42d18d4bccab16b8146dd0a4aae44cee565fd1a9d53043492967a4d06c68d429

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.3MB
Sample261009-zagrssvx2j
SHA256 42d18d4bccab16b8146dd0a4aae44cee565fd1a9d53043492967a4d06c68d429
MD5 15bf673245b0273c4284f2c15aacc9ba
SHA1 7ec75a9b9c4c03b526b55e0a8a95727f8afcdcee
SHA512 3ec1486985101a310471fc5baf85967e8f63e6bea1b0c3d55c9307702c1f56d85894d0a07335d1455cad2afbdd49a897b7a7275fe94288995984a90b130767a3
SSDEEP 24576:65GtI/40sy49ZoAVMEM9GyqIEx6d5WeSn9:GGC/40sy4PZSEkzExsWeS
TLSH
T16165011232C1C4B3E9B7063009B5E670A97DFE700F754AEF6394672A5D702D29A39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1636	alg.exe
4820	DiagnosticsHub.StandardCollector.Service.exe
1948	fxssvc.exe
1676	elevation_service.exe
4008	elevation_service.exe
3440	maintenanceservice.exe
372	msdtc.exe
2884	OSE.EXE
1204	PerceptionSimulationService.exe
4340	perfhost.exe
5048	locator.exe
4380	SensorDataService.exe
2812	snmptrap.exe
4616	spectrum.exe
1736	ssh-agent.exe
2228	TieringEngineService.exe
4144	AgentService.exe
4800	vds.exe
1800	vssvc.exe
4328	wbengine.exe
1868	WmiApSrv.exe
3356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\507ebe9b60f3a3fa.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaw.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e0d54182d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b628ad172d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c5c9172d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075371d182d58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009faa621d2d58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	1948	fxssvc.exe
Token: SeRestorePrivilege	2228	TieringEngineService.exe
Token: SeManageVolumePrivilege	2228	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4144	AgentService.exe
Token: SeBackupPrivilege	1800	vssvc.exe
Token: SeRestorePrivilege	1800	vssvc.exe
Token: SeAuditPrivilege	1800	vssvc.exe
Token: SeBackupPrivilege	4328	wbengine.exe
Token: SeRestorePrivilege	4328	wbengine.exe
Token: SeSecurityPrivilege	4328	wbengine.exe
Token: 33	3356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeDebugPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	732	2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1636	alg.exe
Token: SeDebugPrivilege	1636	alg.exe
Token: SeDebugPrivilege	1636	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4256	3356	SearchIndexer.exe	117
PID 3356 wrote to memory of 4144	3356	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_15bf673245b0273c4284f2c15aacc9ba_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2184

