5f9833f7d03fc18bca4b199a3642e62159d0c3bf44ff8500d0867924280fb433

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260516-qdebeahs2j
SHA256 5f9833f7d03fc18bca4b199a3642e62159d0c3bf44ff8500d0867924280fb433
MD5 62c14b7a2ef6640a4e85f34f798aef36
SHA1 5270fb7581956595df877fad4e51a4e79b6a7e73
SHA512 1af99f86dd812e38d55cd112e54a59bb0112620569123801695cb30ba05aab09f041be7f2ac75c11799622a387b1805301b265c806e0dac016487f2d25307d17
SSDEEP 12288:BUYJ9bi05OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:aYJ9bf5SSiVw6uAX8DS52tpz9ZRzbPm6
TLSH
T147F4026072C190B3DA77093215F8D6B19A3CFD724F2459EF67A027AB9E302C18939637
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1480	alg.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
2928	fxssvc.exe
4028	elevation_service.exe
4392	elevation_service.exe
3412	maintenanceservice.exe
1392	msdtc.exe
3132	OSE.EXE
1636	PerceptionSimulationService.exe
4760	perfhost.exe
4628	locator.exe
3496	SensorDataService.exe
2200	snmptrap.exe
1196	spectrum.exe
4860	ssh-agent.exe
3268	TieringEngineService.exe
2172	AgentService.exe
4456	vds.exe
4380	vssvc.exe
4444	wbengine.exe
1400	WmiApSrv.exe
3440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\710276dac9945a43.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb9d19e991e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000189ffae891e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c5d9ae991e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006300fea91e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035c601e991e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe
1000	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	2928	fxssvc.exe
Token: SeRestorePrivilege	3268	TieringEngineService.exe
Token: SeManageVolumePrivilege	3268	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2172	AgentService.exe
Token: SeBackupPrivilege	4380	vssvc.exe
Token: SeRestorePrivilege	4380	vssvc.exe
Token: SeAuditPrivilege	4380	vssvc.exe
Token: SeBackupPrivilege	4444	wbengine.exe
Token: SeRestorePrivilege	4444	wbengine.exe
Token: SeSecurityPrivilege	4444	wbengine.exe
Token: 33	3440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeDebugPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3292	2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1000	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4220	3440	SearchIndexer.exe	105
PID 3440 wrote to memory of 3700	3440	SearchIndexer.exe	106
PID 3440 wrote to memory of 1552	3440	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_62c14b7a2ef6640a4e85f34f798aef36_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1644

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2200

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1196

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2856 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 1152 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 417bfa237a7298cdc09f5a0f10c59d4a0882e4bb83d1e3c02790e8ffd06945f1
MD5 27a02dc24de3738d8d2a640e931d33f5
SHA1 6a097a97b924d8721ed73429a5748a4b94043340
SHA512 28a34f340d569acfae064099c97e60918523b85e160e4ceae122c851c684f0779b80a021a0f78c1d3aba30240c03ec30df635a6a979b36dc3b44eee8528851c3
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn85SW6H8DS52tdDpbRZy:A3q6HjBd5SSDntdDpbRZy
TLSH
T15DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7f30eaab60cc5b369865a1c5f6cf57fb892e4016d9babc22f6cc49345d87ea90
MD5 64464dae4dc4a6a1327a8bb403eb58ae
SHA1 15f1033908ab2f2ee3f6038c1ff0118e8620996d
SHA512 cf131224f7f8f0ba932b7d5daba4daa5f2bd3e2371658ba22e3d0fef78c4ae3010a82ce88168cde17d66c4bea103a811e597cd34bc83accf87d603c976553011
SSDEEP 24576:CXYfDtczAh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Jtcu5SW6H8DS52tdDpbRZy
TLSH
T17C05022873E008FAED6B8279C8B28511E633B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d3f5b58aeb1a0cddcaabc7a173b4006410950cc3cfa334bc2c2fb74bc044b311
MD5 ed2d604a8ad7d1f295316cb0da2e84bb
SHA1 74209aba0d6607baad4fb962e272d913f50a0edd
SHA512 3fed24b7a0362f20ab0ad55d3ab8668307052bc5dfbcecfbfed386fe9f5633e192f5fc61efd01f56ab7bffd141a7720c15d081c3cd9e2c495a0bff0c0d695c87
SSDEEP 24576:C0Le5ji0hmxirMU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:CPji0AcH5SW6H8DS52tdDpbRZy
TLSH
T181359E55F6748332D073C0BAC5D2A69EE971308657308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4bdfb435f3368f69678f067a62f4580e7c78eb4dc382e28356fe2d9d2d8f4b0a
MD5 d462a35dd7e80829adb1e25674caab20
SHA1 28331564799c32354efaafd29d02e25eaf615e4c
SHA512 ef54f35242a980c1c3cc2031ce60aea1a10b66c77f7d0d6b337a7dc06b5049263b16ac6c8413231989dbc77282b43bae04297484aa63addd99b5f48010bdc0a5
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyue5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:a/ezSC6vUzPvxHjyr5SW6H8DS52tdDpO
