9f9b38d30012bb19d5dd46ae45a37044bfe65865d3f4716cc43c1198ff9e85eb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.4MB
Sample261102-talg4axv5j
SHA256 9f9b38d30012bb19d5dd46ae45a37044bfe65865d3f4716cc43c1198ff9e85eb
MD5 8755f5524b2a0c375cba7ff60ef85bc6
SHA1 12a5944a4f413813075cc473e560c15165a502bc
SHA512 a01d28975d4ca7583abac40cb7c4435d176d80a11258904e47ebf8762d7b904d33471362491ac17e7bb20464fd6d3ca123feacdb7a1ff459fb5a59c9c49c7533
SSDEEP 12288:5cPrGxzQ9TA1ubv6IQ3okt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDp:5czGxmsYtd7mPuI7cpctubZN
TLSH
T13F65021077C1C4B2E9B3453095B0CAB1693EFE341F784ADB6385676A1E702E29E35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3096	alg.exe
1780	DiagnosticsHub.StandardCollector.Service.exe
2336	fxssvc.exe
3056	elevation_service.exe
2604	elevation_service.exe
5752	maintenanceservice.exe
2820	msdtc.exe
4760	OSE.EXE
6084	PerceptionSimulationService.exe
2000	perfhost.exe
872	locator.exe
1564	SensorDataService.exe
5580	snmptrap.exe
1904	spectrum.exe
4152	ssh-agent.exe
5700	TieringEngineService.exe
3340	AgentService.exe
3672	vds.exe
5804	vssvc.exe
1144	wbengine.exe
4136	WmiApSrv.exe
3508	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f99c56384bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9608b07e26add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021d92709e26add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000403a2a09e26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e14bb607e26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcc41409e26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b8d1607e26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3e8b307e26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a19e6707e26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	2336	fxssvc.exe
Token: SeRestorePrivilege	5700	TieringEngineService.exe
Token: SeManageVolumePrivilege	5700	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3340	AgentService.exe
Token: SeBackupPrivilege	5804	vssvc.exe
Token: SeRestorePrivilege	5804	vssvc.exe
Token: SeAuditPrivilege	5804	vssvc.exe
Token: SeBackupPrivilege	1144	wbengine.exe
Token: SeRestorePrivilege	1144	wbengine.exe
Token: SeSecurityPrivilege	1144	wbengine.exe
Token: 33	3508	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3508	SearchIndexer.exe
Token: SeDebugPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	5156	2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3096	alg.exe
Token: SeDebugPrivilege	3096	alg.exe
Token: SeDebugPrivilege	3096	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 920	3508	SearchIndexer.exe	111
PID 3508 wrote to memory of 2028	3508	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8755f5524b2a0c375cba7ff60ef85bc6_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3372

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1564

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5580

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 03edf07c6602bdf659c2d62cf56786d06b0140ef23b3db305c459da5d1ef4e23
MD5 9356753ad82081204f630bbd44041b50
SHA1 3780fc1a7d35c734587706b950ab3da29b1b1324
SHA512 6c7f641579e014ff11e0623ac3986ca1e1386fe6b0008897ac07f02e4a9334ccfb047e9c8813c61fa419dde3b5d4e5bce3645b5d51336c464081134c23e82874
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwWPuIw:B3q6HjBUPuIw
TLSH
T12FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6ca0c674364dc89c49d627c8f0d275475ecff7355bf5a7474fa85e8a8848288a
MD5 8a25606825554f629f32be16bb833577
SHA1 31130ca37898b65f477f132b2797abc0110d2399
SHA512 0082f7f7031a0bfec1cd7672da27d1147ab5548507fa64672cbebad90c57bd9cb25b67a007d29d06a04fea0aa5e42e75f91541d0a715553089071246ed3c677b
SSDEEP 12288:51XLsswWkxy2lRq2czAfkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:XXYfDtczA1td7mPuI7cpctubZd
TLSH
T11A750128A7E408F9ED67827CC8A2C541EA3378554764E78B03E496661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 acf6cef54b95bb7e4f37e0cb758324837fd622490b7f60b7fdf444b1abed2aa2
MD5 d7da83d020acb2d0fbd46317cf2d92eb
SHA1 d78bec4f7543816eff05f84d6bb83985d15b7b6b
SHA512 c558bed903ad564cea226ac815cc5085634cfd7b772d63c4ceaa6446ab25a4b25fa8a2a6e3bfd91d64e65b50d990c283d81f15665cfd2fa9f3114d0e7d0bfcd3
SSDEEP 12288:KXZNYVLeyUji0h90ZD0wxpGZIVuprHsYkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWJ:+0Le5ji0hmx2rMYtd7mPuI7cpctubZ7
TLSH
T199959E15F6788771D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e0531c4ab11008629477b472a2548c45435f0d913b5563f6e46c587c059bc1c6
MD5 42d40af57d88b6dc7c8f04f4e27270c2
SHA1 4c114145cc522d7524182f30f81d66b37d7bb51a
SHA512 d88c3914210f7bee37db577cdcadede715743b893f0c585025baf3d1f36bc36a0d230a9aa2033d4c7f5e2f4ffc8dc8e95f9ce0e4fa43fa1c3a840b32e51fa61e
