Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 11:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 748KB
- Sample260504-n2j6fset6n
- SHA256 9ba288eb4983c43b0a8f06fede646c4de3831824749bd50949e050c12a073c1f
- MD5 ad5c7aa13cf03a2e8c6d62af7899dd1b
- SHA1 ed959332a371f6153634fee24fcf609bbf903bcf
- SHA512 010f200bd40e9030f16b92d70cde121c44e98c16ff1c9949b91a23279eb8051bd73db5f278e1cd2ebc0cc8e53f9f3ff4dc00380488d7e485a9f32dfca925c3dd
- SSDEEP 12288:T93G6vHzOASubviBNDYa36TwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:TVGGTWBZq0a1aytr3keO/nJNv03
- TLSH T109F4011173C188B3E4B6197406B08AB1353EFE713F2095AFA3941B699E30BD25A357B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5424 alg.exe 4928 DiagnosticsHub.StandardCollector.Service.exe 3332 fxssvc.exe 3368 elevation_service.exe 1180 elevation_service.exe 2364 maintenanceservice.exe 3932 msdtc.exe 5028 OSE.EXE 4632 PerceptionSimulationService.exe 4612 perfhost.exe 2816 locator.exe 3560 SensorDataService.exe 3888 snmptrap.exe 2340 spectrum.exe 1660 ssh-agent.exe 3840 TieringEngineService.exe 5376 AgentService.exe 1284 vds.exe 4332 vssvc.exe 5604 wbengine.exe 964 WmiApSrv.exe 3852 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\35d12ab9958e99e9.bin alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\java.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deef2cb1bcdbdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f09bd8b1bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7bfdfb1bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dcce7b0bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087398ab6bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dad3d3b1bcdbdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fc382b1bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c15cddb1bcdbdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeAuditPrivilege 3332 fxssvc.exe Token: SeRestorePrivilege 3840 TieringEngineService.exe Token: SeManageVolumePrivilege 3840 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5376 AgentService.exe Token: SeBackupPrivilege 4332 vssvc.exe Token: SeRestorePrivilege 4332 vssvc.exe Token: SeAuditPrivilege 4332 vssvc.exe Token: SeBackupPrivilege 5604 wbengine.exe Token: SeRestorePrivilege 5604 wbengine.exe Token: SeSecurityPrivilege 5604 wbengine.exe Token: 33 3852 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3852 SearchIndexer.exe Token: SeDebugPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4600 2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5424 alg.exe Token: SeDebugPrivilege 5424 alg.exe Token: SeDebugPrivilege 5424 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3852 wrote to memory of 1264 3852 SearchIndexer.exe 116 PID 3852 wrote to memory of 4280 3852 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_ad5c7aa13cf03a2e8c6d62af7899dd1b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5424
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4924
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3368
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1180
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2364
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3932
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5028
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4632
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2816
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3560
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3888
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3228
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1660
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1284
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:964
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1264
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
PID:4280
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 c5dc4165452e91e9f18146f52e0560e74c650159018ba7da1f99237ab96ab45e
- MD5 7e8ad7a88c7fb0fe0263df33ab2ea58b
- SHA1 1ea7b8c1db0df2d8beff4b50cd9889cc2b900376
- SHA512 b1e8f1e0f1bbf5a634473bb44410327e8e9c988d7ed346b4d5824ce8f2d21c86036ef8a5925c001ad6a41d0a1fd1f1bbed8bc82bf7b9c633316d2012f9c04edc
- SSDEEP 49152:5b+632BuPkFKRrdE6oh7stBhuXjfS4LWxntetr3mJh03:P3q6gjBG0mv03
