21ed17e993192601a830452b7b42fd23ef2f0c2316b441ded581c8e89729d91f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample261030-jbhgqaav21
SHA256 21ed17e993192601a830452b7b42fd23ef2f0c2316b441ded581c8e89729d91f
MD5 2f3e3c3c48c4432616a6e958b4eed11d
SHA1 66a9582cc28448f190276b385bebbb63779f75b6
SHA512 e77fc8c7d8688f0f35046a06a961ae6908b9e7a1a8f06796a5c8c119d85157cbbd211527f219c8250f8d6ab0886e882284ad36ed3b8b17fde34bac6e529ca55b
SSDEEP 24576:a5GtI/4joHjto1GFxlXutIs1WZX5ARLN:mGC/4sT/M+w
TLSH
T13575022175D180F3E573153019B2AA71A97EFA301F6419EF63805B2E4E742E19E39BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1824	alg.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
3600	fxssvc.exe
688	elevation_service.exe
3408	elevation_service.exe
1360	maintenanceservice.exe
4680	msdtc.exe
208	OSE.EXE
2976	PerceptionSimulationService.exe
3948	perfhost.exe
3320	locator.exe
3796	SensorDataService.exe
4792	snmptrap.exe
3284	spectrum.exe
396	ssh-agent.exe
3036	TieringEngineService.exe
4584	AgentService.exe
4828	vds.exe
2172	vssvc.exe
4352	wbengine.exe
616	WmiApSrv.exe
992	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\daeb100c250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adf3f8734068dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012ba19724068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ebed724068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d39bfe724068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f21a5a724068dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b2c6d724068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ca6cb734068dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f1a00744068dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f2b32744068dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe
1276	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	3600	fxssvc.exe
Token: SeRestorePrivilege	3036	TieringEngineService.exe
Token: SeManageVolumePrivilege	3036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4584	AgentService.exe
Token: SeBackupPrivilege	2172	vssvc.exe
Token: SeRestorePrivilege	2172	vssvc.exe
Token: SeAuditPrivilege	2172	vssvc.exe
Token: SeBackupPrivilege	4352	wbengine.exe
Token: SeRestorePrivilege	4352	wbengine.exe
Token: SeSecurityPrivilege	4352	wbengine.exe
Token: 33	992	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	992	SearchIndexer.exe
Token: SeDebugPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1276	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 4892	992	SearchIndexer.exe	110
PID 992 wrote to memory of 5056	992	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_2f3e3c3c48c4432616a6e958b4eed11d_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3580

