3aa52b61701b8cc56be10b0eb359e5eecf6842650b97ba82448b6c81c7e82124

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260809-pn76sseq6w
SHA256 3aa52b61701b8cc56be10b0eb359e5eecf6842650b97ba82448b6c81c7e82124
MD5 9cdb64c6b9945b7a8692777314fc80cf
SHA1 c19ad978bf2346bd91c90a409fe9291afa664f1c
SHA512 18b63237c652512da0cd3c8998c3f0333e1564ee59cae20f19c4ca925aebca2d756aade9620ad694323bec007410e1e01d9c9909ded679687b9c5bb045ad3a78
SSDEEP 24576:55GtI/4EX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vGC/4EXvYMLprznyDSga9
TLSH
T1DB75021072D084B3EA73153049F09A61697EFE700F248AEF63D1176E5EB86E29C39327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3972	alg.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
4540	fxssvc.exe
4928	elevation_service.exe
1776	elevation_service.exe
3840	maintenanceservice.exe
228	msdtc.exe
1536	OSE.EXE
3932	PerceptionSimulationService.exe
3988	perfhost.exe
1960	locator.exe
2364	SensorDataService.exe
2304	snmptrap.exe
4464	spectrum.exe
4912	ssh-agent.exe
3380	TieringEngineService.exe
1912	AgentService.exe
4988	vds.exe
2060	vssvc.exe
2632	wbengine.exe
3712	WmiApSrv.exe
4220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a0ce74a3a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a6601cbfa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000340b83cafa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000053b57cbfa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0c803cbfa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d54eecafa27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e92ce7cafa27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee2925cbfa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb52b3ccfa27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe
3396	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4540	fxssvc.exe
Token: SeRestorePrivilege	3380	TieringEngineService.exe
Token: SeManageVolumePrivilege	3380	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1912	AgentService.exe
Token: SeBackupPrivilege	2060	vssvc.exe
Token: SeRestorePrivilege	2060	vssvc.exe
Token: SeAuditPrivilege	2060	vssvc.exe
Token: SeBackupPrivilege	2632	wbengine.exe
Token: SeRestorePrivilege	2632	wbengine.exe
Token: SeSecurityPrivilege	2632	wbengine.exe
Token: 33	4220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4220	SearchIndexer.exe
Token: SeDebugPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4516	2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3396	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4616	4220	SearchIndexer.exe	111
PID 4220 wrote to memory of 4424	4220	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9cdb64c6b9945b7a8692777314fc80cf_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4684