- TLSH T12AD59D03F29900E9E06DD1B8D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 dc3d4765973ddbd2f06cd8df30b04c1842e8e67d2c81eaf42460e795891d9c34
- MD5 4a0ba9ed521ccb9354ebda6879c4522d
- SHA1 85effa651c8f7787697abc9c149126142f733956
- SHA512 786488fd06dc3235b062a10e3b2460a27eacbbc88bfa6d2e59adb6d44fb7f395a711285565d9a21a18ff54d3afb16ed7aaa59862fa37a8c060ed569ec99e9c6b
- SSDEEP 12288:w1XLsswWkxy2lRq2czAaTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:mXYfDtczAa0a1aytr3keO/nJNv03
- TLSH T14E050128739109F9ECAA81BCC9A28515F633BC915360F35B03E489755F237D45E3EBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 832fa033e8d6ca5411b59d818ad89a590afb1aff5dfb24e0ee31922a3d94faac
- MD5 f069139fe91fba77660c3705ea37a793
- SHA1 a8e4ccda59850050adb713a9378be0315108b858
- SHA512 55586ceff03bde29bc8b829ccb4ea2bbdd35bb7cd62dbf0e978f246afb0345d03b5d48f55dffe143eb7d8e420cfe5dbbbb146907efe911aa6508bc52ec4fc354
- SSDEEP 24576:n00eWzJ0hmxOrMN0a1aytr3keO/nJNv03:nBzJ0AoHetr3mJh03
- TLSH T12745AE16F6748775D073C0B9C5D2A69EE932308257308ACB4286C77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e316832b91804b74025c32760110ced754dc3fcc8974bc991b3ed52705945cd0
- MD5 0badd2e69739822fda3182178ddbb6c4
- SHA1 547d3396720c5204f4c153ecb8c09648a42cdc8c
- SHA512 7a73c7c6c580649b6fd985fb4ec760442df504e49cd07ba66e3f71f393305aad9af9ff994f9f7fe490f68916afa87a77505c2cab23378608f3cd1b620c58e6af
- SSDEEP 24576:e+p/ezSC6vUyD/aqgrvW/6q8wyuW0a1aytr3keO/nJNv03:f/ezSC6vUzPvuHjyEetr3mJh03
- TLSH T16A756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 4fffb69efe6e040f51493c68b71ca1f6c6efe716c45bb2ae88fb7b37a22946d4
- MD5 f1bd625b5542c81dc4f09d43d77334b7
- SHA1 61bd3eec90561b18c6d5e97bebfb6953d01a93b8
- SHA512 93ee61bdd6a278379226d7173d3c97e8da85eb02e20c1d196d72f5aa8529ff5c6539eed0dc7adb2c106d962f9a7ea2d168f1e59372bc4ac101af26fbf7112b7e
- SSDEEP 24576:0abtPsDGFv/l+d10a1aytr3keO/nJNv03:0a+DGFXl+setr3mJh03
- TLSH T13355AE66F6748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C3E27BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 fcbcf8bfc4840744b67cb64399bb49c730cacb4c8e02d8a0bd1762792e03ef81
- MD5 a0819aff8247e0020b49ee191bc657e4
- SHA1 750dd9e1dd203dd7eba3df514ced543994b8822c
- SHA512 fcfcff04ffc8f0996e9fffc70d4b86f14458308925c348966da188c059a30d3125e763ac3a76e8f39fc79bcc277282ed00136beb6f8a659a429181e1e33a615d
- SSDEEP 12288:+vpTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:+vp0a1aytr3keO/nJNv03
- TLSH T118D42305B3154EC6F1FC6CFC66F50AAD353A9FB27100B128E8A41DA4D516FD2A2A12F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 70be47a76a754c1984b309b6d85c4e1375c5671703f033860979abb8dd9a8795
- MD5 55e89c38013935b77d32d81eb9a8e0bd
- SHA1 cbe427c4db6e6bfd9ff3b41e1b31f235e707dd4c
- SHA512 252cb310fa6c3b2e1cb9d2b3ef90b7980344f5742c7d88224dea593cc0dff0ba0cca6e6eeb7abfaf39ffff79ac7d449dbb9bfb80ec200fc1eaa88d0951df6dcd
- SSDEEP 12288:JeBNUbTVO86U4TwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:JJIU40a1aytr3keO/nJNv03
- TLSH T16C15CF3BEE28ECD2C27E9CB85B918740A77278715B11A3CBE174820EDE136E15E75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 098397be7919ce11d68ef1ff3c1c9e7b01c6c718701bbd56f5450eeb740fcdcd
- MD5 46fcfafd3b747faa677d632cbe4069f4
- SHA1 d547efbb73de3bb9ae31d34bec5c3c7bcb66dfcf
- SHA512 1b1f462be7bfece5a819030588f6ded9433487dd2c01c8f4547533afa8afc5a22375ea6e7825f80fd79a1003f19bd232833314c2e51d6cd40c3574a59ca5e437
- SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ69DN5J6NRV3THb:5QvGAdlCEL8c/6RNG5CL0mv03
- TLSH T1FC367D656BF880F5E0B7E178897A85B2F77678421D31EB0F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 00972923769bb18541e184d030bd72eeb63df4338963c40135631a89f4bf3740
- MD5 2c1991588d12517c2742d438a6afd8a3
- SHA1 8795d54d670486b9f9f1aec5a400c59e09364365
- SHA512 eff24fae26f59fdae80ba54048a076f85cb5ab4125240d96526349c9f30d2f9b232f0e02e2458fcb0912aec84dac78fd3deadab67e52eb3bbde90916613d0172
- SSDEEP 12288:xgwSfxL/2Dc3bDLLmt0LDQewsAjbTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:2mewsAjb0a1aytr3keO/nJNv03
- TLSH T1FE15E031FB35D436D2BF0CB61B36C71A243DBA605B5129C3E3E84D9D99206D22376A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c5b5eb334fdf8f43895d68ba3d26d5dc75bd06e20b6dc6b75d7858f5dbe7f477
- MD5 2285d21cf73197735ec1ed2e5d221c7e