TLSH
T1FB755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef7e699c0955951f10a02df09ca0c5345a5cbda8392a114d0f80fee544e09eb5
MD5 32add53f7695d7121ed240a6acb54778
SHA1 53bbdfe375e92ccf85f60f7592c9cbb7e4c4b62f
SHA512 bb9134c8fd039ffe798ff6a76693173700e1739ab23fa1609b368d69eed4938991006601f637de653b505e1f5249fc1eab6b174d71153930544fe297efd868b4
SSDEEP 24576:TVbqPb88hv/l+6N5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:TVO88hXl+o5SW6H8DS52tdDpbRZy
TLSH
T162559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9eaa656bc73b874421d848e24dd4ab79928ae14e98debbe74e896bbbae114eb3
MD5 b51d2993696004157a5f733b39c2947e
SHA1 9dcfbaac0d223b10d479c4010c373384ceab19a3
SHA512 db43b4a716c439b4de1a49c13ef5082f414ab9c312d58a5f47fdcd89543e5f903a731b234a5cdba646bf30152a5925cb502b60a6125dc83b4022102b8f3a8669
SSDEEP 12288:BRw5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:BRw5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T114C423C4479030A7E31F0AF3F1FA96E4DA18EDAD8408663B4E717687CA3998BC577416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e462262e68dc7487cdfed38b2192f374c094cad309443c5bde4a5d00bd783347
MD5 8283061ad6baa74cba3b3a70f51d1271
SHA1 fa7a3f0f4c449e4540523221dc010d15c3c03cec
SHA512 c679d41076cf5d8d32d9ab9f54107a5abe4fcd377913bb88d5b9595f314fe5582f78015bf76dba09b8b7bd8054b37a90c399b8e3375c3565b55b4519f0f01e0c
SSDEEP 24576:RJIUl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:RJIUl5SW6H8DS52tdDpbRZy
TLSH
T1BE05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5f4611df5ea908bf243d99d404630e38e8145a1ff2d71b80cbdba287f96071e
MD5 b89c364ef3ad1ff4fc4a30a6726a7ae7
SHA1 6e49a80c492458e0c302bc96a74c1151957a309e
SHA512 00069a4583b502559eb442cb30dda5ab6027797739dff2cdf8fc423fd8fa9feaecf3d6cac780bf127ef5cf02325a9526af59bc1858b2c171a9e0635f9290e173
SSDEEP 98304:AQvGAdlCEL8c/yRNw5CO5SSDntdDpbRZy:1vyEYc/y3w8ESintdDFRo
TLSH
T1E2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 370cf4576dd1228e51aab22db87b0fb955ab557136b7dbd77f6bd5f8afd29db9
MD5 c1313bf070821b48451da3821ca85b45
SHA1 9a41466dbe6a3d5c1fd9a17f2df0cde738aa302a
SHA512 8765e9ad5e4cdfd07a07da8bbf336d0453587a09775b9355561d4160ee3bb9ca97519808e765403c40aa5b87d1fe1969617d1975d3f7e78b77d7d19ed247d380
SSDEEP 24576:ndewsAj35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dlj35SW6H8DS52tdDpbRZy
TLSH
T16E15E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 18139ff2f5eaa2530ebd0f156eaf461e1b2a17d9ef81be01b9b366488f69b0b3
MD5 4ad589f56059a7d255c6182b9cdc4b00
SHA1 a22a4ff5e3763f289491cc2c7d5776c39c522824
SHA512 9f287c130921be8d5f3eff518a16c4df943549d319f1a502984dc0f47b946037589359186b95f85a43d874f420e567c5f2e8fcabed153de02c24d2823f8b2b48
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxSintdDFRo:9UEtQevvqc2W1cpV2EI32wedDFRo
TLSH
T12E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f667c29c6678f99c280591f8abc70e1631b6197f3d46859beca6a9354677ea78
MD5 1061ad4e31b032de4f525fd4c8672870
SHA1 badf5e9f4cfc9ddd06d7b812f24e9cdf5271b507
SHA512 f7e26fc03bc374ee11d62b33129a1d80d0e0aeb0a801e46f738cc6af97055e4d8e569e754b6e4babb170bd1af6a4a4bab6910acff918b9ac3575b7a556059d8d
SSDEEP 49152:zCbRquA/m2yL5zLfFiV+XenmE3/zX5SW6H8DS52tdDpbRZy:Moq2VjnmC5SSDntdDpbRZy
TLSH
T1F1D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8c6fac9af6bab27102d302895bfdbd37267e90d7cd80e0d598d18c47c4029cf
MD5 990f13a71d9ea834cf3b9fdad8f86d2a
SHA1 eae0d5ebf968b97110f93d10aac28e1e9c96fef3
SHA512 505a42ab7eb91eed22c7e7b29083e591e02f8a2cb15606262c7483709dc2ba3e435404a1709910c67f7f5c2fe8c8e1772ae922092050cf92874b9315bb6e6e81
SSDEEP 24576:xAhGLJIFoiwtA5l7S53i5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:xAMyFoiq5y5SW6H8DS52tdDpbRZy
TLSH
T14435AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 21850ab2748b5753aa55647fda12f3036abe224fd96b7f46982abb12e5b6bbd6
MD5 703fb700c2faee72b71ff3c39c21df51
SHA1 8f027968b66f4c735200693b0077413ccdd3bcad
SHA512 97e1c346abc6e13f2a3daa15414686bbe2e21fadba5575d202a57a12a87dd066905f293aecdadb3115a45e5481a1143ba68d4b63ec17e2e901707c60ee819bf9
SSDEEP 24576:PwuoOWL5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:PwDO25SW6H8DS52tdDpbRZy
TLSH
T14305F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4bdaa3f9b49dc95128fd703266f0e8a94573e16c51d6a076e522b0fb4039ae74
MD5 136514a13c04839806813c96baabe36d
SHA1 517a4a5235bd71c8955c11aba38e59f162256e38
SHA512 80c04d1866744d449b49e25c737437ffb99d57e6b687f0dfec35333ce2953ede8f5366731a766a138c872254ad896af798710d82dff2ff39fe5a6325105098b7
SSDEEP 12288:NBZ1Iyn5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:rZus5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T136E4128923E030FBE25B467AD9F58685D731B4A6533443DF0A60429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8d2b81a509b60c8e52f31a31686c4e0dcabaaeed35a3683088e3416a8b4e14a6
