4617455e03226cdb6abac7b97576d9dc86d6c3199a5367a3b54145e4b24b064e

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample260930-dfswcssapb
SHA256 4617455e03226cdb6abac7b97576d9dc86d6c3199a5367a3b54145e4b24b064e
MD5 39aa7a8ac665e65d9d7cf0c9483e827f
SHA1 5cc81f89d1b87a3bb7e8e9eaec66e631fa306210
SHA512 6034d550fae72a110ff81134dd94cb444c13bfbbab84efd8b0b9b2161a556c5a85b0d4aa41b8916db78875b45f5441730bcd88edcaaf70f81f2657216bd4dbf7
SSDEEP 24576:XVGGTWBZNsqjnhMgeiCl7G0nehbGZpbD:lGyWBZxDmg27RnWGj
TLSH
T11855012172C080B7D973193046B4EA71683EFE315F6049DB73952B6E9EB06D18E38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4256	alg.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
4168	fxssvc.exe
3008	elevation_service.exe
3480	elevation_service.exe
1148	maintenanceservice.exe
1640	msdtc.exe
3792	OSE.EXE
1044	PerceptionSimulationService.exe
1428	perfhost.exe
4656	locator.exe
3812	SensorDataService.exe
4684	snmptrap.exe
4996	spectrum.exe
4280	ssh-agent.exe
644	TieringEngineService.exe
1060	AgentService.exe
4400	vds.exe
1876	vssvc.exe
4884	wbengine.exe
2964	WmiApSrv.exe
1276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3a27e958250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000757ec0778750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000931b83798750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbc64a788750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000810408788750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f39b927d8750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000703e22788750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b40a9798750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe
3796	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4168	fxssvc.exe
Token: SeRestorePrivilege	644	TieringEngineService.exe
Token: SeManageVolumePrivilege	644	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1060	AgentService.exe
Token: SeBackupPrivilege	1876	vssvc.exe
Token: SeRestorePrivilege	1876	vssvc.exe
Token: SeAuditPrivilege	1876	vssvc.exe
Token: SeBackupPrivilege	4884	wbengine.exe
Token: SeRestorePrivilege	4884	wbengine.exe
Token: SeSecurityPrivilege	4884	wbengine.exe
Token: 33	1276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeDebugPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	608	2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3796	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 60	1276	SearchIndexer.exe	118
PID 1276 wrote to memory of 2208	1276	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_39aa7a8ac665e65d9d7cf0c9483e827f_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4980

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1428

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4684

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:60
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c64dd9e48f83f709a9ea331d6ec844cb7e65de2a98d652e5624e3ae93a7b2cb4
MD5 1e2a89188f6f8d54482f1a78a0735320
SHA1 c357d97b45bf791696116fd96c870f149f764f11
SHA512 638c2240b44b307263958ead7cdf6b5af30ee4aada80fac87b8dc283a13ee6d9e0fb8f3ed1c0c471e2466f937f0d52cc9c80084d5a08323cd3e691752fa80779
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8Dmg27RnWGj:c3q6HjBfD527BWG
TLSH
T170D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fc93fe39d220e282aa2ca95a32b6fe5ab143f7014e72348b38fdaff9ef9c24bf
MD5 80063d845ba6028c3692fe625938f184
SHA1 b39a102645a1db4a2aaccc65d8bd1e6b07693888
SHA512 1663c061fd568b7240e30af4604f233358dd75ddb6b416d57d0a967a7fa155801c57a32fb93c601cc3a0d66ae116923b7b8db7468eec87f81498f62981aa46d6
SSDEEP 24576:QXYfDtczAPsqjnhMgeiCl7G0nehbGZpbD:ntcqDmg27RnWGj
TLSH
T10765F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c1931b5d8551fc4b5e33f6590cd3a5f2efd947a4700472c9bebe6b20391c5e8c
MD5 6a1cdfdba507b30e3718dc6534512dd7
SHA1 ca1b4fd86cbb69ccdb92d3dc560261103bcca9be
SHA512 94eb157b283818d9b9b2c003ddf1f3e432ea4a798ab184063f43ac4a8ffb53b92c4152a66b77e6515af99f7a3e7bb58eb1c08e46de5652ad3667ea24e0252a2b
SSDEEP 24576:i0Le5ji0hmxirMIsqjnhMgeiCl7G0nehbGZpbD:iPji0AclDmg27RnWGj
TLSH
T123859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2f29547c7a80693263832b8c3637a7602a8fae08a8e7090c6816ca050212d883
MD5 3019c660a25724ea72aeb10fa781d06a
SHA1 c8ab0205266398688b50ad58e04ab94245db32c1
SHA512 d204008b59594fdb568691968905e75a9e110f657d3c824e3049dde6d8950053b95cfc48d18baf11240c3a0a67994d3e749ea7aeab09c22a3f74a5e780e80d79
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPvxHjy5Dmg27RnWGj