- SHA1 e14950555a67d92e5f798e60b421cfa3fe667336
- SHA512 efba44ca62c7caeef9d8f5ffebb87381c358bd9ba5610c09de97b3b38bef32452576a74b10a0bfca4bccb2c6dac1d46647a02d2afb98e66f23bafd242811f89f
- SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrqdPlbuJHA5rR:DUEtQevvqc2W1cpV2Xri24R
- TLSH T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 5e19ed0bf9f34fad3db051c912d23cef6e607e890a61ad5166826295c239584c
- MD5 9ddd068f243c9fa75a796f6585d5061f
- SHA1 deeb942c61ecfa769613f45452c6b28bb5c51f2e
- SHA512 0b8d3cbc0111c49f683e06a2e350352524cbc35ea126bd3dbe5111f8b1655d0ba895d69e95c4cfee50413a68556e592604e22b3cb516a838a09095ce5885260c
- SSDEEP 49152:f4bRquA/m2yL5zMfFiV+XenmE3/zoetr3mJh03:Soq1VjnmD0mv03
- TLSH T190D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 798954b49f9df9360c02ed12cc49a187db2ed4ce04118e95269ec1836b6206f3
- MD5 e3d8ba3516a6d26719423eb0aeee0b38
- SHA1 59c0c324933b20082c44465b52d18f402d610f68
- SHA512 3b8724b9cd925f43302b6d6f1dda26dd6064e3ec1d25742820f0491d434533c1ee8dfaf56e54ad4da212b212a50e7329dc6bb5da9038cf540df0c11f2122cd08
- SSDEEP 24576:bAhGLv1FoiwtA5l7S53MCKpizS7g4pbEILM6AeHQ969LUhGuG:bAMhFoiq5cFizS9oILMd69VR
- TLSH T1C6459D80E7F515D4F5B3AAB899B69571EA77BCA55E30C21F2260811F1E33E809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 828KB
- SHA256 c112ae6fb3e5e037805a793f17e4a57b066581c2da080cf6f12ed3572951239c
- MD5 66c19492eb3d5411cdb2051005f6a282
- SHA1 65dc559563be9b7c6292737b8d66b1100404a27c
- SHA512 d840e99c5dddff9b355bbed87f7247745737adcff1cab0ebaa61c5f58600e385b90575810f51ec00592d3b60585ea4631e70a93f780f86df6eab5fd7e352685e
- SSDEEP 12288:Smw5HEjsChNYBFgl0WSm+CoTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:LwuROWi0a1aytr3keO/nJNv03
- TLSH T1F105010973A40CF9E5BA857C86978536F7B2BC123620D71F1760CA5B6F233E1AD29760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 678KB
- SHA256 e0867434521b518cad6ad22200fbbd97cd3d9e277d1bbfe2c217088e20cf7e53
- MD5 58fc2853b45c1f31dcd8ded0255daf8b
- SHA1 121202b8928530053088862f6fd4e2923880dcf1
- SHA512 9e3c5b13ec037b181b8933689d665b4561a2177ee5b3331fb9b3b9009f6e47ceebae70403d4fdf400612ea6620fa59b3328a86e411e053096023990350b5e558
- SSDEEP 12288:L4m1ISr2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:MmumKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1CEE4128533E031B8E693A17989A19B1197B33451633987EF7279029A2E66FC19F34733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f1de2ca11433190683840f7ef9c4efd4a6b1fee462c2806787cad25d2bc5939b
- MD5 f9fbc66aecbeae0362ea9005c80889eb
- SHA1 d25ca82bb3b4c00714dfaa74f11fb967d24f9ea0
- SHA512 efa74615cf92120307ed1ccd1a4f8ef35da449bc02b483abc3d4f8e0d660ce93c14dbf7c880267a949d5f308003310da43a01450f8bc2c787f9a694e9bb45663
- SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U5:FQRQyi36YOcP8Lvw2gAf+PN3dizArR
- TLSH T1AF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a2fb9000b021db5f158dd4efc342240a01831a7396e5c2ca7e06cdea50f2913f
- MD5 50ef560a321e8b79c823ea92be7e5ef6
- SHA1 ea190ac56c907ac0b8b57861b7e05b41a95d0fc0
- SHA512 70fde6627330034a7bb4d21688f9052adfda3395e32d4d998c8247499ce928dceae1129c9be0d68d8587ab1e2d6377ad2ad12d18ab3d1db6728c8fbdc0cb81a4
- SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ud:FQRQyi36YOcP8Lvw2gAf+PN3ZizArR
- TLSH T185667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 bfc07377b3133ea17bb2a3eb636676c8290285e727b98ca93e20538ac71de9ca
- MD5 58f568782f708fa03c11c53cbf44f7b2
- SHA1 c5d11bd881104b00be6627792aa51c415af8457c
- SHA512 020315c2f2078f920f2ceb83cbba8658fe9347f384fc48e5e08b3ceb2cc2d23751217872b8cebee55a03369b0a5a54f018b870803a1ba1446ef4698d415b8a6f
- SSDEEP 49152:l68Qg55nhMeWu7PNU3/NizS9oILMd69VR:zthbRc/NizArR
- TLSH T189B55933B2F200A9D44DE1769F46973196D27C718FE0E7DB8115720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 bdf57eef175ab9963214edcb0df00c56d2f43ba0fe2d9c6266deda90a90151f8
- MD5 8cd12ff097d4e664dfcd29a4a6ae772a
- SHA1 483d270d6569840487a5da584b55f32414e44b6e
- SHA512 86f16e756821c439caa49a42018c1d0a03c2409a91c14997291152f30e9088ea7b30b34e3d2b03e835c842a4e6fd705f199c5083164d34235d9ff1d431d451bd
- SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99M:7y5112gYy5azzVv569nLKnhZVizArR
- TLSH T10A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 2e0480beb4ffd5cf121c08bb71e9f19172b6b7b329254f7643b2d02fad7e956f
