Analysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 749KB
- Sample260702-ne4xcagy6v
- SHA256 5f7af5cb29119b4f7a10870b0d515d063685389352375bb1f6de4b158ea3a536
- MD5 8d1775f7859bfbd8f25132a2207aca17
- SHA1 853463c571f2278c1be140f1cc78b046e781136d
- SHA512 6b0431ab2021072b300a46c82efb7f3fe250cd12c9cda8a335c5b6905f4e80f2eb3f7da67aa938237e2654d423e9ad8726fc6e22611e2b43b7271a8707857986
- SSDEEP 12288:393G6vH9/AHubviBNDYa3uKNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9X:3VGGdWBZ+KlnOHKVnrsaGBgW59tET9sw
- TLSH T165F4021132C080B6EDB3153459718AB1957DFE301F62499F73D8272A6DB47C28E3A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 804 alg.exe 3900 DiagnosticsHub.StandardCollector.Service.exe 2556 fxssvc.exe 3372 elevation_service.exe 5108 elevation_service.exe 5024 maintenanceservice.exe 3604 msdtc.exe 5000 OSE.EXE 3004 PerceptionSimulationService.exe 1840 perfhost.exe 3344 locator.exe 3920 SensorDataService.exe 5100 snmptrap.exe 5028 spectrum.exe 1076 ssh-agent.exe 2868 TieringEngineService.exe 2064 AgentService.exe 1292 vds.exe 2816 vssvc.exe 4628 wbengine.exe 412 WmiApSrv.exe 4540 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9a2abd827c8d181e.bin alg.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001656bfbc140add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dca5aebc140add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c70ddbd140add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e62491bd140add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000249d6bd140add01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d0ddbbd140add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d54c79bd140add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeAuditPrivilege 2556 fxssvc.exe Token: SeRestorePrivilege 2868 TieringEngineService.exe Token: SeManageVolumePrivilege 2868 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2064 AgentService.exe Token: SeBackupPrivilege 2816 vssvc.exe Token: SeRestorePrivilege 2816 vssvc.exe Token: SeAuditPrivilege 2816 vssvc.exe Token: SeBackupPrivilege 4628 wbengine.exe Token: SeRestorePrivilege 4628 wbengine.exe Token: SeSecurityPrivilege 4628 wbengine.exe Token: 33 4540 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4540 SearchIndexer.exe Token: SeDebugPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 4164 2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 804 alg.exe Token: SeDebugPrivilege 804 alg.exe Token: SeDebugPrivilege 804 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3328 4540 SearchIndexer.exe 116 PID 4540 wrote to memory of 4804 4540 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d1775f7859bfbd8f25132a2207aca17_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:804
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1176
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3372
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5108
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5024
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3604
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5000
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3004
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3344
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3920
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5100
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:372
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1076
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1292
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:412
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3328
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
PID:4804
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a0171d32db42a44e04a61dedb45d2e3ca374b8012be284c98bf519a7fb2be90e
- MD5 27d1143dc40293a6884db429afa6aab0
- SHA1 b468cb7e5f129586712cf3861697258fdd0841ba
- SHA512 d98128542f1f06e79e7335a68c50d012d1caedf09a81da11ce6c75c8c291badc13a08c2140d9364e2fa0654ec8ca4a50b74858cc031957994fe09ece7176a6c0