MD5 b521a9b684b26b9d2b81c1a04c4fa56a
SHA1 3dac25787e52fe930316f3c13ef0f5ab0c71183f
SHA512 79488c0f73a3614ef515f22666e4b38c40ccb172a55f72dd429696cd11ede184225b6f9308987dcc419e7138a6606cea9f5529df9951698b705b0fe4f71e2d72
SSDEEP 98304:DQRQyi36YOcPQLvw2gAf+PN3Z5SSDntdDpbRZy:SQyiKayX+PNLSintdDFRo
TLSH
T1DF667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b84bd92c959f87c59b7bf34eec1f3a922f8707b1c3039d408c493d024df0612d
MD5 9d6c191d1cad754b4248853c8609678d
SHA1 690a2e16d3e81bf75f0954596673f6979d677ed0
SHA512 0a9d7d5247a10b7bd0ff738491733055896dbed33dda3b7ee9391db7356694e3cc06be32fe57c4bbdd9afefb53d1187c9e5c40b23b7f94c8e265dc07119ae6ca
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3Z5SSDntdDpbRZy:wQyiKayX+PNLSintdDFRo
TLSH
T1FE667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 75843655577421fd98b59e10e9cd9c189733e0217cfc62b9c8fc5bd3e7e21ae0
MD5 34887d7cb59ed0d30a9654d910dbe25c
SHA1 31949a6d8e9f202022444999da77f69ef95d25df
SHA512 91cc5e70e40070f1cf942df840c7ab47458b9e6eb1811c2cb3ca72be04b73e294a16f5ff998a44780ed355f2b0ca9ea224aa28229b4523cb8daa35b668828a98
SSDEEP 49152:k68Qg55nhheWu7PNU3/H5SW6H8DS52tdDpbRZy:OthWRc/H5SSDntdDpbRZy
TLSH
T167B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1074cd52adbd706d200e9b4d4b4a07614e535a1a0e2eb685bc61078a7a482061
MD5 e1a4ca8864d736784736895fc7d7b28f
SHA1 2cd81628d2e663ff99f3c54f0465aba7dd097671
SHA512 9a4a9c0a127c96db2760cb86079fc8d3be8d24aab6f72694f2428c2d7d9d0302942a89c4a8be66fa5e673ad5ddb5f6a359136bc2e710223a8c5995586e3120b2
SSDEEP 98304:Sy5112gYy5azzVvL69nLKnhZw5SSDntdDpbRZy:bLIHmWhQSintdDFRo
TLSH
T1C6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 436be8477df952a24359618245214e915815e9ae0caf14c77a392ae89ac616af
MD5 30191b06ba0bb44e182d1424a170a931
SHA1 4e3c3b03e2a8190c24ad327b08b0163d607f3d35
SHA512 f624482e22a14f5ce757628ebc280e83df4271c494d4639ec173f04e1aaa43f98fc3b6aff70e010c9abe66c1bef125be5fade1f3380e992b9ed314ed9c8d5253
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glx5SW6H8DS52tdDpbRZy:du6JmVxd2dx5SSDntdDpbRZy
TLSH
T1DFD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 10e7fb8e8f2c41f71aeb0a621ac63302995ee7749f394c0078aedf6e519101c1
MD5 bea4260e1771f383f77d71cd19fec1d4
SHA1 efb9897593ce0dd4daaaaa9e32c0852fe502b855
SHA512 c3fb6d00d08d7017e574f8d5b332f9639aac3862d5d8f2f03f93f84109b93cce0747228c85e0d4346418a75e0822206d32820db5e40d8b27ec3c8a195d441588
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xF5SW6H8DS52tdDpbRZy:CmifPbRC5SSDntdDpbRZy
TLSH
T1BBB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7ab9f44c2d1d766cea27452f1857b30266593e9b929eb22704f39fd40692414d
MD5 d39b3024b2fe4b392ee0bfeb14bfea13
SHA1 aa9daa7f70b2fb352f962b9515d581d4ce59fd0d
SHA512 787073db51c7975b350ca429c6aeca09ac7bdde766ef97b1063f1f81d9e440d9dbb939898f7b3f7957f74651031be5b3c708df56f3a0c27dc4da830bf197944a
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqs5SW6H8DS52tdDpbRZy:j5dKTi61s5SSDntdDpbRZy
TLSH
T170C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f2c5094d4a27d8554495d8421f849128da0db7c02ad658b1472bd592bd08eea5
MD5 91f766f5829930481a099854cbcc83da
SHA1 cdd10bd58f44bd0d419af0df81b8481faefa68d9
SHA512 0f732934939d3a1bbd71543bfef1359a95e4ae85f7d899f5ff3cf83ca0433d2a6cf5bcdd94c29239f7e2ff18e9470a0ea8fd341554f334661629a9b39791ce4e
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wh5SW6H8DS52tdDpbRZy:WX2iyphW5SSDntdDpbRZy
TLSH
T13595BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 81562eadcaf34f21fa345b9403b22e6d946ea5de8443939825f978349517a5e4
MD5 e17bab518955f853a00e975ae1fa58a9
SHA1 f6b6c0cc766544a6a1a948bffa632f60e223d3b7
SHA512 2ea57c247f57afc9435b0cd8a12b9054a305bd1d7c88de6ec41c6828255180da54c634e1f275378ce1b20ef6da671e38b84f14355c3b9d5bbb4ad44272cabba3
SSDEEP 12288:Ro5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6H:Ro5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C4C423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B5F716147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 46a8b791fa04a13fb5ce96226286a8d071521db1742973c349e9bd5ab5813787
MD5 efe0386371333193f4e371e7070ae2a2
SHA1 416c1fe675cbef065ce4e7bbf24b401d4eb2f0ee
SHA512 f0ae0b4fc5c852609528bdb227a9756cb6726b38b72c2eba663a863824240398750644b5d57655903bce0984f45e703decc4e49ae3f23f16659abc7f5b5db3cf
SSDEEP 12288:xT5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6H:xT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T177C423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B5E719147CB3598F4676829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4049680331cc2c4de2e0ce6385a72d5b810835a6ad76136fd76c6816bd5c14cc
MD5 1ab7e3051bef0550716f25b0a4303261
SHA1 83cc380b73c1795e96a94f989288d2619a4bd624
