA512 09a98849116a7a7bcbb269cfdfded1569d3edf34ec7827831917ee486e035933993d6ee252e6a39a8d769c735ce3644d2946283300336f3f917475b2cc2437b4
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xwQ/lFTjN4:jmifPbRyLm
TLSH
T1E6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6aeac2fe249380b1129ddc54a69033c0e577e83bc7c82f831d044589b6c64907
MD5 67601a45c24f90c22d6f4df0aab80e11
SHA1 276d8d761fc48fd4d47bbffaf7fb0c309a337439
SHA512 26f3bd70bc87fbfb964e4f3e8148b0c69e3e9354a9e1da7ff7b9628a09b7e2357d2f8dcd8bd0aa104301406f15fcd062c42d3cacaa622a56928e33a215f4c873
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqXQ/lFTjN4:A5dKTi618Lm
TLSH
T117C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c916fe662e9b68a7971bd6a89c2448dd62d294b2f11bf9f35d9d8476a403e09d
MD5 01ed9bc53296aad5f5124709f90e46aa
SHA1 3c674171c5ed210929746eed3b9ccb3510f6669f
SHA512 0b2226aff28e8e31ddb4416ea1e239206e7f7aeacdbad4a6c61d0d58478145936e18ad79793a69d98fb386fa1e5ff4976446559051d6a2790042849bc61d3c47
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5wMQ/lFTjN4:2X2iyph2Lm
TLSH
T10B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 32dc5d53f835b8c660bd995f82d76fd497bc2554af2f77a152ce9c9f5b40b61a
MD5 a88014f244303ec9e06f8e891be72303
SHA1 bc4444ae643c54ec0ec988af644d65f9e3921b70
SHA512 7a3a19253d603a341c3540ff671feae27db6fcfdda1ae1c700f727b4e12fc637504c669365899093b4c367aded170bce7e38a1a0dcd37e3fb345c8aa5106e46a
SSDEEP 12288:pTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:pDnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T15B5523697965F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 40872b3caef44230edf8326a244a0a34c96f3b0d08e3784acd4f692fbb3154e0
MD5 b8563f32d5b197226ed95f212f13e1b4
SHA1 d87c6e96e6d55444c7dcb0dc1f82c2a8b142863c
SHA512 32fc77800cdfb4b55fd3bbaa27437af5d7a29f132a50ab660c010f347b51f0e202eff432f91612e1bca429bdb6851eeabcc1825ff9ae73986514d87c667521ec
SSDEEP 12288:R2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:RWnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T17C5523797965F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 644307e29909594c00c4c9f6a81b850c7b5004f37242cbec87a82ef280eeaded
MD5 8d1fafd99019e092982e332124879d8a
SHA1 2947c995fffa32e51dec79ddf0315f27bb11abba
SHA512 1634ddf8495ad3c6037fa97a21062dbaf2c3f4eed12922b89811e9ff583aa8f017d5e2813e2dda1eb72d6ee765351342f98d80c924ea0203926268539c0b74de
SSDEEP 12288:EoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:EonQ/tbw/2Mkjy6Fr7g0o1
TLSH
T12C5523797965F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d97d0fb58263f382b2141b8053b633c8e318eb76f06f48a45b909b7f66dbe05e
MD5 abbd13578a2f29b793da68391fcbb63b
SHA1 e3b72cc8acdc7196b6fac8ee8068f406de021691
SHA512 ef2678ace00d85ca117611255126235b28b6c44a39d34d1c0104eeb523c7024b155290e6928a4441b600849ddaa36fd791787a4deb008a4e3ab78cdaf9950356
SSDEEP 12288:NVdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:lnQ/tbw/2Mkjy6Fr7g0os
TLSH
T17A5523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a83ada07aa44c39343408314ad3a9a9caf2f03f3384281fcfceb7af24bcece91
MD5 d5c49642bdfe7b7c8001c136f14911dc
SHA1 df45c7248774db4f59e648a9ad05e8ac58f64062
SHA512 077393106c1121ba10d70873ac96553747cc90ce0adef8b91a7c32bb49bee83819463e1b91f6e63d89319550504d93ca649daccb3b25c28b6008a7812bd6d95d
SSDEEP 12288:bFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:blnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1A55523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e3fb613ba5fb6c6724790b9d1c35b03aeeeca01c2a7ea4f2a95fc53fc3c2ecf3
MD5 18d67e917534472f5ac1d0858b2fcace
SHA1 607bd32fed64c9bfb5f1cfe40451160131c0a139
SHA512 6ad4f29237c0a5615edd7ae7da1f1fe72fe34c2b5ca8940a6d32bc5319b439e91f7ea50e6b91d1afbeb19e6dc8f3c8e2a88845446b65ab08c4f37b49ef85402b
SSDEEP 12288:KCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:KCnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17D5523797965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f93ad674e748d80a43990105e8d7d39ba3f7c0f0ffe1021af8467e80217eaa01