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuqtd7mPuI7cpctubZE:F/ezSC6vUzPvxHjyXWPuIw
TLSH
T1CB755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f9fadb24b7ed55b0cb642b882c5f2b1fed3600470dc924142b6779ac9a20bfed
MD5 21d4b590502ffe2aae87975193dbc02a
SHA1 93a3c3e5a875c5a3eff69415c090eab69e6410a2
SHA512 937c4412a422a2a05602408602b4bcc0b7c1cb27b1a962e8ebb94e9b3a0f82f82b261c25c86e843f4710a8d3dda4c2a97352faf47158b97033a34427ca5cd08b
SSDEEP 12288:QVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im987kt2VtKqbUb4mNdonIwsI9Ec7t7:QVbqPb88hv/l+6Ztd7mPuI7cpctubZF
TLSH
T1F9559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2910f8bbd47c20384504db5b8deb4c956e21fd1655996a5c3508edbf5d401f31
MD5 73ae17fee074e506233680090791a7c9
SHA1 4da0be9859b5432628c20e81da2d238926fa6e7c
SHA512 43eeaa7dd8b4c2dcf733a986b7786f7462f1b5f39677278fc89cfbb57f7f48033c47f99787391b418c17287cb2156200174c816b5228036a90d9f87b41d22eb6
SSDEEP 12288:vQ0kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDh:vQMtd7mPuI7cpctubZl
TLSH
T1C75523188B1D8CE4FBB7C1B0F0F2CDD27A174E5858AC5752C647F39A1A7913AEA32191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 78aef1357848520fe742cd9a5e8e349c7d3e00ebcee9fe97931569d5fe982e65
MD5 9f81648319c99f0f9b0bb588dfaa400c
SHA1 87eb07d630f1f780b3f776b354b45f474d31a91d
SHA512 dabb6b68472e88fd4fdc690b690f838a8e32ef8cc0777ad1825db386a18065af001749f5469d810054f693a4f51cf3767eac020827919d8b6ff62cc00467a34d
SSDEEP 12288:QeBNUbTVO86UDkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDG:QJIUhtd7mPuI7cpctubZy
TLSH
T1E775CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0f7054cacfefcecadc9e0f07bdea5d614f5b55eda0638f91ad8f3d0eb60fbb69
MD5 398bee5adce5e342204f66e97bcdea4d
SHA1 a064dcf8427a3f0d4c49239504b0a6276cb2708e
SHA512 f9eb5687626d364642cc7e53b1b30bd46d8fd0f5d938cfe747d218554186f8d636051710c1179d866123efd8315b16a91e88b1cc7c57feef589e7a59ec3de7b6
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:wQvGAdlCEL8c/yRNw5ClPuIw
TLSH
T11C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8fdc7e5f20441e9f8ae547bd1a510c74bd5ae0cab3c407038d1ab983361e2fff
MD5 45bd6cb8c48ffb4445ae4d07ef7eb61a
SHA1 6ddcf041d771cdbddb4eaf8d5d686591c0c53fc6
SHA512 ed9feefedd6315fcbb9de2a8bad463d6c05f835a2a8b7b777b5bd9752a3e8842954e2079e3cc63b872af49502c280702e8f2d290f409275095db63c5685d8756
SSDEEP 12288:gAwSfxL/2Dc30DLLmt0LDQewsAjpkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD9:1pewsAjrtd7mPuI7cpctubZR
TLSH
T12075E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 656c0fbcdb3e17057fbe9d57c31f7b24e1d315421ac5a71ee6230737840690e7
MD5 7f1b4326d6c7dc6da54821cfd62a81b1
SHA1 7dd41856bd212559ce28bab079f82f6ddbc916f0
SHA512 c48e78f3eb6564a29e9a29341ab46a67e3a57bdcc7772ca4c43784c49d515fcf6deb28cee8f83870da03d975650afbd063f26ddd15bea1efe5a87396aff0a7f0
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSbw:yUEtQevvqc2W1cpV2EI32S
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 999d6da10750298c5d9753163be6a7b155fc3663f106efebefb8bd5fc3d212d1
MD5 d4d0f5355b5d0f0917ee1c7ec2e1f6b2
SHA1 ecf151a4f567aa94ecb29b16b8cd462cbac12330
SHA512 212ce28ea0ba5a5fbb2b5e306cbc53a62dcf4509f88ddce6d1c0c53d5c721b6fee6a0a966a17a28e930b51cdc458836d5eff44e73f0f02f0c806a3d1133b9430
SSDEEP 49152:oCbRquA/m2yL5zifFiV+XenmE3/zLWPuIw:BoqHVjnmhPuIw
TLSH
T1B6D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e033edd75d79a4fa7d57c37fc90e1e3221ed3a9b41dfa6f5755e192e2b72fdfc
MD5 91302659470416a1142de8b873f5bd2a
SHA1 b491a89154fd01a38d7427886254b9de4e74dd02
SHA512 a81bbe51bffeb644686acad99c2678439c6fdbc2e4d1ac3952798d8fcd92599fa65095b89bfbae3731dfb15d05a0b2a8402be651c095a764a6662d8e9cb9ad5f
SSDEEP 24576:tAhGLJIFoiwtA5l7S53Wtd7mPuI7cpctubZa:tAMyFoiq5mWPuIw
TLSH
T15A359D80E7F945D4F5F3AAB8A9B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c57cc50061944ba0b21da5561367e93d512d14ee7b0e5c82419f97b69744e722
MD5 d1534845e18b728f7a129baf4210eb65
SHA1 c340b576f4fade9ddfc396f45b3364d7c6fff93b
SHA512 849b3de95c40c20ba7c24655acb6ce12bf3a687eef698a09b26c9a3694690d8294f9a3a1fe0d70b3ae5e0fce7a0bffd16db9816ff33931b72b5764005117ce35
SSDEEP 12288:wmw5HEjsChNJBFgl0WDm+CGkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDl:twukOW3td7mPuI7cpctubZx
TLSH
T12D75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b51261e8a24911983f1ffa01bd5e29fa97fed6b958a0e07b7c9c9865363a47f4
MD5 c42f80bb8bba69a0f810a58bf4defd9b
SHA1 74b669e42b026ca50087ee99442c878556511870
SHA512 1e1ca142189deac5077f3edb1438f7eef66b93dec708bd9ac5fbd15e166f59a3a20750c4e1b77c23fb6f825dd12add2b4fbf65c58e319c26ca0d7384c982248d
SSDEEP 12288:IWZ1Iy5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDh:hZugtd7mPuI7cpctubZ1