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4792

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:616

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 682aaff3ae95d81e3d386faa89d88790f8fdf65bf3025f372466a2e7d342b33f
MD5 6d4bdd7f2ba8c9c1f4a9090f98a6dd9a
SHA1 75f1dddca6e2ef7a1dfa0be1159cbb7cd02a5c6c
SHA512 2004d14e7791c71dab4b8120389c58992ca7ba43eaf5f14e751926e916177b1a1cd4ba55fd363634fb4fc265a58e1d5f5f6a7bd41b3ec56fda413c6bf5df970e
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxncT/M+w:/3q6HjBFw
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3027bcf2995248d03442cc8e11095820e2c1970de8315fc2a8af0ddca2aedd73
MD5 516a4fb30c61d389addc52e0706cc8aa
SHA1 8666bd11656595636bdae1c6c5bd4e953515e95e
SHA512 248f7161d77878a35b61286bc544453908f37ed1f5defbd6db62f3962c9f9c66cd4d1daaf3d1b114255944d35cf38c9a94909c6197f56a07b27b872103790374
SSDEEP 24576:DXYfDtczAcoHjto1GFxlXutIs1WZX5AR:GtcmT/M+w
TLSH
T1C385F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 44510d3ca497520c9419b691ac24ce3092848c8478549b3b210e42fbc5956fed
MD5 b3000095937bea136d3705880a1777af
SHA1 2c16c65abe662bce6f2a21d69f0705271e7b0812
SHA512 b3f25d400c2ae2ea9a2aa8768ee935745d102b1b4b8836987527ac497fdbd75d29cef6cb62cc6ba1272217e10fefc3d6f310a0af449386a84dd59859f446158c
SSDEEP 24576:i0Le5ji0hmxIrMboHjto1GFxlXutIs1WZX5AR:iPji0AGrT/M+w
TLSH
T13E959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4401659e04e360ab54795d6e20dbd127744fb0ec364ad9ae675db9b2c94737c5
MD5 d1cfdec2ed256e9ef0634bfaf8df2cc2
SHA1 ce5d3e429d0d00e4326330c6e2a79f0952ffb235
SHA512 f7e372eb1bd9a2a83168013a24ed71a0eaf992b27de217261ab5e63f8a9187fc40a21783d18d03962ec2655a1ccd4914d09aea079afcb462174b7d19b843b84a
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyuFoHjto1GFxlXutIs1WZX5AR:6/ezSC6vUzPvxHjyXT/M+w
TLSH
T18B756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089DB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 880ef3982a64292aa4ea1c7a081c31c4c80034c606e527dbbaf1cae06605d0f6
MD5 5db5bdf2226c0d834de1b731ba1cbea3
SHA1 ba4e62cbe1c1e574ffcf95db8bf1ddd63a5b53b3
SHA512 99362900a649ef534b4128575f9afdbf15bf87871438a838067dc355fb72eda8bdbf8d44d3193915cb20d29a2a1a3b5576b9f4963693d21f2db71652f4f734f5
SSDEEP 24576:/VbqPb88hv/l+64oHjto1GFxlXutIs1WZX5AR:/VO88hXl+wT/M+w
TLSH
T1E1559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fca0c71e7ddcb9aea516807c0e6d8e847982cbcd1727fbf049348cd5bee7b87d
MD5 4a95e18d3106870d4320828521f7cdb1
SHA1 7523445909743830af9f95a1cfaad3c54e939e0c
SHA512 301386cd6c081bbb005342fbec7997da3d6a8afce2dd3ef5f48590f395d9f22f523bf224c876e1b624d0a052c2ba64cfb7e82a80a497006e932a25b68c817f10
SSDEEP 12288:lHBhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYEN:lHHoHjto1GFxlXutIs1WZX5ARdN
TLSH
T1266523639DF250D7F77A11B029D77A61EC77BB06084824BB8B50FE190E3D060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e117f23b421f21e0688145f8d952db99c4472adaf7fc12ea7bde236cf2293cd3
MD5 65c2bd560fb21ddf90c8d4852dd035c5
SHA1 5873046925a391d0d2fe41df7602cb8e9602a8cf
SHA512 bd595e0781104ba80b840ffebef1a8b40e0c5ebfb05855a4b600bf752214a99a6b79d912420f0dc51c7f158703c499f804156b6af6c67d7d69524b0ee9089acb
SSDEEP 12288:weBNUbTVO86U6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:wJIUAoHjto1GFxlXutIs1WZX5AR
TLSH
T12885CF3BEE38FCD2C27A4DB85A928640E77274314F51A3CBD165C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a778bf5a8b3a909f7863bde8efecd5cad81654ccc4b5854c9a69253b6d452c42
MD5 5c521d0ad48fef393ab6aa969d6d361c
SHA1 51e9771b444c453d9cbfb152f72122efddbc9e34
SHA512 2fc1c8b25c085bdb7413ae4a6e6b82d46e6df519d6aa3b5595730d9de30badf9863a9b1c8b855dd91d799ee8337a9dff482d9e456e3cbf6be0c2a7bdf3aaef76
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:zQvGAdlCEL8c/yRNw5CAw
TLSH
T1E9266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d322cc99519ecc258a77e61a019431e232e6e87e612714140f9a57c01646fcb8
MD5 60afb8486e7256d323739405a42e97e6
SHA1 5c5298adc3f76d7f9e66cd28ca7acb2f98bad22b
SHA512 3ee00442f157cc6d20ae255259cc07ac168bbc398bcc6e778c258c759ff06dcd01dc79f46c1f452c7e6a6399d150d09f2b3c3a14f21766c0c009265538fe8aa6
SSDEEP 24576:m7ewsAjioHjto1GFxlXutIs1WZX5ARlN:UljbT/M+w
TLSH
T1FD85E031FEB1E036C37B0DB12B26D716687DBA200B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d7f7646e93c2702d7b6c5351715ce10edf0fb60d5c66ae044a2376a6d5db1a1c
MD5 eea819c4eb6502bc19a8891351756d0f
SHA1 fa1dd7aaf3667724803f1476237944dc4f2a1bcd
SHA512 057dc8a66c708c59297568bfb4c838fd8c87eb78e099c0076c31b40e88551788f4637726502a53c0598543181c467a0005cf3b03740ae45727fdf7b1a4bfcad7
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4:0UEtQevvqc2W1cpV2EI32
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2e2ddf623420bc5940644dfa03751e983ca825612bcca9f596253e5c9edf2365
MD5 a26267aea09bac0025c83d58e6c826ae
SHA1 56b64396b3ab2e55e7821d14ba86071297496d70