TLSH
T1CC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 16d792eea02c7b9513fa94f557495632b53e6fe8890bbedd9801768653150b8e
MD5 30169f79f6517ec8a5b1f725301c0b3b
SHA1 3afa10ea7121cce71ed999b09e30cd71c321d532
SHA512 31548b964df8adb733e172d8df1ef00229739812ecf9fa57f1a36f9424336d95ef69969e655b440bcb50bd9a234f33ff2824a3e0c9cdfeb5a94e474aaa818590
SSDEEP 24576:WVbqPb88hv/l+6bsqjnhMgeiCl7G0nehbGZpbD:WVO88hXl+4Dmg27RnWGj
TLSH
T1BA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a8c71903202a6701f0fb943c1c0529d77e7b49fe5f8f45383c66fe75ee6cb37c
MD5 f0e4bf3f19731438ae42d0e066eb936a
SHA1 433988be6ed824ee3a5f6f4ef57eed6cebdec38b
SHA512 731638f938b0c67877435fefc8352c70b8c024157bcfda36e107027d7628584bb57338a892dc2263445dfdba1b8e9010a353a5daa706980f345126dcdac3dbcf
SSDEEP 12288:+RkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+RksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF864C51CAEB7608B5C3E9F11EAC137E56982008536A637CFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 06a52809d7da4994847e385aed0b5e66e21525c076ebaf360b27a6e6eb6308cd
MD5 c1219a5af4b5a3247aa1f74503e62eaf
SHA1 7ec6fd866f0a0cb1ab73304c240d7fa76eefed3f
SHA512 355795d6578da3b3f9c5567f679cec6bca45b4a4a79293b40d43f78e8ee3f753aef4c0aac98f9db060312884e039a59f6eb9ae754356103bef142a9586b239be
SSDEEP 12288:eeBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:eJIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77f5140a71e972e5fcf84b549515e89b09a4cd4debcac71d54758e00ee8f4934
MD5 114ce655146d078255ef7f6709439a08
SHA1 054a434a8f6c96ce66e29319c5544eb5c3ce6ed0
SHA512 5067d775d91ab3cacb0458cf41be0c13eca4963adfe4e338d64ae8ef0d449ceef3f45ab787026cb63d9b5ba85b0a6051ed3dede8ba8310f4e7d0ef7c44b8feab
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:+QvGAdlCEL8c/yRNw5CKD527BWG
TLSH
T141266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ee4ad8d5cb118f9706941d9585743554cb4aef7c20c5178cb42dcdb36fc34d7
MD5 52d213ee5bba4f1f684a6836d8f45439
SHA1 ec2568670261424c6ac488ac97fd7adc80561514
SHA512 62345134fb0d48e3591e94d0fc77080966c13395e4f44d0e8a06354281bb8c1480dce01738b7cd45f45687ee8d3b2dfb23252b6626afcebfd8909258443394ef
SSDEEP 12288:iAwSfxL/2Dc34DLLmt0LDQewsAjBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:ndewsAjBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10575E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ba402c5d493cea2eea5651818b95ba272c83575f51a362d88b982304eb9a84dc
MD5 ae4f2a15c59eae0c09da8f2beef97967
SHA1 0927f1d60f17a3dcdd8e4e8bc64e87ad15dc1447
SHA512 b73afcd71e44c32b325606a8a0e99735f90fc10e515d225650154252a876656cbaf935c8d66413ad3d835d79e6c0ef87407ea00e9a894e61b5afac76f0ce2cac
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9VQBWG:iUEtQevvqc2W1cpV2EI32IB
TLSH
T15F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ee585a5049b4e3f1e4ede6908ef12c4e833756efd0de2f6e55aee1b948b09c1d
MD5 eca671e61222407a9bf996802bedb536
SHA1 7b56f8024dc931a14be28bbff062c88d86d51787
SHA512 8ee06274a609fc53d75945d23bf8324a435ad1b7235f1a9caaf933dee9161ee43c2897dd0f91faf59102602f3434e567dfac39694aa4f0503928168fcdbcb92d
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/z1Dmg27RnWGj:foqtVjnmeD527BWG
TLSH
T177D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8fdaead6ae84316ecad7aa805cc1b8cc75c79e5d017e4f005f3d3562a78549b5
MD5 bdd09cc705ff15bf5c4b4848104570a8
SHA1 243616515b55b1e4d7f9162a1e6b808d56541b9e
SHA512 83e1fbb62524715d8dc926d3fce5b76cce6b3a9da93ef5ba7f542255d0004167c1d7c92d14131036fa16eb0d608524621a304c99323f8421f961b1ff829f6e6f
SSDEEP 24576:lAhGLJIFoiwtA5l7S53qsqjnhMgeiCl7G0nehbGZpbD:lAMyFoiq5ODmg27RnWGj
TLSH
T163359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5c12d639e905388410c9b3bf5c27caac0958d80c65622ee1b152e73c340b4997
MD5 fb32d8f0d8fb25a3c4aad93b37a34f4b
SHA1 e0d6f69828d42c22f61a3807bb3b899fe5182ebd
SHA512 aa5c364968b8d1e4e76d2887946186c956a1f5487a8b6a48e2f7b5b90223fa951a3b1b9329faa3acba3b95526e0aa2016bf1569cef93f4a5db7a6496be9c90d3
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:uwuoOWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18065F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ed5cef367bde91f39514d9bf3274f5459e07a009859471f147ce5055d6db752
MD5 abf3b3727883df3ad60ca7d566c43f71
SHA1 676a17cb160eb984b47c4214df5e85eb1d2ddc0d
SHA512 93ff72e97346098eb07f827bfeccc36ad8a31cf500dfd8132d13b200f999f84975129ae1fb3c0ee1b530081bae5c2ea7248f7a33de88eb12dd520dc8dee58836