TLSH
T13A65124823E864F9E2A3C27CD8F18A81E7337856277943CF4616935A1F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b18ba514fb2f4ba722de11d0057ebb38051a8aec0462c4e85bdbf0e403b2fd35
MD5 e4f1cde9038ee69311498aa0cdb3459f
SHA1 d2c4a107b4a13fd5deb73feafa086f060f29e5a0
SHA512 062c9bd438e82faf298616483e50d0d4b6cf5f3929cc7d1b169b8a834ee3d97fe3b75e0ab9d4cf2146a811c61f3a7c89f451b3ec44ac204066de42b1e14755ed
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:sQRQyi36YOcPQLvw2gAf+PN34PuIw
TLSH
T1F0666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9199e155980ede323352d6940902d2ca3bc5cced536231d99bc71eaf198cbc7
MD5 6253fd806143b69020392b673756b239
SHA1 7cae8fd2ef5909b458ef91f0d8d3f91047cfe8c9
SHA512 08e923ecd85f4864518eb1ee0af66933ef0092906a0a1971af1190882dd176eed911535512e580ca2fc27618dfd9ca57b17c27f80076521799ec31d86b3d7bf1
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:jQRQyi36YOcPQLvw2gAf+PN34PuIw
TLSH
T1E7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60610bef33fa38b1014e77321c9f5f9460c880945a0b202986258f04510afd1c
MD5 2b03d36ec91ed2c66c2ee5589bc6b730
SHA1 5d948f46545bc27af51faa825f74c10fb34d39a7
SHA512 38e1222b60b7d0ea84c0b0c38d692ff0ed83afdabeaefa4bcc3fa2dea34e4f5a52c460e8bcf71ad95efeb8b1854c0ea65d874bc7d9951074b8443003810071ab
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0wtd7mPuI7cpctuQ:S68Qg55nhheWu7PNU3/7WPuIw
TLSH
T193B54A33B2F600A9C44DE1769F4A872196D27C758FE0E3DB850572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c1272350dc447ec47254432e3c5ed0f1a6c01e56789ecdfd030d61fefad14e0e
MD5 38831e9dc6af4274f3f4e22ad8bf46a7
SHA1 ec708bc67c634ff2343f18c76ccadf678883fd73
SHA512 41462ba694bae144cd510c0cf8363ef6f03b4cc242747f63d7e707d3081e65b9949973c7a017e8a3749b641f83e14a005a26d5cd07efee2a005c90bcd326fb4c
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:hy5112gYy5azzVvL69nLKnhZDPuIw
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d634b29a7eb6609ff0517ac8d253c1b450b27e769c32e8a4a06e6ad038eab487
MD5 e06ec21a59c898639d607aec5f43872b
SHA1 f79d1fa5a4af8c5205753f3a7c8b5142bef310b3
SHA512 40ea513255dc86cbf8fb16567661b7063eb9db2ac6b4bbdb293713bc44b6a075addb88a75f45f449700b775788f6e89717cecef2d7f3e0f67f895c9293ebc46e
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFWPuIw:pu6JmVxd2dAPuIw
TLSH
T153D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 82dc75bdb4d943f6b93b074dad4884b9b22f7c0ddd4e0b2258dc53c7ecd11ac7
MD5 68b62e020e9882245b78fe46d0d71305
SHA1 93cff8eb00a64f1e0586838909831221a0a6297e
SHA512 efde9273ebc330b8812f3deb5ebc9810f3af9d87b3428e125497868c346a7df33e8ea42585554d1c9f6b26c23bb77ec33ef293d95ed8da229c46c623908a8f80
SSDEEP 24576:whv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3xtd7mPuI7cpctuB:s1hpsNoJpF1A6UU44CwH7R4xBWPuIw
TLSH
T119B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e0238c50150600be8a9c28ae54509a01ecea816335c3d854ae775453fbac3352
MD5 18abcf189f250e78a7fe64dcbe3f3523
SHA1 b05120d1d5b4f230070ae537d781a1c796ed105e
SHA512 35ec0782f600a6318c4fcc1a134560dd0f41dcb07a1c159b5d9ad3a007d20ee6e02d9cd1ffaabaa862a47f89a18116c23570ccffa3d88ea383e1052f170a4e4a
SSDEEP 24576:U4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqgtd7mPuR:ESuZQIY0Be2KRRVtOnks6NMHqgWPuIw
TLSH
T11AC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3e15770c0798dadf4607e6aa2017ec878e28eb964928185aee237cccdcb481c3
MD5 70a254a96feb74d74a7b6239d7467a73
SHA1 f299af69494b66cde013d21e93286c0652f006cd
SHA512 4bcad4732a2fe06896e2e82afa1b4b1c34e9b1f036e2a57238fc53ccca6cd34216df47eacdd93530fdfbeb1ba020fc5c0be8e49f7bf819eb9b54ee6910205c5d
SSDEEP 24576:hhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLxtd7mPuI7cpctubZt:hhtSn8EApI0figngiDn0AP5w1WPuIw
TLSH
T18195BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 aa93da7d49d0a606254f97d0d9060e11075f918db7b41325e31a8835498ac84c
MD5 f52b91e4d70664646ee1dab3e7045416
SHA1 30f4d6659fa9e2addbc9b2a469b991ceeadda262
SHA512 561c8ba4608ec853100d714f22cb2c30fe089ae3c47ae78a153fe925a96b5f399ecf66ffd4f211e7c18c6d6151ae85fe8c1310062e2d386409fab19f33a1613b
SSDEEP 12288:eckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:e0td7mPuI7cpctubZf
TLSH
T1835523089B5E8CD5EA63C1B1F0F1C9C1BA1B4E5DA8AD1352C74BF2172B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 02f08a2e1c89c5c59bc25a1d7c71dfe587f35bf69b33c4fd567714cd40dc0c98
MD5 cfe4985c177cc8890ef7b42e20152dbc
SHA1 09d095531b321da445a45f7a784da6c89d9dd443
SHA512 0c3a94ca715f064a60ff17007c2457fe0c579b8ff5420d64b5d3223de3dc586615f9812a6747167ed324d2e8e53c182b6bdd5eb44afae690f27b579f8b328fe7
SSDEEP 12288:wFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDD:wPtd7mPuI7cpctubZn
TLSH