SHA512 e151a83c8317ba3655ab4d4b3f69c02a3a33b3cb240cd77251f72fd321b25e6d3cf04b68596dda9278f74da774aeefb1d41c95b23792b2d9c22ce6323f0657d9
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/z7T/M+w:ooqtVjnmkw
TLSH
T1EBD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e31e777e3a3920eb22fd842268e3cf1ea87331e23c13ecaf79d6d36da637b1c8
MD5 16886f45332e5efa784d72897cc12631
SHA1 d524591140c4babc7245ac5f4c4b8a4547452bd9
SHA512 898432cfa03b980ce6482fff70a8901d28c229151d6e0fef895da9d0894fec3edd4252fe457b56fd40bc0a9de4a4b8e4bbeab2a2ae96f0c3ad11d4596ba69d62
SSDEEP 24576:eAhGLJIFoiwtA5l7S53JoHjto1GFxlXutIs1WZX5AR:eAMyFoiq5ST/M+w
TLSH
T1C335AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f1197c4a29468f7357c4aa02f1c732031bc2b17ccd07bf47994371e1c6efc14f
MD5 052088816bf3b340212e565fdf961b9c
SHA1 0d72a565feca9c77f81124866834fa3bc166eb69
SHA512 02bb14cbda0903fe8753dd97bc87279a51a84488d6927a6415d87a7405a1486b09ca3d2763a5d90264b109b82d19e8fb91a27e90fe91f49de9ec969032d9dded
SSDEEP 12288:Vmw5HEjsChNDBFgl0WDm+CbhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:QwuiOWWoHjto1GFxlXutIs1WZX5AR
TLSH
T1E685F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f5e9a5411074382f941ac8ad1452d6fb7af291b37cecbe61b5dd4fdf657d3aa4
MD5 d582dac48495c736081cec0fa0d1dca3
SHA1 cc2751ff8e43b85b0837ea80494add30f12f52d5
SHA512 268774f4c8abf0f1031e0e594604deede1a5c18f8afc631bcb0bacd80247b32fa496473bdfcbe7c44933f8028dee54641411e2502b011b54a9f41469b617bb3a
SSDEEP 12288:nTZ1IyAhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:TZuDoHjto1GFxlXutIs1WZX5AR
TLSH
T1CD75125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D06E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c9fa52deb1479ae8b57dfdcb9382dc77b74dabd95e864e9482213267eb8f6c4d
MD5 6908c3ac5e6d58b0060d4aed0e517024
SHA1 d9b2d57b93462ddb6ed2ebd8e2b917807037f060
SHA512 3e4c57dc13e61d0ebfa42bb16470504500d5ea2355daf40c8710765cdf76862e4146d91a073ac971f655136bdcd5b6e1203925b2f4814d5d650cd12f7cb17105
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:/QRQyi36YOcPQLvw2gAf+PN3xw
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53484d471d5b3fe80e099fe1bd9f00a142e4b405b5978b1c7b1949c43c2b79cd
MD5 17bbdcb38d810ef093d661483c37dde4
SHA1 73e6c5ee3a681b240a182246e0f81f6b5e2ea215
SHA512 108694b78bbc59c758d175489df3735db904d757d31cfc0a0285f5b2abe9cdfbc3c9ae93818462e71d70528f525b07888b10d1d96e1d4c1ba748797f1268485d
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:nQRQyi36YOcPQLvw2gAf+PN3xw
TLSH
T1F6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eb8da7cc5d5c0164f4306187a83d9e69786ded9a7087e00890b94c66a84214bb
MD5 24e10e555707ff96332eca298df18077
SHA1 fe89dd37d6c2b24fcf528ebf309895cd81eb92aa
SHA512 131966f3177c3610bb12e3f1acf6168c60549bd497ea7873c3404f079b37580080a5da7fed7911a23f14e2334937aacea5b9d3eb46a575184c5819ebdafb142f
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0zoHjto1GFxlXutx:q68Qg55nhheWu7PNU3/rT/M+w
TLSH
T198B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cd60ea0f58b5359f313e2b04a8b4c3e709f5e3543c7f7e3d84bab53ce88b9c3a
MD5 5b4cc0d757b96f4a519fa3ef9c586b0f
SHA1 e60033e985aee9d94bfeeda9c8b843e0a375e062
SHA512 4caff3b659dd328f73c310729834a5e56419c01cc9c7010e1fba09b055184226b4391904d0d2e5014cc481b0293a415db438321cb880e03642a3574824082429
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Py5112gYy5azzVvL69nLKnhZCw
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 46b1a8b6cb7deedec4c41e59c4b7dd1e4f1fd626765546c540bd8ded24fcce7b
MD5 9f4dd5fb454943ca513151e8419cbe89
SHA1 c21e39e0dd23f2f7d98bb935b7bc58755a1c3668
SHA512 3573914fec9c94c824b03fb9b2cac458198af65110304a95d8105d8bf0d8505146e2392b6de68fa40e3ec8633a5ba2a82e267b701625eefe1e8beaddb93a941a
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFT/M+w:Xu6JmVxd2dpw
TLSH
T18BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bfd7171e4302aa20ab41b6c75e5b4c50542d9987689e969153bedf3c297f4af6
MD5 23afafae74654707b7cd9af9c557aa32
SHA1 dd7fc7469f5390bac57448376f177121cd6a61b7
SHA512 c74daba66ab95da93b9135169c7a5645235bd1e5c03b6e7c48aa281c521d66573c877dba4ea35bd20fb0378ea304012aac7ed173a321197a160189f66d5336d6
SSDEEP 24576:jhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3woHjto1GFxlXutx:p1hpsNoJpF1A6UU44CwH7R4xhT/M+w
TLSH
T1BCB5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 edc70279233914c9fd2adbfe3623c713d4766ccb2fd7a714284d45c0a21260d2
MD5 15861231640f2d97fe0ebfee7e98c273
SHA1 67c524162c9685b2753a149a12e2d4f57bbff17b
SHA512 5d8f82854ecc3f512ee740d3095097386617bc7efb090ec476b8289586a816dcbe8b702746b99eba9eec95582b5872e650b64aca534465b91c283cbcf19787d0
SSDEEP 24576:a4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqDoHjto1z:uSuZQIY0Be2KRRVtOnks6NMHqMT/M+w
TLSH
T1C6C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 29f10f8b6c1ba0fa9a8dbfea6895adcb14b843ce5b50b05053b870c8dd283687
MD5 cdffd623a1e0647d5a01b11eb19951de