MD5 d6bacf0807870ac16e3b1169f4020500
SHA1 eb7f0d694b8fe3fce22baf613ac2757d0a6a24cf
SHA512 03fe84890e74c2ee888c5f20813ca279d7c108662aa8ac86e0da2aead433a1b046ab202376464d859a4ab2abdf58326f3dc8ce405811ba8594cf1d6ca72d52de
SSDEEP 12288:y+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:y+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1DE5523797965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ccc6e8892e1219c3f116536724029fe9dfbb3ebbc09ff449ea5b7b4bc405d1d1
MD5 18e0466afcf550929870b3caf75015be
SHA1 5189bfe59d95c0542e929033e68b1f5e26de36c8
SHA512 bf5278eb1aaa4d714af94476b887dfffd8bde587cd955e8d5aee8377049b73fc0b2a83bef4d0ec0b4e9c4c1866c83e2e2fdbc95b8d744172d421d018dbc25f6f
SSDEEP 12288:3iZwbDzzFEoS2cPvyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:yZM3zFVSO2nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1CD7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1c368dd793d6344efcbd1b288389d659d938b04d033d4361289d16828a159e54
MD5 d8bfe2ede0191e2f64d39657eee1d080
SHA1 c1ec65163d7f76696fe57302c70a0d96458be448
SHA512 a6fbc1e010e590569d1c8bcf995570eeae1676c03f6951411289f4b40d5bdfac377798a8b85d4bc58d73634b15e195ed581623eb196871b2b249a576da11d8c3
SSDEEP 12288:nHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:nnnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1075523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b602dca789d752bf64c224ab7a8365adc346d1eb511bf846046c4c58890209ab
MD5 e72c5177f86edc76dd47fbde88dc152f
SHA1 0d3cf4e4450b05956c0a8e621795474e3221cf7d
SHA512 be0e8af03e389ed453410910abe5a22284ba30f942af90df8989a6bd7a6c3fe01c8c1bb38221cb12d2184685349e6bc0d75721d9a82738d70e702962c3f6e451
SSDEEP 12288:lLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:l7nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1D95523797965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3740eaca49a415c243571ed2fd359073811ac257ce3eca6349c09a4031e2f6e6
MD5 38fe9c30d4fdf199777cb6f1fadda061
SHA1 684954065d5c4ff3a4d328029e979df42abfd14f
SHA512 59e80de3b5c70cbdd4b3327ae0f58716e10bf4c6819aa29bd049de9792590117725885189b6f2644e29c41f725334168361a819fe4a7b42308800c76f06bf63c
SSDEEP 12288:pyPz5L86GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:Izy6nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T16765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 17b9c347fb0d886a8d3bc41d1de786b4d157b5e7576e49a1424986a0caa94b57
MD5 47f418721a35838fdac059b054284408
SHA1 6e70be4afec4956c784e1821ccc530b953d55e84
SHA512 29c9934010c5b4a71fd500eb327d8bbeee151d38d3693fcb027504ce73af0860ea7b66db28aa83eca91ccf3b32926e65ea5329fc6ab373ec50432ea5f7dca327
SSDEEP 12288:HHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:HnnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1A85523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 131ff8c977d30f782a24fc1773c8f53b71d2af08d9a9af32decda212d877caff
MD5 dfedbbcc6185f8118a535df6f9bd9341
SHA1 3e07c64c3887f06c3643a153f55c127534043bff
SHA512 d52a2067494cc969ca7c2b543a5293978f1896e2317ba9e9e87747bab32ef2a7ba4cb2fa4a847fdab87710ebc8e60d5ede5cf65caf1806377e77a57733ca524e
SSDEEP 12288:HHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:HnnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1B75523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 591aadf788556cd77bc234a9e09fbe84904b8aa41ef9e4a5e91a3736bb213bc1
MD5 26fd5398b4c767349e16f24a98134690
SHA1 454e167cac9015676f5031b0134f3a7e060f490c
SHA512 136b3d8f20f18b6120270ebb75e84f1e08d6cc65c3a6da2119d2a3f0aa79fdf1a15e6507fa94ddaaf196c0ffd89614482fa0609f55681e2c0bd01bf1f3dcc3b3
SSDEEP 12288:MyPz5L86GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:Vzy6nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 57954a82d9d9f09037c53e00be87906ffd05b97b3fc5b937c5c18bb7a8a7ed51
MD5 ba69741f4397cfe93abdc7b6fdd4d256
SHA1 a724a9f182e9c97c9e9905a13f396532b198e249
SHA512 4591eafc198a59bb41973c065969a3d54d769110b2df4b196b48f372f31a87b089921ed79099ec1ac01400d9121b971e4468a2adca08a5f453b03f4457d3c605