SHA512 a312ed68e88a3d0d1d1e90cf8f3876997d74b3918c0a4f10e6c231080d3084dda92b35f43702ead2828106e24ca5a6205f466bef16432b4bdbdadc3fcdc8ca62
SSDEEP 12288:zd5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6z:zd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D8C423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B5E716147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 071bb864b2f64230fce6e2ed7acd2b15234aeda3381e16c91bbe6bb1e60cb6fc
MD5 c208c87caaad84a0c3a62ff77c89fe9f
SHA1 e1980c79d279646b745b034b62ffd136a2a45753
SHA512 019c62bda0285eb60cdb9048da2d07c1c8da280703483a24e6c083309fa243d85eacda4e9a9a328e2d8915e92349c13310fef0362668586e8f428e75fb341b41
SSDEEP 12288:HVC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:Y5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T135D4238027A520E7E51F86F3D1F682E4D628F9EED524637F4F20054B8F31B8A9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 306b13334ddccd75ee6bb43e463fdca5353b164ade196cdbb24af07906667c76
MD5 0347bc1f23ea6b8f422945ccbb4a02a2
SHA1 4281d2dbdc734f387feb6751e35e5d49931d3670
SHA512 ec862a6a69d23ec8a90b23558cba64667ce46fdaa4cc303065376ead8fb9266f555c28ef3fe2015b8c89af50298da18807636fd78cb3a4c3f57d020c21680cb5
SSDEEP 12288:fq5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:fq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T18CC423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B5E716147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 595e5ca6211a5b0652d67bfc7c3ca3747bcaa9dc92309c9bc8487a0405b81214
MD5 98e2a3b6e8e1a4db8612863865a2cb33
SHA1 bbcda4a0433933c0979a07658f00373fb06629dc
SHA512 cb8fb78b90c8bceddc4cb3fd5d757f1e0d8063fed5f29bf82c88110eb472304366a87631c1dd4c0d770bb0450d456b5ca6f586fdb0df0bdc7f99d92d9c8fc54e
SSDEEP 12288:yP5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6K:yP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A9C423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B5E719147CB35D8F4676829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9e383392b5c2d5deb5833fc6f5168b049ad51f1b554a1b4b484941bb2d773bd4
MD5 8091eda45ebcb6b2ed2feb1a1fd60c40
SHA1 05459d6553ff218ed0ac66ec94b78b252536be47
SHA512 8cdf68e483e5d114f9333569db7de07b8fe7be4c1579e66b8628c2326c46af9430da67d6d6df42073806aad60c0a14576b1b85ae244b53606b42dc2f26ed0583
SSDEEP 12288:6b5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6C:6b5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T106C423C457A121E7E30E0AF3E2F686E4C90CA6EFD408623B5F719147DB3598F4676829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 bd98d70b01fa9b10f6a1adeb9ce80fc3207b797b60a2b6ce6a2a90868f4dc03b
MD5 6e18eb95ee4bd94b375ae74a37f81db4
SHA1 ff25aae1b83e0b4fc5d22351e013174797f610ea
SHA512 776a22db208797e8c3b6a948a92052675e6120f19979cbce107164bdde8ac3a79031bc51b48686effe63b2648f13aeaed8b00bd55c9d71fe0c5fe47098b4052c
SSDEEP 24576:gZMSzFVSOz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gZMSzf/5SW6H8DS52tdDpbRZy
TLSH
T115050294B39018F9EC67823EC9658945D6B2BC5A0760C62F07B436675F333920D3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2d3334193e8d8ae8f473c385d50881b401499f8aba10f1ce2c0e852592258f7b
MD5 c32f5e070e8923dd8df9511d1c5b31c9
SHA1 0cc94602a6b72b9213748f33c3d44a6c6ae905cc
SHA512 7aece2104079d817f32f79d9c1d729c4aa107d50de1b17a3776f58a37df7c781a5e716984ce2bbb824508075de6bb7e5ca9236bd7c677c5fa9e5b3ee0ff513c0
SSDEEP 12288:Ec5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6x:Ec5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13BC423C457A121E7E30E0AF3E2F686E4D90CA6EFD408623B9E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6503c8d05b2ca6a6de61c319a333c45036aada516b97cb55782ed887aff1af5a
MD5 10f9fab31e9414ab246bd2f5bfcb78ba
SHA1 a02c7e84f000dfc72377ec98f855987fa5c6e7f9
SHA512 9aa0546faed2432c2020e60b0242e504aadfe37c89748c01dbfdfc6a817b7d275a81ff913067715fa8617618cd67109189236bfd5772912a9ec297d72b14a2d0
SSDEEP 12288:fg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:fg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121E7E30E0AF3E2F686E4CA0CE6EFD408623B5E719147DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 002d3b2a977cde564ca3610be90c5e64fb10a83158a188931dc0f2e6becbeeac
MD5 fb498a092d34b5ab3ad884ef65151a71
SHA1 056b13a0c5ca894de6cf67bdf6cbb33a415b5fe8
SHA512 e706ba771cbe3e26c551c215a2cbc7943ad93fe1558617739bba02ddfa5593a10697b862c923da664d3946db54415d3e89df42057e4219db932d043423a1d747
SSDEEP 12288:CyPz5L8n5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6w:fzyn5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1CEF4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2ba33b3ffd3700c4750ad91a50b2cb2ff6a6bdaae12a0766d9822e1224bed6b3
MD5 55c8d070b5e67cd1218dfc51baf3d6dc
SHA1 33b3fbcbe27c143592379e02b6d5e5e2d48fd2f6