SHA1 630377a4eb5978c221d6e12ec832b4d4e86642c4
SHA512 9b41778ddc3301af7acc2d176dcd3aa7142317d97cba62d29fbcc1ab4a444101ef73c56df6a9715e6cdb60df69707a66b9d589bf376189f9a87031e75ac58abb
SSDEEP 24576:YhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLwoHjto1GFxlXutIs1Wg:YhtSn8EApI0figngiDn0AP5w1T/M+w
TLSH
T1FC95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ef30c4d9cebe733c03aecaac461ab202a6548727d6c56faa34fa369fc403d981
MD5 ce5b2ef2af501fb9036f0c0de505b9d2
SHA1 98b49b1fb3bf63700eeed5a064720793bd2fe76b
SHA512 64f604fed0e09ab953300a125fa4f8b65b4f27d4f2678ad3ae34159363d3ab5890205e2ca7235feb87cb470d798d48d068018f3c550e0f48becd904e5652bcda
SSDEEP 12288:5phKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:5voHjto1GFxlXutIs1WZX5AR
TLSH
T1696523639CF340D7F62551B069C77AA5ECBBB307194920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ff0bf5063ec3e812d5b352df62d58a1f2b9dcabbcc80d41a6f37a7c6516d4a1f
MD5 417dc08de1c717a10cf4b512bb1b8065
SHA1 057551c246e8f447986fec3126782f38bdf49301
SHA512 f07a5d788229813d95b9aea15d54dfa3666dadfad3af22e9f3a155949a8df855ab47a828076a758a33277c6f77e4ed62cf95a5c5860d66645d82721f168e7061
SSDEEP 12288:J8hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:JuoHjto1GFxlXutIs1WZX5AR
TLSH
T1AA652363ACF340D7E62551B029C77AA5ECBBB317194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0645c2c7716439caa68969aaf4039cae18ce45d8b2064feacfc631a4f5a09b61
MD5 4427adbe34ade109f2f50fcfced30957
SHA1 09e73995c48b1bf5f22350051ca425bcdf3c9f5a
SHA512 4afebc7f9851725c5403c055570495a32421f10dcd5e43bc42001dd351d74c704a81547a68423e659c19aca0fa079551dc70429d44365c629fda787341cf5a36
SSDEEP 12288:+ChKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:+ooHjto1GFxlXutIs1WZX5AR
TLSH
T1C1652363ACF340D7E62551B029C76AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 bd81280d139932e6db1508527c5a16ef652956f2a761c4b2c99dd8bd5d22c503
MD5 4770c816357af308ab530aa2e0824e4c
SHA1 519efea112c42724f515f3e44df3f46f41de8331
SHA512 f920636bda4fc9e497e38a7b310aa3b41500e1e8446d33df5bbdbe39d53422111d0e985cccbb70a648da6b9d405a830360eaf616b39bc0de1ed63289fcee9674
SSDEEP 12288:EVvhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:UoHjto1GFxlXutIs1WZX5AR
TLSH
T1016523236DF200C7E53692B49DD36661F8B7B6565B2521FF8B00AD190F391A0BE31BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4bccd0838876186d7ae275b70162cddd20495a7bcd63fd2c169cf5ab210906d1
MD5 7e6939b00e49678917c5c4e9a8f84cad
SHA1 d63bfd7a12e1a1cd5c1feb132ef8d689f602f593
SHA512 9c111f3045c348ad5c78f88068a8659a264eaeb4ebe95622ab8374d3dc40de5ec4210a440ffce30f7bac52bf3662068e80a6a9929ab2c4bc20fd2d3b0c29328f
SSDEEP 12288:EHhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:EBoHjto1GFxlXutIs1WZX5AR
TLSH
T163652363ACF340D7F62551B029C76AA5ECBBB307194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f8e97fcb159af469d28990751ffe58c984593a63d0526f7e593f326d8cc5218f
MD5 416d8fc0f34ae34b7d66746666cde447
SHA1 12404b4244dcab8b0955b63daea97d8ecbcafefa
SHA512 83a1185571edd2788ca39aa8ddd887a44239fcffb3414b6b7f1f5f7db0e4a4256dc56b61334a765031d4363b9cf3461dbc304037291761d978496b373e15680b
SSDEEP 12288:BYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:BqoHjto1GFxlXutIs1WZX5AR
TLSH
T172652363ACF340D7E62551B029C77AA5ECBBB317194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3645577e2ba5b200a1bf5521bc0a7a0b75eec4288cdf5ca245fb060ebca4f466
MD5 eb2e46a1f1619d1047452ad76ef3e777
SHA1 83dfe50446c02d2fb38312d1389eaaa99e6e8b4c
SHA512 7e35c60493e1494e3feb2f9745fd75910e9abb62e8bf3b097ef2e754d311240665441bcec51fdb76f9efe4f69c8d68bb2c6764a0a8a2bac0850cd5371c48b126
SSDEEP 12288:s0hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:sGoHjto1GFxlXutIs1WZX5AR
TLSH
T1BC6523639CF340D7E62551B02AC77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 3b222c86f1418adcfe3e4a2f81547b42dcb1dbd44487193ccbe32d4d15246a61
MD5 784228db8a72d3696f2bfc458c79bed9
SHA1 3f3612833feb20662f79736842a378ef6d1945f0
SHA512 ce4aeb466b59a75ff8859ad15e4ded98cbc9918984e228340b4701dde626c7926621c2dbbde0b53640489eaddc8f8347c9e2085371c127e31170ccd05c12f36f
SSDEEP 24576:SZM0zFVSOOoHjto1GFxlXutIs1WZX5AR:SZM0zfzT/M+w
TLSH
T1628502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2251c656eda82e10ad5bafb8cd8a1750256e16cd7b867c5b71fc5f193d0a13fd
MD5 f6840389056f524957b1ca4cfc451650
SHA1 3a8abac62619010dd1f7ccf2084a2353746412dd
SHA512 6ddded12d36d8730001e9357de2cc351a9472cac26295075ae324e5b9d2b84b2133f7e39588cdfab764f3bb7e24c460661ada9cae857b2415bc4d91b12007ec8
SSDEEP 12288:idhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:iToHjto1GFxlXutIs1WZX5AR
TLSH
T1F0652363ACF340D7F62551B029C76AA5ECBBB307194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 191592f4b392a71e59e04fe6e0e94f9df1bec472ff5501bb2e79c51d9471c5f5
MD5 88aaf75ea469bc5d04bca5bc3bf03dbe
SHA1 6ac5f2b614adeebb968529cd16365112f00087fb