SSDEEP 24576:VcP4mcvIjkGOxhKP2l71nNKbrh/8KBPnQ/tbw/2Mkjy6Fr7g0o3:6P4m4IpOO67W8KJQ/lFTjN4
TLSH
T12965AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d2ad12409eceee81d013651327007cd7076fed7ca50a6522bd97fd1ea2514d6e
MD5 aed9b75862c52fed84e8c4b577faa777
SHA1 95f00a0b3701c953e276fea4abbc614bb4298869
SHA512 3084e037fc3c9f8c773bad195dbd9172de08af35add5f02aa835fc8e4dd691e5a101dd864af40d5c5e54dceabb707a12d4557b73299b67502371680c5746c2af
SSDEEP 12288:Issf3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:mXnQ/tbw/2Mkjy6Fr7g0of
TLSH
T10265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4a01a0e32cc786866c32ce7364c8ee2875fbdd1a5d48fee4188dd46e4228576a
MD5 99f40f9a1794b0de21402f1292ceb897
SHA1 8310479f8f861a71785d72a1b3887106f039e95e
SHA512 58521fbda09e09d30ba4e395e3d0da1840569303e2742879539a3f7d0d131f3a5f9299a9a16a69b760a1a717945f2d5000c5df0f0e016f707da14a9ef2042b56
SSDEEP 12288:VXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:V3nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T172552369A768F94BFA3B06B05882C151673F0EC5BF90D78FBB08222D957C3D40DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4d2438e1560f39602f1b73df75fbdffd67ac3b9f8da8545b7079727c0178a4cf
MD5 ecd9071ee948f28067a653177547680b
SHA1 d40a749cebef7e5ede0f3643153c3f2e06b71681
SHA512 fda443fa8648fd55779d8dec76280def8242deae270317619dc098f8c9957d10a446b51746a9a011ff83dbc070d690b4f945832345bfaba193323445075e0a2e
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQlQ/lFTjN4:Ja0hNYG4Jw9Lm
TLSH
T150859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 426336817e15864b4002f1d1e6b7a939e8c835fdbdefeb7a25f46c6e143b93a8
MD5 9a49190d60e34ef13b47d98de4bba11e
SHA1 f39e5d017221abb77f8821ad4191b238a87e8e2f
SHA512 3db315fac719c2d4cdcf8175fbc06a82f4582188decf204ed5524cd826b11b479fefd00d6b118f2ea7c515842e453250712f3f53f6a79b7fcebb1bb96354e00f
SSDEEP 12288:JhbHjfXmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:JhbHjPGnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T16955027D26AC30DAF63692BD88928546D7327C552B51A3DF2381823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6971187c30d45fd787342d7413964bde1a46e255be4992f07ec30665177f1cc0
MD5 59d79ba44dd9ec23dc72456749ce223e
SHA1 6d28840c024060e534fbd1f3d901e8b151b7ea19
SHA512 5e5a873ed89c17906db7db3728f85298524462ca7a2a13c5b4c5f2a9367a982ea96193a036caa56f5dc8c4780b5fa07a72d77f5acc51adc6c58a3f21568d05dc
SSDEEP 24576:z3YgnJcRTk4yti+R5dBR/OnQ/tbw/2Mkjy6Fr7g0of:zIgnaTk46pBR/OQ/lFTjN4
TLSH
T1E545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e206d082362a41f412231e20f2e6ee7b17bc1ee48db3affbf8e2c98cb48782c8
MD5 95cb790aaadc32e470a49cbcbe9e3dc5
SHA1 3976ae4da5dbf801e00a752e9e8ebce2622ac5b8
SHA512 56ac4f579cbd75733cb044467b2e322ace04f0971a88ff668a04ed7a4ef7e31f30149b397749e4e6d433f0d984c53cbc1df06baa0e5552b43782225412356d42
SSDEEP 12288:bbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:bLnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14A5523687614F98BFA2B06F54C838546673B0EC17F91A3CF7B482129967D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8d14891012fa04675af04f990824d2f7bd6d943a99a31216b662037723f28564
MD5 54044e49613db11035137ff53382b252
SHA1 7fc50d903a08a270a685c301aa9b141aae2281fa
SHA512 4331248bb36b8204e9da216eb5fa83f7623e8ff913141062ac6064650550000b3c0687622369774a21116a7971244a3963904c98612029f7726a6a33ac42d4a9
SSDEEP 12288:LOb4A4LWOsvAYFTMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:UwL3UTMnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T15175F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0c0adde4968e18d7891481e077378ef6ed7cad9171a2fc349dd740d2056123d1
MD5 3bba87bf7ece7349076c271f9f9ac60f
SHA1 ba92a5be9e2671531b26ddee38a6e9e7dc5fa05a
SHA512 22e494bcf0d9074d6f2c6c4f7f70a05a71389a4bea96530ca60739e176d5a0a1e6717f01b7155eafa60a18af36002ab875457060b9c14b9c8f3fff42d5277c22
SSDEEP 12288:opFtCOQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:ROwnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T17755022D36EC60E6E53A527C89838209D37278961B6253DF0780817E5F77BF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 74ef760f1e78fed794acb3bdd06bb411547f21a979b360a168b070fbbf341be4
