abae3ed37f487440008a7d73dfc6f323f8a4c535b634adad46e2800de7c003ea

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.2MB
Sample260809-ndcfpsac22
SHA256 abae3ed37f487440008a7d73dfc6f323f8a4c535b634adad46e2800de7c003ea
MD5 00213d47ad081cbf4ec4585c48f0082c
SHA1 864c245ff53c1791bbcb93041b206dff4eb5cc5c
SHA512 3a88bb352487e2f6e44e20de55e4d6218dad9c37f582d714156b6a9912d44d6994dfd4db1db63ec609794c691e86f0824b33d763c2eed5fe2544f813fdd958d0
SSDEEP 24576:nVGGTWBZO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VGyWBZOLNiXicJFFRGNzj3
TLSH
T15255025131C080B3EAB7043449B49970A96DFE345F7549EBA3842B2E9E747D28E38B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
532	alg.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
4828	fxssvc.exe
3432	elevation_service.exe
3704	elevation_service.exe
1804	maintenanceservice.exe
2844	msdtc.exe
3768	OSE.EXE
4280	PerceptionSimulationService.exe
4484	perfhost.exe
568	locator.exe
1376	SensorDataService.exe
1780	snmptrap.exe
1808	spectrum.exe
5116	ssh-agent.exe
3292	TieringEngineService.exe
2788	AgentService.exe
4224	vds.exe
592	vssvc.exe
2360	wbengine.exe
4644	WmiApSrv.exe
3196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62a4a70268b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a28cc94f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b83e293f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cac18093f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000267b7d94f027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036d4b293f027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d555794f027dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015678994f027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4828	fxssvc.exe
Token: SeRestorePrivilege	3292	TieringEngineService.exe
Token: SeManageVolumePrivilege	3292	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2788	AgentService.exe
Token: SeBackupPrivilege	592	vssvc.exe
Token: SeRestorePrivilege	592	vssvc.exe
Token: SeAuditPrivilege	592	vssvc.exe
Token: SeBackupPrivilege	2360	wbengine.exe
Token: SeRestorePrivilege	2360	wbengine.exe
Token: SeSecurityPrivilege	2360	wbengine.exe
Token: 33	3196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3196	SearchIndexer.exe
Token: SeDebugPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3736	2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1172	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1600	3196	SearchIndexer.exe	111
PID 3196 wrote to memory of 1228	3196	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_00213d47ad081cbf4ec4585c48f0082c_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:532