SSDEEP 12288:rBZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1375512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 07a53893edd41b181c4218d893522bde44e8b06503f0f216e2650d8f1a112aab
MD5 d953f914f69801f2737ff9eff177e724
SHA1 72a89ec5edd89cdddb35c1a834b589d9e4252639
SHA512 ff244173f53ad1145ae93b21ddd5eddc4c724f430339e63c9d72671e58c57d8c228cb0b29545b459492939dd244b154e85b0a7b8335a21ce3c15f57355e94027
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3rD527BWG:BQyiKayX+PN7VQBWG
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5cd807c0e36213eda13c75aeca6955cc333d91b199bd2f6ba905f132c19b8406
MD5 c152145ffc393e89e3df01130fe4c0ed
SHA1 ae0b70ceac9395350fb41e6b0bca8104729884d5
SHA512 d14a82b6c398a45ddd37b3021e0cba5218d39202fb64e97d53674a1ffa438cd521ab271dbeeb4d5fd312fd2a5c8f597feb828865ed7c9625c41b3ff495f0a301
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3rD527BWG:HQyiKayX+PN7VQBWG
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8fd1bed9ae5c13a5cd8f1827ca575f45983930cef4706c9c6de65f9726b1dfc5
MD5 3c0f061808fce71e80ce9de2baf1ae65
SHA1 6411fe31413b6dbecb06d27f1121bd304a783473
SHA512 f19104d8331a3962fec4fbf9d50372af6535c5cefead947d2a641d8eae1f42fd9ff6db9e72121c5950fd2ecb3af358dc43502a262d13b0eb5cc51091a90457f0
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0AsqjnhMgeiCl7Ge:668Qg55nhheWu7PNU3/lDmg27RnWGj
TLSH
T1A9B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b0ac4bd1cd048154f1fc767ea85c109592d1cb0f7647e2afeb8bc8f3f51b4546
MD5 763e9ea55dfe101893e68d59c1bbd330
SHA1 eef23d545836ef145bcda3d13321535a59ec2215
SHA512 eb99e3bf613ac06fd044e521f620959ced7bbdc2f9a0bfa6e7c7c46bf3764c4a93ab2f645f605b5bf1fe3a6b072b8806def3a24661532ee30c6f40e4e39a2329
SSDEEP 98304:wy5112gYy5azzVvL69nLKnhZAD527BWG:JLIHmWhGVQBWG
TLSH
T111167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b0c05db77e35c72af4ba5c02e1dcc025a9ddaf933e56df2049e4fc41473a66cc
MD5 cf0571d8731fae537ef8d3268e1522fd
SHA1 1df4093acb607c7b7b83936e376eb455e7efd43f
SHA512 194a43ee0be40aa3656adcf83ad195e700e8a4c581ccebd95425743817304cfb07a5ecc3ed6a2be1aace29e79e8954c21fe5e10bc06d8fd20b0749ae8a3743dc
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDDmg27RnWGj:Lu6JmVxd2dDD527BWG
TLSH
T185D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4a29fe397557ac9fb5e07287447edc16565ea442bcebb7261055c852f1774d29
MD5 8adfdd03ee182b60afdaabb2fc0e7ff0
SHA1 9267b33f336052f9097a60629ad62c14b5cbaac8
SHA512 d199b81129495ddc024623a2da0e85a4dd7b3d258ac96b2a2cd3e5c172fbb910921472a9ddd804b432750fea5360e0633fc37f6b3513f5102f1441f128ae8071
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xnDmg27RnWGj:3mifPbReD527BWG
TLSH
T18BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 afe1a9c3bb79ae44aaad8d21e749b8c9c78fba66df9c434aa54b85112673ab68
MD5 0fde2cb8a1bcd5aa2037f53abda9a309
SHA1 1bb8adb84c9c17f38b1ee3764433ad8592c21241
SHA512 d777c7bdb364d507f6acacd86aac6cbf4ae33a39c35efd5c3b9cfabe5398ad94aad9d5b173e015ab41f7aa3f1ce9f0fa5f3140466478179d87f12af426d9de09
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqsDmg27RnWGj:j5dKTi61sD527BWG
TLSH
T148C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9962ee71515cbb57617ebba057144e7d878ac730585786c15f958288dcbb1039
MD5 b319cbe1b19257031f2ae28f8d92771a
SHA1 c3c80d8e8cf973e374bb34547dc88f1e2ef94aee
SHA512 7e4df85872c6814e2ccecb643fcd0d660d58354751882c8b0f12b9e53639b70df1120b74d0cc31778f64dc30ff4b189e555a43aadb57a2543d59aa72ad2123b6
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wzDmg27RnWGj:vX2iyphSD527BWG
TLSH
T1FF95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fe677390a8fd03824fb323acdb0cb1b70363bf8ce6aa44429850664a74c8793d
MD5 bd1f6184edb7fc3912cdacd41be91614
SHA1 364438849ab2813cc4890755f125428e73e48784
SHA512 d96870efcaa82683eacaab5b6c7d9890f7f8e95c40ad353734266af686fd342c0851dde7510ae749e932abd5e316db47281208cdf84ef06db78cde8bbf8ddb49
SSDEEP 12288:PMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BF964C41CAE52648B5C3E9F14DAC073E5BE92004937A5B7CBEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0359a8548dca85879eac2c3749ba7065e453b43b593f016771aba9a9c5163f45
MD5 100fc76fcfbadc5aa848fa64f55f640d
SHA1 9ed8f5f7c333d5e3b31b3ad16869c639de4ea395
SHA512 bfb7ae2482ff9cabb7dc19771f7724c197b5195f0c532eff47a985db19ec5e7f24342ee335c60f40a6e00a35361cc1321ff1ae5539f7643c25686ad72810419f
SSDEEP 12288:h9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BE964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8d1dc7da2de36207504a376d63626c9442e087622d16cd12b80f930ef0ad428d
MD5 e5178748ad219d47a75129393e301f88