T17A5523189B6E8CD5E667C1B0F0F1C9C1BA1B4E5DA86D1353C74BF2172B7523EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 79efb9c4a8b9c3c061b1b2fb1664eb55136b0f2cab88d5db46052e529b7c3ea5
MD5 351c2e88f295f8bddfb59d2f22f104a0
SHA1 5f43fb41b4b6198ea48943b27f332d3ccc93b150
SHA512 96885050056d2cbecc86beb44625b3bf7f4b535cc476f1442b81eca67767a456af8646f95086489fd1a1cedd8f5dd4be7d34adc5a806060e2d72813253332d79
SSDEEP 12288:Rrkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDO:Rptd7mPuI7cpctubZK
TLSH
T1955523189B6E8CD5E667C1B1F0F1C9C1B91B4E5DA8AD1353C74BF2062B7523EAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4a39e30ed2946fd3c59d6507c1d240026ad4f5192955e1d778d04fae5e8cc4dd
MD5 839bafa2f5b470332b96eae6554f7071
SHA1 b9132bb167f4324b000192ba428bbb7585c81425
SHA512 9e6d938ad04dbd1e598a2791c3846dbd5919d41a986f61e44a17ad2926bfa81184d2d29f3ee263728b402da6afe6eeef825add0cdb1e4f95941539b0c03a1d48
SSDEEP 12288:aVqkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDk:vtd7mPuI7cpctubZo
TLSH
T1325523045B6E88D4E973C2B4E4F2C5C1F6377D98A939539BC702B24B1F71379AA31A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 b48d29631257ebf6ce75926e94a118f975c6a36d06e865079efde36dfcbe6f4f
MD5 1174045eb33d1024c60083193c86a275
SHA1 a016e564d74138073b5d87d6918469c4212bdcbc
SHA512 0d8c23636c78427d258e5dd9f00ce35c89e7ee2ba0bbe26fa1a1350bf556aa4da43175baa76a7799d38b9857b3bd903ad7838b40782cb5028568ef9bba3a5576
SSDEEP 12288:1Ckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:1utd7mPuI7cpctubZ9
TLSH
T1DB5523089B6E8CD5E667C1B0F0F1C9C1B91B4E5DA8AD1353C74BF2162B7523EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 8d08451a8a54304314b8a532a4f31b816d6d0b86212fb4a1ae9d0c1fbbe20fc1
MD5 e99e08ae4df66c76fa58573968de188e
SHA1 cb55d4564a7c6154a242c6721390471070952a45
SHA512 3e7c49671269ce6bde23e7e4f3acca9edd472ce7a4053c85e8818283dc9ad10e7c27c2e234b63dbed17e33afbba4b50d6d8e03c7a7a0b83049780c4aab668ce4
SSDEEP 12288:BRkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD6:Bztd7mPuI7cpctubZ2
TLSH
T1155523189B6E8CD5E667C1B0F0F1C9C1B91B4E5DA8AD1353C74BF2172B7523EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 95ceb6b1a05409a78e14d2ebbeedcf123854ef50a7daf214fcafd523c7da79ec
MD5 22fdec8ad0cd09d0695631078a3765bf
SHA1 40d2194c463a5e060d46762245dc29156c07afeb
SHA512 1f9b174b62cdb532b94d7041374e729967ce9948f82fcc5cd7ed30101f5ea3df7bd7990a99595a093b5d181444f6b9540bb09c1a26a6570581efc04e49e5f85a
SSDEEP 12288:f9kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD8:fHtd7mPuI7cpctubZY
TLSH
T1035523189B6E8CD5E667C1B0F0F1C9C1BA1B4E5DA8AD1353C74BF2472B7513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d50f6ffeaddd65b733133806975d2ef084d8d503619934b98c145fc3e41b9d45
MD5 2104fa6a151f72b7c42b347c0b1f13f8
SHA1 55cc614dfb791782e6587902a9525e7955a019ee
SHA512 16466e46ce87d9299b72b081cad0b2b40d4c73de061d5789d7d9d76d7a78f37c2e6beae29ccd79dbe41b790a325eb3abbbe208127839a8886defea7edd346fcd
SSDEEP 12288:siZwbGzzFEoS2cPvylkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:PZMGzFVSOvtd7mPuI7cpctubZG
TLSH
T16F750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 42bb427417bcf2f0cae594fc707eef196c3db7ca4559ab6bac80ef525a78d9a3
MD5 a72191eb996aa5d3b01e87595a514beb
SHA1 cf0c199f45db3378ac42b95df00c69b3dea009f4
SHA512 72595798837d56463ac68324490e2648e58777d45eca2606bea2041ad258f2e36e275e4160cedcb730bbaad5ea7f3e6116dab6005ddef70b7b36513418098d6c
SSDEEP 12288:yQkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDL:yQtd7mPuI7cpctubZn
TLSH
T1FC5523189B6E8CD5E667C1B0F0F1C9C1BD1B4E5DA8AD1353C74BF21A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 19833180c59e2ee93385e3bc02d9d6867ccf216ff98430c811e3ad43be8cc10d
MD5 f2b29b38324330818d09a6c9e969ce3b
SHA1 7317443425be0b39efd19a801a02d0d158c915a3
SHA512 b5b56445c684646bffacff3bfe9010e9cd774bb7db652d4e82e4e1fce8fd0d4e75f8571d862f91007cc04b01afeba34116252b9d8c60bc3b3122daf6c67c42fa
SSDEEP 12288:7Ekt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:78td7mPuI7cpctubZx
TLSH
T16A5523189B6E8CD5EA67C1B0F0F1C9C17A1B4F5DA8AD1352C74BF2172B7513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 17742d576b03a0e77f7ad78ebf8c66a38ad2dbf46a1ef3308b98a3b743f801c7
MD5 6494c3aff4393c17e2d9136efe4b6f4b
SHA1 a598d0b56228342d2090eae679e0fc2a2ca19038
SHA512 59120655e937d91a63caa726c601bb2b1cf57459e1907bbf1851e5b6f5ac2da61c7a35f22ec9765f16965f1c0f91da8ccb6974a1dfe9b33c3c66cbfd3cd95a2c
SSDEEP 12288:eyPz5L85kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDY:Dzybtd7mPuI7cpctubZU
TLSH
T1AB65120777A520F8D177C278C8A24A82F77678354B248BAF475453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 7173fd482b68c23b10837a571669ba4b12d8a3c8669b2be0d9ccef50ab89a587
MD5 3b27543b37d883d829a6c11af701b520