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3020

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3768

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1376

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3584

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2d23c8c68b93ce5e603cd5cf64d7f32c6d97ed1b1caea263903dc2c70ae66f8
MD5 83aa69c1a488d9385fc06aed4a259609
SHA1 7db02e3115a26ac036f87f597eae1f0a55ac2d78
SHA512 73f8cfe09b0cece2da4eb165c2718d410fad19432681da8e77abf5f93c715c13db9b7790b018529a416a0b40729c46e7bedc14303a14215ab2f61e0cc5522c98
SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:P3q6mjB77wRGpj3
TLSH
T1CAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 9e361d416e478b6127bf460299dc8753a380f3437524d9216af6d07d658b586c
MD5 7a37adde47ad34add2b0d910f3e52676
SHA1 31f5ff27e0916083616513aeaae26a25050e1a23
SHA512 79ad154b4bec9a1fa85f9878fd1daa85d0ae4db1750b5cd1610e313f33c1fed32f41f2bb40f625935422ab02b496ed981dab9fde7f4ecf360d8110ae20f0f1b6
SSDEEP 24576:iXYfDtczAf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ptcWLNiXicJFFRGNzj3
TLSH
T11055012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 d540d7d2276fa08e4f4aa1d8b23d42dd24037c9d5fbf049198c4f1f4a22b9090
MD5 1d9198727ad9aa194c1cb5ecfbbf98ba
SHA1 c5759a17d5899399fa7d3475f892c523549e1020
SHA512 1213bc7c6c3f172f7217538589ca171773f3bc843b1d088d24ad17c5fca314318fd713927c1fac70e7011aeca56ee2f5e1af45ad38ff7a2ededdfc61e7d9a60e
SSDEEP 24576:I0Le5ji0hmxerMg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IPji0A8xLNiXicJFFRGNzj3
TLSH
T1A675AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c469db4640972c10066c4480c0178a4e73892486b01d4bc4acb9d0f8cce2871
MD5 51859193f22acba38a9580d89603567c
SHA1 761ae2c6c7d0df1691660aa254d3b0d0f05cb26e
SHA512 1f95c9175cf20b0fb76f86efdfdbe0ee149124dc8f1a0b5fa98d37b1d669f514854edd3f7815798c8176f62deb33de60da51d5e77fbea635b72b7f40231dad70
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyum/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/ezSC6vUzPv+HjyVLNiXicJFFRGNzj3
TLSH
T1D0756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f64ec5b6bdd6bcac4a6d7d8f779018ea4cd1139db33558de1ad9ed2abe9c30b7
MD5 0cdbae94c00d3a37fadc631b9fd06c90
SHA1 03b1596b21afe4efce4b09ffb576ddcf657e1ebd
SHA512 695ef7ba019043afb12121e0bbf9f6364230e086b8483a4f2e21b203c5e86dbaea07c19353a6be4e0fb842267c35f6d4338d49b2155cbace74643354592f14d0
SSDEEP 24576:FVbqPb88hv/l+BL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+RLNiXicJFFRGNzj3
TLSH
T151559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 e8116c4fac4b678835d41262f7405305269fa3cc6a7b1ab41d73953f133d950b
MD5 46c6e039a11f7bba4bb2ba090aeee4e8
SHA1 3a60817a68a8553a5ee94b80ae80c21f426fe2d9
SHA512 ab1c3887ca94a462a21fa510a6373c6b522dc6da98ea445465759ea30b1d99c6f00f97db584554595972b8a5ab6efffde9ef3f270d4a6af2fb9591b79602aa86
SSDEEP 24576:xes/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1653523D3468864B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f67a38525091efd4df8bfda77311e8ba88809a778cab28ffeb2d49df6ed0136
MD5 bbcbb46fc8e23d73dc89fc378800ec30
SHA1 ae7e0e49b088bcfdd7cebccad664f6b731d710aa
SHA512 05452449c47b382923d2c059fbfb017568fb06654102c50acefa4d53f41397f8ca353569b52d457eaa5fc5ece8419cdd9c62ce6857222604a38e00d998a0ac5e
SSDEEP 24576:DJIUj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DJIUjLNiXicJFFRGNzj3
TLSH
T17265CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3771e5cb4f9b6e9b9502e1158c74e8afa6156dd92100db7686f2f9a4303911c3
MD5 0182debb3d2c5007e60fbac95159eb92
SHA1 0b40a7f596e673a76f38675a52cd29a285163fd3
SHA512 a0129d50a936bc2ea9349d9971d6749f5ad0962e846f24e2e31e5cf3316a18292b5bd58950f7a41e0c71bfc95840ccd1d3a331500f8e3f5910f9b96fd798acad
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH3:/QvGAdlCEL8c/WRNw5C27wRGpj3
TLSH
T137266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 882fea4036cec800c7edf57e66236818e759a6832cb51c26b25fd96b71bb6726
MD5 14e05c0c681a2b4812a07c062e35f85e
SHA1 7201d4e81319215a6514a7bd1b13200fea443cc8
SHA512 d58c284ffd2f2d3bffbb63df088ff38aab6dbcd41bfbc7891d9e799e05b609c4eab7e068aba8421777d06a216f31d9d33c001cec6793a2530117fa7f1b40ca7f
SSDEEP 24576:6yewsAjB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VljBLNiXicJFFRGNzj3
TLSH
T1A665E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 52d0bf7c07b28911a68e0d44eb702f625f92bf37fe7d1b2ca369b1cd1ed8d9a5
MD5 17f4d8742783e321ebc2cd2398ff9646
SHA1 4c5dcb6aa0ed2833063f5001339046cf68e915c5