SHA1 43286ef22d33738071821c2fe6d11ec0bb014cd4
SHA512 b00108e01ec493c9d6be1f487ecd674e7c9a9eb70cf88641dc2df43d97c91d6bff1f768c922f2138d6242bb0e0e3d1e44aff814225baac79909dc4df5212c583
SSDEEP 12288:arXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:arsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE964C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f2ef2846e9748d4f1c92acc2655da933cc50b7c99914d477cc05f4aba972c79a
MD5 99676816065c1b52d8052a76e12058fa
SHA1 56c0ad0fdb398d9de627e533aaae02c5f4c88a69
SHA512 1da881d7fd65a6b1b01139e30b663b30fad5ee923007d89b942ebdf88b6da7dda9ec73aa15b464c498536ce68567e92306273f4d082a7d0e3bf5ff71a437862c
SSDEEP 12288:eVKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E845237B575C00CAD83285B8C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f274b932b860ff066ad04b68901740386ab2b4ee558b7149447f41c78d48105b
MD5 248aec1be028f28d10106ce36e0ad3bb
SHA1 4a7505e0ffc96b95adb13920b3c50a539992a6c8
SHA512 129ebb2863452aa30505bb3deda7f053ad77ddbb1dddc2e74b282e288943acf26f8b406bed9f0ba439e2c6e11e82cd5f0c404b17b0282301e130d74b69513770
SSDEEP 12288:xiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE964C41CAE52648B5C3E9F14DAC073E5BE9200493BA9B7CBDF7F14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 628aa72065789a60ba8bd9bb72f6af16550719cae2e607200d83575dc8863878
MD5 47c416c0d63a1351557b419fd5292419
SHA1 8e245c5337f9ddbb69caf82a44c3c1527ebb5512
SHA512 4a21aef89b66d71d747faaea737158600727425e4b4ffe1013aba0f3c9ea0b22b8145577b60f0a49e10ebdc5cedbdc860f999b54a6fbffe58732af19cf19ba52
SSDEEP 12288:QpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE964C41CAE52644B5C3E5F14EAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5cb927a587f5ee5e4a16172de31fdd3f06ac5cac972c5ecabd6960c1f51a371c
MD5 2687e18651e619b7d8a09b469d79a8ad
SHA1 0ffbc9a82d8dad9b362fa482cae0642262793c54
SHA512 6b89e5e07b9964cb0ffef237d3efd113340a6a1e6507c62e65025cdd19665789557b2fe07265be210df51e8aa791d525f0557ce16a867b4e300e4f2ba35e6df6
SSDEEP 12288:x1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BE964C41CAE52644B5C3E9F11DAC073E5BE9200493BA5B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2ed79d229147c08391e31cceee141025539c66b161cbe977aec44fac817e20e2
MD5 6c71724f4867f6f48505af111f5c2abf
SHA1 a060a4d96e0f2dab4c5df0b5ede02109cf389f2a
SHA512 360b376cf5d0fddc2d6600cc0a0deda32274aad68f7eef2af0775fb67eeb664443ca935bc79109dcdc2f27617faae1dcdd0e94ded5ee0e2c0f95ef583614326d
SSDEEP 24576:JZMSzFVSOdsqjnhMgeiCl7G0nehbGZpbD:JZMSzfdDmg27RnWGj
TLSH
T16A6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79608931ac2f92ba0532e1daaf51dc23d60ef1da4cb20ac46b06153c73b8e82c
MD5 8ee344de9df8ed5d50ce678d443e5906
SHA1 1df00b33eb27374a3a1736600e2d21ce51c5190c
SHA512 937325f86c4bb0a42c42d109861dbfbf08e828de835d51111fcb078f22c5b32c2375ec53d970df0df2f3e4bc23033263a7f7110705b14e8594a71da740bf99c5
SSDEEP 12288:DgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BF964C51CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f49d9248b7b2b21aebc821b052930ca595e67bf61b58dae4488f25a279cf777e
MD5 7cfb7c7a83ac13bf81b3c86ff8365c7a
SHA1 7991f2d60cb52d39d57ca4446ac5d8593c83c3e1
SHA512 3f4520cc51ee25eead844e34934d2dc2dd04f5990efdf2cbcecab591becdf6c90ccdf744a6de450be7401ee1cfeabeb1772b17313823bb7e8376d94ee540e719
SSDEEP 12288:4UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF964C41CAE52644B5C3E5F14DAC073E5BE9200493BA5B7CBEF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f4cc50bbdfef87c4c3c0abfa4ee287576a8bada07aac50c80c14422f6a8421c0
MD5 d5950336eb6d1424d0da9c65fefd152f
SHA1 a1752f6722421be8b17ff1572349326271af1ce8
SHA512 28b8c4934e6c026acc03046bbba32958fd1a17174b37dd28180f1a693a403f73c5a20e453b664acbb461a80ac4717c7be28f0aab764d3294d97eb90082aa2d78
SSDEEP 12288:yyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F955125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 116df1e05566ac8ec2e91dce5bcd52b9b0968157f01d1f8c479ce83c303cdb01
MD5 1bb9778774754ec5d281711e22db1362
SHA1 84de00dab44e46d0a19d03c824692d0b0d43c840
SHA512 3bfddf0548dfdc0ba1100863deeae365d548b5adf65a08cce29b11efa9cb605d442da53af61ba0e5d543e2c28ee7a374939277356eaf3fab550f9e2cfde660bb
SSDEEP 12288:bgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2d05e8087269257a882e23b030ccc6206b3f75a2010abc8d759fe49c84c73f7e
MD5 bc2411af35f857e936820c4ca15793fc
SHA1 815c60c03d414c5e895860924f505d37f3669c0c
SHA512 63ae48d336b4c3a1e2c364154093e82a9391d10450056654acad30e9b2837eccd6a8a0347a05b196e9dce68400e01266cb82223c88e98756f0d475a0876594ad