- MD5 7e3b0f1351da7165a7b7a2ddcb40e767
- SHA1 a8d5dabba2040cddd7e475548f081634096d8bff
- SHA512 9cbd4de26b67e11a38d3b0c4f58f9a69994cd8dfa900bfa3cbee048e5e5b0044a4d39a40ee209a2d7bd75c20a4381d335c4523277d2f4da6ded103eb2ca3d0ba
- SSDEEP 49152:TB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glKetr3mJh03:lu6JmTxd2dK0mv03
- TLSH T1B4D59D13F2DA01E8D06DD478974A9233FA62BC491B34B6EF0A9073552A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 d03a4083f62667f977b55bc9ce842e0f6c2a1014e7a253c97bae9034f54377b4
- MD5 aab6c73cf08205f8ba9755382aa4e11e
- SHA1 d12db4fc3ddb675f8bdb0a4d7c5a95546be1a6f2
- SHA512 62270e9240e92a93a1da3d38ef5c83c70096d2ca8edfc19c46cc2dd23530f9b0db5ff9126aa465a9fd95c3f5ce0bda57ed27d19308c2a9d8fbeec2b9d8fd1e79
- SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xaizS9oILMd69VR:nmifPbR9izArR
- TLSH T13BB5BD13F2D800E8D05ED17887569632EA62BC450B34B6DF0A90B7962F7BBE45B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 329f97c212e0e90f1bc17319d0cb462a958638ea755fbc251e2bd357b30b3742
- MD5 172a0fd9dc16a1757c501daa789ac0ca
- SHA1 882c0ab36cffca3ecc7ec3b4bddec80754f8d3a2
- SHA512 0e7cb8b9e493b01989e53975ca5579376c31d7f43efea8186bc6a86d2eff0e8f5a88de42ca97b60bba1ff63ab3608087384b89ccd6b1710892691e8ab43e4dc4
- SSDEEP 49152:pSuZQIY0Be2K6RVtOnks6NMHqJizS9oILMd69VR:n5dKoi61JizArR
- TLSH T1EFC5BF03F2E901E8E0BEE57487669632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d963b10cf4928f7394cf688cd3ddfd6222b37aae4f967447abddc060a6d9804a
- MD5 76e9cc27f539e0db1cf55a5de51e8736
- SHA1 6fc2cebb77632e09b50baf078a4029e62f6fbde0
- SHA512 5856292a1b7f6482874934adf126987cb53abacaf1634058c83d9be6acf967c6c142a8f1d3576d58ef5ef0793f77c7095d912991d6772780c4539429929fa0cc
- SSDEEP 49152:ShtSn8EApI0figTgiDn0AP5wmizS9oILMd69VR:TX2iyphxizArR
- TLSH T136A5BE13F2D901E8D05ED178C7468632E962BC150B39AAEF0A90B7561E7BFE45B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 a1b4c1fe7202a45f3c0459fe9915de0624c6be75f9fe4da5cc232d3ce8c4b70b
- MD5 f446281e6ac0b69d2993e87b98a64e99
- SHA1 fec5aed726feaeae6c1e12138f16e43a5b4c22ab
- SHA512 ce58fff21fe7b0cddabc385f136df97312d23f02ca89b418f4d141cf41caf82705460c08ee36ad49cf61a4c6b043102149d8a517edbf5409e5c7d9b497658077
- SSDEEP 12288:9D2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:9DKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1D3D4239076E23A58FA47B4B29951AF3145F71880A47D8C7CF3BE019A7DA9FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 5ac2145596da61fc8b8f486f589bc5e84956111b4dfd28794e001c34b5e5c82d
- MD5 18003d3cf228f6b11009a42b7a41fdfb
- SHA1 04e8aa715e51176ce3f2c71c0361fba2a13cb057
- SHA512 b721796bc6073968a3d8ec5156c62c6f00f66432c39b11884da631fd8172ec46c14ae5561a71b42a6234e1edb251eb4ce2c2e6fe9a472d881ad443a5c28f02dc
- SSDEEP 12288:zn2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:znKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T184D4239076E23A58FA47B4B29651AF7145F71880A47D88B8F3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 ccd08e4a06ca2e01567c19ff591dbc5a16119d8614cf0e82b78d51bf4ea3a99b
- MD5 a2483cca032d9a605d544d3802180ba3
- SHA1 f799df4ec975d0735a1f1db83e8e16df2bcdfa9f
- SHA512 b4357c7bb15ca5be1005dd9e0ece60632b89203e6a3c95cbab5d691a474cd56491220def3320e488f926c26a95ba4e68090039684e597c28fef22c7b2c079bc8
- SSDEEP 12288:hx2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:hxKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T171D4239076E23A58FA47B4B29652AF7149F71480A47D8C7CF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 622KB
- SHA256 6d309e2f35252e313bec2c98256f4d0474c51e819ed7d08bd8befe914f5edf2f
- MD5 8688f6b515e3bf1b3bc3283148b532eb
- SHA1 5a27aba25bac6a7db806f904e375388aff703d78
- SHA512 53469a1d834c3416599c233d719bfdedbc52986e36c332580274776b895b8a9a3c0be03b5c9f2f5458a749a84ed0699c02a0c5950286e65af28617e0ecdb9474
- SSDEEP 12288:0lBi2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:wiKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1A1D4229133E225D8F987E475C962AF3196F37880A43D897DF37A019A2DA5BD09710B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 3a0958008311b8108eee0c3e4bf7434e4534682d3991246fbd0254c2a7d01ea6
- MD5 5614bdfe07336076446713145b9580b0
- SHA1 22aff6df507d8b2c596af9b896bfafa28053e0e9