SHA512 e621d67fc57ce175e138cd2bd0048bec016e48986c2ee0ca24a65e2808045e589f9687fd40efd2aaf98a7a23a43b82b8092f5af8ad0b7a2b4b8e31cbc854b85e
SSDEEP 12288:pc5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:pc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B3C423C457A121E7E30E0AF3E2F686E4D90CE6EFD408623B9E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bd8300d3c506e2c560c5eb46b5af243acfc75eb3d552ea4aed93b1e981da5e6e
MD5 199af8f780acf39e2c11021922ccc825
SHA1 f2d2d91f661a26cb2519efed4ae7c5a456cf9b86
SHA512 544e7353a4b2657a83d1e8b209a397bb8eb7ab6ad942a58b6b6c144784eebc246f4d395eaf60d6fdbb33ee3826acd2b69052a5fb1946f9b5f5fc406fbc3c0e90
SSDEEP 12288:3c5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6d:3c5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1AAC423C457A121E7E30E0AF3E2F686E4D90CE6EFD408623B9E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9c9b17f176072f0c2c030f198f13463aed0c5e02f2586cebd2100f5fc2e58bcf
MD5 3f4ada067b19373173063f593bd83da6
SHA1 fc268df756583042a8a7adff19caec0f0ab9358c
SHA512 27e07df3a4ee8767cf06ffc5e876cc06ea21d9e5e242ae03671426316a7ab4dbe381149d6d518a422573d60b8c0726ccfbc504d83cdaa4dd6180bd4ea49741ba
SSDEEP 24576:/CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAp5SSiVw6uAX8DS52tpz9ZRzb:/CUxPTY+8Wg2lIL8lrIUJLWwq5SW6H80
TLSH
T19E65AE1DA3EC0896D0BB81758A518A16EB32782E1B21D6CF2170C37D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 86a34901efcc757528b8089928e06eae57403a26f9c4d1f3b2099ae6de7f1a5b
MD5 fa850860df09bebe87fe00caaeab84ab
SHA1 80206d34c089c7a5b9461dbfc20f179340613749
SHA512 6c43dfebac00455f24674d586e9393e28bcef5fe8b19e591a6b31ccbdd46bce606cd275ffd18fb79fa6444a7e91e20ffb9dcdd9d75062357429cbbc91a7cc1cb
SSDEEP 12288:aNsfs5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:Ts5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BEE4F149D39412EAC02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 152e6c8c10fb87e8d731f8231858919f423fe9a2ca41a67639aa5cbdd686f12a
MD5 b127f585a0f67c915d5e39b8fcd7d488
SHA1 628a68cadd8ee511d3ab22937fdf6a50091705e2
SHA512 e995e4f784eae5b0b35dc028c72617da09194068834f96c8a4e166a6c10469b33a8357c6f5e55da730134e1b64694c2e21a3d328c6c17031a6e70cd2f30b833c
SSDEEP 12288:x95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6y:x95SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T131D4238043942597E22E0BF3A1FAC2B4D60CF5BE8B0491FBAD205287D735DCB8D7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9a1860a98ead4da01ca632c0608d48d557d1d6a5a6f43d084ea01484f53527fc
MD5 0969feff842939b7a051a8a24f210e54
SHA1 03b5beecef19e04cbfc7591597938674f652d3a2
SHA512 2ca10dd21b4c623973c48ca2e2f50492ff5d6c60d6fb33482d74d22ce416c5bdef874d32be339bfe7ac598bc9cb6074b87a94715af3f4319b4d7ef0dc5fbc2d4
SSDEEP 49152:hRZwQCyiHiQEaaPnM05SW6H8DS52tdDpbRZy:b9xvPj5SSDntdDpbRZy
TLSH
T19E85B01D63DC46A5E0BAD2B8CDA74407E6B27816573197CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 81e1a63b259568229d79e11a54c5963e907c99fe2975f2ae97448ae8c000ac81
MD5 709a9a7301f2e8ebac4e39f20620c569
SHA1 a9fa3d1831eb24621ff46b222ac0c1123c894939
SHA512 7b373033610eb09206df394fe7fef998ebca2ca73e8f24e827a9169525eee625904bd74aed38525d7d079924a1e01b5ca385b0ebe007b9b174ae396f455b7d48
SSDEEP 12288:EbxA1U7Kt5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:EbxA1UGt5SSiVw6uAX8DS52tpz9ZRzbH
TLSH
T12AE4126D13AC24E6F13A967AD5E28105D331B86A532093FF1990827F4F37EE94C36E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 06474dbd489191555289db3a7cc4669ebcea3adfb6cf5cf0b02c65a46bc827be
MD5 192f9936bc3d74d05aaac00b22cc63df
SHA1 2b234ccb9e7e29116de3d9fdd780524b905a504d
SHA512 ba477b8918b147f107b98cae22a7a4b1b24ea1f66ed1e5975f3542722b44fcd33a7da51968d95a9ab8505032f6847071074201b896f4fe66df7c1270f3b51564
SSDEEP 24576:ojsmP0yHaqrVqHra44KDzMsrny5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ojRP0yHfVqzlAsrny5SW6H8DS52tdDpO
TLSH
T1C645AF2EF2B910F9D4AAC176454107B5EB71B42D1F209ACB0170C235AF0AEE99F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 c88ac07a759536d395ff36f116a9ab7cee63c443ba7628bdb7bf86278e1c6bbc
MD5 180e822ad291cc6bb543104e5aa383d7
SHA1 34908705788d77454ad643f61a9e8305645e53bd
SHA512 3f265d0473df94ebaa4dc6e870bf22b5987902c96f5dc78f3b9d12aa7f222c7263f3ece397d5aa65ff78d170f54add9a356badb5462cb1bd6797575e7f6a6a3b
SSDEEP 12288:Vv5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:Vv5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T192D423C4539121E7E20E0BF3E1FA86E4D60CF6AE860862FB5D716147CB399CF8676425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 8304723cfcbffa74965756cc74a23df8baba5e6cdd0a418fd15c691de3838ccf
MD5 aae4af2e3b90dde97b96f0cdde435f30
SHA1 ca84ca0256f475f0106da4bcb07ccdfc626f463f
SHA512 691de829e658915fd493f5e71e6fd4d997572a718c37f89cbba87c37b810491e1a036071d2599a4c0a099380387de1fac0d202cc8180240b2854da11c8064127