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1776

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:228

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3988

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2364

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4464

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3960

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8b552bc8b3e3cd71fd55bdec04482ab207ea2cd7067927cbebbb14dc9a048527
MD5 92509692ffc61051b49cd376be10a994
SHA1 fa2360b70e7116308d26db1f54a49ed1f5f36c78
SHA512 a24dca4e0dfc10e408cc14198791fe9012022fd1234ec4dc609dec341f72127cf8ea5b19673411f005130290eaf23e819e7f805f2a8caf53469169a5320740a9
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsXvYMLprznyDSga9:z3q6HjBBXvYCp3nyG
TLSH
T12ED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 561e219d130ab1bf62d4bbc6e50608385ac95c3c4d51a74c5176ad91461968de
MD5 07d0a2ad6ed85ca8e02db98661a1a708
SHA1 e6b2ae70e302e114f9ad04f11bae2601c8f63f3f
SHA512 0aeb89324a095b1d22df6a904409938e8e91d9d13d8f4d948e416961f14643f873ff13c9db2a68ed2d51e82b67b7e0cfd33aeb391ec0389a3b99058bac0a6361
SSDEEP 24576:gXYfDtczAdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:XtcOXvYMLprznyDSga9
TLSH
T1A2850128B3A408F9ED27813DCCB28405EA3378954764EB9B03E0996A5F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 05948f8e5420d2639c31a2c9a1373fddd61406185a0726de3052ee7bc7374d7f
MD5 23be787261b53fa56a22bcf5fa1742a6
SHA1 1234c90a0f050ed08df4ad2153a36e3f6b6ca6be
SHA512 03c405ea1ff0eae9c8b51ccca0f91a9d444d13c9081e20ddf15f276496ff57e993e983e61a8d598e2f7eb63c9bb3f037a7e09b294758b954e65c947d6541f913
SSDEEP 24576:20Le5ji0hmxirMEX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:2Pji0AcbXvYMLprznyDSga9
TLSH
T107959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d4ebef1efad84b1c6e2e610622b9609573dc801aabda4c406253fca9a9d714d
MD5 b28a30128efc0080caafc8b3f4321851
SHA1 04c41540157792675e89204998f3921490875600
SHA512 43d76c835eee348c1b2de5aaf7e5f2ddb9572304957922eb03a959953c73ed576c5cdb5acde7e8a5622dd3cd7c45d7598388b27f151161acd5aed04aa386a7a6
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyu+X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:6/ezSC6vUzPvxHjyHXvYMLprznyDSga9
TLSH
T167756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a52417ab8d9bbe8f4a8705e0646807808df434c6808cdb1e4b75a0b83799305e
MD5 1c343b1d61a0a7d441c5eaff8c96f40f
SHA1 e610d2dc643577349943bef69192183f4d8ecd03
SHA512 4fb2fdba66381354baf4d3027af693ba2c2f407c6eb702c901841b71c4b04dcb6f4e8cc3312d8d5e77965f89ed2d8cf303080041aec4a6479ff84886d4013bb8
SSDEEP 24576:zVbqPb88hv/l+6xX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:zVO88hXl+wXvYMLprznyDSga9
TLSH
T110559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7493fc5333e30afe39cfb379b8633b5b6e89100dc21198057d3b18403938c029
MD5 fbe3e58eeb4ceb37dded0518ad05e41a
SHA1 df3f73ed296f8dc6e96b20f5cf4d30f9bc5e977b
SHA512 c2d9de7e3d3037b635446072fc63968c3db69f18ef826bd5eb2a0bdee0a16eb319d243c1375411b64d792f7af53fc14a0a24ad32a463ab1a0fccc2a251174431
SSDEEP 24576:0R4X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:xXvYMLprznyDSga9
TLSH
T105652314A63C69F7FF2B14364CF5480DA86F2EC44409AE2743D2BADE94FED39E446126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 da8a5e3847865f79eb093b345d82dd1c8ce1f6b7eba31a3a7c27131e232972dd
MD5 6f2465c54913c00015aabab5f2440065
SHA1 420040dcf01ab0bb79be79588ae04ab09f37b06a
SHA512 4696d53c967632f48c95c81e885dc8a2ca54235ec0299aeb508a3bbc9987e77471290f23d441535b399170cce3150e003c6a08850b18f6edf285993f5edc5bd5
SSDEEP 24576:CJIUJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:CJIUJXvYMLprznyDSga9
TLSH
T1F185CF3BEE38FCE2C67E4C795A918600E77278704B12A3CBD165820EDE275E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e472b73e244851020bbc3f1795b7e75ee9118da4b2734dffcad18300351699c3
MD5 406e01978d5f3c7b3a9d6f3f02b0d8fe
SHA1 39e915526b4f38d09cc4893e972070dd7d73a55b
SHA512 aeb53bceb7bacd0dcbe2fe3307a24040f7abd0c38a76a40027a1d55b816824bd44d7ce6663b7407b71a586e99eacfafdc35455b9af49b3a201a9bf05caa7ae78
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:YQvGAdlCEL8c/yRNw5CuXvYCp3nyG
TLSH
T1E8267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1a123cce2ae58c53d7109cea3356ad888b3ba9c2dac6d01cc9c3b04f07916a05
MD5 ddd9c0b29867f0f8b79463ee640b232f
SHA1 4b43cd13b1b6565c40f353331598eea4efc5f1c7
SHA512 dd735b781f8abc96bef6d4a1c94974e87b000887cc88a103c4d04091ecc146bc881cd6122b16fdea5218f5488eab05f488e9bd7e23f7f94669e23029d562d056
SSDEEP 24576:2dewsAjLX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:+ljLXvYMLprznyDSga9
TLSH
T14B85E030FE74E436C77B0CB21B76C70A586D7A604B511AC3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a9c12a53c2c0c999fbecc326460401d37d70b0944f573ab908e481da95f4dcd6
MD5 37ac88f4fd32b53dbd62dcef80e90b68
SHA1 c4a650ecb53d4ae69afd49970a80eca105be8652
SHA512 d68d5969c83b528b827be53e1468083820c76cb1a31f763a7076f50b8fecfd8a4f15a27be3076f92bfa8b8f158baa35b3b6eda6e0b6c79099438c145497f69ef
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTTp3n:pUEtQevvqc2W1cpV2EI32fh