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4380

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2812

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1548

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d2633eabe114d7534323dd5ef8fc65f4585293840740ab2123f880347bf1d2c
MD5 c20157838d0e9ecc104638bfced130ac
SHA1 9cda6aa3f9c0ecc8b5fba40f7c30e7956547a271
SHA512 4ae37de996de27f4b4ac31bccefc64cb0083a0dea91e999e071000a48cbc061ef6170b530354084398008cc8164562f359dd2580aad37c1d64facdf58f30447b
SSDEEP 49152:pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnqsy4PZSEkzExsWeS:/3q60jBGy4P9yEx3e
TLSH
T182D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 004c084df776273badb1255915fa07587641b4a622b16188b5cbfebe47e6f143
MD5 24429f2b02638642da37e8c9196a5a23
SHA1 38613473ad5212efd4874e5a8e4798429c1e88f5
SHA512 89d17a336514bc9fc89afc8fb8257357e4922f81d92258887728669630232878a232539d020ff4cb976ad1b6a93978d72455d7bffc03c17df5989eec4dacdb1f
SSDEEP 24576:fXYfDtczAhsy49ZoAVMEM9GyqIEx6d5WeSn9:qtcYsy4PZSEkzExsWeS
TLSH
T1B665F12963E408FAED6B8279C8A2C111E67278954760E7DF03A4DA351F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bf6d90a007b052b89ba6bce79d08b94522ef29a49ba74c72c1c7e16c8be089b0
MD5 a8e992c5c24e80293dacd2386fe37c43
SHA1 2b3b7f14ab9452df06dc7bb1f37a548ba5e228a3
SHA512 933adae8c23012e0737a17957178798d762ef4d9902349b8325e1684274a978f35f350d8dc265a42d26114f86a9fe7657cb00a7588541ac76e2bbfd3584d9b7d
SSDEEP 24576:l0Le5ji0hmxTrMCsy49ZoAVMEM9GyqIEx6d5WeSn9:lPji0AFDsy4PZSEkzExsWeS
TLSH
T13E85AE16F6788335D073C0B9C5D2A68EE971308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b3ca95110264f30200b53d6c5acd855de2b69593e76e6ca4966dc31a672f45b6
MD5 5737e70eeda36d15145bb4fc27f75316
SHA1 ce329910023465438dcfb7e66968389b5c3bd949
SHA512 618a41cd423848d7c8a57fb4ae8ad5e9335450ce28d84d5218cb2d73145a65d5d9afcf140a1a50a0faa347c02fb88752d9dee0588b30b43da15ad9824f34a2b0
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWr6q8wyuIsy49ZoAVMEM9GyqIEx6d5WeSn9:b/ezSC6vUzPviHjyfsy4PZSEkzExsWeS
TLSH
T1B9755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ea1b1949603cb46a51e36aa8fc3ee4585a8cbd2f9f767a64ea92d84fe4c16304
MD5 eb390fed0fdb16aa0fcf4bf6dcebd7a4
SHA1 6a5db36a09119afac994d2ed57d0f37b230d43fb
SHA512 4be6d38fce60ae55e4c5daf57d7a83f7c3c9c2a4e2d01837af4bb7adcfda0ac3199427fb1d61cd0b43e1b5930e76df1bdf0be311d2a472330bf5367699786494
SSDEEP 24576:zVbqPb88hv/l+b1sy49ZoAVMEM9GyqIEx6d5WeSn9:zVO88hXl+Jsy4PZSEkzExsWeS
TLSH
T130559E66F6748331D073C0BAC5D2A69AEE3234424B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 afe86100147f00a0049743bb329ca7778f7cff70788a79a511d96ab227fd5f03
MD5 77d2b6d3953c8812851329dfd0d173f9
SHA1 773c4e3bd65f0bfa0a9f09d5ee82b4d4baa95fab
SHA512 05eaaa2a51ebb56a018392480feaa96a85ecd4291e301702781a2af1eee8bfea33fca7eaeaef1756720801269f2bbc009454cc58b3a40cc741e78da70aea176b
SSDEEP 12288:/tmsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIY:/tmsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1A4452307031D98ABEBBFC372099BE358E0B0BED48865519F4336FB755C78618E24E661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ab69c23eb63fbbf8e47906a37cd39d612efd462ee3ad8165c54a9d44fd517b4d
MD5 f96b56e32d07ee7b991ef6ded53a7632
SHA1 a509e36b47bfc4950e6b7c664f889e8f23c81927
SHA512 4740929a5671784aa8c7c87e04505812808c95d3bd23e094cc753b970ddc0aaec1228061fdcaeff779e02a12baffffad5370ab42d441e3aadee551eb9269b306
SSDEEP 12288:BeBNUbTVO86UNsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIr:BJIUNsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1F465BF3BAE28FCD2C27E89B95A918300D77274704B6193CBD265C30EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d2d1ba8a4c580230d2e1e21743a0a60d579f860ea4a24d3d53b2dd9f3720d230
MD5 710006008f6089275650ff3094e82ccc
SHA1 194a7d3664946e6cbc9478fec7f1c07ae219849c
SHA512 44bd8e1f6acb5284faa1713cf984bfd47bb0ebad7f11f3d1ada10e2eefee8573b092e2b3fb88e12c938867e1cab984b211518b2d924771e490d7b584f27a61bd
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THm:AQvGAdlCEL8c/RRNw5Cvy4P9yEx3e
TLSH
T1E5266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4ea53decd0c40f66db7f22b59b2df3af8241f7a0ce37a6ab884b5ca2146d6cc3
MD5 7a73c157e8737d2f341de17d51ced32e
SHA1 d4dff1b7269cd87a649c38059419fc2c6110ff6e
SHA512 4bdc5dc5df24b32d5b738ff5807bb91affdbdbc490e8e377c55cf4d8a946c55604dd20199cde3c15da6f851696fccc620a3c1373e3f963341a3bec2c4d0e11d5
SSDEEP 24576:f8ewsAjzsy49ZoAVMEM9GyqIEx6d5WeSn9:Eljzsy4PZSEkzExsWeS
TLSH
T15375E031FB78E436C7BF0DB21B26C316547CB9604B611AC3E3A89E9D59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d64ba4103c4861eabe9d8e9ff1154ad61a3f79a155d8e733df9b73460bb99791
MD5 e1d7e8e65a8fbdc5a11479ca5ee75c0e
SHA1 5a42319bec4ba0e2fddeb79d5033c4d69fea4fac
SHA512 f4793876febb496925e1a9611fe8b09d461952bebc911935deb41b5ac97b1d5ca9e2fc72f024e21850af69e56a5d653f84e519ffd8e7cec0c7e6b3c0ea46e061
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHqXx:FUEtQevvqc2W1cpV2RI32