SSDEEP 24576:7pLBUTh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:7pLBUl5SW6H8DS52tdDpbRZy
TLSH
T151250254F7A400FAE96B813DC5B68616D272B49D0324E7EF07A84B561F237E64E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 481e4b28b099ac747c79e50d8492449c6779eae5c76c8677dae4b8c892eb2428
MD5 a3fd5deea8792dfb20b22b7aec38a5c3
SHA1 b99593fae1bb59f7b081c48e82ff69cbd10febc7
SHA512 51baa38502f329c90227e66830ea2897b2e5980f2c58125f5b8a363dc41e8909b2ecc8c819194f45b4b058f0eebe9f42dc39dc43ca8f016fc8ec22846d17f709
SSDEEP 24576:PrYNHG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:PrYtG5SW6H8DS52tdDpbRZy
TLSH
T1D705F21E52AD18E5E53F917ACAC38249F272B4A6171092DF05B0C27B0F17EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6b8957b0b103084a7ec59abf381ed94497fa341ebc2f6726a1553176999439ae
MD5 499a2bba7795ad1d6972766b1b2e3adc
SHA1 71436a40148fc12d67e119f79f5e4797ac631bd1
SHA512 1104b937393b67c28155c645f2a73906570bd902da849b2e9ccf99c1f771853d785711158314228b6a1ca66e2083cd977e46a94ddc87b4db9959118e393dba9f
SSDEEP 24576:MnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKH:MnXoJJYH84VVS6AmEcJas+cHBjSSKHP6
TLSH
T1E765BFADA2BC04E9D5BBD17DC5C24506F5B178661331C6CF022082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7a04f71c2a14626cfb7672d58cb1a31fed32974e07f1dceb4cd9350a108d169a
MD5 64f2a2f31e686a4cfafd4a6cbdf2daac
SHA1 bc4639a7e44e4af3dac6df6671985c7f681047fc
SHA512 60e34529f394ca0a34ff8c8be0547cf98a47b14aa9bf3a2165ccc445b941c06a12093a1cdb8b273c36af24c3a98a72b3e2ee5b5bbda91066170eef3b950acfeb
SSDEEP 49152:FDLL9TuJ0M/TYW2PP5SW6H8DS52tdDpbRZy:2u5SSDntdDpbRZy
TLSH
T141858D5EA3EC42D8E07BDABD85B79146FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 5c6cae727a6e1fdbb4bd7a33c6e722a904110d8c64faecafd52f1f0905cc46af
MD5 8dc0a0d8cf3db251284e4c4b631545b5
SHA1 54fe8f4f634974985731bc194a6ada301d70e93a
SHA512 772e9807f11d9763d72089d3977ae26e4e61a22236090b56f3e3f0de3db6ba52fcde3daa978833b065a1d1251781b842794fe4c246000884d9207d6dc8d6853f
SSDEEP 24576:5egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wh5SSiVw6uAX8DS52tpz9ZRzbPmSZP:5ngOJOmPOHhh5SW6H8DS52tdDpbRZy
TLSH
T14C55CF3FA7BC15D5E03EC17ECA968916F6B0782603255ACF0560827E5F1BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 6a2fc52ca9bc72936ed548c67e32e0b2725188a3375f0cef51b6baab693e988c
MD5 e5e20b1eaef3bc55e24119f1aa27f942
SHA1 c30a3e98954b4d59beb40723883185315de14c99
SHA512 b9c6221b8d934b4db63fea05b6b960ad351cec76090ebec5953da3dd3e59fad470b7e822f69ce8d7e5c392d6514b6161c82c4825c6c0145708e779121200ea2e
SSDEEP 24576:kLJnJiTk3R3waE4JrOP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:kLJnJK8R304lC5SW6H8DS52tdDpbRZy
TLSH
T1CC15E06CD2A810E9D4B7C2B4825A1796FF31347D2B2169CB19B4D5313F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e32c40212c1f827d8225e295822fe8ebe7629d57711e1d5734925b52c3231044
MD5 54176be54067bbac1d201f61954088c5
SHA1 6b9ed13ecc01ec7a912febbb3af94f7a2593e364
SHA512 8b998dca2e60d419457ca5fdfc6a02c8b57a79ee4318b048183b05174c69863e658eb7c7b923469c480fca99ae7994a13a3077b48b7341f19283200b1593b733
SSDEEP 49152:p9GqCzDScAZmlvTcFg8Ph6b5SW6H8DS52tdDpbRZy:Fm5SSDntdDpbRZy
TLSH
T13F955D05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 8a4c3be8712a1e81c89c5f8274ba46edff2e7f5685b191261a28b3b33971e811
MD5 3da40069f91cf2577f351ce1c483c542
SHA1 78cf12e74fb75f060f057ad5d3a17f40d62cb6ce
SHA512 041e039db537fcdd7e0b9bc836cf54be2d5a11434fc3c5327c777ba60dfa7f19d289e70ef599a1c68e0002b968aa1e14159b5d760ca5df195e67ff42c055ca75
SSDEEP 12288:YlYJeXm5nkEUuER5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSown:YlYJeXm5jUuER5SSiVw6uAX8DS52tpzt
TLSH
T186E4129C27A830E7E21E85BAD5A24654D331F0B6530063FF59F0C17B8F26ADA5E39E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 fe03bc893ee74fcca12634c05b5f8e65a96799cb3acad5308938713ec1dc0042
MD5 01a2b034965f03d882c1e1602196102d
SHA1 06e52b6b7464ec6d1e468951e9a46438b6a49806
SHA512 6f4fb58eab3d432b153e5ba4afcbc9318a279669ea4c42c8502c4eb96fe4d3f054e9ff48953b6bf44b2e3b5bf856669efb1c76b7c16394fb6e1319166a603c59
SSDEEP 12288:qwu6kyS5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6R:qVtyS5SSiVw6uAX8DS52tpz9ZRzbPmS1
TLSH
T16EF41244239020E7E66E0A75D6B382A4DF38BC658B1053FF59E0E22F5F36BC69931B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 34b1206268cd06cbc72f4d71604b8ff150babc7c51714c5c14d85484cc384a29
MD5 afe9a3484ac0f12cf91e907a2c24cf16
SHA1 080eeb3e01fb0550b02e9da027f730227717dd73
SHA512 0d79aae210372659d8ba5b7d32c4bac71ba0668b4b95b0a0a107720324e5f422045d298b5fa052ba65568e57a71cd17b0b9ebaef4b588816313ae13df3194899
SSDEEP 12288:+Ph5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6l:Kh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1ADD423C813A130A7E60E0AF3E1B646E4D61CB6BA860461BF5DF0E177CB399CB8576C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 aeb7ca11b06ca9a730cbd608479f83e7d124756cb4894d065a6712b8400adec7