SHA512 b881030c3c8240479b116e548394a0456668cf4f0c7191d601859721fdae1ad3d0066e7d958e30df5cb9a69babcb938577c251441fb1144fdc7cdec3e31a4c64
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH9F9:kUEtQevvqc2W1cpV20I32D9
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca40b7ac4acfb37af3c46a13ef35d9d73251a7f5a0131ed0ae00a9ca62505fcb
MD5 f530c905d1efb2515dff3eecfcc26400
SHA1 9c624472059401a1fad7e1043e5792272d6adc48
SHA512 7d4d731d5f7f4be9f989db0af0b42c55b61345a9e3fd424035ce58ac05ebba7d48e9f70de1428aa1e109b333492b95e6a80710baccc1354be3d9185a144a9f7a
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/zhLNiXicJFFRGNzj3:noq2Vjnma7wRGpj3
TLSH
T1D0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 10735e37851e4149a84ebd2487f7eded581425d4fae3863f7f38e315cba0315e
MD5 64c4b50b58c840b26914ec5c5b12227b
SHA1 da5e948fb0a7012ff87a8edbc19282017cedba7b
SHA512 7fbf48dd64e1dbee09bb33ef3deeb4db970837852de46abc7f808f68aa9fb7af7943112c0f8a6de9dbc775b7048c42c00a2935271d8cfc5a6925a5aedbdf2d87
SSDEEP 24576:OAhGL6IFoiwtA5l7S536/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OAM5Foiq5qLNiXicJFFRGNzj3
TLSH
T11D359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 031fb85176cc41c90d4f4361d15fda94cfd8a7257523ace5fe0a1a7d4dae904c
MD5 107708d3c281c07bbf46ad6c82a95e09
SHA1 04f06b9031f6d61094cdf456e0b3b4a68e4a1d2e
SHA512 fea6cab7147c5eabb11b29bc9e308725deba7eb04e3632c0d6cf0654824b0bb5403375435cda81da99ad4831e286fb8c99756423395bd28b5a27c1a76a6feaca
SSDEEP 24576:ywuSOW1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ywROeLNiXicJFFRGNzj3
TLSH
T1B255F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 3db1a5a9681ea718be46cd6ea5fe76810000c75f95a96df832fb63f838481540
MD5 0db35777b975151555e3a0f185b86ec7
SHA1 404e08eae4b7330eae2f1551e33369622fb5b6f1
SHA512 2e0a1ffb1fa2c219c2d23d9f7604a0a12f57f3d37deaa5690775bddc84a60d3a6293ab28f7fc11d6c3f24fe5fdcf8fa00244b991708fae7c186933366f7d22da
SSDEEP 24576:AZuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T1CC45129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ddce2e8ea8e56e56e247bd57dd90171de023de13bf1796df14ff41a5abddf32
MD5 94c418dc680243031fae223835efc68b
SHA1 8f0d613b94a6c2a7bd04b5edfc534cdc026ceca9
SHA512 fd62199a3aa8893befb96d918f840b3a6d9d07d1122f04da2c9641dd2b378a12a127d689da033e249cabfb9295ec026039b12e38285c11d0845947ac0a4652c1
SSDEEP 98304:vQRQyi36YOcPDLvw2gAf+PN337wRGpj3:eQyiKanX+PN7F9
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3bad3a6bb170166ac27acb8d8c7d82e0f2214dbed8b861530005df3cc985d9ec
MD5 f4838e5e220dba00efbc662a536d20fe
SHA1 2ecf3b2317462c10d3c5e738cc8ada18e9db06ac
SHA512 dd741e1fd9c40c7ee9ba9eee3b3c5b5d5a692fe76f16013c4bf1be9ac5461560721c423d8db2834672dcfc81f42cd245026856fa71f8b564d0430cc4e1ad8c94
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN337wRGpj3:DQyiKanX+PN7F9
TLSH
T172667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7f971fd4c562e8de46aab2a2d53bf8515f1f9fa9696f64340b8db36338b3b265
MD5 baf213d022adb404492793e14984623f
SHA1 7cbf301a48c6501abd90e379b629ef60ca20f4c9
SHA512 56cea6d32c99d77b063035acb0eca70d7174e9cbce35c80ed2007ecf74fc58025b19c6391d10f8f6b9a602b5130ec99f655e0cc5d80121492d0075ae47e5a5d2
SSDEEP 49152:l68Qg55nhkeWu7PNU3/xLNiXicJFFRGNzj3:zthTRc/x7wRGpj3
TLSH
T165B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8e0f0c92f31f86c2016448c236fd9e4e8694c77a0494583f2797a9ca8c3f83d9
MD5 e26f2f2c676c340bbb806c3a168a478e
SHA1 81781868f53090389c0d197dd0283a54a2458690
SHA512 eb6d63fb1c3654a616ce142beb7cb8ab4be7a05739ff6202676efd404fbaca195eaa498b93941272582e408ba519f69c813a4faacd672c76a9cf44479ca5bb96
SSDEEP 98304:Fy5112gYy5azzVvU69nLKnhZs7wRGpj3:oLIHRWhmF9
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1856ec973b226f28d9a833f5fee9c6aef8e267baee4ce03151b1ca681874c55
MD5 5075a7f5389ef7ae469d85fdb54e8c92
SHA1 a8057df58e53d514bd1f1b2568e962c2cac6fd96
SHA512 70351399a34084b9be8c740a544c9403801d829586d3b5e90e0bffa6d4bff2a223a2465ca7b34275888d41c4eaef2f01797f6b0e8547dead7e38bb6cd7cba06a
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:ou6JmIxd2dP7wRGpj3
TLSH
T132D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2b17b73a2203a2ce246da67dd566270910ab82d2fa2369766cd692bbcc45535f
MD5 aed90ba47b5291b9b36cb35ecd0df1ae
SHA1 ef1ffb14eeed203595f46f8d2cf042a3ec79088d
SHA512 2cd17c54d0af52a52e1684af8e93ebb02cf51cafe004965b94a1f1e7d260be4ec250719d582bceecfad9830ec06936b7b0fd7bc374bf6f35118e75e58e84cf34
SSDEEP 49152:91hpsNoJpF1A67U44CwH7R4xDLNiXicJFFRGNzj3:9mifPqRa7wRGpj3
TLSH