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dcbc2588dc1f3eb79f22428454a2bfb705b0d133890ccbdb3efc9f2b889acb5e
MD5 a86e31b657b9d547aa30367c6235e024
SHA1 77a1ae965b8e08854b7829f8d68df3dbc47f0711
SHA512 c6811996bfef12209dcb2a073c46074bc986e666f6cda0986cf256ba3f93543e4ffb1b8e5e8eb92a5d832dae9637ef760a899febdf943d9b84c528efac732a57
SSDEEP 49152:nCbRquA/m2yL5zLfFiV+XenmE3/zrXvYMLprznyDSga9:woq2Vjnm6XvYCp3nyG
TLSH
T1C1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 30631c1593c5ddfc3e4a62b550ddad0b6941ed459ebe2d781408b6b43efb153d
MD5 ecae779792d94ff197bf1ecfab52429e
SHA1 a1df5bfb002129103ac4b87f8b7a7ed4d2bcecd2
SHA512 8bcb1b69e8b0a13b48d07a93abc14950f7eea7416a243b434747f00c882236dcd75f8b5f3a59fecd7b822c5b69dcba8745d9364e70d8382251f61cd818b074e0
SSDEEP 24576:yAhGLJIFoiwtA5l7S53aX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:yAMyFoiq5qXvYMLprznyDSga9
TLSH
T176359D80E7F955D4F5B3AA7899B68170EA76BCA65E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 93a667ebc39365a8759b254274979a492bbbb435e94a61e5cd5cf5af35b59724
MD5 b32bce64d80afa42bb75e35331655c89
SHA1 827bc8233e2a4b3f115333f2c3608e01ddf30bf3
SHA512 7463f7f3b640f0534c0699009f0c74876a207ecf0e4dd7dde272ddf5a1b8c0b3eeef5753f1e30a5d69b60f1312c3e4e62c4a1ee942117c68acc7f9cea010a645
SSDEEP 24576:MwuoOWnX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:MwDOWXvYMLprznyDSga9
TLSH
T1F485F10576A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 19946e14f5fe1adccc983bbf2146d6d8b80231645798488520789532d55411b7
MD5 2b755e377a2a805eae7dee8d44d08a95
SHA1 7811207ff1d0c9ddc5b8c9804b6a0f177a60731a
SHA512 edbd11aba8c229f6b2f6307e2f5c8b7f7bde847e1018e793c7f7d8c16e7782b7e2cde29a2848183eedf964a065826651ccb4eedc3759ae6f910b3bf46b2ba934
SSDEEP 24576:OZucX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:gXvYMLprznyDSga9
TLSH
T14D75121932B830FAE667513DCCF14509E7767492173683CF026146AA5F7BEE56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2bfb45cadee80e93646758f6e23767ebe26e8fa6974d4f42467375b09cae8d2c
MD5 5cbce9297b2aa7c8e7697da546725f22
SHA1 357fedc1b31c00e19f04a26df81ed40692cbfa8e
SHA512 f2814a1823e6437f6c8a1e37e38aa37e82bace3f54c24c89cea45a446642fa28221785e04a64b7f089e6f96b83e411a9c387ce2d904ad335a01e930a2889dada
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN3VXvYCp3nyG:VQyiKayX+PNlTp3n
TLSH
T1C0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f580d97a9fd6ac4845063f975f9318d4aa015c74b2141999f9d15afe03d081f5
MD5 049f78ac983ed29b155219ece4e5e867
SHA1 b62190886e2c798cb30669393c5c4709f48e2c85
SHA512 6672b953d76a30f4440b306a2ac4d61038fabf75418df354d7ecac3d883074a03e5c858a9dd82f5d4620cc424b0236d366a80352eb1e3aa61b368e01ce600f57
SSDEEP 98304:YQRQyi36YOcPQLvw2gAf+PN3VXvYCp3nyG:PQyiKayX+PNlTp3n
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 abef83d7e6a5ce27f9629ae7d28bda922bb5f6153fe3438c409c07633d1df8d0
MD5 87fe7d17ced9f1616d1447cb886c916a
SHA1 1b9c141d32b75ff78c3ec611178c3c59e83c336e
SHA512 0898d33bdfdc5b5e08975eeab27829b07786ce608f613b5d30887b5382c2a67ab7604c436491426faa3c2eb2a147b2ddd2e8a3f8ece919f4ec93363b52cca0a5
SSDEEP 49152:d68Qg55nhheWu7PNU3/bXvYMLprznyDSga9:bthWRc/bXvYCp3nyG
TLSH
T141B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 92ff89eab1a158f2a859a9b8d5184502b61de3654928b0661952d5b574e3a3b3
MD5 50064aaf9b1f9aff324451ec143f0a88
SHA1 96dabf3802611a32b5d2d72dbe92b47f58f116ba
SHA512 69d9740ce0d1062b265fb68b833f2caff383555178124f51d4cf5c61bee1238cb411ca6be434f09e02a2271a76f12194a61996b78377c750efeb5c42481fdc89
SSDEEP 98304:Ny5112gYy5azzVvL69nLKnhZ4XvYCp3nyG:wLIHmWhiTp3n
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 634573c976d40db4f867b85c098cb0816f4f5ac1a0f314a17a721540e3a910f5
MD5 74efa77f97b3222e7987da22353942f5
SHA1 0634e7c5c58d7d5ebc0ea27e1841c6ae966110de
SHA512 cc3ef45eca406f70e6ae1f4eb4fc761a6bf896ca203ede36cbab124cdcf9e5139f315cc4660a3b934dd44955b44bde929beb66e445d70ad487bb9a69097a2986
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltXvYMLprznyDSga9:eu6JmVxd2dtXvYCp3nyG
TLSH
T1ABD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 915f4f7d7a0a198cd8b0d999c946e1ef934f5c0d93a6c14ca6f5491b0de4a840
MD5 e117e355f56c9c76ef8b4b751af4c50e
SHA1 867936d752b4e93b30ab71abf5a19d8ac47d541f
SHA512 e404a376fea1af09b9053868e5c71ebda9e40dff880694ffef9004e2f51913c2bba43e326ca16e3e162c6b73c0408a4775b21ab8c8482757d47c6c34d27e7bd2
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xpXvYMLprznyDSga9:smifPbR6XvYCp3nyG
TLSH
T198B5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a5f4a3aba736f071010580cfa1c90a3ae482d7e4412d23187a5e3986d9453acc
MD5 887e0ca31052f9d8a68f1aab5e50da27
SHA1 f85f7afcf7662cab9305e5e94c69e1c1a8c5ebf5
SHA512 b90fe00d32cb31b448346ca379459fc0f5fc6c49c2d2515baf1373c02723a56f9a29c05c8f48919af6cc02337deac971301c1a063062bfafae914f5d5ec5dc38
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqcXvYMLprznyDSga9:T5dKTi61cXvYCp3nyG
TLSH
T19FC5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0788a84367804d3e8abe1bd07e58add036a49a43d140e2641493652b8c8fb978
MD5 782a5a376ed286f8c04843764d325904
SHA1 f1d4383291fa6acbd38fe395922ab96d4b710457
SHA512 bdec3bed782bdc710b6563230a9213ad6987544991ffae407fd1f9ee638de0bc0085fc7c3e3f41c2ed7836e9a6bb553d84bb5eedaddfc81d8f5da413d77910df