- SHA512 dbdaeafe479e75b4e088d82cb961ad7b1604279d0d4fd0bf0040b9f73aea82f24614cce34e89d5400159f5227cbba7a9ccc3ac4965c9459c312321962fe9205b
- SSDEEP 12288:wE2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:wEKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1CBD4239076E22958FA47B4B29A52AF7149F71480A47D8C7CF3BE019A7DE8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 37ed21ffe228ab60ee2022e710a95346a5d2b9d77d4a2122c388f38a4d245fda
- MD5 2df89cf36f5afed742f156c3d86e4303
- SHA1 afef27b1b4431c0da084a8ce3d46c1082c9d8084
- SHA512 2537dc610236efb35e9ee58826fa32adcb5a6496b19cf05db21246a22c6acb5076e9cd28c61b0933aa50108044d6e351b52a75f2d5bbec42de8b525612f85e76
- SSDEEP 12288:DxJB2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:DxXKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T128D423D476E22968FA47B4B29A52AF3145F71440A47D8CBCF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 9972deb0c6582916a985963cc4a17a81155559e28d0c20658439ebc4966b5783
- MD5 ebee78e0e2e22fc93f74639db8a6a413
- SHA1 212f9d555ee591d9e770bd407794b452bf8971fb
- SHA512 491a6560b36a7b6cc63906eba41e819bd0c203c12e742076390adc7c2d11e740a0695fe457668092f980d8865b1517f5919a3ab6f7083c7b4543e41c0b96a77b
- SSDEEP 12288:8U2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:8UKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1BDD4239476E22A58FA47B4B29A51AF3145F71880A47D8C7CF3BE019A7DE8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 863KB
- SHA256 3dd95fb0824374983bc279680e0c8fab4f512666a973cdeeb727099444bd9f7d
- MD5 f68d3de75b006440c639ac69cbf6939f
- SHA1 2179cf6968a6dc89a2a1e265585a2d036a7d4b46
- SHA512 bb78881db07d803aabee54c7f83712c68ebe1e70eb21510a1ca2b936b277fe66f499ae20bf4b9af16d00c6359cba65b27c16e492e0a484fa42928ff31b44843a
- SSDEEP 24576:HZMszFXSR+KpizS7g4pbEILM6AeHQ969LUhGuG:HZMsz5WizS9oILMd69VR
- TLSH T14215019473A01CF8EC67813AC9119E12D6F37C550674CA2F23B8226B6F737A05D2DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 646737337c890bc2fe34e26d9c2abb7d327f896bdc78b0d07c101cfa200ee05c
- MD5 0207ec750ad4fd5b27dfd03553b96448
- SHA1 ef83ece29e6855ed01192d6ded2810a225d39e62
- SHA512 9e1b1001169d779e91dc81742b9821cee35a9d9deacd24fa80a9abc43135be4b0d3169e7c8af59c8ee85752ca05e0a43e435397da8eef55e9595ce3f71b6b55e
- SSDEEP 12288:XR2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:XRKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T19DD4239476F22958FA46B4B29652AF3149F71480A47D8CBCF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 92c081029a2ed083fc4bdd639f7b062eee0161407311ad1b98b6143b1a60978e
- MD5 b2f37a6def606a89e9887c164568eabf
- SHA1 9226303f505340952b324b38ff2215df3c99b194
- SHA512 ae67b12b47479b91239463e3d06326e316a4845cbc9acfa216aeb7be86086e8c84fce16575a1e0d0eca729c319d080259d1411932238f71013e0388da819e180
- SSDEEP 12288:ND2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:NDKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T19AD4239476E23958FA47B4B29A52AF3149F71440A47D8CBCF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 740KB
- SHA256 c856448f4ba16d4735b6e6d859d15de159eeecaff42c7f8bfa47647b8dba9e0a
- MD5 d4cff3a9e66e716b7e266e150d2764fe
- SHA1 fdd8556afbcf48c3edbcdff59a4c764f40707f74
- SHA512 7371da1d940149d692bdb9821232c8f244f3677814e4b45edcab14ebec0cf39d72c846e51cc3a5e320c68ce92f9ff81d48658bb9779e122409a0126dbd8b4e5f
- SSDEEP 12288:lFPz5L8z2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:DzyzKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T156F4014773E130F8E567913589525E12E7B3783147388EBE63B4027A2E67AD09F29B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 602KB
- SHA256 f8799086d1608b90bebdef2837d7243477040f31224e57231b8ce47a4f66d017
- MD5 fd9fe3aa4f1291c8b96403256f99bc9c
- SHA1 e2c7065d22f005c3ab38280f2ffdd76317b97dc6
- SHA512 8d4bb714872250a4ef69df9878744b52ad474693584812734ac656c7be50f574d40f30faf660d0f97b93ee6a6fc99a44dab2111e0ac6469c3bfa2ab3eecf4759
- SSDEEP 12288:vA2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:vAKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1C8D4239076F22A58FA47B4B29651AF3149F71480A47D98BCF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 602KB
- SHA256 0df098a1340f7dc8f7c08ea016a77a3f4b44538257c71c932fc09d9f79de7260
- MD5 4d09ecc6d112e72363f15a0e20f6577a
- SHA1 8538603abf5f684cab998cae9296ca7d9acd5263