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b4e1aee3d29e5c0a142e5b8002e329d48482eb30f1f56ee43c69a13509b7690
MD5 bae7d1f296db35417c9b645f462bdf3d
SHA1 7a77d785f9bca6dbe5a16ef6a5b41d0951b04ee6
SHA512 7b5170266646d03c86439c3175967d95c958b0bcb2d7e4eaadddab4ddca89dffc3ef2b249c7eb9fab4781d38b9c550b32f5681205cadb054c97ffc66162accb3
SSDEEP 49152:gCbRquA/m2yL5zifFiV+XenmE3/zTsy4PZSEkzExsWeS:poqHVjnmLy4P9yEx3e
TLSH
T1C6D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2c55fa4acace234f421c79d0dc3a01482809d3077f5fcb8c778732dc0cf26884
MD5 d850a8d2cd8c64025ed02b09fdf2d339
SHA1 e2f87247839fa26e1f784f02644d961a46d2f023
SHA512 6a26af4d2b4fa52f780e493b633124b00c26c086f53e104ea49a4de2ba14f53a36aa5d1920d334235936f902f46fe5426c177131128c49b92cec3e5524955853
SSDEEP 24576:6AhGL2IFoiwtA5l7S53Esy49ZoAVMEM9GyqIEx6d5WeSn9:6AM1Foiq5Usy4PZSEkzExsWeS
TLSH
T121359D81E7F955D4F5B3AA7859B69170EA76BCA65E31C20F2260D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 81f543811f6702d2a9c414fb657e2103f009a992e898a295f2b225960048f6ed
MD5 384da571c35f3806e125e49c8192879a
SHA1 d7e9d9263fa5774c20cecc184d89a9f451e77667
SHA512 89e37cf36cd2ad5c2f3afe683c6f253643a1868fa82422fcf831353fa737e7403ae547c4cd21d6b73aa4dd2b2b6c10dd166f6e75306b0ad2bdf9fb84b41ebdf8
SSDEEP 24576:iwuxOW/sy49ZoAVMEM9GyqIEx6d5WeSn9:iwOOAsy4PZSEkzExsWeS
TLSH
T1CC65F14623A91CFAE9A782398597C135F7F2B8512A25D71F0360C75B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a38132c77ddd94f198295e907b669f1d2543223d4910d71956ec82b0c37e4df9
MD5 5c26ec0eff768b925656d54b14e719f9
SHA1 9af871f67aa10c217a097ec8fe1bce35b6715a82
SHA512 433742dab339569bf5a65bbb4fdb54b714b11f2f11d2d63d849fce98d73c55accfb6c7ac48704313347dcc683588980808d272b6612c40698a97a8bacf968b4b
SSDEEP 12288:AlZ1IyjsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIR:6Zuasy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T11B55124A239C60FAE2BB837989E69305E3B17496473243CF032597652F72BC55E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f6dd933d428b86c3052dfc8521b851f416448d0ae0c4ce3e388bb9d6108b225
MD5 965c5ce31b939be2d47d50bd1ac1f8f0
SHA1 b969306eb743c863895dd28aeb3c8fc6bff40d7e
SHA512 ac877a5178ab507e925efe5381d14d61084dbdbcbc6113887a3ed4066ceb4db1d2d642e7d93eb6f4a998e8fda4e06aaa38b06c01f6e9e65755c4bc2f0b20238d
SSDEEP 98304:cQRQyi36YOcPhLvw2gAf+PN3Ky4P9yEx3e:DQyiKahX+PN4Xx
TLSH
T1E3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e270e4451782a4acca6b0d4192e825a7a7e406987b415826bd306b5bc0e4358e
MD5 a973f63218b37e117720abba525ab30c
SHA1 55dc437278dabd73cd27f086bfb7ef0cc0c59951
SHA512 e2cd77b51719d517e011455da30bdbe6312abb56e7d00233d88d1848e0fcaecc38b5f39ff512516fec2c2273cbb10f6b141d9180e8957b871662cb97efe25e1c
SSDEEP 98304:PQRQyi36YOcPhLvw2gAf+PN3Ky4P9yEx3e:+QyiKahX+PN4Xx
TLSH
T1E9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3ec194dee91173feccaabb16181983877058f06ed3ba5c80b1fc1400c5e9c631
MD5 c2b2bad5854076736a9046bc6b512bc7
SHA1 e47ac11abc1286c5ab7656b23912a15184effbed
SHA512 4fb805e67b4576b9ef3a89564a2bbe7962c38959d08f277a631a5ef67c5acae664e4842e86742fe5f24393b1fc0aaa595bfaab9c067719e547ccda62f5dec2be
SSDEEP 49152:n68Qg55nhceWu7PNU3/Dsy4PZSEkzExsWeS:RthLRc/4y4P9yEx3e
TLSH
T1CCB54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB861172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15a387df9110be3a03542682a0a6f43dfec7860248362eb034bb654da5ed8862
MD5 e6777bbf06dc3d356d910b53faab58b2
SHA1 5e0a968117677cd218620097e75d621a92a8464a
SHA512 226c4111d15b35d6cb2f9396d84ef2204cdfb3ec2ca8904c28390dd390a311e2ecfea3d73bd176bad886651a28de3c7c7411a500b0a7e26c348d97a67a8df679
SSDEEP 98304:ry5112gYy5azzVva69nLKnhZZy4P9yEx3e:GLIHjWhLXx
TLSH
T1D0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb156eb5ffc829a698d4857a5def58e381cc32c6d92da344ec30aaf917f17454
MD5 5be306c21ef3912e391de0349921a6f6
SHA1 58c7810590666771a0d26879d1da9ae16ad9bfb2
SHA512 4e9c60e699dfd168409b950e1d815e9548b61f952695990dcaa85818d35086db8e2ebea4549027d2932774e7e42b2f6bb2952098b95fd6e49c5294eed9adc2fb
SSDEEP 49152:LB+taZ3usBWOBr4tEG20bqx0z+n217aau1glxsy4PZSEkzExsWeS:du6JmUxd2dCy4P9yEx3e
TLSH
T166D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77b760dfe1d4ab91791398c230478f9cec2b0850fa8579c37dcf435f5077198a
MD5 2461fe6adbc0960cf526b8b7b80ff4bd
SHA1 1aa583ee79af5dee6267c3fd1e662c39c8e9e3f8
SHA512 fe3c0b4f570edc8506d45feae33c0e066b1b6f5ffa77ee385ea536cb7303eb3d90edc46d795ad3ae2b3ce245fc26363c42b4b650a1c4e711b661c7665b7917a8
SSDEEP 49152:F1hpsNoJpF1A6BU44CwH7R4xtsy4PZSEkzExsWeS:FmifPkRLy4P9yEx3e
TLSH
T1C0B5AE13F29900E8D06ED17887569232EA72BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e91657b56e813dc596be01264e6bbd30a95afa8f6abc178fb8abf2bfbccd16c6
MD5 15e764c44ee4357890bd3442504a824d
SHA1 fa0c9d014248ce5457ee77eaf313facf2b124ef7
SHA512 16fe6d99e4be926dd7c0096dd1074352b95f044c2fa139a3b888daa385312682104931eb8b9ae805aaf4529e87189220fe88d1bffdbe95a52903650ce86c79eb
SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHqasy4PZSEkzExsWeS:K5dKvi619y4P9yEx3e