SHA1 ca5e69aabeccef10581d6ef100a01bc4b25be5a4
SHA512 d2936f897da0e28cf543277608afed7f67ddd4538aa4f72470ed1b5c9b4014ad4b2b4d082bb6e005b3deb834aeb626724ef2f022aca85db2e6b1f381b7542b11
SSDEEP 12288:pQkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:pQtd7mPuI7cpctubZR
TLSH
T1C25523189B6E8CD5E667C1B0F0F1C9C1BD1B4E5DA8AD1352C74BF21A2B7513EAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 776e93222a1c2bd4d9e12660a3c66b5df05198f3ab55a01eea4795e8a188ec77
MD5 be29803e0ad15da7bdbfb1cd915e7da2
SHA1 7d407c0600446980c70c5ad26e40f24606e6c1e5
SHA512 d4a0f5f9760620b52635b242ba96dc5fa4edd39810573d354b1f052fa1aed5537714b172a1de6474937e264200bb68e3b1f37d686183d80599f5bfba6ef0b5b2
SSDEEP 12288:+Qkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDpS:+Qtd7mPuI7cpctubZ1S
TLSH
T14A5523189B6E8CD5EA67C1B0F0F1C9C1BD1B4E5DA8AD1352C74BF20A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3552793d2392b4674cc46b80bc1b381e3aad8cc46ee08100f1c663abc57a97b2
MD5 058fac120185874d92e04560ffe1fc45
SHA1 f8a3a2a5dbde6504e79941eb42fc5749c3eb3b75
SHA512 c8d3d99200dcfd739bea6e364072483932b63695dc09f7dd0e91b4ab623abee9ba46abd3c9cd48c594ca2a251508cf30dba22bdebdcf5000e1d0bcf09e8a6304
SSDEEP 12288:lyPz5L85kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD1:szybtd7mPuI7cpctubZx
TLSH
T1C265120777A520F8D177C274C8A24A82F77678354B248BAF479453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ec6454c5dd0a88980ece5ad49436c8471515a95f7ef74960caec33d0a1c54524
MD5 e0b412ed07fb06c0dc1ccad04bae54b4
SHA1 6e2be1fb6f3798f8ecee1ddb257eb3d8853ee853
SHA512 2b64159ec4448af6d9032dc7767f301e45dd5edcf66d1de9a716459816277d36f699ab3b336ed5c9367e9c9103e2ae3af83ede6ed3fdf3ced379afc1348b51af
SSDEEP 24576:fcP4mcvIjkGOxhKP2l71SNKbrh/8KBotd7mPuI7cpctubZI:0P4m4IpOO67N8KaWPuIw
TLSH
T1A265AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4f61cd9f8e9497cff82deee5625a429476de98c9c8f7845b09ed18e070655de6
MD5 124ffec8a2e81f839247e3d474428857
SHA1 15de3e9f85c7bd9c88fe4d3effbe1c2590ab86d3
SHA512 0467696b412126802f8a8f85e680b423006e5969ca959d33bcdc728d54e09ad0164cf05233a340dc80daf402e26cc3a0b57a52e9d994c95947640a828fbf6fab
SSDEEP 12288:v8sfAkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDe:zgtd7mPuI7cpctubZq
TLSH
T1CD65F108D39841E8D06F9275D7928A81B7337C2597E193CB43C1F63E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e07598f1b06bbb75da88dccd685694923c01d34a5a60f5069e862e893f14d52d
MD5 bb348972a2527cdf29ec41de17bfc1d7
SHA1 4ac6068837463e71d1c137bcbb4221da11941cd8
SHA512 ea035edb32a5d0e1271b18db7ed64c855fb19d84df51702ee4273d85f398aaa25ee6eaef6be1fb5019c76f58e9ea5d2bd280d700de80ec916a962d43a7ec74c6
SSDEEP 12288:Xgkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:XAtd7mPuI7cpctubZX
TLSH
T1D95523188B6DCCD5FAB7C2B0F0F1C9E13A1F4A689D684393C607B35A2A7417ADE32551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 24418e28e8158345be57526450fa76f8982bcfe710ee24716d23f2962aae82c9
MD5 d7c988c1bde8de6fe9a33cca1f7a4647
SHA1 d1d408323fac15c1ec9e8c8d653f05818b8bc5a6
SHA512 46017b0f5eabeb5aec43d8d1977a8f59fbcf422aed60717c3a3077913f48606bd560245f32aa5ce9f6107b7f430481bd5adf8be2f382ce7e0e8c1c88b3eba173
SSDEEP 24576:goiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bqtd7m7:ga0h2GEkuAe73q3pp46zwwQuWPuIw
TLSH
T1D485AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 3510076e02ce702cfaacb103a9b260df487ca589f61f565f6b8115030c50503d
MD5 91cc8bd622e5d5319015f1a18a8baa49
SHA1 230918f32afdf950123e47d399d99593068375d2
SHA512 35bf95f94130090610f9f97e373fc950c3c55ce3cf209ab85a0f56a4361016bc3afb3da9a95e3b928651083cfc319f398949f4fd82cdd7fe22cf1cce3383df0c
SSDEEP 12288:GhbHjfX1kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDT:GhbHjPftd7mPuI7cpctubZ3
TLSH
T1D765127D17AC14D8F572D2BC95A28582D732B8291B2593EF4382927E0F37AE85D31F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 73d50aa730d6586e1ca944b7fa8b1249f6690f3a84a0cc578561820e72c09122
MD5 b762727ef8764f779f89f5f9a3041a43
SHA1 ec0c01b0f7d3b22c8e6ab43b08a33c41b96517b7
SHA512 db3d51147304c294dd817a6292bd465447438a8369e1fd90fce7ae5716795a3487c0c93ce535f3f3a5068140cc1bcbb85c2283fd3121bb44395ae58292083c11
SSDEEP 24576:Q3YgnJcRTk4yti+R5dpR/3td7mPuI7cpctubZj:QIgnaTk46ppR/3WPuIw
TLSH
T15345BF2DF3B910B9D8A6D136850147B5FB71782D1F209ACB0170C638AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 5cc6c9b44d4e69d5062baff01f4b3d8c9bde4e9545c3f2b25533a83d0be401d0
MD5 1dccba153083a219485f4f4329adfffd
SHA1 66e0e365015ffe3066342eb2679c1ec100655004
SHA512 15e303adca1994250ec3d6bdf772d5253c85daeb9d521ee0d9bd613cd27f64ddc06ea0a43d046c00b5c0e1d5134bf7e68301def66b9de85614b14053b8cd46e1
SSDEEP 12288:UUkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:Ustd7mPuI7cpctubZT