SHA512 1e4ce0bc5005b8e6e1eb876c81a20fc107083b77190ff7a76b98d46194efa285f4e9208f7773a6fb05d8333e9ddd34695294e3a2df66bab9f499fc3d9cc0a150
SSDEEP 12288:hxhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hXoHjto1GFxlXutIs1WZX5AR
TLSH
T17B652363ACF340D7F62551B029C76AA5ECBBB307194920BB8B54EE190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 92a94a1b3bbca4cac8a1896c2706ce1a96c20a43ba7e52f491d025499dcd37bb
MD5 0efbbecfe9dd9f369b0dd458d6a6490f
SHA1 c7f0b56b29ea2ce5ae67fcbc9a173bdb57e8d3f2
SHA512 9a93700dc93be392b54940775c311eebc97b6185b92c94faaaed02f1625c88f1b76372a52e0f759578bd0ae11f270df675160a07ee09153181663c8bd852d395
SSDEEP 12288:tyPz5L8AhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:EzyyoHjto1GFxlXutIs1WZX5AR
TLSH
T12175021776F130F9D136927489931A11F777B43607245ABF47605B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 894a444164b1303e34cebc8d1fe75138c1acb1e4e89c5a63a0315ba99a0c810e
MD5 a8f88353efd8c16875dc66088f027131
SHA1 ab5f754f23867ad00525ddf48c0af88b89f20672
SHA512 d58ffd7d8dd3d6ef8a7c65c0b0f5dccca4c76028810a11fc70d231132ad7093e54f75122d2d23eab05b4d374689e88127960939f7696b0fd1b359934e38fda67
SSDEEP 12288:BdhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:BToHjto1GFxlXutIs1WZX5AR
TLSH
T1A1652363ACF340D7F62551B029C76AA5ECBBB307194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a4f675136a0aace6480a8eb5e1ba9195b59c9056cea261b3f524fa9d160fbd8e
MD5 3ad975318d274ffd4fb1b3985864d732
SHA1 37a3b1a92fbfedd6b99f001ac7cb2c1b2e32968c
SHA512 2087df8bccc42b070b33b5ff6452df995e0a18f07a08f91d281dff3231b543db081d3488eb11ec040379e834d7d10b600b2d7069cf84dd451987e7da79f37b9f
SSDEEP 12288:udhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:uToHjto1GFxlXutIs1WZX5AR
TLSH
T1A3652363ACF340D7F62551B029C76AA5ECBBB307194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e6aa06dc803cf6c29e3f341ef5f4480beefffa047bb5886571827788acfbd55f
MD5 bd2bbaf1521188e8b6fa68178276aa88
SHA1 ae7e8b02ca0101b9f063d95c90be7354152e6198
SHA512 0bab1e5e933b63e906ab9467c9155418198708112b39febe66c9b28a50928702689a5152bb5eb7651630ff9b511398d1e9c183d71d80e75fd171375d6269c692
SSDEEP 12288:1yPz5L8AhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:czyyoHjto1GFxlXutIs1WZX5AR
TLSH
T16175021776F230F9D136927489931A11F777B43607245ABF47605B3A1F371A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 56c077d9f43b5edbc9e7750117a85b439e4698401aa565be9af55d4681f186d7
MD5 1925f0b80eadac4ddcd06005dd028dd0
SHA1 1499680236a248774cb60ac1914166e3c2768238
SHA512 135a3ee9c6f8127d37752bb5c018e18c5117272115b7efd88aac93e8e42acb683e40c01502b1b25f09c838db761a0de7063cd1a5cc37098aca576b80f04069f3
SSDEEP 24576:tcP4mcvIjkGOxhKP2l71nNKbrh/8KBLoHjto1GFxlXutIs1WZX5AR:SP4m4IpOO67W8KGT/M+w
TLSH
T15665AE2DABDC0096D0BA917885668A49FAB1742A1F3286CF1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8fbd7d9356635004f8f209aeb89bab382f315f34141c382b0fa7a09b3bd22e20
MD5 804af5924730547313dc13783c5dd893
SHA1 18887c6b64a5b51e804947847b3404eed7b0bd1d
SHA512 0247919da85aa1898b79a12729c8f146b43b297a109c39a9b30a9970585795cc811682adde43720c0d367b5348e5c649f996d270301b2e5ecdd62c3940193829
SSDEEP 12288:czsfthKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:7DoHjto1GFxlXutIs1WZX5AR
TLSH
T1DD75F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ad736324bef2be4697092025076387b736987f38a04ad2c351449d94a8da10d7
MD5 8a80d414d559a42347f5338fc08723c5
SHA1 ff97cdbd1ab199c6073b6c73ffe144dd28c42129
SHA512 10ec3e8aa494e6378574480c7619b6d44502577b2271e1e88d48050d2aae763bcb92f173e0e63d36ac191a25d6310992d63eecd14d5c51d9f5501f3a3d61eb12
SSDEEP 12288:oNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYEN:ojoHjto1GFxlXutIs1WZX5ARBN
TLSH
T1AD65236399F254C7F57A61B02987AA71BC7FB3160E4410FB9B40EE190E3D060BE726D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 242a3647cd8debdf48f28fbb7c6980c249e68d7bdbf73412ebaa51938ad2a067
MD5 a42ada50e17b6c1f50f8b23bc01e2e29
SHA1 95053cbdfd92cf958add52843dad4b198d68ad4e
SHA512 c09fd6dce67e817916e94c81e4eae2ddb5ccc9f6a35b6065cdc88e6fa4148bb8d1d63dbf7f0a0c757cfbe7a0b0e573b8ba14a10c68e8cad0bfc6cb74deb5cbe2
SSDEEP 24576:ioiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bFoHjtq:ia0h2GEkuAe73q3pp46zwwQaT/M+w
TLSH
T13485AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 6c5b2a4858bbe2c46f11731f3670912e2a5c9b7e4ae82e561651e9d7525e4641
MD5 06519de323901e5d45d6f42a0c6023e4
SHA1 b760859b7915c2d5d4b0599b13700662a443ba2a
SHA512 49cff86c40833327d60a831b5950b483d52176d462d9326bd3375c2b66fa7df5ddb5eb3e58de94fa2dae63259ae9c8be574206b973dcbcec4ecbec253cc3ee1a
SSDEEP 12288:4hbHjfXMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:4hbHjPeoHjto1GFxlXutIs1WZX5AR
TLSH
T1C975017E1AFD20DAF171A1BC99839606DA32B926171163EF1381C23D0F3B9E46D35B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 09f30643f170b5d6b42e06e5061d70a2994baa50f4b2598939d506ac06f0d719
MD5 a38ba66daee624b1ace028d89b2c3f0c