TLSH
T1F2C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6477cc072c9ce11f9e0ee5e83394679b191196c264e1c27e69c40f71d8f736f5
MD5 a19a4131b30cb8356d43292c55fb20e3
SHA1 d76f1d4c37761ba1093b6a80143ec1ea464a9ef6
SHA512 d8b81024a85c0218c21af255dfcbc1fee95d7098bcbaca9ac97258dc8da82318560c865d1fd62f05fce80f9855a58143b27429eee0f86dafd2e8164f8bf60e25
SSDEEP 49152:NhtSn8EApI0figXgiDn0AP5whsy4PZSEkzExsWeS:cX2iyphXy4P9yEx3e
TLSH
T1B795BE13F2D900E8D06ED178C7468632E972BC160B39A6EF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 600a72e8f071684d93c6b4c65fe0c6a089bbdbbc32002830018a4d03a7c7676e
MD5 4a9c87ab2afa73101ff5c864fef877c0
SHA1 9f6d3f58a4dfad9400b7200205b30a261e393fce
SHA512 2f6a06f5190778cba8f6e301051c22670fc8be5f70d009da32dda82dabb0a7b3c2791e4a3fa08ae3e0998c97a1d13ec65d2ce8fd47e31b118b0bc2b746416dfe
SSDEEP 12288:DesyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI2:Desy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T108452307035ED8AFE67FC3B2059BE348E0B07AD9846611DF532AF7316DB4718624E9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b13085751637702e73f4e37dcdd0da5bdfca42986f7b0d0306d686d25ff627d7
MD5 dfa119004b972a08a345ffe073f1c39a
SHA1 0c3aaa782c511d011674ca707f4116f598a5a424
SHA512 02c9567b989efc4f437b74297dc841a7826c853bae4a3c74f6613f761adb02619edb1208f41c5cd333fb70ebe63d8f164b9aba9ebf17813d4113bdfad0085c85
SSDEEP 12288:/HsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIH:/Hsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T145452307035E98AFE67FC372059BE348E0B07ADA846611DF532AF7316DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8e66208974cba571b5ebb17d68fbe87d1e3a0204f7d84807b7534294e1a2d1a1
MD5 9ee6605f9f155b56e43080bc76292221
SHA1 8851af21d3b2a4546bca0471e9529031f2811ce1
SHA512 fb0614e2e77f5dbedd1bf01bf3d1a4d103a2ac446eca0a2133a801199c049ed6de08cc1c44d97dcc75089a2361a185a3f438a8ad7a882cc2ac99dbb6c72a0b66
SSDEEP 12288:LFsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI+:LFsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T142452307031E989FE67FC3B2055BE348E0B07ADA846611DF532AF7356DB471C624E9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0cf78d8eafc457ee6759732df407957f52c2c73d1eabe2f569ab2468adc8270a
MD5 720b40a273d05d1551c9222e8f212f57
SHA1 4fb04a807e019c80f8fb9166348e8a7c531d914e
SHA512 ad32b4a43adce482dc9845923dd9ecb434ec3a6857e58e567f2f4abd6f176bfd06c7d74566f8a2b3db680bd89f1762e3d1dfb32b552797a7a3f520eec7a91304
SSDEEP 12288:VVksyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI6:Usy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1BB552307136E84EBE9BFC37149A6D318E1F0BDD5853253EF4321BB251DB07586269BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 683d21f0bcf3f163db08a5ebfd1674cbadd62f154f502042baf96ea3a5577e48
MD5 43696e8715cf11a8ff125aa872217939
SHA1 59ddae172193085d630ec9e61ef6fa32b5b8a749
SHA512 0bf3151136b78bfdb59ff3cfe0bef4cbe1d81fb0b4aed885c18678a232a6456ffd05f6591daf2b427403a15106bf32ec55569cba345339fe5e5b69660232806e
SSDEEP 12288:KMsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIL:KMsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1E7452307031E98AFE67FC3B2055BE358E0B07ADA846611DF532AF7316DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c2dd5d831c9d4c8be46da510d473924f615d91e820c3cfd86138cccad4341f34
MD5 1581fc615f2a1a25617d24eca89a2574
SHA1 1dbe1e94ec8d4113858b0e0cde09cd9d44322540
SHA512 5d97f213ab60385cd5ad231ce24553c4aa2461b869a236dcb26ccc5a9fd836aa50c8499226a1e89c83f43f9b317c297c351ae6b5ec8681db2148b2ae6a4e8d8d
SSDEEP 12288:ZrsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIy:Zrsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T109452307035E98AFE67FC372055BE348E0B07ADA846611DF532AF7316DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 62b2d298bc876d438e29fa725378fea1dd8ee84f0c5ba73ac662c57ccae8bdaa
MD5 57fd5c97142d166ca2687a52539ba551
SHA1 f49fd037426d52a7be6b58286117c447e6a396d3
SHA512 5a16524130a27b688f9306aec46f93821dee1c900f9353032838592b359c26a3f4b6abb79ba6f6a9e60037e7b422b4dbb5a20724a793072eb52c967aa3ac2a24
SSDEEP 12288:MPsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIW:MPsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T183452307031E98ABE67FC3B2055BE358E0B07ADA846611DF532AF7317DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c6b0c228acb318f903e79aa2c2fe85e0da84179eb6f498ff2bc04f8e30928db1
MD5 aa497d6f6035efac1bae08fcef5edfee
SHA1 a29ee7dffd47ac780a1956a5fc8e02cce181ac41
SHA512 9d417a9324687703371da38aa6ca4421ce91d870e7fb6d1fd38a97ca2ddc28ad80854712d581365d3f5e5273e154cea8d8c06946056bad5ebfc16e9675d7f282
SSDEEP 24576:5ZMCzFVSOnsy49ZoAVMEM9GyqIEx6d5WeSn9:5ZMCzfbsy4PZSEkzExsWeS
TLSH
T13B650195B39418F9ECB7823E89568605D2B27C5A0A70C65F03B437275F733A01D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3ecbfe947ce21f4b53b6c789fe01c0ed594ee1accc1f5ca39523d17186c1c01e
MD5 54220ecf6a8f0c28d87f0d6fe4f6a1ad
SHA1 7d2a6b2d97764c332dcbf3abf704c243d8e0d276