T119B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d778ece9ba63f26ea676c197cb8042581e0027c5f23e4153e7532112543620bb
MD5 a6bdbfe5baa719cc677049ee0b172d8a
SHA1 e90c320d87cde2502313b7ef39854cfa0e26451e
SHA512 55ae015b7d48b18318600719aae79665023277b9f317b1a8137f2cfd49ca3b7d14b52670c94713fcbcca4ce4296230f51dc57491abc03de0a382ffa0a5dadf73
SSDEEP 49152:fSuZQIY0Be2KkRVtOnks6NMHqYLNiXicJFFRGNzj3:l5dKqi61Y7wRGpj3
TLSH
T1AEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68bacd5f3b3ba7641f40219758363fffef2b51b82088d3b57e80974f51fecde7
MD5 66d05a0926f5b140216e7c4db55dfb01
SHA1 c71c4dcb134ea65ec1e4e44540df7cecf0aa1671
SHA512 d47008d579f098ce6f86632ae6f764290f237f85fd639956629df322bcac486cc635df8783f3eb060e76c62f2d956091364afa00a00ead6ceff58fc7331e2ccb
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wfLNiXicJFFRGNzj3:sX2iWph+7wRGpj3
TLSH
T1C695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 13d773d28dbe0d80d00abeee0ef3ad6062991cd2163f566ca4013cc4eebfb8b3
MD5 9ea9782e0dd179843d0c09c1a1f19a4b
SHA1 1924552abf726b09165f904859f389e0214affb5
SHA512 ea6d0dbed44b0fa26c816470ef4a7558615e4f6f70cc4b8921dd2cfdc6ee2727fdade8292fb80777eb6db13422ce03bc495f2c6e69496694a072d39dfca3e396
SSDEEP 12288:qiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C73523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 9595f4b915fd4e5fe9ff07ea352b06a7ff09b1c55129a309065b7b6b0c984ed2
MD5 56685644b9952f2d9af08f9eaee10b5e
SHA1 d88e6855c89daa3ee6c9491cf314889c8d520315
SHA512 8993724b0a08a28ae53153f59dfe96a064f7767dd3b41718a1584291ffc700d050d7e86861e0dd7912c3c9537966939b9df668c455336afa8463395328306eaa
SSDEEP 12288:SRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1183523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2c540b67ff174dabbc1ea49d5f6da48c2bf66cca5ecf2f766f08599d6b239518
MD5 812977451b9a12af384f653babfcef3f
SHA1 dab04c83b270b4c74b5f6a6b3e8e8076e963b10e
SHA512 a542429ce3567745b48a0207afaa758ecfbd4611e455c5672065eb65590b9ba1cb33196b14ede1be5ff64f7ef5e12a08a53786ca00da645390612397a7418a6d
SSDEEP 12288:pPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1993523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 41c3e5e63fe6c020b6006e08c4d39b340f776993a511e1a4e0fdd4bd67beb9ec
MD5 cc04fd91da3a6626b5961fbda47131a2
SHA1 831a15a44e5872fc0ac9bfd03471101c455e17b0
SHA512 c63fd76126240a5571881f46003aa69144349fae7c86b14c4e19c88aece1d13dee9d51509f7cbf1f3c511d5ff2886fefd07d945d990da8db64bd092f0017852e
SSDEEP 12288:5VoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T127452392168901E1E9FD8039C6764424F2947D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 a415fa86203b46f656c869f4c7e21f910f9ad3851e09f69127b8471c5c6aa129
MD5 d651229ecc41dbaf254975910af78003
SHA1 92859e2e6c4ed947be4d14ff200e27d68b37c908
SHA512 6577c73d598dcc6d37a704b4348611ff07f9d78b63c4ae19843ef0c05ca55f7313cb3a8d7489201e52c9502d61246704350fffc444dcfebbc79f5143fd6eb0af
SSDEEP 12288:6wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1423523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 9c5323af2e344b18775c7842f444d186ba3f0f389ac28b7d23dcef26a2d95a59
MD5 b2730d3554c4397a04e2834915e1cd7e
SHA1 589036e4acde1574acf737879c5baf0d203267fb
SHA512 f93a157f2493a37d3c3bab8e4e6cb4762066726fc7b03a63fb2e54c82ceb18d43410fa5979d50f7c83ed70630ae82b0c03f5f93dcf24502a571325429c6c6d52
SSDEEP 12288:Z1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E13523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 b0338dec115bd0a36d89f8fe777fa11df4913f278a8f1e8416dd34e0cc5e9196
MD5 61e826fda1f52c90d7f65984b3537255
SHA1 b5c58f688596645ed9cd1e32fbe80e5d4f67e3e2
SHA512 011484d3142d3a2e303819dd43283a5f0fff9e2b48881f8c1cfb65b4e9ea12a7487aadfad9fb49427b52191aa4b862d0eaed00be8f462c1e45b09b4aaaa2a491
SSDEEP 12288:Z5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1443523D3548955B1FAFC003986354428F5882E2DEB5659E3E2083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ddf99f1ae8c8605196ac3cf65023f776f3ba529a380bcee7fc6ae41727c0c4e6
MD5 6be6d355d0c6426f0b99b4e3ce48dc58
SHA1 602b227ff7aefdd0d907558f12deee1496f9c2aa
SHA512 e40dfb70f97255331d2bc8e17e7874acff37301f1b6dc4b11c028c6207c945a93033031749fab8be0b6e068472d4d3ea6e7069ce1dceff478e153d6492115cab
SSDEEP 24576:uZMOzFVSO9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uZMOzfpLNiXicJFFRGNzj3
TLSH
T17A650295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 e62a395ee7b053802d019df60585b617ac30618d3f73d6dd84e6df0d467de39c
MD5 9717168d0017ac74b7c500ecd8bbcf6d