MD5 48eed23070b6385903870f30d1fe113b
SHA1 d41a55c2291aa5660dfa6746332751ca72080f33
SHA512 b64d311308f1201769441d3a37147f7ba2c78254f449b407d2acf606b647b619cba66537b7b4503dcf5e9d811a4f8127b24de6240c3f6d4fbec0178d512021d6
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhsnnQ/tbw/2Mkjy6Fr7g0oi:J7cBWMpPjN8DbEhmQ/lFTjN4
TLSH
T169659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1822d73f4aa02005605fb5ae7550774c91c6fc6e3f52f460080803dfe0fe4809
MD5 4ba3656fc5a404bb2d0b27823aff2f5a
SHA1 7142d3b79d95e271d4606ccd0e9a3c4c76e5f664
SHA512 afb4b77aeb68ddc874a502b944e1b5360e22658569a4b5ff18bb1b390e57cccd8a69eb346eef2ef4d9061a3b0c81a1005ae57c615c669b87aec88c873e0a1f10
SSDEEP 24576:bW6BApg2YuyuNDYTabvcdvNYf8km1BnQ/tbw/2Mkjy6Fr7g0oD:bF2YuHNETovAvNYf8kmHQ/lFTjN4
TLSH
T102857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 37623053df7f00deb2a4c8d92fc27a92b9169322ab64c5c628b2e999762f5bea
MD5 d555e69c11b7f1f089a07a28ce25f65e
SHA1 3ccd6ecbd20d6080d392957ed8203cedf8f3b2a2
SHA512 195377ee5bbe301f990727f6609c7495aeb6e43d2e222e27ef3a4d1616e5bcc3992ab65c9a5f0fb3e08a8ce0debc31676dadc8165c58b42156eb85e07cba1f4a
SSDEEP 24576:kAFs06+Omlf3NXEbToEnQ/tbw/2Mkjy6Fr7g0og:pFs060lVXuFQ/lFTjN4
TLSH
T1B965AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 cf35824575dfcc4c8c164a8f9603eba10d0f2d443900d198093f4d3679d8ddf2
MD5 699af6f76a67757ba8c8eddd0f77255c
SHA1 a12f302f25caad2d6ec64a877c9ac77c67627af9
SHA512 d634f2bb239a064cf162503804de4744ba31528d1b9c87ce469cc998dec368053111943f7820d5c82a257668bc83a6774b9a99a83b40440306a87ffcf01f9ddf
SSDEEP 12288:JCJnJ5D3VkrqzxnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:gJnJ5D3WaFnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16875D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 208fe85de51e984015f22cb1a366c9d786752668702f3339a674a7ad9c38abea
MD5 c62ef05c2ee49ad3b670f67bc2e3f23f
SHA1 5ae39957dd5c88dcbe0504e101c571af804e5674
SHA512 6c68ae4902d9ef7b41e95a69500ca0efc98f9eb6c197cf67a27bd237d7d6abf0117c99d7528aac94a3134db93675ce2e3dd4963b1bbf7ee689fbea35c4b6ed00
SSDEEP 24576:DEPghm6/7IIXdwcXrif7qQncjlP65i3VuOnQ/tbw/2Mkjy6Fr7g0oZ:kg06DIKdwc+eQnSt65aVDQ/lFTjN4
TLSH
T1EC955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 52a5fa74876bd8e869f400d27a0b7c444b77e36affaeb56b921a133216fb1ec4
MD5 4a3e252523dab912501f22741a4fe3d5
SHA1 f20dbecfd341ba673c63a54ebdfe08cdd158955f
SHA512 db9ecd8e2ba3a793bf4f3604804060b6e62dbf6260e6fb8d26242fad7cbe5746ff733be70720c49106c13bed12474ae218f8c8c423106ab880cb7be1aaf18bee
SSDEEP 12288:oEP3RSJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:DSZnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1AA55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 1b63cd888cf6c36268a2e59075218db4d1452faadc1842aceb741796e6053b4a
MD5 cc3d96809dc8051bce0b1c71e8732afe
SHA1 38385ff6d810f0e8ad688e9845bc8f36cd2e74c2
SHA512 53e4263d533a3bf781badbc874d0bf33c6014dad0aacf7e9141ef0faa11a93dafff255507f483c7f6fe870d875a6ea3158970c689cbea639e2e2cca7d941e384
SSDEEP 12288:kjky2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:kIyWnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1D16512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 4f6365da83a48b1b988cf4824c44789ecd380925e25a8c9e19e2eeaa4ac56408
MD5 c0f7b6a12bdd80498bf1770afa0f2324
SHA1 e823e72c18a54da533c8f60fc26d0d5a08ee7f14
SHA512 78cb8814ccc3192da8a9e8cbbcbb948452822de5621ae7d9343174bcedc20a509c1ce8577968e85d104101e69b4776190ce59839c6eb9a66e9683b81365f356c
SSDEEP 12288:P0gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:sAnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1AE55236C3625F89BFE2706F448928542973B09C17F9167EF3684A239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c88fdaace125710d566b76cb16e177c2a0b59d01ed843ef28e6c9286ff1a52f9
MD5 c22bc966d0bec9fcbb6a6c4c8e46a339
SHA1 4b9f311e44811bcfb228deffbba68f17b7085ff9
SHA512 a9d987ccf8e6f90ce2e7366ad094ebe983fcf8bee749fa3e3e18d71bd4a9fa5202339935a4f1a15adc8487e042d4922ba06e7e32a7cd2fc648698a7b20b02f2b