SSDEEP 12288:BgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 41616e7b0bbaab7390bd10c4a310260571fc057045bf40e6cb5981c930333b67
MD5 f932239ec8744b4724bf56b0d60aae6d
SHA1 909378eb8fdf3959418da9eeae8df5b0bef910b9
SHA512 7b2006486794961181db5c91e61f0e0dda37016173b78cc2a858dc41a5afa4d916c76f4600c1ce1a550a38c0b50bf191c0e521a1b88df641087085dbcd70d855
SSDEEP 12288:ryPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19255125B73A530F9D1378178C5A29606F7327C3647204AAF17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e9cf06edaa0b7f7cbe50a5bb6ae328258d8c69aff632bd763fec92ff3dda1f8c
MD5 7034095b2556ee33f88f288a1128a396
SHA1 cc7cd662032b59ce6eace3425dc747a159a57fc3
SHA512 f716e642c096bd161a828645f532fa202ffd09de523aa74fc9ee8603644040934453585e360616fd6cecd38f8812fa6919d0d15614efad785194a2ef59bded3e
SSDEEP 24576:UcP4mcvIjkGOxhKP2l71nNKbrh/8KBYsqjnhMgeiCl7G0nehbGZpbD:vP4m4IpOO67W8KKDmg27RnWGj
TLSH
T1B765BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6f9e86dacf971a136aa1eed919610274a91e0f0402a52ff282a24a3f98023dfb
MD5 0a0d8ef270b24e79fd605feab1076120
SHA1 a2e91b5819c67ce21823c3581e2bb85fc6fdb35f
SHA512 de6006d4694d39205f3bfa873fdfe8f9e83e64490339032af41504425f3815a1e18cbb8de65b14dfd7d19ae911e9ff9f466da05140587bba498600f4bebf8ae0
SSDEEP 12288:+NsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15355015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 377823bef2fc33071b882ffef54c032551ff9177fc3b06f9a10a39e90ee0de82
MD5 d2207eda193f38ed71771daf9b9ad9ae
SHA1 349a88d7f50cb9e18458b76b61597158c10a21c8
SHA512 ef40fc53fb574184d3c72a2538210aa15364762f9ada35f70eba87f45e66cc2de55674abbe6733de44791f318c3387dd3b69939d34cfb1ad9785aa1c370b0374
SSDEEP 12288:RQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F145237FD34C518BE57659B082E9E12D780B3E6A9E204483B9477CFDE6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9d3434c327568edf30cbaac9be7468a4b66861f1f222d9dda1750f00805871e2
MD5 b7175e7c1476306c428a649f797f2371
SHA1 2bc03c8984813567c2b4c49def7fb101e77b10b0
SHA512 2e3be67a5806b822cbbfb433cd0cdb743024a0921ec3e8360b6db0d71d23a6fa115111014c2f0503ac5b4ae72819f6b971dfeed55775aa868a46cfb284e3b8d1
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQmDmg27RnWGj:Ua0hNYG4Jw9D527BWG
TLSH
T18F85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e1a6934810209a2813981286565b61852b289eb3b52a519ddf78043fae6c7e41
MD5 4888678fc68680a7e348ab1ccb841ce5
SHA1 c02c2741fd7e167031f0f5e0c21f83df7f98669c
SHA512 62ff2ad4cfd8206a6a1b806d72970e9f46f53276c8e7ac36298ae3f79ca957241d67c5aa8022d57e6dcbd50fbaab9ad8ffb1760fe83e1b4d82c45814f25052df
SSDEEP 12288:5hbHjfXNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5hbHjPNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19155127E16AC20C9E572A1BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eed01beb08a27d39137c8eec86222b16f6aae12d0d8d3ea8df31285849eaea8a
MD5 aba95939f6c3932743050c695ef923d0
SHA1 b7fdf88a4840b4039ea9b703801d2de08568b889
SHA512 e3b33779783ffcc3c4ff41c675720577a41dce19acd149b6218ea8aaf4040f655ee765d83d5a65ce9407d534bb9a5ab04fc213af305e7be2274c2645d9fcb4b3
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/lsqjnhMgeiCl7G0nehbGZpbD:GIgnaTk46pBR/ZDmg27RnWGj
TLSH
T10645BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c3c4e481ee2df9d7ab6317adc6218c725d30a8dfeb71d4af1b848878d623e727
MD5 3d6322d8cc7f23bb21dd88a0a4f1f635
SHA1 03dd0c910da1e8f25dc3f901b3d9f099b0265465
SHA512 468fc2d584c8c5340162ba8638df0dd91cbed326d2236e2373c4756924484c1b056f0a29f3eb0aa64c975600a662bba9a3da52ee271750ca4443ccd2bd52e754
SSDEEP 12288:LEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BE924C51CAD53649F983E5E11DA8073E56AB2004D379677CFEE7B18E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3d52e7c989d210f4e14bb2b37a1cc4d3fc93852370b7d67efb50e780962c786b
MD5 c71ba1d5eb5083fc502bce91cfab2f0e
SHA1 458fb0b89ee24f6aebd8040822c7c3c3bec99f42
SHA512 1a96568d39de2ffe0e66f92045d4e4eb5fb7b316b976e4a8312c43c85c08f21bc32bc94f43ae0546c6abae6fe42edfed116d4f9e3c83e6840448502cb2edcb3b
SSDEEP 12288:ROb9A4LWOsvAYFTPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:GpL3UTPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D9750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 6be9118dd8b0c7ab49194b5a80df62e2ef0f7c67fa541988c6d23c1a4d22fb55
MD5 65508b335d49c544983504ef62fdae58
SHA1 409426658ee67665359b4b2de9313ff999e76069
SHA512 110b78bba81db05ca2e6423886d9bb7ec77f34b8e67b6299cf71a7960da9120bc53aa07cbc3dc96ef6cef2e687a6cb799a99fe0f572b873b92a55dfc5a86667b