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5wdXvYMLprznyDSga9:HX2iyph2XvYCp3nyG
TLSH
T1E595BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a8b282913edd31da77453a5a5e14e2c8f6666f237d2f23a19599902361a046c0
MD5 f7fb670979ea20087e5165c7a33592c7
SHA1 0783238c3ff748c0def830f4ab6599d49918ab4f
SHA512 86998cd98b4d0c1c9efe02a7e682ce0d277a0ce4603062f1f2f8bda3224f6c0dd31017221485b6f44f90eb99f8635de730b790d3e7c73b029ce358fb9681004e
SSDEEP 12288:bwLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:bwX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T12D652304B43D69FBFF1654368CF0440DE86F3ACA840A5A2B53D3A59EA5FFE796446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3de9683ef23071bb3afe67c127d511b6a37a827ae7b781d04c6d411ac2ec0ce6
MD5 c0dd1033fae97f8aade82e4df17d9c18
SHA1 986b6658e118ea233071bbf9db8c1dbaad966200
SHA512 cb9a6ab740515868b7d05abdf3b9a8558639dd5a228ac2a345103d9670cd96452392bf6f28df20f2d97628de40f9e1dda64466fbe4399f93a30f897c9e468a3b
SSDEEP 12288:JvLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:JvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T11E652314B43D69FBFF1A50368CF0440DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f45ee63a09f86d5521aba10a3614997fb72d297e7d965cb611c2654bd038174c
MD5 1271f97f6bf952d88769dfef4fc0eeaa
SHA1 f6a1a3820f146eb81e0ce076f8dd42de17d8d835
SHA512 da8c1896a40241e92dedbabee50da03f5fdc14c54a2327e59c8a977d197409a2e7b3ff4307d897ebd8e768010d92428809a955288b7522a43aa849a8b3aa9324
SSDEEP 12288:pBLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:pBX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1DC652314B43D69FBFF1654368CF1440CE86F3ACA840A9A2B53D3A59EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e11573753486e463c0211db55699bb3167fb4a2fc6e7c77c013196e9e72fe03f
MD5 13353f7ee8d455440d25a11d94b7c10f
SHA1 66a96b5eef1b128c8d9f5e87f30d157cdb1daaf5
SHA512 c3f9ea128d27bb396cefcae353631d5dc98d6d87095bd6bede5f12e98f784272034505736f7de7ca7eb4e978fbaa73a2c526559dde512205f3c1cc229bf9c0f5
SSDEEP 12288:EV6LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:FX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1F6652304763D15F7FF26913ACCF14409E5BE7DC58626ABAF4382099E5EFEB786805220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 14ad948ea39859e1e86ef97dbb754d0b4379b62e7ea45fc596b6498ad016743d
MD5 2f0b12d6c0aef5e0ab5753684ada5b9f
SHA1 45124483085bcb4d5cf79f0299c54bb6035f1f4e
SHA512 cb2e814911bf5cbd2e332a49fb881bae1a87a93efe9550ae66e6ac16cb2a5b9184c9f51bd690b424465f7f6b98a98e6f0a097ef157a6b440f4af8f0072b221c1
SSDEEP 12288:rCLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:rCX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T18E652304B43D69FBFF1A54368CF1440DE86F3ACA440A9A2B53D3A59EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 096a6dadd8102a0e5235de74f2b5b8ee319f9f80d1a21f30cfbbaf4fc2e781bf
MD5 4c771a74471aa9190ac4f95574187be9
SHA1 8fc047a57dfa10ff1f5c554826fbf851a8e1babb
SHA512 debbe509ddeeccc0ab66c97f78df4c289f57575a6e5640a11dbf33d00e54f29529f3d30d12eb3e79d42f96754845f2c966eae859102514f5121d1a85c1e882af
SSDEEP 12288:4DLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:4DX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T185652314B53D69FBFF1A50368CF0440DE86F3ACA440A9A2B53D3A59FA5FFE396446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a64c5680fbccb92453f445e7520b7f9c8a6b85ec1c8ba73992276cfb92c5d04e
MD5 85ca942a296970d4f954b858f33eed11
SHA1 c1b4c5cc8dda0a98ea9b53147c20a4866b0526b0
SHA512 2b65092cc9afa5ebed4991a2906b3a6b1776821bf8a62096291d6b483a79f79c4d8047e447ca6898d730d07ca1bc0935d4cf999cea87284c38e493bc7cea4910
SSDEEP 12288:R3LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:R3X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T18A652314B53D69FBFF1650368CF0440CE86F3ACA840A9A2B53D3959EA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 d456b7e555901743191fb5a9a1aea2e2bde8c2b145393e339b006fb1011eb76d
MD5 cf0ead5cd0bc95117af8136bd4399696
SHA1 bab942383b71e608a966e2e7189e4cc83a29f751
SHA512 5edb5c7fcdfca9854a7abe7409fefe22d0b50d6d5b2a8dff5e03f6ee1bd842f646053d66a80c196d3a09b57e24711438c21fe67e290686bff69f56884ccc8827
SSDEEP 24576:LZMSzFVSOPX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:LZMSzfzXvYMLprznyDSga9
TLSH
T1F7850154B3601CF9ED67813ECC65880AD6B27C5A0B60CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 13663e3fbfff58faa3cf5029a69c256b9746646a712eb27ca8037566de623e7b
MD5 68eefa8a09234cb351160e153851936e
SHA1 f3fdc59167a199b9255e3f4289d0e6f8a3a22b42
SHA512 5dedd08deb79c2935fe8dc15077cc6ce6d163683256cd43326e69a5dc73cabaa63308543d1c2eaf071618ce4cafd09a25f014d1a2c295866ff4f65d115408366
SSDEEP 12288:IMLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:IMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T121652314B43D69FBFF1A54368CF0440CE86F3ACA440AAA2B53D3959EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 79b82dc62eff1abf2e9a28896400ffa62563103f3f1d0ea6d6c8ceae2e2192bb
MD5 9d55eec92ea07f832e2b5f89931b4df1
SHA1 96f9b0771befd565ed33c870ae057b04b39cb5c0
SHA512 01f27856960d50a8b7cda9ad216d853752793779a02755c88e9492bed7552da480f853f1905de2b6212f67e3512eaea2dbaa530854db28896ac1f1d6017580d1