SHA1 691f5d0b7bafc7fcdd70f5326979e8f8b4662ffa
SHA512 b792b3398b3c7d7e693373e867160b20537e8f74b6b798acb5723e4cd1949b45c458e4ccfce5f60038d5c9e4d1af17ac4cbde96e370265fdaf8b70c2ef158da1
SSDEEP 12288:deiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:do/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF3523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 886638695e508778958ad7086dc4a60c327b73de1a8a4aa4bb6c1148313449b0
MD5 2a47324f5df02967b09bb020e936f953
SHA1 0963ba35a5e733d480aab7985e5ff97e02d2bc97
SHA512 1215dadc42a4750c80e5ad71bbb5ba16a8e13f1b405e9b2110526bb087d619337f187f5ee2a1ea90785202fb0a8fec47a0cc5990266ac77eb496e325c7a502a0
SSDEEP 12288:taiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1533523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 8d5049afb04adb0bb3ad3dbdcb8c18f9299b72c8ec783f7670e6a4c68bc655af
MD5 687423baac3d47aae0fc5123ee2c3801
SHA1 c4e8a1428bec36792aa5a5fabb348bac5982bcaf
SHA512 915190a930f336d5ad6ce1f77e38335e88a0d99d52fe202d2ea3c46f06f37ea07fe06ff402636ff0659794f2854a746bb73cfe83a282dfe5419158e6e8ec5c3c
SSDEEP 24576:mzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m+LNiXicJFFRGNzj3
TLSH
T14B550247629530F9E17A4139C9620911F3B17C364B208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 33ee36ee1d80fe648f8cb76c0340b5597132d2d136d8ec3ebfc251f7b0d16fc7
MD5 41cafa921e571c349d0991e57f6f4a21
SHA1 371314c496b42854f643dcf55a30e725a7e2e5c5
SHA512 1667b29b3d0c43e1b7dd5530072802b1b51ad395cf02799b7dc7892e5c3e784c8fe61d8122eaa92e69f2e22d6ef886e3ca00783e1ecb2dbb3812ea4c7d6cf6d4
SSDEEP 12288:ZeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1643523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 83f5780caa4b26b4651aa5ad5a4b2426b4f71e9ce5de61a7ae64b178f3fb2c82
MD5 60b8c5f41d624caf2fe61c422d9d16a5
SHA1 1516c31647f9d26e22c6d59061cd8a7e2b3b1ef5
SHA512 ffd15423236060c9298f5e4484969ec2cace5833b1c85f2cde5a158e817c4bda86633995464f5d5cfe1ce441277073b734a72f2fca18fc098552e69f6753b9bc
SSDEEP 12288:GeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Go/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB3523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 8d894678ddd0d1fc81158e9b9014a9209cd991664cb43cc9da07e9d09fabb149
MD5 9e0acb56f593bb9c3bbf6f6a9d4531a7
SHA1 6157cc724bace2d64702d92939f2cba37175011c
SHA512 e4acde8e8de28cd64e54c88c6c47e044588fda2a561d5b004e854ef99b31e766422123acbfd571b218e9ab8f5d660a1900f7c95bc4475211079bd64e340937de
SSDEEP 24576:WzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W+LNiXicJFFRGNzj3
TLSH
T1AC550247629530F9E17A4139C9620911F7B17C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4903bfe66ce21bb473e4614a405b69f0e34410320505bbc5d04d859454063976
MD5 6061d977aa81a4e0e2dec4897ee5683c
SHA1 7e3514d02fc84af862cf2d0899ed5459c42b3ff5
SHA512 84c653e219cc45163f1d5bb0976d1ccca06077d6f02b58f31a595260083cbeb0092baf05dbce2715bfce47c72e81db3a8402d1926dfe0edc26c15f3507a424ff
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71nNKbrh/8KBQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hP4m4IpOO67W8K2LNiXicJFFRGNzj3
TLSH
T19965AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 c6be7dfa0e1d5e44e506ca2101d238b7eeb479096936ba9116ac85bffa06170c
MD5 8e77dca7b2c25fa0165020819cb177c0
SHA1 285a94655689b550082310a2d92124d9cb4d47ea
SHA512 6e7bb6ace24c365f9560335d635e0c72542089ea9271bd4ee091e8c4287e28da5d6f3945451d7c422227e931ef0a63ce08f1d8a39ac8fe39644247778ba2a4e3
SSDEEP 12288:QIsfuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18545F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 305fa2413ace57fa1e5a9cb726a1fbd88bb878cfde70bb88f6b3bdb3497a5996
MD5 774f158f72303482bc4be14422596041
SHA1 f66f6c74e672771fde7d6a1dfa6492eac9ee4d9a
SHA512 2103ae020e9789a6fb04872dbeb1d1b5d4c468d1a45429e3081a0697b41420fd51aa2feb278d3c8e07f24ecebf5fb65882a8c79547e3af824c111772a80d6309
SSDEEP 12288:FOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:F4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C352393568C5572FAFD1039853A8438B5497E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cb0137e97f7ddc4cbad362968512da13c28263636385850ec980e06e3b1b738d
MD5 94d21f2d1457d2009cef5faaece02271
SHA1 7dc15d706ab5541d0d8e707209cb314ece2c48c2
SHA512 7dd0af20d71e3308bfb33a1d062b8b6ac13b36b35705203ddbba8a096f2c4972d743838466024e3646ca158669d70c0b17a8ec6f37cf109a6a915a15076151e7
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQiLNiXicJFFRGNzj3:xa0hNYG4JwJ7wRGpj3
TLSH