SSDEEP 12288:rpFtpOjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3OjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C055022E33DC10E9E536917C8692D20DD632BC66172117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 677b7cc1e3421a3939d5a1c65b2d8db2350afbd5ba7508a2457703e01f36ed3b
MD5 b51ad37522ec088627c53cbe1a548753
SHA1 16a788753136b32fc5104a5ca03afb1dd48760bc
SHA512 349456330a8923ca37ceaf5701dcfe6bf591c85ac14b274dc7790e8f3994ece4be1c3f42c8e013036737c696577343da29e9131d9c1f9b1250cb9319561398c9
SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhsgsqjnhMgeiCl7G0nehbGZpbD:i7cBWMpPjN8DbEhRDmg27RnWGj
TLSH
T1A2659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1f6189b4d908a20c52717fbd398198a53eb9f61c57da30b51e654f16a781b33d
MD5 167d18477c3b1bb6cc5088c029ae25ef
SHA1 24f3daa26fda43519ec56dfb924699ea5db22f32
SHA512 81220d3eaa680fd372d6eced4485df571f736d1ca4219eec7b7d1378db86061678209bc32254cd53d298897dcfc7263c00cfe7c809cad8ea0e2c3b205c0462e3
SSDEEP 24576:sW6BApg2YuyuNDYTabvcdvNYf8km1OsqjnhMgeiCl7G0nehbGZpbD:sF2YuHNETovAvNYf8km8Dmg27RnWGj
TLSH
T15D857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 32c49ae068a20c0290155d2701594fa246e247fab6852ac91206aead630b56b4
MD5 da50f64baed23cd2c04e663de3044176
SHA1 2b2ff8c08155e30409c3ac368e751ade9e88c43a
SHA512 8b94ceea0422b935544afb788b5837901e080d93eabe42fd9a8fbf43e2cdd0aef418b4d15781c8428411fdcd8ed00d0ee937b93b34f2805847c245e66f25cfc5
SSDEEP 24576:DAFs06+Omlf3NXEbTo3sqjnhMgeiCl7G0nehbGZpbD:MFs060lVXuGDmg27RnWGj
TLSH
T10E65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 591c692d93c63908d28895a39138ae42a2ca2b346bd0b7e834256a8613ece716
MD5 7c9039598db2f4f42b54edb8205cde1e
SHA1 cb8e89a42f2a3d28bccf1f65f24f311d190bb009
SHA512 7dc027e51d69370e60dac017936fea55c92d21c8feaafb791fdb5029e044cab473036b71292aa53b4a5bf1da38cb6ddf5b812af1b8450c7f7637cbfaef99ac5f
SSDEEP 24576:rJnJ5D3WXCsqjnhMgeiCl7G0nehbGZpbD:rJnJ5DGXGDmg27RnWGj
TLSH
T14275E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ddf2e789a2c74b9d6803d4ab04ea10a97d97f5344b70d3e567ea0592c0278125
MD5 8d0d64078c496257c27a3039e30e2869
SHA1 9c4370548534db6e540fbe9ac3c6cbc02b218892
SHA512 2129af666db017b03589b4a58071c838a33adc996f39ee1062c8c1590c24e49f785ff3976ea4a3037783593b0e46a9508c1c0252bd9cde34fae6e01653947cd4
SSDEEP 24576:LEPghm6/7IIXdwcXrif7qQncjlP65i3VulsqjnhMgeiCl7G0nehbGZpbD:sg06DIKdwc+eQnSt65aV4Dmg27RnWGj
TLSH
T109955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 858531597179de4f1940a36a15be6def4308e6c7f99dd0e86ab592d564852769
MD5 2578cae76ec66167eceb8897adfdffcf
SHA1 6d7a008a905895c1cee1f11585593bf7e15cee16
SHA512 5464b7aad7d41a76042f41872bf4365d47e81ffaf89516398640e9e6a53ae7361e36f67b86bfd69a6703fcdf957cba293e88bf9255f8ce834c45b58bf9d0e37b
SSDEEP 12288:EEP3Rn2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/n2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B855126E679C60DAD136907D82A1C209D733F4756B2127EF2692C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0166f600791d859f88f35ced915672f15f88976ea6a1753d36d88595d6ef9c2e
MD5 890d53496f3d701d2c710cd0d9aa160c
SHA1 7ac63cf64d983e0ce5f35ae71d6226b650f2cf7c
SHA512 bda14947faef441ae50d46446579d283c18cf15f004f4be22f2b35ee13f0ab446840d0442b0b77d7eb5a4aea55dae01b00085065c459949c62df071174478cb3
SSDEEP 12288:jjky9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jIy9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB552219639C60C9E5760578C6B3D1589C32BC31AF2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 44363090159848ee2e01c31f928d4af61b8f85f538045b66a330194e7f27eb5d
MD5 86d1ca2b0ef6dde3248248925b8e13bb
SHA1 64b34c6122c28040115fdc2dce1eb38dd712175e
SHA512 a438600ad748ba3eda6550636ddb49c395ba72db7da21ea02d0b2c67d4bd6b0936bd7e1566196900e05f9c18eecf71c95ca66891c78a30ecb96df7cf04ebcf6f
SSDEEP 12288:HyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:STsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17845237E525C60CEE93245B8C3A5E10DA8133D76AB2014E779E7BCBDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 784e066d864666d1a5a4185808e8565f154a30778fcafbee05d65bffd309f157
MD5 6557fffa92f0870bd6a5eb172395aeda
SHA1 e156cb5a688582ce7f6e9d48e0ffa24d21e160e6
SHA512 e7cfec80c35adedaa2bd23a3955eff8bfb59178434390691605af8e2e8891cc0c7a480f686cf14c4c37d055f4372887e0128a942d2ef6a6d41e8a5e569963e05
SSDEEP 24576:/Q9MxZKdcz9dw3osqjnhMgeiCl7G0nehbGZpbD:/VKZUDmg27RnWGj
TLSH
T112558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1766b3fb98f74eb6b82260c3c6fa33785704380751846eb6058ba56fb68b435b