SHA512 1f5ef2b90d134c3c4455e7ec758776f5e63476471657ec17045bf283b9ffd27690d3ea484afd23c5db36f2ee7cb93e2638b07e98eea4600aefd3ee99ede3b834
SSDEEP 12288:GKsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIm:GKsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1B5452307031E98AFE67FC372059BE348E0B07ADA846611DF532BF7356DB4718624E9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 74c479f1d118d853b5920aac5041b8af49e90f855e4c92d61aeb43c1d71163c3
MD5 0684d13d57dde2774c352e229bbe5487
SHA1 0d12602915cfa162a3e7c521b59c6f9521afabd9
SHA512 8095a8d4e2f62b997dd740c25bbc518e71ce482cd1508610a40d90dbe356edb273c67618c0309a4da1a62b98ce9af813fad2ef3f6ad48b7b666291b9af37b178
SSDEEP 12288:8WsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XID:8Wsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1BC452307031E98ABE67FC372059BE348E0B07ADA846611DF532AF7357DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 21de1bdbcb039c81bb2158928c51df4cd826cb74bd9e24ad203361757544c19e
MD5 6b171e7bdab37c279ef7cbd938e035dd
SHA1 7cdf8a7abdda95c136f6c0ca567805edd6c71413
SHA512 0d051dcaaf72d1bba1102eeaffbb5c75c9e8baa2939442c71377f87d199766907bbb73f532f533052df40e96c9e75f9d210cad21e4df44501d66231ccd6bf81b
SSDEEP 12288:qyPz5L8jsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIT:3zyjsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1FB55020723A930FAD17B833588A65705F3B1B87647208AAF136457762E777909E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 888afb0b7ea788a8c110fdb18cec66d8765f6d1e4b0ed39a4e3c2d9d76eb00f5
MD5 b6ebf639534f533412493c2beb36dcea
SHA1 2e494b7f321cc045a4f7653502684553eff2d0fc
SHA512 1b3877deabd63748e6a3adfa443e3003eb37d41dd561da83d363256bf24b4fade1350aefb08c31230e7ba8c6600dc48454c762fe514ed897d2015cc95410c8db
SSDEEP 12288:6KsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI4:6Ksy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T175452307031E98AFE67FC372055BE348E0B07ADA846611DF532AF7356DB4718624E9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce7901228cb5e70e307f36cf5844c2e50e47c8ad01077b0fae40082ef8ba7914
MD5 15f9ecda67cf6255df7b5a54f34a3d4a
SHA1 55b9c39997ee598fc7b5ffe5d24986fc5bd0e426
SHA512 4de8f4d569523c7a1957224da0750909a3812b6a1a6d21ad15658f1f94e497e5f349abb7886fc3a2492d13215b5304dabaabfd6bc8b793acd1675f0ae1b49686
SSDEEP 12288:hKsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XId:hKsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T199452307031E98ABE67FC372055BE348E0B07ADA846611DF532BF7356DB4718624E9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 522e17a497a274b61e3673ce86d1348e9623f597dd3d5db2f064fb2ee44227d2
MD5 e46eab9ab62dd341c847d4ce4d1266bf
SHA1 c6ef29b86ccb9244ab74dee5e4c748f383804a3b
SHA512 8ce93fded4b1f686425bb3a06baaf458b0d8fd51b6c9579410f9a2e492731a0ad04895deac25d6b1582655cdb949c8dba451e65627d80d083d735a495a8a364b
SSDEEP 12288:WyPz5L8jsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIT:rzyjsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T10955020723A930FAD17B833588A65705F3B1B87647208AAF136457762E777909E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2ffdb9061ffcccd26e23347b2c3af8b2e60102d4e7fa0d7e784ca9b66ab3f131
MD5 8ad9b9a7f3ed07359a5796e146f4cf26
SHA1 b70cfd0040dc7ba1ad1fc503fc89487bcc79de1f
SHA512 3d07d930e0f26f02d26ca5d2a79d93e17805fb3710644157e9b5c5d2adfd059b6800e933d0ae063367be9046246d64fd8c62f4f0884c92fedb0d33cda188f039
SSDEEP 24576:0cP4mcvIjkGOxhKP2l71SNKbrh/8KBSsy49ZoAVMEM9GyqIEx6d5WeSn9:PP4m4IpOO67N8K4sy4PZSEkzExsWeS
TLSH
T1D965AD2DA7DC0096D0BA917885658A4AFAB1742A1F3286CF1160A33C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c3b2baf2806006cb5df3712c8b97d0402521ed3a4e439a84c2bdb4ce69001bfd
MD5 9cff49aeca0df761eb5d21d09feefcd8
SHA1 5a1b8d13daaa0db376936343bc20029d83d9de06
SHA512 e6927e8049f297c5799f9be19e281fda0eca2a6dde12b95e7745b9d330d3af5fb71b8f2f31e69a546a2df05bce645e871d0d03c86ef0669dfddf0447d439870f
SSDEEP 12288:nssfasyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIT:rasy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T12F55F10AC29801EAC0AE9275CB569240F3737C6587E193CB53D0F63E1F756949EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f70ee247a7abc46cf509de97b55bb0d4e69bf47525c2656564c4f6b97112ae91
MD5 e0f389832d148c8012baf3bb4578d6f2
SHA1 0dd17af758c732cea71c1c24a60fa3e376d96c3d
SHA512 601e7e794634bca15817cc6a36075cf25d10b1b0f141e9b39e33094966b46ff8e7da9cb35886687159b06767e5fe408169e0b3a094b4ec2d0f5c99a4ae9ad306
SSDEEP 12288:E6syU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIH:E6sy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T12F452307435DD85BF6BFC371085BD328B0747AE88D2141DFA316F7346C78B18A66AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 11d27943c70b9ca938dd8a923dc01c47ef17ca8d5c142191b8f81ea0065c08b0
MD5 8f71f07a28cac7741d2cdf1d01e771b5
SHA1 ae58bee4306156bd8317396e331a14fb07d5b740
SHA512 69438ad4cc096bfb5bdfb998359ca2385184623d4a56d2626e091b795bd2109e37672fc180c3da9069a7345a9c0e3cdcbc089cf777c89b8743d3ba6861eca78a