SHA1 942a5b996cae2bbb032067dd38b53c462831cf43
SHA512 db5d0dfd9610a3060169c20b9e7f386b8440dee5f6b4031c5ae7154c0b83ca5d1f75bf46ab3390dd049246293568cef74e12157f0f9fb66463ecb1d9679398cd
SSDEEP 24576:73YgnJcRTk4yti+R5dBR/WoHjto1GFxlXutIs1WZX5AR:7IgnaTk46pBR/3T/M+w
TLSH
T1B345BF2EF2B910B9D8AAD136450247B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 53217f3e89a41b951117f8a7968171c447199cd3af73f6b3a75d79963fcd95d8
MD5 042168c82259b47ffad915d5174df341
SHA1 06944436a48bd8f107bad1bad54f13e6791ae725
SHA512 0ab1e6903c29d7a4eb0d3c692f602a284260200f1b1e3a32596cbd84d6928f614f828acfc461807e97b0cfb5e61ca599696d129aadb231730ee0195131e1f668
SSDEEP 12288:khhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:knoHjto1GFxlXutIs1WZX5AR
TLSH
T10E65236298F250C7E63552B029C76A75EC7BB3161B0921FB8A50FE190F3D0E4BE726D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bb5b4cec7cb41068aef2f43f78a44d73a3cd0033093718af8951b634e49d9c89
MD5 73dede36d05b1de7d4fe43797dec9609
SHA1 9191bb4956ff2a3dab6f768069d514e7a0fcfd43
SHA512 daf880fe1e731ee1dc9daf122ba8eaf9c0fc1feee46e37966c21755d494364e157f0643692b8295c14751da69448e325cbac0b592a3724730c4c63d6ea2819d1
SSDEEP 12288:cObbA4LWOsvAYFTWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:BPL3UTcoHjto1GFxlXutIs1WZX5AR
TLSH
T1F8950155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 759a31abe8a2855966658042300d57d6ed07c3477d8ddce0d47632ef8c3cd2a9
MD5 554e599b4e6ecbaea5b914ae559ef73a
SHA1 53e9b5624b338034287f42a7461693cfb16d5757
SHA512 d6940770e37fdd6cd6a9b884d8233238cc7ec86ddd0eee3b41994071faed4c06b6af88e12e23fcd78ebfe471875e1c480074aaeb384c438bd08148e479c46eed
SSDEEP 12288:apFtfOahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qOgoHjto1GFxlXutIs1WZX5AR
TLSH
T10A75022A36E910E5E136A17C8A839359D772B466071213EF07D0C53E0F77AF86D3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d4f4f1156a3fa79283c593e658965867fb2d3dd8e808abcdb46e2ca762af139
MD5 b8a3ca2e44935fc44074b440f62589c2
SHA1 a079523f244af929cdda137ba3e639fd9e8054ea
SHA512 7a9f35dd90cdae786c760f37d2d3b4e8971201e624f6bf644abf65e3908247b429398aa9359f57195ca2de4e15002f14d208f4577337b70ae1bc4d06e5bfd17e
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhsToHjto1GFxlXutIs1WZX5AR:H7cBWMpPjN8DbEh/T/M+w
TLSH
T10765AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4bcdd122391aab58dab2f2b64817ca7adce823ef57161146244f8002953442d4
MD5 489ccc918b6b9698cd51da1c4aa76244
SHA1 6f6c22cea86735113152e485fc0ac1b7720713b1
SHA512 b2a283238a67443cbf6323706f88c431339ce0d4bdb2d2645588ac0a96221907b2bf8a458f546c361010c2905623cbe7fc9dc5bd8d0c60ce3dea39f90a6d5a62
SSDEEP 24576:VW6BApg2YuyuNDYTabvcdvNYf8km1doHjto1GFxlXutIs1WZX5AR:VF2YuHNETovAvNYf8kmcT/M+w
TLSH
T126858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 08fda1eec238192b1c79d021e15b8ee6b7aa918a2b4d3a8527feed12528a4ca1
MD5 80ab7caf0b2eaf9230ac22157f2ccf2b
SHA1 915def3370b5766fc14d35c897813557cbda6b16
SHA512 7b14b82719021d0e4856d4b5b773fc64a6b0bd80125db2965aae6e69fa380bd442c5b8ef193eda0591214a48d6e1ae555ff2e4a64bfc7d3205bbefe9cd93e744
SSDEEP 24576:OAFs06+Omlf3NXEbTokoHjto1GFxlXutIs1WZX5AR:HFs060lVXu6T/M+w
TLSH
T13D65AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 0d597a20db9e03fae087509c2edb93d942dda78764812fa54ba0ed0de03123a5
MD5 18512de542fd09708b9b7322bf7dcc16
SHA1 87557581f4998a6210578a39a1b4fb4956a8c21e
SHA512 8ce0ecf6335df38a0ddd46b01cdffe0b986b5aeb204e77feb01d73034e589cd5e27220af1f44b87cae6d8d9cd73197b61e58032c488dfa7bec80ec7b558c2c6b
SSDEEP 24576:vJnJ5D3WhhoHjto1GFxlXutIs1WZX5AR:vJnJ5DGh6T/M+w
TLSH
T1E185E03DD2A410E8D4B7C2B4819A2B56FE72343D2F2269C718B4D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b48f6340d78b57747b4a6ddb93b7708b0e1fae4aef2336ec08176ce37b0a345e
MD5 d29af2289ec2f87a5c19db1aaf5eed0f
SHA1 6b4cc471bafabc9c890e6bc39740af11071437bf
SHA512 32f576d46f302bc801b48b2b6abd4e3c03b6d551021a7bfbaee34a5d9bd4b2dfa69c86eae8dde38d12c680b75441215a7c4940c69895ff43b11bc22241919fb7
SSDEEP 24576:UEPghm6/7IIXdwcXrif7qQncjlP65i3VuWoHjto1GFxlXutIs1WZX5AR:7g06DIKdwc+eQnSt65aVwT/M+w
TLSH
T1FA956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 492520ca56b053955f619a7d4b89ebf98be75a289c936ef03c9d0cdaa901a6b6
MD5 011709336bf2ced082e9ad05770c81a6
SHA1 a52ba761460f5e5f5fcf3a8c45ef26ef918f802c
SHA512 20f0c7bc2fe44a994c46d6c05cefb6f318967c90f3f2bf2cb58aa1f55722acdc83502c5acfb31b617ea226cc941141405dedb509c52298cf1566242dca32352b
SSDEEP 12288:xEP3RFbhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:iFloHjto1GFxlXutIs1WZX5AR
TLSH
T1B175126E2AE960EAE136A07C55938645D7B3F0211B5223FF4690C63D4F3B5F42E39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 793234f6bc71ec44f3e17bb91e6c4193acc9a0e6a87d126e76928f7e0c059566
MD5 362d682ba202105f952702dffbdc1de1
SHA1 dd6b62306f855dba77d932c34de423ad42f3d99f
SHA512 435d74529d252bc1c50b9085d48bcf86dd58f64095e5dc879b82e3d434e0571ef89750f795daacc02b9cc46eb3b19b86f76e6eb7a0c49f31ec07f94fe654c7fc