SSDEEP 12288:/oLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:/oX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T188652314B43D69FBFF1650368CF0440DE86F3ACA840AAA2753D3959EA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 45355671577aefbe087877707dcb960d0ee476f4961a7eea35c38158afc338ec
MD5 c2db11bf3a547893fb44e84184dc6899
SHA1 3d8513b65a30ad15bf0dbf245a4e856a1eb6987d
SHA512 e18ecd58096a964941de5c75335abd07a640c0b6597022e71577b5065b524299f579c11ca771ea18c82cd34c87a2c72b3005b792b3bfb3374e08796334666844
SSDEEP 24576:9zy7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:92XvYMLprznyDSga9
TLSH
T129750207737530F9E6379139CCA10905F77A787647249BAF13A047BB2E7B6A06D2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 848470b2c651445e21e1aa23b6f10c07fc0b712e8cf677d9060992367eed7f38
MD5 f9b99f08cc872011cb2996129a0fbe8f
SHA1 9066aa9707ec4bb3a35ac965d3127aeca34c9626
SHA512 98946d6fee080a08954f442da5a71215bd99e4ab6fe13c4d17d1f4bbe1dd57364f558e725d1e779bd9e6471f589a482a97589c66b7fcea2d2c246d236c087654
SSDEEP 12288:WMLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:WMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C5652314B43D69FBFF1650368CF0440DE86F3ACA440AAA6753D3A59EA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bfe7779f436c8e87cfe4e22e5573f7178b6caefdf511204829d6c31ad33b73ca
MD5 681288d58b09f1ef33b4838a572af625
SHA1 7f89ed434d323ced4c174990462c83763f981a8c
SHA512 af2314974d8a122454ae6a228bb93be3bd1920ef6610f84fb384755d4aada7a86662669bf78f3ebac5c207abb4ca9a3dbb452e695089d775b9caff735c9f1a97
SSDEEP 12288:MMLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:MMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T193652314B43D69FBFF1654368CF0440DE86F3ACA440AAA2B53D3959EA9FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 6b6b8b16550b3a10eb1ffa3d036fc9d2fb79172992783bac48b44098ea7c6188
MD5 6cbaf8eeed2282fc7ced96d504202678
SHA1 ce718adb8b05ef8f3e9989274ff8f8fa93d5df4e
SHA512 896ad50425b172aa50ffb49969079ab76f616726d1b25dcb6cda910853e0492537841cc05d31c2cf3c847a1272e3de714b4f14230c872d438897724f0e28b109
SSDEEP 24576:4zy7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:42XvYMLprznyDSga9
TLSH
T152750207737530F9E6379139CCA10905F77A787647249BAF13A047BB2E7B6A06D2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 be3b5cc6632ba268eee6223b0e93aa7001e3d27bd3b21659e24857dde1a9dad1
MD5 ccb91b58121c000afc1aec512e584dac
SHA1 045db84dc9dd817dd95ed6d71c8b6bf4fa39c9ee
SHA512 5358e6343a52dae8a9f50b4ebc2f5602a5c6f7b26369babf18957d92b9a17c45ef90cd43a7ac763b929383feb0774d03dc0c00b825a83a16b4374b6110a98b56
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBUX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:CP4m4IpOO67W8KuXvYMLprznyDSga9
TLSH
T13865BE2DABDC0096D0BB913885658A49FAB1742A1F3286CF1160933D7F7BEE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 64b830288d52cc69b2ecfbc469834685a2d3ca0643959d4310d487132af305e1
MD5 157d75a7f406356569098db2963ec13e
SHA1 71be5575079bb964c8913e600759249117e36143
SHA512 2b2ab13160a6ae7d4f9946ba1520c07001e6ff583ab4642a07df81b29711a8473ab6e851c5c62b0cdc5c663c6e04f4c831bd9fac02339510e70707b906ebc968
SSDEEP 12288:3NsfcLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:0cX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T17C75F109E26812E9D52E6139CB914A05F3373C6583E1D3CB53D1F57E1FBAAA46CDA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 baf1cb5beb96184ca96512ef12e0e8a5b4118d38109222121fe74c606f2239b1
MD5 d989b2b2fb23a67968348024750f0d6c
SHA1 3d9593fbe18e29496c43f5f5cebdeaf00ea04048
SHA512 2860c6cd175f9bdc31283189734765272489a5f91a58f9f1af239e391f4dcf2fa158dc05560b734c6e5643ad047d69dd12a2ead5ee37306b44455cbb748485e7
SSDEEP 12288:B8LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAjT:B8X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1A9652314F63C6DBBFF3A64314CF1840C782F3AD44909DA5B6382669EA5FED78AC42116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 21697b98c8521e8f21e61a6d99da179b13543cc565676768e72d95c00fa401e5
MD5 c42616ed37a04fdc3f532ae0d08e6560
SHA1 c6c1ac934fe0bd4d9ba56a0b94b2cc184ce1281e
SHA512 fdc8346b81c23cbd4901125d96599b236829ce57cc10b5b123de5d0ec3fe688e58f708da5c979009a6b042c45b6b33badc6265213ba4165bb023a200ef5f611b
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQCXvYMLprznyDSga9:oa0hNYG4JwTXvYCp3nyG
TLSH
T1B185AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 324fa22986ec3052dc94e5e23413605ea7ebdf814100af69656b78aac42b199c
MD5 d7fb9be787a4fd94c65f6fd92514078a
SHA1 0482951a84fd917bdcc87487ba9f4153c19d2051
SHA512 193adc34572c3f81831b8bacfe7130800e0722531e43226dd1c5298145bd7963b932237f0e8f171f8133bce5ffe5c53991399d020d74b85a2409a43d9ff9496f
SSDEEP 24576:6hbHjP/X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:6hbHj3XvYMLprznyDSga9
TLSH
T12775023D26BC20E9F632A17D88A1450AD736B865071193EF13D282BE4F7BEE85C35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b7cc28d9742f7caafe6263d38aab2d62044c2bfd54db8875e3fe7b8e924d1524
MD5 2fecc139869b18556acd6793b766ff76
SHA1 10246bb9876659c9c9b46e66c489fdad79b6d219