- SHA512 cbb9dd6b0b47f25da71891dbaa6ad7731b49a485dd81ffbd152dd0b24adf184eff24c91ebe266d4ee8c7cf9233a79703a442e791a7edfb6c1ddef05aafe0aadb
- SSDEEP 12288:La2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:LaKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T1ACD4239472F23958FA46B4B29A51AF3149F71480A47D8CBCF3BE019A7DA8FD09304673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 740KB
- SHA256 06bec75b3a56a89ccafe2da7eaeeb8c4e8ab53da73b8987db3a5a266570bbafa
- MD5 3a29197a3659f1d25fe97352b2bda1e7
- SHA1 a6d8692ddaf71fb50c2cbcecbe80ea3f621a24af
- SHA512 311a5e67cb90b3232e0c0d8fc4b8211c354ba432c718e535dba90d1e754d9d9ad1f20234e0a5999148b7e55f0d064ddf868b4fa22b252c101b7807386a2b9e3b
- SSDEEP 12288:EFPz5L8a2ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:6zyaKpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T176F4014773E130F8E567913589625E12E7B3783147348EBE63B4027A2E67B909F29B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 55e88b1f49da24c242bed2433b3ac13a64f627168261409be5873a724e9f85b6
- MD5 f0d02dd9789fa6e69153c75e20307e87
- SHA1 b8ad4731baf4a2ab6bc13a2961dee5ce494b67a9
- SHA512 aa54bf5347243e051361cd39959d2516ab51b1896fbb65f20edaebb6d2f8d745616c0d3f5ab2cfe2761ed6ca37ad53c59a50fde2ad6772f08a8b18dd8d83ff5b
- SSDEEP 24576:ccP4mcvIjkGOxhKP2l71zNKbrh/8KBW0a1aytr3keO/nJNv03:XP4m4IpOO6768KZetr3mJh03
- TLSH T11F75AE2DABDC0096D0BA917885658A49FAB1742A2F3286CF1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 e5f4d78cc58cc507c0a986e404f729905a63d10894dc046c42fd1e4d1f50213c
- MD5 6f88d9f867fab959d432b746825f6984
- SHA1 1d6202f73d38406b9e0f29d6f2ebd21364c22823
- SHA512 2d8b9cf98c89c2778969080165c698990656579e2cc375008a34ba4ed33c60c2e1b30307552f4245b4947cc508824c18d0687a5378a7f88df7c27884617bae73
- SSDEEP 12288:qTsf02ZAYiUYS7g4pbEIjpsWReLOASRHQAi357JJjDV4AgLUhuWOC6u67UG:d0KpizS7g4pbEILM6AeHQ969LUhGuG
- TLSH T115F40149E29012E8D05EA175C7529B11B3733C5082F5D7DAA3E0F17E2F79A909EE8723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 609KB
- SHA256 95288a38a48d89a36574b6a5ea4382d65147a2cfff968b5c9d88e3e4ba350c3e
- MD5 9561bec2939814b2a2fe78b21fe74104
- SHA1 85b768090c52585d467f8f24e6bdd30ec4b3556e
- SHA512 7cb5a5cb6465ab614ce5439312ea609d77d429b93b306b6f21618e3819a6a12e333955346770c0787c30d7aef60fb046723e9745e1563a4e355c4d50fa41dda1
- SSDEEP 12288:qvTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:qv0a1aytr3keO/nJNv03
- TLSH T14ED42305B31A8E8BF0FC6CFC16A60AAD313EAFB27500E12DF8541D649516FD266613B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.8MB
- SHA256 b44181c708bf19cbe5f00098fb4dfb7ca14bcfbb97be694518d98e9146055989
- MD5 f20c2cd2154337805b329b81382a0aaa
- SHA1 5840cbc505c8040b8955920a2d7f83362e4e2249
- SHA512 8e885c328e286aed3b2d16bc9e80b24f0de7449503ab15d09929d4e2f27a555dcbc96e4fe8e96330c861b8b469cf85f98309ae25fbbfd2b5eeb8c032b09ac257
- SSDEEP 49152:Ha0h2GEkuAe73q3ppt6zwwQ7etr3mJh03:Ha0hNYGtJw80mv03
- TLSH T13C85AF1E67EC82B5D0BAD278C9A6854BE6B2B4221B3156CF1150853D3F37EE44E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 680KB
- SHA256 3e927960b807f936915f4742a7c9d804d4834b2ba16726a1526c8b4e03ee660e
- MD5 997033e614f80575613c4b1524b8009f
- SHA1 65375f4dceb32f89533436ba900e8c7edda0c03f
- SHA512 7c7393289e81824ed7408fce92c33328017e7320ec4c1056c6b22e7a7e4b0ee49ef0ed2b1100cdd0078cf437f047b491880b831d021d2800c8dd1e80bfe3be42
- SSDEEP 12288:fhbHjfXxTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:fhbHjPx0a1aytr3keO/nJNv03
- TLSH T1C1E4122D236D15C9F0B8A5FC46A2464AE331BD623300A3EF66D145794F2BFE11D35BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a8e1b09f5387be4ae0537e3828eedcf98f574f8db513178db8b8ccb1b173dbb6
- MD5 a5ce2f2b944f0c6d00797c34c301a280
- SHA1 1c8b237bd191aad6489dddbf91cc50f83ddceabe
- SHA512 9b4cb751bae542504d99e875e7340bbd4db773b025299455bffbddffe009a2d5daa052fb41178100a15aff30ec2877f24914cfd9bbb14558e63a78dc643358f0
- SSDEEP 24576:CVYgnJcRTk4yti+R5dUR/20a1aytr3keO/nJNv03:C+gnaTk46pUR/betr3mJh03
- TLSH T10945BF2EF3B910B9D4AAD176450147B5BB71782D2F209ACB0170C538AF0AFE85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 599KB
- SHA256 5c064533e4fb24ae6ace4bc9d84b0522e513800bdf5aac75c2d9377218df72fd
- MD5 f4ad33342f87927437acf16dc74fc353
- SHA1 33ab839edcfde757bfa7adcbed643949025727a3
- SHA512 1bd201299d9a675f3045294378f8cc734b723bf6ece994968ae01681373e3c1a422ee6d9ef5d71915925bcafba4b3ca0a74f422c4fed42433bd257c35d80b062