TLSH
T1515523088B1E8CD5EA77C2B0F0F2C9D17A164B585A7D13D3C647F25A2B751BEAA32580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 1ba22faaff0fbdb7f7d6e6f6be526d91a2d94f586e311836f00a54c7bb0c4f1b
MD5 47c664c14ea6335e8584d84002bdc909
SHA1 435d3b11d5da82a0ddcef74aeda621a176da14cf
SHA512 ef9b331cca6297e71804e01501f6d2613f92bbe11f299646ea45aefafb56dd2d8da2b3ac6ae507048348259c3d0eb450c00bf1d9273beed092b98588f457db39
SSDEEP 12288:cObpA4LWOsvAYFTfkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDd:B9L3UT1td7mPuI7cpctubZB
TLSH
T17485F154E7A504F9E977C13CC8A28A12E672785D0764E7DF03998B661F233E64E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 17390335cdaa1342cdace967c164009c0a5661b020cfbc2ab85999e01e713c41
MD5 64e1fc4fae7d61dd6b20717dd6055e19
SHA1 b8287e5238557f10cb3443cb2f3d8fcee39d3b93
SHA512 09bd971d67d16cecab4835d168f32109025a162a0a7c8552222375f0a94c3fb6fcca40b90fbc714f7c8d57f1431c6fa65a516570f127dee6bf67b9dac8ec34c1
SSDEEP 12288:upFttOjkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDT:wOBtd7mPuI7cpctubZX
TLSH
T17465121937ED00E4E576D17CD9928289E732B8650B2653EF4280D17E1F73BF8AC36A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39b28582a625df37a3e3d8c7e9b8b161ff2d1bf893b05859642cfa3ff833293e
MD5 bea9a7fec540e32807ec8302ee20f3d3
SHA1 2d0d182af2f79a0809c267b5c8ae5ec9cb9c6adb
SHA512 2ee6be2293e3cce30ec953c3386f278431b5fe07dd771475c863a7a2fd7b2d84e896e4933382e91d0a4112216a51a4700b2737b62ea5157d58b1ad55fb8ebf86
SSDEEP 24576:l7NM9YmZqmWMUkPjZM48Mv6bEhsQtd7mPuI7cpctubZI:l7cBWMpPjN8DbEh/WPuIw
TLSH
T18B65AE2E6BAC81E5D477D13DC9E28246F6B2B4611B318ACB1152833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 42b59bd69b96f64bf9c72a75438c09ea3a6c71d538b8fe4c8c678f0f4138a68f
MD5 b015b4e4b1e9eef00d36e8ed034890b7
SHA1 535f5b6d9b5d1b3504b56415319a70cb02dbfdb6
SHA512 d2ae7e626367a37b19e6d7ce74e9930542cfdab0d2c8609d357e910b19b819bff7c69cc4e52e97797b1f41bc7430677127a33ad019c24186a9dd9627dcfdf3f9
SSDEEP 24576:cW6BApg2YuyuNDYTabvcRvNYf8km1itd7mPuI7cpctubZP:cF2YuHNETovcvNYf8kmwWPuIw
TLSH
T1A4858E2927ED80A4E0BBD27D45B7D286FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 21256ef17686b8cf080ce46b178a4f3c6bc4d2166d9a24827246f117c508817e
MD5 1fedc7789dd2c62abdb3f22b3ba2eb63
SHA1 320476db26ef865f5c1fb465b6c95145ea6af148
SHA512 bf569626f3601e290fb4cb24642c9f5b40d195a09f8fa4bf6cebd3fa6d63aac9c96e85677459d8bfb3cf436424ce8d5b24f46ec1aa3ff6e60af5dd5889c7a8c0
SSDEEP 24576:2AFs06+Omlf3NXEbTo9td7mPuI7cpctubZ1:fFs060lVXuOWPuIw
TLSH
T14E65AE2F63AC00D5D07ED17E8997C91AF6B1746707255ACB0260863E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 a711587bd7f32c752ae7f5fb88fc8603db858daa749ea9a5aadf535b604a4ee3
MD5 2f8160136819647af96fed3973b2af80
SHA1 25bd871f2074e4dc12472496b15519303e4fe81f
SHA512 814e146e8680d2197dbaa365031a6dc758431974970ad2128e7211c5b331908f33087aa9fb2debe9c3a3d78081bbe05eeb754f4bf65ae4e4b533090cf1eba7dc
SSDEEP 12288:yCJnJ5D3VkrZzxwkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDu:zJnJ5D3WJOtd7mPuI7cpctubZy
TLSH
T19175D02CD2A810E8D4B7C2B4819A5B96FF72383D2F266AC71464D5353F22FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6665564a18706789de49d4d749b34dc45076ddc6153e023b2f92631d313c26b7
MD5 48f8e4ec6f59b92a67600bf6f4ae870a
SHA1 e6a0fd5a07846ae9cf73382d3a57ff88a6150d61
SHA512 ce4c398de8df3923ba24fce8cd5d7d45c7a24229cec74e15c638561b2ed1d89f95440ca0a4deb0526564f62dd56c5e2960f5ab3a19a64066b99c99f1f3509470
SSDEEP 24576:GEPohm6/7IIXdwcXrif7qQncjlP65i3Vu3td7mPuI7cpctubZ1:Bo06DIKdwc+eQnSt65aV0WPuIw
TLSH
T197956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 975f62d95315409ed2b557c64810f629dbce8dca7fd5ae7fe028fafa8e7ee2aa
MD5 512905279c64be6cca0c08acdbe973bb
SHA1 744ea0ec194e4b14cafe4faaf9752576f991c1ef
SHA512 d019d1259dca576c3a76b4a04e096fe6612258b66a30e9fd0abda981b08a43f6ca5221dc888d8e678d10e72d0e370fd5ee34e4cb6acffe80dc4c67c469453a5a
SSDEEP 12288:YEP3R/Gkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDr:z/Ktd7mPuI7cpctubZf
TLSH
T17B65126C67ADA0E5D127D17CD0A1C581E372F0642B6623EF4682D23E0F776F96E39A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 56012ed4dc1f7dcf3df07ee38960e6448c498797a038cea3192f50b0997afd0d
MD5 f735b6e8dd7adec2a4b6066a7132e858
SHA1 294cacb048f052f043984b2ad7b46b2a03216068
SHA512 de38cb491e5af12471cf3fe44630c40f8517f9b3a9dfa301368fa8b1ebe6bc98c90a1d0c6a62bcf6b91c3e17a7ae6ad5caf7f09f6d995938715146e665c39700
SSDEEP 12288:HjkyFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD/:HIyPtd7mPuI7cpctubZ7
TLSH
T12C651208539894D4EAB78278E9B2C1D1AA36BC205F2553DF8181F33E2F367E5AD31B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 8c3553bdb58ff5a0dabfe6c5df03f8087691d6236eda9a579ef0276081be8728