SSDEEP 24576:eQ9MxZKdcz9dw3/nQ/tbw/2Mkjy6Fr7g0oR:eVKZ/Q/lFTjN4
TLSH
T1EE558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e63c64f3d7871864215cb06f0d3da517970a385e3bc12c91f7693c923be35264
MD5 c50432d2c5519e1d9cf0cf6564836349
SHA1 e8d42de1a8f4076cf900228eadb01b44ec7c4310
SHA512 8da8c1cf029409a4044ae6dc9439d717f1862d0790cf5deaa39c7a1cb4ad010f0bcccf7071ead0aae4239969565808f8c23a15bb19944aa8039be088c9df8ee5
SSDEEP 12288:tyoKo20Rple9pqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:tyocSApqnQ/tbw/2Mkjy6Fr7g0og
TLSH
T11665E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 58d3392f8538577f4c5728ff91e3f389c322d76d25c187f5f0e82f5cf9dc90fd
MD5 3a06a8b87aa36ab0fa9d5fb6e35cdb5f
SHA1 134face088b4210cb5466eb7bb7e7fedcfc0db35
SHA512 a9b56e38788a7cadf5a571a8d1f907d8e33474cd6c4f48151ef174433b181a12c36eced3b049f89c2a5ad4fb66a65e277a34b436156bf3df55426cd55fa34ab1
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKqQ/lFTjN4:a0zuNIvLm
TLSH
T10EA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eef884ee26b42cf682da7251785818dc6b4b2312ac8b5f9e308660977ec87be3
MD5 51a22158d106d37aa66229d932d89f18
SHA1 7b0dec76eba6ab2d5e2312bfd616dd6632a1d477
SHA512 f051ca6d101de2fc65aaa766aeb6c71f300096de23fa0e0f81230d105449013ce88109d00053581dd2d806e6f29264745c7f91dfdc34f6f9724c8f7921b7368d
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYtjMqbZnQ/tbw/2Mkjy6Fr7g0oF:jTDxR+N5YzTfjMQQ/lFTjN4
TLSH
T1D055B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e6e49304049b9d6e793358951ddd56323093a724292d2dd26c90fd0ae4ff3177
MD5 9ce192c2b43cbee190bb5721349bd5cd
SHA1 22d14011a564835dab2b50f0791dc5c02b77b6e3
SHA512 8d0e68ed7c23ab4e956f4e466cf341dc2a115569c31d513c38ddcec0778fa93b099e5f1e2df534ebdf154b063d919a1e5a9f38c88d861c6b04120405c5edeef8
SSDEEP 24576:HTMdOz0FFS+1mSL9nQ/tbw/2Mkjy6Fr7g0oZ:10K+1mSL9Q/lFTjN4
TLSH
T1C675E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 a04feab240d4e3decade4f948f8b44dde305bd17a6caa5568cff60259115da2b
MD5 737e542b593aaee12c860189988c9a57
SHA1 d897fdff6ebecc2b513565a53954620c7de07116
SHA512 9b9f0136be3e99a5e34ccb6a6e880e0d54dfdcf6b49bd7aa19bbfea646ef25a4d6856dcb47c79b621f41c39a4d5b6a3d0a3bf2e556ca10894e6e584ca8519195
SSDEEP 12288:y4TMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:hMnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10455122D23E8B4D6F93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-90-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/388-265-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/388-95-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/888-272-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1532-123-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1532-117-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1532-270-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1928-266-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2072-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/2072-1-0x0000000002260000-0x00000000022C6000-memory.dmp

Download

memory/2072-8-0x0000000002260000-0x00000000022C6000-memory.dmp

Download

memory/2072-346-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/2080-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2080-412-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2276-280-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2396-55-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2396-59-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2396-61-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2396-49-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2440-264-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2440-83-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2440-77-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2444-273-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2640-276-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2728-263-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2728-67-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2728-73-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2848-344-0x000000000C950000-0x000000000C958000-memory.dmp

Download

memory/2848-413-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2848-149-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2848-181-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2848-279-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2848-165-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3084-130-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3160-275-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3412-35-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3412-261-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-29-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3488-268-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4076-267-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4076-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4132-350-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-355-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-371-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-370-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-380-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-381-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-383-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-384-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-385-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-382-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-387-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-386-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-373-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-374-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-375-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-377-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-378-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-379-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-376-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-367-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-368-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-369-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-366-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-364-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-365-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-372-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-356-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-359-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-361-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-362-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-360-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-357-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-358-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-354-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-353-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-351-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-352-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-349-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-348-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4132-347-0x000002CF8F910000-0x000002CF8F920000-memory.dmp

Download

memory/4144-271-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4272-260-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4272-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4272-22-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4452-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4452-262-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4452-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4760-106-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4760-112-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4760-269-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4912-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download