- SSDEEP 12288:vuqOTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:vuqO0a1aytr3keO/nJNv03
- TLSH T1C7D42309B3164ECAF0FC6DFC56E60BAD353A5FB272007129B8A41D649607FD262612F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 962KB
- SHA256 7faef6079915849ca1e0e007b21f15023511d0c5723c0e5e9bf38a2b088e5e13
- MD5 2ee0d7344f89e3b1dd3842f3a6f1b8ba
- SHA1 b081dca4392de9696457a58df388a156a964e1dd
- SHA512 f122c20263ee96eb42d677e49330469deedb9203c1e8aa7b454209f70e79aa5f6a768dcdb57e545384d15863b3cd572fb7473b51cb9bc5ff035924b249f1e36e
- SSDEEP 12288:NObzA4LWOsvAYFT0TwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:qHL3UT00a1aytr3keO/nJNv03
- TLSH T1D3250105F79504F9E87A917CC9B28A16E272B89D2310E7DF03A84E651F137E24E3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 692KB
- SHA256 284ca59399ba9f84b06a30aa5e02c8cc09080cd4c33d9d010a035cdb4c4f5fc9
- MD5 3b2b1b30acacc06927700a76c72511c0
- SHA1 99b9a17b7b8b1bbb687dc0ec7929f4c7b4cc06dc
- SHA512 6818699330a7b900da0f59b23236db858b91b3102747a7e32fdc381d5d372e9ed5210a402c3758520d3b59b0c7d03cdf73950328a3c2795c01fb8cf916ac82f0
- SSDEEP 12288:OpFtzO+TwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:CO+0a1aytr3keO/nJNv03
- TLSH T14DE4011933AD14D5E0B8A5BC8A92434DE336B8A2371163EF45D0497D5F13FE46C36BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 1edc4c6296d6508e57edff0dccbb897e0aa9b8f2f33f3ebbdefd22cf45599c26
- MD5 8b2361e40af39a1ac4905b1653fbdd0e
- SHA1 59748646c1f846b4506ce106ca4e9bce1ef02934
- SHA512 5800d378bf1673dea799296ade82f279e01b1200fcb8044dfd5d1f248a6e372e89ab7e328aa69b092b84cf41cfe138a209c6d0976c66bf2d6ef6ea2f7911bfaa
- SSDEEP 24576:77NM9YeZqmWMUkPjZM48Mv6bEhss0a1aytr3keO/nJNv03:77cBWMpPjN8DbEhcetr3mJh03
- TLSH T19E65AE2E6BAC81D5D476D13DC9E28246F2B2B4611B318ACF5162833E7F27AF44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 6843399d83613df5386deb0fd4f0e8a717e1110870dd0d9b86b38f760385b2e1
- MD5 8a19dbe0dd917d49f5f3bb51b683ef9b
- SHA1 276186e86042a5391f1643f5dfcdb9d546905f35
- SHA512 313f280ee5ba240ef773c6c82ae9e32c3fd113436084fc2f80cdf16ae465125dfe4fa460dc3512c6a467f0ddd257ae2a48b6b0ece427673c272c80661f97a0ff
- SSDEEP 24576:IW6BApg2YuyuNDYTabvc1vNYf8km180a1aytr3keO/nJNv03:IF2YuHNETovIvNYf8kmjetr3mJh03
- TLSH T1F0858E2927ED80A4E0BBD2BD45B79246FAB2B8511B3056CF4255862E1F33AF44D3D732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 b1a74313aad827f73e76912daea751e4d1a717dd315ae89ff37dca9d9c90b562
- MD5 9d33a89b15479603efed3b43e43f8801
- SHA1 3b0b3219cbbb3ec484683d91930a3d9f99d66f12
- SHA512 c65839153319d8972760a79f2a89b4c1551c64ac5a2ff3b9976508cf24b387f1c55b852520ce0e6ea9a398654bdd6ee38f53011a244c1c0c81a88ac0c91345e0
- SSDEEP 24576:kAFs06+OmlfzNXEbToi0a1aytr3keO/nJNv03:pFs060lBXuietr3mJh03
- TLSH T11D65BF2F63AC00D5E07DD17D8A97C91AF6B1746317216ACB0160867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 907KB
- SHA256 d54aa58945d04bbc4868a3eba8b0ed1fbff66d2ef5c1bfdf664966cc192dd568
- MD5 9e724c745142c222e965be073cf6d65e
- SHA1 572884bfb20d8e37de5099d07c56c78c2c7aa078
- SHA512 85d2db5e63ed1b5143e35299bdb472e385f3c8e308dbfe969d1bc71552859be9a81989afff8dd16d7fbd96fe4c73a7583ba23a4e0d7e060a9f6b5eda42ad7126
- SSDEEP 12288:npJnJ5D3Vkrezxx5XTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:pJnJ5D3W2J0a1aytr3keO/nJNv03
- TLSH T1DD15E12DD3A810E8E0B7C2B8819A1795BE72387D3B2169C728B4D5353F12FE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 9bdac5c421c2e350136c6c8ddaf3293a78b8414b643f4a1e66106d292340eb9d
- MD5 5b0d95a6d11a9caf571365575455a0b0
- SHA1 77007d7ddd473f1bb13f83bd4865ba2d22224dfb
- SHA512 e374d0352a635c320a072bafd92082e98ee16b8b0cf786dcef34becf9c34a32f4247108232ad9a9ec9d00193a90362c5d9810a1b0ca9b4c390d46fe376987cb3
- SSDEEP 24576:3EPFhm6/7IIXdwcXrif7qQncjlP65i3Vug0a1aytr3keO/nJNv03:wF06DIKdwc+eQnSt65aVAetr3mJh03
- TLSH T1BBA55B15B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 682KB
- SHA256 6ca99337f70fcb8b7e4bce5d6a6ad0ade4f5d252ecf10c5355d91588a83f0aca
- MD5 c069bc2b4d7bf15fa8856f0f9beff28b
- SHA1 6ac7c37dacf06360f9ebe0dced86ffa6eab661d3
- SHA512 4d959fc3065c87e0d7ed3b51ce3922c0cbfd8c9efd04fcf56f57d834feeb0e0c650d9bb99a1d4e0f69ae513c079fde169bda9e448e39618d8e27e8cfb1bb9429
- SSDEEP 12288:rEP3RiITwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:wiI0a1aytr3keO/nJNv03