MD5 ddd36a6f2c86f68e67efc1cc95aa2ac1
SHA1 e9bac825ba89529b43c231f8828e4385797825b5
SHA512 901f2f67ad45a982198a12240385ed9b3aa95539e41d4bdf29c702d9511d0713e850d6a62ba718b78a25e5355a9ce942c325fa3aff91b4c2b857eb58935ebf7e
SSDEEP 24576:vC+TyQIu93VAumZr7jmM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:v/TfIq+YM5SW6H8DS52tdDpbRZy
TLSH
T194558D1DA7E919CAE276C675C8A34493E633B472137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 5cb780f512205305c40e7396d2832f6c81048d1aa1bd018703835b0342b3ae2b
MD5 8482612d76f8f6ec5943cd5184fb0724
SHA1 3c7e58870e79e2906183266d27a7839d8feb381d
SHA512 805cc6e5a553d9acae69a26b8fddf994eb8d49f7da2dc1ac294fdeb3a24f814be9f103110f9b30c51cd5ebb958fa0e3fe2175e8bc51a00254e0522f1b1b65bc3
SSDEEP 12288:zcyrWOstaa3kcs15OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSowM:yLQikZ15SSiVw6uAX8DS52tpz9ZRzbP/
TLSH
T123F4010EB3AA10A6E16BC27CC8964251F673B075471163EF06A0C77E4F675EABD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8a0bcb5aa3e0c9a761c28e09562bee2135da3603dfc3afcdde47777bfb84e5fb
MD5 469a5b29fa1bda68c6be7b419cd640d1
SHA1 c6f2271aa7ab5612f928312eca0938d811ace4f6
SHA512 9f6bbf84fc7b8031a4fc8895abd2ccd0b750b83db21e877fe8b7ec46d9145b7ca0e69347706fcae41ee254576388e05c4dc019745e8c7b337ee288e9ef20a795
SSDEEP 49152:FpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPS5SW6H8DSB:mpC7b4+80GTkD5SSDntdDpbRZy
TLSH
T16DA57C3DE2B810ADD96AC376C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b72a79e7bb8b06dc31fda31be270bf0dbb049046c22e33fa8936ffce62f1431b
MD5 2574026efb9e4c2ca3abbbe6c4af09f8
SHA1 a37bb5debc03af91706f064aa24c9cb7dc6c2349
SHA512 e9427b9acc9a3aa29690cb9eedd8ebff8b923aa725feca2e862c4b1ed5d0efb53ff12f5377ce00338638a83c98681865e6c9f4b568d6f66cb2568576b8dfa61c
SSDEEP 24576:+SAwJPE1IDAo+4Kt+l44135UQK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:+qPCIo4Kol4/QK5SW6H8DS52tdDpbRZy
TLSH
T1B055BF19A7F956E5E17ACBB4D663C611FB727822133163CF4290813E0F169E89E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 dcc80c91fd288062da81f7308370978ed03555eeab76f7f36f38c90eccf245fe
MD5 d58c6046aee0f814f4f092ef7c8ed1e2
SHA1 61ffc84ec6edee8a64f0ffd77c1c1c46ddcbe4dc
SHA512 99d995f0e2a8e72a2850829ee351434162a0d1dd3a92e737c0d02da3358d51caca85711b9af3459e0369d5313c61a8f57d2086e4f962568b44d6939b450d348a
SSDEEP 24576:zyLXPLcM94t65SSiVw6uAX8DS52tpz9ZRzbPmSZyo:zy7PoLt65SW6H8DS52tdDpbRZy
TLSH
T17225E03DD76C04F5E47AC27DD2A38906F67238AD033166DB19A0917A1F2BEE46939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 7c1aa8f72aeae26c069e29d05c24662dc64474d37dfc4846786e206efed8ea39
MD5 dcfa108b1b7aefc7e70b624eb9ed278d
SHA1 4dcc1423c9a249410d863346fc788325d5fb4192
SHA512 daa5fac3ea99d86364ada56bb97a117310e4ff19bb91df6e716c98c4572edf76f924ee8e39d8ebb08c0932ae47e2ca188c94b3e217efa86fa7922f0a9eaa7ce4
SSDEEP 12288:E9lyvj3IkxjbBzF5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSowm:EWv8qjpF5SSiVw6uAX8DS52tpz9ZRzbH
TLSH
T1EEF4128D13E020EAE13E4670E1768265C135BCBA1324A6FF79D4D5BB8B35AC6853EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-16-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1000-24-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1000-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1000-110-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1196-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1196-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1196-158-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1392-69-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1392-219-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1400-163-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1400-369-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1480-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1480-106-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1636-85-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1636-335-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1636-94-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1636-91-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2172-147-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2200-367-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2200-118-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2928-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2928-51-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3132-73-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-79-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-82-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3132-251-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3268-159-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3292-6-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/3292-1-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/3292-81-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3292-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3412-61-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/3412-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3412-65-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/3412-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3412-55-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/3440-175-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3440-177-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3440-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3440-209-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3440-193-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3440-167-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3440-421-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3496-366-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3496-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3496-386-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3700-408-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-382-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-391-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-402-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-401-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-400-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-399-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-398-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-397-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-396-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-395-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-394-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-393-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-389-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-388-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-387-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-404-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-403-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-390-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-409-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-407-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-406-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-405-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-372-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-373-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-376-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-377-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-379-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-380-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-392-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-383-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-384-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-378-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-385-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-381-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-374-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-375-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-371-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/3700-370-0x0000025DE1050000-0x0000025DE1060000-memory.dmp

Download

memory/4028-156-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-38-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4028-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-31-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4380-368-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4380-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4392-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4392-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4392-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4392-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4456-160-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4628-111-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4628-365-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4760-107-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4760-99-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/4760-104-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/4760-350-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4860-139-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4860-164-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4860-133-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download