SHA512 200db62aa837bf45c7bc15ac17844aa2eda753bf9a1ec86fdcc30f1d93b6ef8f24fe8e58f9225d3f0f3742b5bc3f74b8e7e527986931323e5494aed0cee3209f
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/nX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:fIgnaTk46pBR/nXvYMLprznyDSga9
TLSH
T14B45BF2DF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 405bbd1e36ffefdc73811c498adcba1a77266ae673be69f713f10dcbdadbe11c
MD5 7aab72c05840b769df6f0c6dbaa97601
SHA1 823188881426dc0887b26b1eb81a3d919906fa2f
SHA512 c38a7155893bf4df898bcea96ba798e15855f80e215a14c8fbc016dc8c866f15e055c7ca730347238c9d2f0a2b62dda9effaaa9344b7b8ad43e11009ad485c36
SSDEEP 12288:rYLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:rYX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T198652304B13D69FBFF2A543A4CF1440CA85E3BC4070A5AE712D3A59EA6FFEF96856110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3cb73c24e326a67e4d6ace620ab340d5d85b7fd2d308c05744de5333f268d133
MD5 f0d8d4294da14de709610e4822ac807e
SHA1 d83311843c5ecb09860a6151f6dd79e7bb5cf3e0
SHA512 3775f77f3fae1083d0386f9fd7f017e8f8d5e0e0f0d8443322792061ebe930e2d4f9af4b34cc239965d4395b92a488cf0db6133af99d45e9835ca306d9a3a431
SSDEEP 24576:fpL3UTdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:fpL3UJXvYMLprznyDSga9
TLSH
T1C395F114F7A804F9ED2B913CC8B28916E672749D0724E7DF03A94A6A1F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b8ec270bbf12d7bad8a49f08cad3e4519f220821176c4876589d40be57424ca0
MD5 fe55d994021834199183c8f1353d3d73
SHA1 991fd7279f4058f42a66e9b91e5526ea419d8b4b
SHA512 1622605ade78625b5d220563462fe74fb8524631c65eef473b544bc6be59a335969361ecdeeb5314f9add05afc4a18367c4abc9e9bf2d6d907187da2caf35ab9
SSDEEP 24576:SOpX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:SOpXvYMLprznyDSga9
TLSH
T1CE75021936BC20F5E636A13D8992420DD77678A5071257EF02D081BE5FBBFF86C3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a88531f4aa9bed4eb64b8bfc88554a6cb0257a5db5e089736395125b4262f92d
MD5 ef09b6fa214aa308e835ed606fea3ec4
SHA1 a83505ca13ca3072de3b4167924c7c1f69486d68
SHA512 ea50ebdd2dedb2f4b296c51625ed8a781cb85551f21dd2b9d02bcd12802ccf7cbd24183a3f3d6aa2b1bc5a0f3c509667f6ee20c366983aba4e08d1efdc2aeb04
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:p7cBWMpPjN8DbEhfXvYMLprznyDSga9
TLSH
T1C865AE2E6BAC81E5D577D13DC9E28205F6B2B4611B318ACB1162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2bdd7e8450dba447fbc7018537b7f154312e2de24beec534da2fa63c5c82e1d1
MD5 959fb0ded273cd4b7c7da05014fe6e8d
SHA1 3ef01082561cba02038d66ab83638a520fd52b3c
SHA512 8ebb56c4cc82900a31a8297249dc28e0d12e1dd6bc8f23ea282c950b57ac0a07009c9f0b9a7e237d6c54959bef8782f16f2a4b97ce0d12fc84a6aeb9a4d72c6b
SSDEEP 49152:YF2YuHNETovAvNYf8kmsXvYMLprznyDSga9:d6BCf8kpXvYCp3nyG
TLSH
T1AC857D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF45D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2ed4af943415b25a88f14242f5d4cd3cec9fab2b48c13bd469c46b547dc64db1
MD5 d6494646710da891ca3dffa64d131fc3
SHA1 f8788ef8c28b56745dfe026f19609913567b14ec
SHA512 bf4e014d27bc679352ab5d6a3fa6e0bc2c38413cf0afb2738927af440546fcf9a2bb2ac29122ec5bd3c78a7731590fe86533850962e8c5ca108a10672c6d6244
SSDEEP 24576:mAFs06+Omlf3NXEbTo1X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:PFs060lVXuiXvYMLprznyDSga9
TLSH
T10065AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 e0aa2bf8fc02647491727657317a87753ce720c43b860bb9a4dc810c8367f8db
MD5 0f244c4fbef58fd22e5d0c5d959ee709
SHA1 e358ea3be827fbd410f3955d7c53418da8f2bda1
SHA512 2507cc885e558b98cc55eb3780a5309563d6c1a3eb5a14a69592b2f07020748ffa6c21a72f238f49ffe9cdf419aa35e9c87fcf618a391b83173761ce76c52022
SSDEEP 24576:vJnJ5D3WXiX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vJnJ5DGXiXvYMLprznyDSga9
TLSH
T1EF85D02CD2A810F8E477C274819A1B46FE72387D2F226AC724B4D5357F16EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3ebe9e7a35725dd5c120b405c30c6a904a1692b6059138956a40e213524fbef8
MD5 e22c3f0f5bcd4efed96c096b38c3b559
SHA1 4515a51d667d0fd213f8da0b553299e3883fad24
SHA512 57d25cd2ce5d1bb1d5af9b5bcb0de81f594d0f117a0b619b6453625cd11d5e9e4d060158c0401afb0eaeb5cf718914422a1e8355819b2ba7d1378efb71615fee
SSDEEP 49152:qg06DIKdwc+eQnSt65aVwXvYMLprznyDSga9:DmXvYCp3nyG
TLSH
T156956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D835B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 57a06f541f54b80de1c2d3c8535e6cfe249cfa79505d3631a037b6d4d4f733c6
MD5 56c25b850385dde5a95b365237f5d4ae
SHA1 19dc56927c790b0407f499f3260d083a8328db24
SHA512 b7ed03628cd769e6b5434481b2fc21e89bb00c6c9694aa023e1aa0757ee91811083e366262a8e425b6a349a28736d7bd854897d6ab24ee39963a2107cfb40dd5
SSDEEP 24576:tneX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:tneXvYMLprznyDSga9
TLSH
T1F875021D776C70EAE626903D88E18509D376F0A51B1267EF12D2C27E4E7BEF92C39610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 e8f46e5f3d305e19bc37cb26aa494a037eb759fe5ff4f8c00700d141e888f36d
MD5 bff108d059f278f1d49eaddd1f86e0ed
SHA1 b1c21cdd2094154548d7f4961f2cc66c81cc71bc
SHA512 6466e36e3620a7dcfdde9c85dc8dda503e7e3476b828314f00cbe925c8aefa9aeb132f8656c6d1c3b9bb47336c1ef6520c55c9dddbade420f84b726c7e4e5b89
SSDEEP 24576:XIyvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:XIyXvYMLprznyDSga9
TLSH