SSDEEP 12288:Ljky8hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:LIyuoHjto1GFxlXutIs1WZX5AR
TLSH
T17575120567E050C6E67A02789EA392A0DD76FD211F1112EF5680FE3E5F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 e6cf615c4f223365097d9639539e530a9722677d6243220b999a9e52161eb226
MD5 589d72b60ea767ebc1a77f2f14f39651
SHA1 01d03420f37cb33bac9ad61ee395d8bf9cce2be6
SHA512 99581c328fa48f7f54c7a786caa621c25919dc5cc92272a0fbbc60697bcb4aa2d1ca56fb6bc1f52dc49eedd2b7ffd4024261fcafd109ecaa68e1aa9673b09a92
SSDEEP 12288:XQKhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gwoHjto1GFxlXutIs1WZX5AR
TLSH
T17C65236658F260DBF62551B419976B61E877B3261B0520FF4AD0FE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a4a647d05f7df613bf577542a90c1cf5177123a4df39b3ecd3ec7f1981121341
MD5 a769ce39a4180a30ce34395c3c8ccce0
SHA1 6871a9adbfc3751ad53fb3883d3f5a1b5ed25c92
SHA512 834725d2cb26660c8a9a0c14e693b728934a018800166343478285362b1ca93b7dbe0ec4850461b7f6f1ecfdc07939f53a4cf29817e60fb525e2f95a65f5cea0
SSDEEP 24576:BQ9MxZKdcz9dw37oHjto1GFxlXutIs1WZX5AR:BVKZET/M+w
TLSH
T1B6558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 7f6fd51e129975d8148ef191bbfa557b8eba44350407ca0f4206cc65a97b6530
MD5 edc388539e8ac27a518632ff269b0681
SHA1 c5e06478d851ee976f244cf8680dc9f29e177d9e
SHA512 3e76e3af9818c11139c20069626278db710b6f7ecc79419d0f4303f58a4757e4d3d9bab83fbd60b4d59db0d47c956c12d0270718d8bb690e13f2a4b445ea6ee0
SSDEEP 12288:CyoKo2bRple9pQhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:Cyoc9ApioHjto1GFxlXutIs1WZX5AR
TLSH
T1FF85E01FBBAA40E2E176813C89868755EBB3B0301B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4805d2284e872e78c755cd8e0b6c827408c43f82ed5e52a34983d09cbbae8625
MD5 043e1bb881696f7cf437373061b6ab81
SHA1 559e35177bae2514cc8567943f0ae37627381544
SHA512 08d5da11cbf1e45cfe55cd7777e0fee89458f39c157352ef1aa1ecc39e75ce521073657d0b08f84eaad0c998979caaffbc0676a307c53164105aace6241bed74
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbT/M+w:f0zuNIZw
TLSH
T141A57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 76aae230d864851ef33d4ecfba8b1c600951377909f9c2fd3a5e72ebe64cb524
MD5 d9c74934fc10ac5f2b4a2f3a2d3594fd
SHA1 e8101e1a3906108c7d1ca10a983bc12c9e0bb7b7
SHA512 18f283991ef28ce4335dbf53b53a4fc544239dfc3dbb021e696b38455c060c03bd598a7881639148a03b5e2b3bf22f6556dfdfdaea7c0caea46b0f4f91703082
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYtjMqbloHjto1GFxlXutIs1WZX5AR:uTDxR+N5YzTfjMBT/M+w
TLSH
T1B055B02EA7F915E9D1BE85789A23C512FA727821033193DB42A0C13E1F7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 d35522b344f188a155c673e1e31e517e12dc972ff8ced19b3dfd7383a56c088f
MD5 34c7b6cc276b8a37db4060e3ea4ea6ca
SHA1 f78aea76dcdd83f9221f3ebccd2f8807881e1451
SHA512 3563b2b1a662c54f1a4a397aa6629fe8f4e8e11c93e70b5ddfacd0bad9ca37b28419562260c4e43e9b1fe00de1787593512ce6688050b6ed905518e84afeb989
SSDEEP 24576:CTMdOz0FFS+0mSLpoHjto1GFxlXutIs1WZX5AR:O0K+0mSLiT/M+w
TLSH
T1E285F13EA7AD14E5E47BC27C9A438906F9737462032166DB06D0C17D2F6BEE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 0c74b24e43bb0796899e005a6c5949b160a85ad2ae44410d4b897770ceb8a23b
MD5 bbcca523c6f8c0ba93ed4d0fea9295d5
SHA1 777393ef546da9231a1b28f67889fe0f375e6320
SHA512 ceb2d96a5fd1f7523b5a9a9d1f0f06a57613bc7afea63fd370442b93406f87f83701f0cc3247fa4e2123fa6b35c0b2b671bdfcf3e7aaab01c0e2f76e9c18e7c2
SSDEEP 12288:540WhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:7coHjto1GFxlXutIs1WZX5AR
TLSH
T12775221A27F530D6F43292749AA71261D972F532171421FF2AD0DE3E0F3A4E4AE35B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-73-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/208-82-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/208-154-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/208-79-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/396-143-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/396-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/396-315-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/396-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/616-382-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/616-167-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/688-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/688-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/688-38-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/688-32-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/992-193-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/992-213-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/992-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/992-177-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/992-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/992-406-0x000000000EAF0000-0x000000000EAF8000-memory.dmp