T18985AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 8c7b4ac04bac27090d244c30af4d356907b2aaac290fc67cf68531b0c74a1e8b
MD5 6bc7da35ea168df758c23fc4a975b0f6
SHA1 d71b6d26bfbd5aba49b96d54e1c591b8722d3196
SHA512 fc9c9b953ebbeac7e3d008d46b5cfdfa4341cfc3e5291b81c12f5b8e23703f85bb725fc9d39d197020099f34dace2c6ba728dac329f4d57de33d65c50e477af2
SSDEEP 24576:GhbHjPN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GhbHjlLNiXicJFFRGNzj3
TLSH
T14C4512BE169C20E5F6B5903D85668409E370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e4933d826a375f13787f7e1310742529ef0aa0a0cc0d7488cf5db71e4636c321
MD5 9dde18a9a0b3ae342f38c42733fa7f0a
SHA1 0ea6a7d61e3044e1e08558abf3326e5aed7e5628
SHA512 e05df8b8a0e76ca136dfa4c03b52aec848f06303a769d4833cc555f802684e1203519bc90694fe58182057d1957dbc939eff98aa3a72cb476709b37156fb271f
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oIgnaTk46pBR/1LNiXicJFFRGNzj3
TLSH
T10745B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 ef0cfc44d73360112e45a43468c47c7fe569cf4c6af21fe233847af0d282491b
MD5 0a06d264f5f1a730a4dabbc64af96312
SHA1 b734e19b542ba0b5efef93f58b49c3f2de5953ac
SHA512 7feb8ca375fe4612741a901c503de07d3e0b4f345e68dda671af157bf8a9014379e4e7afd9b8706a24263efcdfec63861794583f908bb40c21150bbe6e3e9346
SSDEEP 12288:TKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F13523D2518959B1EAFD003D867A4428F5442F2C9B2619E3E1583D1EE278FEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2b204fc5ada33cb690658224c5111b0304e36a1900fc543e024efc0e85a8954b
MD5 0977ad7cca051016c38f9f7119d77203
SHA1 2b8e6aec5198827dbbef8956c5ce77011242e55f
SHA512 4b90cc88234f8bc8260bcc03b2c0c2a2b6b0d150da236fbd285a09f0b70df3ae17956843aefcdee15986f97fbe942a673a91e42ed366d3ac9aac13365f011619
SSDEEP 24576:IFL3UTf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IFL3UjLNiXicJFFRGNzj3
TLSH
T197650155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 e72c13d7c237fbb7723b068ebdfd2673022e62da7b798cd9c869a9652e8f0eb8
MD5 c4e4675fba065e56e26fae038844fda6
SHA1 fe606788ff1883e3f7c5bf76a835b16453cb01cd
SHA512 4d1ed4d99f7d2a477ace1a1aa009d25461b378285a51306e79dcaaff1d7aa112cbefe6b615e45a68246a4388327be31ed27a4576961bd5b30669c2a8eac0b5eb
SSDEEP 24576:YOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YODLNiXicJFFRGNzj3
TLSH
T1B945125A32DC10F4E5B9503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2d7e0b20bdec67eac8eb916d624314bba943430bb48a726601b021ab1a0eef17
MD5 4c7d103d1443a4505c925929b05ca61e
SHA1 78cd47b58a140bcc5365204a8a3fe662d168d4f7
SHA512 7b6de4d7d54281c38ae7ecc23756fdc2f8c5db221643854272668b5b2e2e36330b8fabf4d3cf64b76efeec7fe1b8256f229dcb0608d291c18e1d79116ff9b0e3
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhso/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M7cBWMpPjN8DbEhtLNiXicJFFRGNzj3
TLSH
T1D465AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5a7ff157fd21a2203a7b6acf7956189dc7ef6cc2e627ac06d76e861d42cee7f8
MD5 842bb7fed140f6a614730eba2b1ff0fc
SHA1 1076aa19581879eae89f8935ede4e2a22a6c4232
SHA512 efb66a4ebc56e5e463f9a70e5c8a06969dae04d5b0f9be833d50f360d7cef755db6ba272e53b8d954bbe0474219d0c2a33b10cef1db4a0331ce7d4aadcd433dd
SSDEEP 49152:0F2YuHNETovAvNYf8kmILNiXicJFFRGNzj3:B6BCf8kD7wRGpj3
TLSH
T12D858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 43880eda1e367f0f7c2a1c421fa38add3511be94adaec31d5e2af9a060ba43a7
MD5 43850c30290e1bbca9ae6e7d95ff87f4
SHA1 8aa00f64b922815710294869322b76998c997736
SHA512 464f5e0632e9cd7b489d5e7cde5be0afee9f1f0eb41d79986b2588dd45572b3b2e121c42b015dcdfaf9c64da9c0ba9802714707e55f58f351bdd5d0e5440b5d0
SSDEEP 24576:3AFs06+Omlf8NXEbToX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QFs060loXuCLNiXicJFFRGNzj3
TLSH
T1B565BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 427731b9b0e9ce0aaa1138ebe7f32c9a13f8a13a40aeb762ff5b2e614aa5fdae
MD5 24523233fd1f06de944c9190d06aabc5
SHA1 d48b2d029c9e06407075aabe468fb77eaf3ec45c
SHA512 8f6d176d4c1d1a55b24b74e904e7e9e32b09fe11776637cc57d93debb6b95c6dfe680e9a57a423d4bbb26309338fc0136396bf925be54b57500ecd10ead1b028
SSDEEP 24576:RJnJ5D3WkC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RJnJ5DGkCLNiXicJFFRGNzj3
TLSH
T16265D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b70c025181b85cbd7227b6c47c4865908b0fe4b51c07da24045fb560851442b3
MD5 4c9818532d92754ec885d37084e94c05
SHA1 c84453bb9436cdafe3549c05d4a54b4a627fbc6f
SHA512 111a97ccafc505d4de5450f7f41ed7050397c455a9c2f64e4663df0345c8147c6c6fd8869beae268e796a0b424329c229a01b63bc67112a069d97c6cc34ea1a1
SSDEEP 49152:bg06DIKdwc+eQnSt65aVkLNiXicJFFRGNzj3:UO7wRGpj3