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQMsy4PZSEkzExsWeS:sa0hNYG4JwQy4P9yEx3e
TLSH
T19B859F1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9cb624d1f4b658862039491e9369abfd717c625716e4e9833ad8f3d34cf6ff8b
MD5 bd0202575d83ac760bcd72f92f8f4bbc
SHA1 2ef37174e8352e30d6c534a0f4b7998135efdaf6
SHA512 275845bd9ada30f190aed0ce7d5304a5dabd618cb85ede4343a01dab2464b68c2bb42d8da9fefb035be095e133d9e68aec32796c42a371a11ddf0d1c9739715b
SSDEEP 24576:zhbHjPXsy49ZoAVMEM9GyqIEx6d5WeSn9:zhbHjPsy4PZSEkzExsWeS
TLSH
T15755026E13AC20DAE17AD27D4596820AD370B865072193EF1392D3394F3BEE85D39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2f9820ad2d4c737c5acf566b4eafd5251fb243d605350d23c459af2fc574892d
MD5 683f070dbed7a9d42f93949f350e262e
SHA1 6d938fda4d89710ef925ffdc0db4ca29f8b6710a
SHA512 4e466d5a7bee7c55174b447f4a183b9ed93694a2576fca1cfdc8046f2219ef411dcb57a86ec1220d48a0da8563cdfbd2239126250e9a03ac5f42aad47523beaf
SSDEEP 24576:N3YgnJcRTk4yti+R5dpR//sy49ZoAVMEM9GyqIEx6d5WeSn9:NIgnaTk46ppR//sy4PZSEkzExsWeS
TLSH
T10F45AF2EF3B910B9D8AAD236450143B5FB71782D1F2096CB0174C638AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a6f4a807a8b07deb687ba3e3835cc2760aef013fe39abb62d358790ed427644d
MD5 0351e99326c175825e1fc76cef53051c
SHA1 102201a3fc7344c56cfa89657f7f8338641f3b40
SHA512 6ec11bdf8a12ab2e0f28095bb4beac2a4e00dcbb6c6285591f6f9740c124ef8be13180eaf8bd1e3000622534c25e1304e2b3ac8e530906b763c49f6ad722f6c0
SSDEEP 12288:uGsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIL:uGsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1E8452307031E989BE6BFC3B2094BD318E0B076D4472212DF5326F7356DB8B99627D661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 b30e4db14861bc9714f67948020f5749e124a91db106e8c7330f0ac26f4b35b9
MD5 fb69305e0c8bf3df09cca67b815e7867
SHA1 570915fa6376ac18dafdcaa66357968dcbde400d
SHA512 fbcd86a7c51f613317be1fc6add20f7b673cdab8ee4988d98c91ec4f9b0ef730b1c620329f1589de75290022994bf969ab72f070064d6cabc12602a5f6f19b57
SSDEEP 24576:PtL3UThsy49ZoAVMEM9GyqIEx6d5WeSn9:PtL3UNsy4PZSEkzExsWeS
TLSH
T1AA750115E39800F9E97BC23C89A6C616E272B49D0764E7DF03688B651F637E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 21f1fc0e6d01f912fde72cc90f7839b6550aabe1fe129546db83ad2b5295fdbe
MD5 2f83cbe2edf42afe0630d4ffc5c6a250
SHA1 75c3dc7b690f384434ad4a30c5f8646117201b57
SHA512 7abbae3984b742012940b77ccad75136a6c5aaab387ab26bb7dcde982abc7f50a7ae4f02632a5da4b580732eac5e83cac8df92fa028dbd4918325071023141d4
SSDEEP 12288:lpFtuOtsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIr:iOtsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T13855021A239D10E6E17A92394997830DD371B8A5072253EF0390D27E5F77FE86C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8df24500e2f4a4b7a6509f7a0bd06959c21744b432ef1f3d1a0656cd906c1a4a
MD5 69026624ee94c3fc2bcf26fca408f7e9
SHA1 3b7a619d6072ae00d6532fd789e2e66ba86574b5
SHA512 f786b4766b89dd12f771812b4458ec7f561196ca0f7f481730cd3406cca334bd42dafba573cbbb6dd55db82d1dcc74ee3ef443b1bdc3fdd3ee85eeaa31977b0e
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhsKsy49ZoAVMEM9GyqIEx6d5WeSn9:j7cBWMpPjN8DbEh3sy4PZSEkzExsWeS
TLSH
T1C1659E2E6BAC81E5D577D13DC9A28205F6F1B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d998e2d453815033edb10d4b84412c7121bfcc38376bb6d2dbe6b9e3b7ce94df
MD5 cb934abbb39af50fd7d51a2e384696f4
SHA1 fbd167352e6cd4c8c7d5ca8d10f31f59e334afda
SHA512 7de990588b551316986f1bac925721e60e715dc4914562379660769fe25c492fcfd389cdf7e9b8fc3bb685849a471dbbdee8c2f4bca3da7b52fef260926b6939
SSDEEP 49152:aF2YuHNETovcvNYf8kmqsy4PZSEkzExsWeS:T6tCf8kOy4P9yEx3e
TLSH
T182857E2A27ED80A4E0BBD27D45B7D246FAB2B8551B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4460fc6c53df1c93a43818cfe9b338bf475b02f0efd354976518ab84ec20d483
MD5 cbf1ec380875578a49c6b73d05420529
SHA1 51b8ba91853702373ea016c8de2789bbf5c220de
SHA512 153673d119c052ddfcc25260df473692166d8934b5344713603dde3d425228da5a8b4e321a8c1091b0ea7faa0abc83538a3c0cf6aab7f862ee0a115a91096eb8
SSDEEP 24576:WAFs06+OmlfQNXEbToZsy49ZoAVMEM9GyqIEx6d5WeSn9:/Fs060lcXussy4PZSEkzExsWeS
TLSH
T10065AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0dd3baae162190ddd4817f01e20b396a11e858fcc51c9b11b48625ada5343a6c
MD5 b21a1a46ee3d16b2025b832313d5579b
SHA1 37c8385eebec99affd88a63163f9dce71b4e7e63
SHA512 fb53e4ea121fb6e9b4bf4fa982c9fa8096d0d477307963c475c441b4c8a45f1fc8c19fc4f164a735cd02fbe957a3ed868ffe672e13e21b8cebd564bc29cfa24d
SSDEEP 24576:KJnJ5D3WKssy49ZoAVMEM9GyqIEx6d5WeSn9:KJnJ5DGKssy4PZSEkzExsWeS
TLSH
T10975D02DD2A810E9D4B7C374819A1745FE72386D2F226ACB2474D5353F22FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e00f8f8440064f463f5e12a632fc442f2709ecdec7a606a55d7136fcb9191778
MD5 1c953e7296f6e1609a7d9e9671f556d2
SHA1 9b02cb266ccda5d862f21f651cb703876ee6b126
SHA512 705461f5f9f4c55f7114283ae0755f92641c580386919d893846cf1b89ee7e52c0702e00f5675f0085b48bb5b4230748f07736baf40afd132b1be56760ea0240
SSDEEP 49152:bo06DIKdwc+eQnSt65aVesy4PZSEkzExsWeS:0ny4P9yEx3e