T12A751204736864E5EB3A01398DB28148993ABC604F1597EF52D1E63FAE7BFE4AC31711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 ac40407013905e283a7b5e4947673899c02a862b9cbec544b29c67d0c0867036
MD5 89537e57fa4bb047384f6956dab605ef
SHA1 f195a62db93b10922205b67c6b96d9d0e383be1c
SHA512 f20c662b03af07edff055661d7e446d4976ea2a3182bf1e04761fbaee02c90d81a3d4f97c2f4accd14e5ca55e057b39a47257c7e939f582810798d7ebf7adc38
SSDEEP 12288:EyZLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:RZX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1ED652318713D79FBFF26503A4CF14808A46E36A407096AFF12D2E5BEDAFFDA96456100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2640f83051ce2d68dd81eb09838fdfe97488d336a4556076008ab7069e6dcfe9
MD5 2fb7d07e5240a8090f442f882f65d4a7
SHA1 3107a15bae5b8eed8f7acb6e3b07e6114b71a3b7
SHA512 86ce490696377955ef74ace1456ca54694c7814a89db66c75d5f59b4913af7b69072788f96ac156799df89c1c75d84801ec28905c41a26c19d9e1088c85a4dea
SSDEEP 24576:XQ9MxZKdcz9dw3kX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:XVKZkXvYMLprznyDSga9
TLSH
T1A7557C2DABF9059AE177D23594A250C3A633B4311B35D6CF2448D03D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 4983fd676fe170099e259e072e970f14d648d45beed4f5812b8cec1c02471591
MD5 8027887ddca29815021c3d42e96a7cea
SHA1 1acd49cac5e7761968e384b7c8f3f516b360a29d
SHA512 b565c101387e2d9ada6aab7758cb6a479ad25a9bf1bf90cd92c00c459a7366433cff04ebe6d7c2000478dd130146e312e930b148daa92e8f7001774cae73c285
SSDEEP 24576:3yocDApLX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:CocDApLXvYMLprznyDSga9
TLSH
T14E85E01FBB6D40E2E136813C88958649E773B0705B2257DB5292C33E8E77AE9BC35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f1f068379b84ee99312b9fa8f47c6db790e87e8608e7d6a39679fb09bbf16805
MD5 c2e2ae36d5f3e3db08935c7bb3225e96
SHA1 fdaf1cde92e502b46eda715f2bc43940fc6b5e93
SHA512 8b54beeb024602d2bef06e80a1294844be4448dd31deea50fcf8fef6c22bbc0f84414d4198c106b99a21ff6f189c93568d5e284b156d39ad57819ec9a21b7502
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKLXvYMLprznyDSga9:T0zuNIdXvYCp3nyG
TLSH
T19DA57B3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2816f6d064187b2bc38594866e5cbd94363ab4e0bf2ad184d55bd94a9f805534
MD5 363b7e11252312966e58f63e36ed1832
SHA1 418a95d0c383eba70a3bdc2c56bc89bad8e242ce
SHA512 64c85c748772c5a51de15c76fd921e64b94bb766d768d7d21777889fe9623a0fe6072446837d76df7a31d022af2d006fcde008aff520d29ea022ad184ae75dc1
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqbeX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:gTDxR+N5YzTfjMJXvYMLprznyDSga9
TLSH
T1A655B02EA7F815E9D17EC5798A23C506FA727861033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 48da0b94c5a62ea8f365dd47610d4d310e497a3037eac2f90fc3b2c1a0a69c4a
MD5 7c0221336e229cd495897bf563b0cc5b
SHA1 7e0f6a06989883a603bf270fdd6291709327eb03
SHA512 79f3d119f55ce0e51a05e0686c63a4344dfa97e986ff72459ccc164eb1159b81bf62641648aea181a7b645325f51643db8359efc218b2782fae79a3fad69054a
SSDEEP 24576:nTMdOz0FFS+imSL6X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:V0K+imSL6XvYMLprznyDSga9
TLSH
T1CE85E13EA36D14F5E53BC17D9A538906E57234610322A6DB06D0C1BD2FABFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 0bbf8f637a29c9217cc3f0f1f22adc2f49d5d710a23aa6250d2b88114dd809a5
MD5 cbe2f660be9b30c590eb5f94ab3de7c0
SHA1 cee0d4e9e0daff91de1fc09b0d1512911cb15d66
SHA512 de33d4ec725bdf7fb5a154a11b5e57904ad8cbdec9105ef34ebab102a050bf24612ae24705148793195b623cd015117d68ed2937051f2c028f526f2709a0e6b7
SSDEEP 12288:24KdLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:EdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T10E75120C63FC34E5FA3291398DB241099575B8A503156AFF22D1C5BE8F7BEE8A835712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-70-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/228-146-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1536-149-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1536-80-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1536-74-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1536-83-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1776-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1776-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1776-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1776-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1912-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1960-112-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1960-273-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/2060-173-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2304-120-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/2304-330-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/2364-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2364-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2364-309-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2632-174-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3380-148-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3380-364-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3396-24-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/3396-