TLSH
T1D0956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 088ad348db4951f470c772e2352917a7eafaecb9e3d4bc45236f5fd6c17133d5
MD5 2eed50a1d90b3eb186a0cdfa7bf09538
SHA1 e59751cf1b142e0c3fc7fa58d44718438212bb9f
SHA512 88caa5ac8c4f75c0dc2b7ca26907d1bb67b07fbcc097a7ef86a2f904b3c8acc675459d5398a7a79fa3eccde3e8733d872a536c6a0ba630e7d935d84f8d01bdb9
SSDEEP 24576:44G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:44GLNiXicJFFRGNzj3
TLSH
T1574512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 0df236a42aa3a52b6014cfa856d68986860a93a425e59082eed491f8395312d9
MD5 0ce33bb9e8eccbac85476d3ab1e63cf3
SHA1 926cf6e17489aaf664bd9879a29025826c0c2b34
SHA512 bd2360c1cd7949ddfc3e31d44be4e308d29b71a21b50c06f34775705c28de95d44663f28a78b9f9f79e528b0512932707837edbe560c7a37c936993809f8d5e1
SSDEEP 24576:HIyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HIyLNiXicJFFRGNzj3
TLSH
T1BA551245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 26de07d274d2a7591e12283b686475b8172e2c529176c9cbca92cfe6f8fff167
MD5 2833ee3f6ae496bcb600d74773d23e26
SHA1 6b8a625840459f9add6e85cef117e0312a86993e
SHA512 ac7a26099b982d1f7585c14008617585f82cf0b0f31bc0c3da3b8ee1041fa5e78c165cc5edc080eeb3f15bbcc7af94be76b923c018937f42303bd35b5c54c6d2
SSDEEP 12288:vKniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D235239A118964B1FABD003D86364824F1543E3C9B1628F7A1947A3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ddd59130682a35917c789fe92bb124f836e6eba925eca9e23581ea473b1aa8ba
MD5 a997b0566bd70f5a7e6792539314b5b7
SHA1 62c668bc33425a6942ea5f5775d023d3d4f61357
SHA512 1c3a8b0ee4bcbf870a7346d04559e1ad0e696b61fc7fb79c3c721d065d7217f143b6d0e40a2324764a7ad290fcd0bbcf4ed985eb3d1f10397eda06ca8386e013
SSDEEP 24576:HQ9MxZKdcz9dw3A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HVKZALNiXicJFFRGNzj3
TLSH
T168558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 240230f4f081c283835faf78cd801f3e1136a3dc7c6b46f3ec29d2e026986e90
MD5 fbd431b89b741c6b9a23fe9b7356def7
SHA1 4bd1e8e2e1796315fe5cbf40b177fa3c73709c5b
SHA512 e9a261d1b16608c245c9f71a571b09f1f1b0a72d2c12c8eefa2cb11a9b36993a8cfe79cd87941529ff17e185d33db1fbc6accf575204a30504b926532a440433
SSDEEP 24576:CyocUApB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/ocUApBLNiXicJFFRGNzj3
TLSH
T1F755E05FB76D40A2E176813C89858204E773B4345B6257CB6191C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 637a02f6813a6cb38ea051c32cb0370c30ea884b8a770182a3a8d96abafd2921
MD5 5bad19305244fdead20b52bdc155a8a2
SHA1 1f568543e49e047eb70bbe5c614830ac28ce3a77
SHA512 21106f735f1c5af1281dca30b0eddc8fa4d1b12b62a1c84ffbd346545ea8f63b203a95d9ca346478108ce0eb06c24577f36fe5bb639d304a59fc1daf616acb57
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKBLNiXicJFFRGNzj3:s0zuNIf7wRGpj3
TLSH
T196A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b3e015b632878ecda67af94cdc4a4f0416ec5af725b7e1bb644debf58e40f3df
MD5 06647609c1185826d12e41fb08ba3a01
SHA1 957566746e0146ecebfc7b0ed4d023fb7d2d6404
SHA512 9f0b1627ed69ca43e14afe604fbf64754281e12065e5d5bacc98b27d88f8d20f77a243d8a8d9a04de1b5340691b9c509759cec46991e0c5a3d39590c6750c627
SSDEEP 24576:Q1QT7EcpfxR+N5AWAz3ooiYzjMqbG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tTDxR+N5YzTBjMjLNiXicJFFRGNzj3
TLSH
T14355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 c0f9d4c118e405e25125caaf6c1d77bb4c1b5e0dc60c34e37e4f6e0bacc8bfee
MD5 7f73af202015ddd308641cd2f668f585
SHA1 e80e544d288fd7926cec910bb16094020493eaaa
SHA512 7024f5083aacd6e250642ebb05eff6321159d697d48f2b598c31faf3041c2278417e17b383a88cd491b49e7e3d3dec4237cbda58612756f72256309762a12b48
SSDEEP 24576:1TMdOz0FFS+PmSLa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v0K+PmSLaLNiXicJFFRGNzj3
TLSH
T16365E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 7eafc051f116be57cea143390490a7c408727cc747b68e51c09f893f0b46a66e
MD5 f8e3f85dce4030f16944c224525f2013
SHA1 406ba52f75a403726256b45705d8b6d8de7e7ef3
SHA512 906130f94fa8aabfac0185cdbb07148f3b6064fc413fedd6cc38e7473017afc00cde30e12a40f1e46fa897114865c01db4ac420d8b86e56fd0b761828845d1a2
SSDEEP 12288:D49LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:If/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C45125A13D830E0F5BA51398A364014E660BC3957251AFF71D0E97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-12-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/532-333-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/568-289-0x0000000140000000-0x000000014011E000-memory.dmp