MD5 a7953c327b7025b86e7fb73fcf55f640
SHA1 9b9d9cfbbf56cfce82332b7f0bafb41f60766436
SHA512 b7c82546f57e085a4ef9986189c98b974b9fc76bb67ee444694fa44f7f891fa393adbea702ecae97b24681a2603345dd1751ad962db359a9b3201534693c556e
SSDEEP 12288:byoKo2JRple9pBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:byocDApBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12165E01FB76D40E2E176813C8985C249E673B4315B2257CB6592C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3f13274ede3f7dfcf289c42bb2f5c91e1fd4754a4092399fc107bad9ddc749c5
MD5 0ba5ea502993514c6cdbc2949470dd49
SHA1 743e13493ca4fab6bd0c9b5f39c5df4d3b2bf491
SHA512 859a7fbbbca26bb714a924a333fb6e85e8d9437c910fa9bb0cd7599286d1e8614ca412332f08ed396523b55dbdf23a20ce378eb76bf50e2be14366c3fbf56496
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKVDmg27RnWGj:50zuNIzD527BWG
TLSH
T164A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a237c67ea40e798545a3439aa5aa6f567391047a2822565fc9f477e5a36783ca
MD5 41b5e81f8cb4060b4064497312e9dc65
SHA1 f4d4b90d3377beca2c584454a349af2c0b6632e4
SHA512 2db6ef7c70301fe59f5111ae22f3e588ec38abc24ed29aa27c30bd9b03279d3de8de00a922d86f04e93be1b39475e23c0264654ca511e8e6d0534a8807d396d9
SSDEEP 24576:Q1QT7EcpfxR+N5AWAz3ooiYtjMqb2sqjnhMgeiCl7G0nehbGZpbD:tTDxR+N5YzTfjMHDmg27RnWGj
TLSH
T1F455B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 678f6a8f9bbd9dbfc1387d63e2dc9eec228c83ae0b688d7a87ccbf989324044b
MD5 49e774ab1b515bbfe45cfb0226f84ccd
SHA1 c6fb4ced3c910003353bacb6d3100003b5095cea
SHA512 2bcd061e31e4f15ae6386616631143e05d86d0cbe44c30e55014b775ea29103452b9d1647b964ab523aa443d5022f5f6f012862d0f3d1963699bc9aa3b71aa07
SSDEEP 24576:TTMdOz0FFS+imSLKsqjnhMgeiCl7G0nehbGZpbD:R0K+imSLeDmg27RnWGj
TLSH
T11E75E17EA36D14E5E47BC17CC653D90AE9733866032166DB0690C0B93FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 bbc6e8cfd272f643de0c9a6ce997ed8c03542dbff006d74537b381b4434701b0
MD5 dc3cd16c3923768acd3678543a55c690
SHA1 436c3d1b07c0322b0da8014587f17db14c145bdb
SHA512 517fde2a701e3743ffa7e67c0855175adae9ce51e7b3ff69dfa7703aa4e888bf6fc36f3ed0e254de809e6bdc1373f2882fc32a727496886e5c6341ab08982cb0
SSDEEP 12288:d4KPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17055126E63DC30C9E4329578C6B6D1099432BC36672019FF39D1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-1-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/608-8-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/608-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/608-70-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/644-358-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/644-147-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1044-158-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1044-97-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1044-91-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1044-87-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1060-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1060-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1148-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1148-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1148-55-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1148-66-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1148-61-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1276-193-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1276-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1276-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1276-213-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1276-177-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1428-102-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/1428-107-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1428-162-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1428-108-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/1640-72-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1876-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1876-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2208-412-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-409-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-396-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-395-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-394-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-393-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-392-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-391-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-390-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-389-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-388-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-387-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-386-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-385-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-384-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-383-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-382-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-381-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-380-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-379-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-378-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-377-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-376-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-375-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-374-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-373-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-372-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-371-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-370-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-369-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-368-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-367-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-366-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-405-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-406-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-400-0x000001C4FF6C0000-0x000001C4FF7AD000-memory.dmp

Download

memory/2208-404-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-403-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-407-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-411-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-410-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-397-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2208-408-0x000001C4FF7C0000-0x000001C4FF7D0000-memory.dmp

Download

memory/2964-167-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2964-398-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3008-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3008-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3008-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3008-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3480-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3480-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3480-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3792-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3792-154-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3792-83-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3796-16-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3796-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3796-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3796-101-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3812-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3812-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3812-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4168-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4168-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4256-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4256-86-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4280-341-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4280-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4280-144-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4280-142-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4400-362-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4400-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-112-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4656-166-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4684-120-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4684-271-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4884-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4884-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4996-320-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4996-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4996-129-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4996-123-0x00000000006D0000-0x0000000000730000-memory.dmp

Download