MD5 c615378dedfe616fd450570d4dcdd32b
SHA1 afe5a79fe01f5271bdd2ef29aa50e4babe61ae1e
SHA512 7cb2026819bc81637798bc64994fdb765b2a2b2d97fccfd569a521a2d1a6eaf9c29bebbc068cfca300b5eab56bbca741af93815c2e3e281bd456b81ace2a8cd0
SSDEEP 12288:xszkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:2xtd7mPuI7cpctubZn
TLSH
T11255231C572E8CD8EA63C1B4E0F1C9C166264A686B6C23F785C7F3761B751BAA5329C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3d28093ca1f8d6fd1e15b8002341f909ec0fca08e8685ca75a7e40879d704594
MD5 334ee44440b468914fc90501273c4b8a
SHA1 e246f9a02644680fbe4a1eb4a077c23372a33c5f
SHA512 de09c9863a6fbc240ff3cdf4d7855c99e7b79fad74de4437951e873688a97989b043d3a7038de2ca863ea49f365240c5ba537243e2143af60157f24f8c7d2fca
SSDEEP 12288:RLQZb3C97GYnZMv5zBcKY97MD34kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:pQ9MxZKdcz97w34td7mPuI7cpctubZz
TLSH
T1EA557C2DABE9099AE177D275D4A240C3A633B4301B35D6CF2449D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 a13361458633e69ffcda1f57455491042f41e3fc062fbb3c7416f875cd40f12d
MD5 2ec2b9267677e8bb956dd663e016cc59
SHA1 2382edddd3bf6a48a9bf3fccb72ae341f596c530
SHA512 1cfc16211597b227a1d1210819232e9f7b844ffc280b7a44259bac2bded6c5cdeb5cc54616c12625d6877a7e438c428d4014cff546fa4a8328c934b19b41a30d
SSDEEP 12288:6yoKo2TRple9ppkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:6yocVAprtd7mPuI7cpctubZp
TLSH
T1DD65EF1EBB6E40E2E176813C89818685E773B0345B6253DB5682C33E4F77AE9BD34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 13debe2f5277c81eb96ed3dfb61032db702a2edb69a04a871a6bae25c83c8b19
MD5 24cdca3a80d2f80fd221cce02e94a732
SHA1 28cdd63eef5aa2cbedbd5b13abf53df83ee316ae
SHA512 ae912fe7f8c5cb7adabe324330083f9a99c789ec75d2fc696e2b36edb3167eb7722ebe3f0ab1ba38eed48ede319e1663f4a8abdd71e72581792af1bbf298526f
SSDEEP 49152:+WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKrWPuIw:Y0zuNIWPuIw
TLSH
T1D4A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f520f717e2f0f39cb6238fd9cc8a0561450b3aa789f43ac3b4b9c1def18d40e0
MD5 b6c1eff72c9e8c1c7d496395cdafab1a
SHA1 1e47ab1f5090c4050bda5d6ad5d340f5700489ed
SHA512 9cfdc1bb5dd373a0f3b18a9f20df343d820b5353b3bb752a2e4cb108b66280cc9d4998161bf6a1944305fdf8da5915b2f4e996f85d4885a1d25a9a50509e89e8
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqbKtd7mPuI7cpctubZO:8TDxR+N5YzTfjMhWPuIw
TLSH
T14855B02EA7F905E9D1BEC5799A23C512FA727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 4aabb3376b0ffc9fe5851dd12509217d6ba03707245f9d4ca7661bb55f7444c5
MD5 81754a1d39e129aac9167d0dad3f9535
SHA1 468cc2abeb00877b38aca5567f4a24706dc010e1
SHA512 3ca4cf5a7fb71d6ac78333ac5d6388da1208bf738d040a1bb6003ac113098b98f55a9fb3d2051b50df5d2e4edc8ccb94206703ca6c71ac97040e1d7449ace016
SSDEEP 24576:NTMdOz0FFS+mmSL2td7mPuI7cpctubZU:30K+mmSL2WPuIw
TLSH
T1DE75E13EA36D04E5E57BC27CD653C906FA723465032166DB0690C17A3F6BEE47A3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 1c0b4d345314df6680b74ca76291a5491f78f674eabaa3ce3c4e0f8d52f8f0d2
MD5 3a6caec2da1ba650b54bfb00d4c2a820
SHA1 4f67b7450449eb70f6e38f6d143ebc1ee9d4b837
SHA512 67427a4a6f3c54f630b5b745a5e458ab7808c11c9d21ec607386c49d8b929e0b2a7455d201e729fc98e189c9c15de33983054d55d845000a7bce5951b2c15b13
SSDEEP 12288:B4Pfkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDH:o1td7mPuI7cpctubZr
TLSH
T18855120C57EC64D4F573C274E5B28682A632B869272813FF26C1E27E1F362E9D931B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-387-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/872-137-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/872-131-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1144-226-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1144-232-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1144-396-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1564-388-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1564-147-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1564-141-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1564-488-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1780-26-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1780-35-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1780-34-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1904-162-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1904-390-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1904-168-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2000-127-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/2000-122-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/2000-386-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2028-478-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-475-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