Download

memory/592-302-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1172-25-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1172-24-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1172-16-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1172-335-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1228-397-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-367-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-398-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-400-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-399-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-395-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-396-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-394-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-393-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-392-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-368-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-370-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-376-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-377-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-360-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-361-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-362-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-365-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-364-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-363-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-366-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-369-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-372-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-371-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-374-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-375-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-373-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-378-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-381-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-380-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-379-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-390-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-391-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-389-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-388-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-387-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-386-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-385-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-384-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-383-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1228-382-0x00000251677F0000-0x0000025167800000-memory.dmp

Download

memory/1376-290-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1376-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1780-291-0x0000000140000000-0x000000014011F000-memory.dmp

Download

memory/1804-61-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1804-55-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1804-68-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/1804-64-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/1804-66-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1808-115-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1808-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1808-121-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2360-303-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2788-139-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2844-70-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/2844-355-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/3196-305-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3196-357-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3196-158-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3196-174-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3196-191-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3196-350-0x000000000C9D0000-0x000000000C9D8000-memory.dmp

Download

memory/3292-299-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3432-352-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-34-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3432-40-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3704-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3704-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3704-354-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3704-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3736-82-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/3736-8-0x0000000002170000-0x00000000021D6000-memory.dmp

Download

memory/3736-0-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/3736-1-0x0000000002170000-0x00000000021D6000-memory.dmp

Download

memory/3768-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3768-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3768-356-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/3768-84-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/4224-300-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4280-308-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4280-92-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4280-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4484-288-0x0000000000400000-0x0000000000520000-memory.dmp

Download

memory/4484-96-0x00000000005A0000-0x0000000000606000-memory.dmp

Download

memory/4484-101-0x00000000005A0000-0x0000000000606000-memory.dmp

Download

memory/4644-304-0x0000000140000000-0x000000014014F000-memory.dmp

Download

memory/4828-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4828-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5116-132-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5116-293-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/5116-126-0x0000000000910000-0x0000000000970000-memory.dmp

Download