TLSH
T14D956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0CA2E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 404fd00dcaeab46c4b1e95f1e2a0657124dc888f5d3613f213b7f8b9a7f5cb12
MD5 fef31dbc333b538c756b46ffea9109b9
SHA1 a6017ce263845ffc48f42aa89cf80fcebb4cef84
SHA512 58ce1b79c5356193eb801b2c1679f3fcaba192db0970dd7fdc0be59661be3da153b8a3ef61295855500c4a83c5c36cfaea83164d59a1c13741a933ee4ad33e1a
SSDEEP 12288:1EP3R1osyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XI+:21osy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T18A55025E239DA0EAD17AD2794591C204D3B1F0A51B2223EF13A1D33D4E77AE92E3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9f0d72eece32efe05b319ed8333d5a9638b35ffabca52b2d0ba8c105a48b2457
MD5 2e4a6158809bd439c665c8acd460caf6
SHA1 8821fb9d6ddd05274803fea449c6fa75e9d06a25
SHA512 27a94d101eaf9c9b8be9416c5aa85e463479e52c60c0bb7ac60fa60e14b32c7ab94acf10233917f7e2da7097d0e75ea1f3c08959c0103c1d3b27f63925d78568
SSDEEP 12288:HjkyHsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIa:HIyHsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T1CA552209139CA0DAE6BE833449A7C394DA70BC604F2153DF5250F73E6E76BD4A939B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3d417209d1a8e4192c2c50c5e45e708d748debdea72ecbdf4fe7fad1039604ab
MD5 a0e6f53a0d0c436b016f96ea7c5928ea
SHA1 c9c6da22b20ad21e6ffcf4bb86acd2ec2bd7db4d
SHA512 9ac8fa2520d402f1210512cd8a1b0819a855b216bb510fd29483efc3ca4329d8045bdfc3ca94910556d2b85c4199907c8b4c8d3516212442b4a9b4f72bab44f2
SSDEEP 12288:J3dsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIT:ddsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T12E45230E031EA8AFEA7FC3B1055AD344E0B075A54B2121FF1365F7359EB4798627AE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2c8cd7bf612788f6a995ac35e67c0f39b5a7e720f71a293e8d282db2f88cbb11
MD5 9f759525dfe9c25c602a28001147fc07
SHA1 3793fb0056bf7dc57e4262f4a85bf5011c47980c
SHA512 a0aca87501ef2fd11e346d052d750b458c9e2bc797a8a16c75363ba3f9b7ce10a41597a1f194d00b84199e52eab8a131d589ad02c0a8131847f9ed7bf52074a9
SSDEEP 24576:aQ9MxZKdcz97w3isy49ZoAVMEM9GyqIEx6d5WeSn9:aVKXisy4PZSEkzExsWeS
TLSH
T1FA558D2DABE9059AE177D23594A250C3A673B4301B31D6CF2448D13D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0925f71f2510b21cc441a5bfd2e2821fdb318ec5ef96609130ecf5fc946f3f71
MD5 1a927bc63f4ccacb9e4b10e8fe8555c8
SHA1 0cf4ff2ad378bb42cc3e2009bcc07d3608ad0606
SHA512 30c8880308502309f94bf32e347fc41904aec660883f51f478384236957fa77f9b76fe6736c60f040d1c7d9447a83f315761bb316d331b59a0a49f9a8bde85a7
SSDEEP 24576:qyocvApzsy49ZoAVMEM9GyqIEx6d5WeSn9:3ocvApzsy4PZSEkzExsWeS
TLSH
T1DD65E01FB76E40A2E176823C89858345E7B3B0705B6253DB5291C33D8E77AE8BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d59d49e5c58eddf150ef4e4bd482fb0299baab8d02ef2a857fc2175ceeb0a5c3
MD5 45b77ed06b4a493aea8ef9f4427194a5
SHA1 6b9d218f50f4517a1847c2cd1dcf5c06582eb17c
SHA512 396267284149eb422554b6b1af4ef8ee827d7f4a73602b3984acf8f3ac46165fe56e28b478057cc8b4b12fb395ac89609c90b2f47ae47dc441ed1605d8be45d0
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKzsy4PZSEkzExsWeS:d0zuNIUy4P9yEx3e
TLSH
T1BDA57B3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b7de880e3bb3035ede23cca4ea5ccda1cf7714d7c94b0265263ff63e4ed86a73
MD5 f0debef627e94cc6907b3e091b6b2e17
SHA1 693ef49ed5a44c4ebbec34332a0923fb39dbecf4
SHA512 35df369fcff0472594ea5a7304d4c45092572c2bc4306c110014a9ed3b2ec9b38471d374aee0015bd5fd465ea8c7690378fb28a451795228981bcaea609dde76
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYsjMqbosy49ZoAVMEM9GyqIEx6d5WeSn9:OTDxR+N5YzTujMNsy4PZSEkzExsWeS
TLSH
T1E955B02EA7F815E9D1BEC5798A23C512FA727861033193CB4260C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 f1584ca29fff8613991530d705d76c16528d512cba9fb383a373d5eebd043854
MD5 e855d8a350ae998b6379e75f37726696
SHA1 f79a3604e2e6377cef84a56e0928c63ad696a0bc
SHA512 faffa9c446267fa3e27c6a5f349ea35d647205cf931e3e7c72b0f5385b82c60ced186b100125717cd633ef8b8ae054ab5fe6bd4fbc8e5e80481d53b7d8719eac
SSDEEP 24576:/TMdOz0FFS+jmSLksy49ZoAVMEM9GyqIEx6d5WeSn9:d0K+jmSLksy4PZSEkzExsWeS
TLSH
T1A475E13E636D14E5E57BC27D9A43CA06E6723465032266DB0690C1793F6BFE43A3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 ef69bc3398a4cadd87f351252429a793275cf7df42db1fea6d17c99670ea785c
MD5 563780436d5d0835b5ede57cf48fbd15
SHA1 e2e0bfcc7f0c3caee57edb2d6a01fd67dcf98f94
SHA512 98b9824ecca0b7e02ad5c690a19b0910b08b6ba55e78d8b4f22420010d89cb82bb7fa4569baa4f3e0448aa62186040457ba528d10d53a3540b75b4f8ff1787f8
SSDEEP 12288:B4NhsyU/9AMohuVMEZILdL4CG98qIEx6a9mZfWeSvP9XIT:Khsy49ZoAVMEM9GyqIEx6d5WeSn9
TLSH
T15355120E13EC34DAF47AD3754A6A8305D270B8B5072112FF22E1E73A5F76AD89539B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-393-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/372-92-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/372-86-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/732-6-0x0000000002170000-0x00000000021D7000-memory.dmp