-476-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-477-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-474-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-465-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-464-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-469-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-463-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-473-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-472-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-466-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-467-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-471-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-470-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2028-468-0x0000020F66C60000-0x0000020F66C70000-memory.dmp

Download

memory/2336-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2336-49-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2336-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2336-38-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2336-47-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2604-383-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-579-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2820-409-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2820-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2820-88-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3056-578-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3056-59-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3056-61-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3056-53-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3096-13-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3096-456-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3096-21-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3096-12-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3340-193-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3340-202-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3340-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3340-199-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3508-295-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3508-461-0x000000000D0F0000-0x000000000D0F8000-memory.dmp

Download

memory/3508-263-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3508-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3508-279-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3508-253-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3508-588-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3672-212-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3672-393-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3672-206-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4136-398-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4136-236-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4136-242-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4152-391-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4152-173-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4152-179-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4760-99-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4760-105-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4760-384-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5156-8-0x0000000002290000-0x00000000022F7000-memory.dmp

Download

memory/5156-1-0x0000000002290000-0x00000000022F7000-memory.dmp

Download

memory/5156-0-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/5156-408-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/5580-158-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/5580-152-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/5580-389-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5700-392-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/5700-189-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5700-183-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5752-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5752-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5752-86-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/5752-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5804-222-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/5804-216-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/5804-394-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6084-109-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6084-115-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6084-385-0x0000000140000000-0x0000000140163000-memory.dmp

Download