Download

memory/1276-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1276-110-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1276-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1276-21-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1360-62-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1360-60-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1360-67-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1360-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1360-65-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1824-11-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1824-106-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2172-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2172-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2976-94-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2976-88-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2976-158-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2976-95-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3036-334-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/3036-146-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/3284-287-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3284-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3284-127-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3284-121-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3320-111-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3320-166-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3408-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3408-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3408-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3408-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3600-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3600-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3796-114-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3948-162-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3948-107-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3948-99-0x0000000000670000-0x00000000006D7000-memory.dmp

Download

memory/3948-104-0x0000000000670000-0x00000000006D7000-memory.dmp

Download

memory/4324-81-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/4324-6-0x00000000020F0000-0x0000000002157000-memory.dmp

Download

memory/4324-1-0x00000000020F0000-0x0000000002157000-memory.dmp

Download

memory/4352-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4352-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4584-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4584-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4680-69-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4680-149-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4792-261-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4792-118-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4828-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4828-360-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5056-392-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-391-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-370-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-371-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-368-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-367-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-366-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-377-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-379-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-381-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-380-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-378-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-376-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-400-0x000001E4834D0000-0x000001E4836D6000-memory.dmp

Download

memory/5056-375-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-389-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-390-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-369-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-373-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-393-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-394-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-395-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-396-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-397-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-398-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-386-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-387-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-388-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-385-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-384-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-383-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-374-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-372-0x000001E481860000-0x000001E481870000-memory.dmp

Download

memory/5056-466-0x000001E4834D0000-0x000001E4836D6000-memory.dmp

Download