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3396-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3396-100-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/3712-175-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/3840-63-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3840-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3840-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3840-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3840-68-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3932-86-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3932-92-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3932-94-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3932-164-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3972-99-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3972-12-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3988-107-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3988-102-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/3988-247-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3988-108-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/4220-365-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4220-361-0x000000000C8F0000-0x000000000C8F8000-memory.dmp

Download

memory/4220-178-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4220-211-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4220-194-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4220-176-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4424-403-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-376-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-392-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-391-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-390-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-389-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-388-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-387-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-386-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-385-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-384-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-383-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-382-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-398-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-399-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-400-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-366-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-402-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-401-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-406-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-407-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-405-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-404-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-395-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-394-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-396-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-397-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-373-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-374-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-393-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-377-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-380-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-381-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-379-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-378-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-375-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-372-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-369-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-371-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-370-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-368-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4424-367-0x0000020DC1A00000-0x0000020DC1A10000-memory.dmp

Download

memory/4464-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4464-123-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4464-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4464-129-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4516-82-0x0000000000400000-0x0000000000679000-memory.dmp

Download

memory/4516-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4516-8-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4516-0-0x0000000000400000-0x0000000000679000-memory.dmp

Download

memory/4540-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4540-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4912-142-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4912-144-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4912-360-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4928-39-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4928-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4928-33-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4928-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4988-177-0x0000000140000000-0x0000000140147000-memory.dmp

Download