Download

memory/732-0-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/732-374-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/732-1-0x0000000002170000-0x00000000021D7000-memory.dmp

Download

memory/1204-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1204-377-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1204-113-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1636-20-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1636-427-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/1636-19-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/1636-11-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1676-51-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1676-57-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1676-468-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1676-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1736-171-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1736-177-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1736-384-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/1800-214-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1800-220-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1800-388-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1868-234-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1868-390-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1868-240-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1948-46-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1948-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1948-38-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1948-44-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1948-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2228-181-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2228-385-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/2228-187-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2812-381-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/2812-156-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2884-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2884-103-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2884-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-251-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3356-392-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3356-463-0x000000000B780000-0x000000000B788000-memory.dmp

Download

memory/3356-501-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3356-245-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3356-458-0x000000000B770000-0x000000000B771000-memory.dmp

Download

memory/3356-293-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3356-261-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3356-457-0x000000000B780000-0x000000000B788000-memory.dmp

Download

memory/3356-277-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3440-78-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3440-84-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/3440-72-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3440-82-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4008-375-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4008-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4008-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4144-474-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-479-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-480-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-478-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-477-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-476-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-197-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4144-475-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-472-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-473-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-471-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-470-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-469-0x00000125CB790000-0x00000125CB7A0000-memory.dmp

Download

memory/4144-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4144-200-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4144-191-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4328-389-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4328-230-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4340-378-0x0000000000400000-0x000000000053A000-memory.dmp

Download

memory/4340-125-0x0000000000700000-0x0000000000767000-memory.dmp

Download

memory/4340-120-0x0000000000700000-0x0000000000767000-memory.dmp

Download

memory/4380-145-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4380-139-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4380-465-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4380-467-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4380-380-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4616-166-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4616-382-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4616-160-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4800-387-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4800-210-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4800-204-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4820-456-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/4820-34-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4820-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4820-25-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/5048-135-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5048-379-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/5048-129-0x0000000000500000-0x0000000000560000-memory.dmp

Download