- TLSH T145E4011D775D60DAE078A0BC46A14649F336F4B1370163EF65A0897D8E27FE12E38B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 733KB
- SHA256 75384b614fa9967b34a5360e0f91f82cc961e67ee03e7d8784c4b5f548b36864
- MD5 902da309512ef3ba863ea14aa2870a4f
- SHA1 8e8790e61edeb680b133443b65dfa7326779a088
- SHA512 0f883932826563b632e687057953f818c58706bdceae03923aef75c88b183707bad2b212019b8159268325bed040356fb218a3e42c33817fceecfeb87ae86722
- SSDEEP 12288:MjkyqTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:MIyq0a1aytr3keO/nJNv03
- TLSH T1AAF41208731455C5E0BC59BC96B342987A39BD317B10A2EFA490AD3DAF37FD16930B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 605KB
- SHA256 60c52d29fb9e635f07451eeed11499cc2b94c069700f8f5f8ee2ebd4e18b6251
- MD5 ad9d3dfb8ccf1110cbb4309f4d477834
- SHA1 0795d9378a0d702bb74d184d71245e10c4108f5b
- SHA512 c89e0db6ed2165cc8817d35514affa16cfedadfd3e83aa913a2da09a92abd48a7892b45477e65bcfcd28804184769061021cf0fcff9f22b70e5839129dff04d7
- SSDEEP 12288:JrqldTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:B00a1aytr3keO/nJNv03
- TLSH T1D2D4230D73265ECAF0BC68FC16B50B99313A6FB27200713EB8E45D74D606FD262616E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 46eec49292295f45ee0fb5bdf62ecebb8f936d99b667b549d555fd87d338b8e8
- MD5 3eaf24aaab3467cc9d355fb6bc2ecb7a
- SHA1 fa9da3b2cc42346d5ea311fc7532e222905dbd1d
- SHA512 90a09a114f587e53ff6679fa13482cde12d56ecd158d7691c9eda72191a9f97384fdf6f1b9a741feec901c33231ec5625b860f0d957a985e6370d0f90091743a
- SSDEEP 24576:8Q9MxZKdcz9ew3k0a1aytr3keO/nJNv03:8VKixetr3mJh03
- TLSH T19C558D2DABE905DAE176D27595A240C3B633B4312B31D6CF2448D03D4D7BEE8AA74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 793KB
- SHA256 3b6f32f618f7a65b6f92b8b4cad4b9cd4dee86fa569e2f64296d04dcc6253fc0
- MD5 ea7dc73439e5d8b8a5442d72d4162c88
- SHA1 3aa2feec21bc35eaa5c0382bb9a7437236aefb69
- SHA512 581885f90867398a85e4acb4ec62194e08b724303652248463166f9acf66109499e9df4a22e6f40cc2b4a0f8286be3baf596224de403b848c056b3f817187b60
- SSDEEP 12288:kyoKo2mRple9pmTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:kyoc8Apm0a1aytr3keO/nJNv03
- TLSH T19405E00FB72A40E2E079913C89858749F773B4702B1263DB6591873D8F27AE9BD34B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 90776109bff07671d73eb48f3c20c27dee242224c9df3eef5f3b0ac3306d319c
- MD5 f0f5bed275fe832bbdcd86b0d2fc8eea
- SHA1 047c26987fbd0145a28d9ffbac66844407dc5763
- SHA512 5bd3fff668c4ec34c6c85dd421ccf97eba77fe63acb45c2115b2e16ea414702601b70ad85a53a4d516c487743f5ebd75ac179ff4715272501553f264cf1cdc0b
- SSDEEP 49152:fWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IK6etr3mJh03:H0zuNI60mv03
- TLSH T120A57C3DA2BC00A9D8AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 b1d6573329a40b2058c8b078c76e055aaa38b9f81a5505ad78173325c2811168
- MD5 f5ac7f92aa8ba73edf1af96b06f063bc
- SHA1 417c76dace1eb7aa3b79f96506c8aca61e6c05e8
- SHA512 d93e60413a0cf77a93823d0946bf9c8e33e7ac3bcfa601bc0ccda6c131414008fd946ded05dc507da0656a8c6046bcefe9ad6a331a5e3e2df53db97d22db6861
- SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYhjMqbi0a1aytr3keO/nJNv03:JTDxR+N5YzTTjMGetr3mJh03
- TLSH T1B055B02EA7F905E9D1BEC5788B238516FA727821133193CF42A0C17E1E2B9D85E76F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 899KB
- SHA256 424adfeb6a568ef9e22f4a9f0b5e4029b22037f6987217752d265199ee3a6551
- MD5 5b87637704626645c55ce929b4a76b61
- SHA1 93686162765fd41b1bbeafd83ae9b2e28d97a994
- SHA512 fc347cbd4adaa8c79e02e6decc610211d1d591506a87c1c9d24ccadfb2937803be1dabc0fdacbe022d797759d06c93ea8f5094a00587906a292e0aba6bb4bfd7
- SSDEEP 24576:UTMdOz0FFS+HmSLp0a1aytr3keO/nJNv03:c0K+HmSLeetr3mJh03
- TLSH T1D815E13EA36D14E5E47ED1BC96538A0AF67238621321B6DB05D0C0792F5BFE43A39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 656KB
- SHA256 b4f5c5cbedc23239c906553f30e9d0d97527b2f420e3ce0e9efdc1546ad62a8c
- MD5 cc819215295e5521ed8f276775ef6fba
- SHA1 9454ea827a0a0d813e8f3fb1371710f7b35d5d06
- SHA512 965949c130b314db2a8314e72c47a049e7256548e1006fbbfc1f9be8eb77b409e4fdb87dc387ec0ce7f17938a6d611a0c8174358c0f9edb1200f61d62512448a
- SSDEEP 12288:3EzxTwPa18DRzEdPr2ukeO/s4FCCyD8aiWMstQOH:mx0a1aytr3keO/nJNv03
- TLSH T17DE4120C63A929C9F0B8A5BC867606997235BD72331062FF38E08D799F27FD19534762
- MD5 SHA1 SHA512 SSDEEP TLSH