- SSDEEP 49152:Hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnbOHK9rshP9t49AmT:13q6gjBUo2sqv
- TLSH T178D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 71ede847a9a9d9f130901fafcb0885224433ed111a81e3f8faafee408f32755d
- MD5 768c0cc2850eec8111c8b15d3b72f86e
- SHA1 7b51d730e77aa8847a4cc408ac35a9106a9d0ae0
- SHA512 0180bae72cf54edf63622aab32d9f6edc1c0c7505359c4cfc047939ed150b2d8e313b4851b511b5b0654aa872bdb913d8d135152f6192cfe9b030cf75e792464
- SSDEEP 24576:WXY8DZczAhlnOHKVnrsaGBgW59tET9sq8mAw:QZc+OHK9rshP9t49AmT
- TLSH T1E2050129639409F8ED6B823DCCA28516E67378514760E78B03E899361F337C89E3FB55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 d08cd418126d71fcc8a1b46d86c8120d370f48ccc161556b5c61b5460c333eb8
- MD5 0559343ed23e16d102dcef7a94628aa5
- SHA1 b3906b8157bc5de262c2ab2a15dd4a6b1e106fce
- SHA512 eb163084dc1dbf86c93684f88caec1ce48606df5d4a02f041c7fbf108977c24a0f96fdc82a4fa36452d1b78f316346d5451a6b9ec1b5d7e8690f1b0a3cd6067e
- SSDEEP 24576:l0QenGN0kExOrM1lnOHKVnrsaGBgW59tET9sq8mAw:l8GN0BoOOHK9rshP9t49AmT
- TLSH T1C2459E16F6748335D073C0B9C5D2A69EE97130865B308ACB4286D77C3E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 6c2e0d7dd9a7b3cdc7a3badc701f0de7eb2b06645037c49ab10eef64b1fb0e91
- MD5 f7fb9f14e6558ae110bf7eb2401a13a6
- SHA1 ebc68a44351166c997084c9904f4cf4dc3e4fa82
- SHA512 5aa479d182723810c018c5fccd15d167cf714bdeb6336eae9bb46d7a93df1d607a13d55e328bfa1147a08ecab5e7eb3aa2aa3e237370f7120c79e8636a1289c8
- SSDEEP 49152:bZezSC6vUzPvuHjyhOHK9rshP9t49AmT:tezSC6v2XuHIo2sqv
- TLSH T181756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 4c6b471de6f8f74d1c612472fc9c521642d8b100ba92184e57ad310fb2a5ff91
- MD5 1f70ed313441a64e9900e819146cdc0b
- SHA1 8547594d70bee9f9aea8f299d4afababf9ee378e
- SHA512 a40f5448fd9b151be9df4132494bbdb55d5429d02a3692afdec77011fde6f30226ba0ab0367985fe0c1c234647e556cf22ff423daea5fbe953a3b1f99733a497
- SSDEEP 24576:AAbnPcVjXv/l+dzklnOHKVnrsaGBgW59tET9sq8mAw:AAgVjXXl+5KOHK9rshP9t49AmT
- TLSH T16B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 39e5b2f3cba275e78a9d939267c82b76df32f2511e91389eefb3a1e1e485a067
- MD5 c19c911d7bdbe728abea7f950f25af7e
- SHA1 b68bf8ad770c32eaac5e9d23e3b68e361ab868cd
- SHA512 14aaebb16a6d4ff2998309c21611d7b60b73a4c4b858ee38c7037d0812ae2ea48a0b862833499990fc5302651a7957500d331e34d7fc91e7ef385be2a931ac09
- SSDEEP 12288:A5o8Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:A5VlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T189D4234F420441ACEFEF113AF92345DAD4513F605C13099A2AE8B96628FCA87DAFB15D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 6a4b3ece402707192532f51abf43838dfaab31575c23072ae3f465d70a60f914
- MD5 9e0b41da29101ab8c2bb4499258bab47
- SHA1 34bdc306a490ac3ac2f527cba78d78e0600741d8
- SHA512 7f5745b9c788b2940d81e7aec989caf38ac745839036d32d42ea749a1c276fb1b42230f06f80f1bdcb2f3bcc0f8d8bfed03eef4f1ff14241ef0b2c0477bcb72c
- SSDEEP 12288:IeBNUbTVO86UbNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8Kdi:IJIUblnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1D615CF3BEE28FCE2C67E8D795A518640E77278304F2293CBD164C20E9E235D15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 526ff6db9b99887563dce27dd5f27b86cd2e6754b3ab9b0102089728c6172c88
- MD5 a383e84033a3d5f1e6814d1fc1cc1bfd
- SHA1 351d052a978ebffd84cce1049f23e9408e32fb38
- SHA512 6420bcaaf2abd173950114cf8aa183874124317c8ae5c9fa0c253753fbc024ad7b123052181151c174369c2c44b541687a025fb40a12d2dc91be9898022b8045
- SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ69DN5JTNRV3THE:nQvGAdlCEL8c/6RNH5Cxo2sqv
- TLSH T1D3367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 a23527106c814a371c6a1fd658cd4abf073a45f850a52b2e36c58d4b055a6d41
- MD5 e256ed728f9cc945378ff5a5cc81c7dd
- SHA1 917a9d4bd8cd3028ff137b7b34dc99d2e1a4299e
- SHA512 23d161bcca299770df8387f823eda6a93282e3a5032d8e75b93e6b6d2acc1cf4230238bfe7416c372948731eac5558dbb2d9043a8d39fc95dfd51dfce02fc923
- SSDEEP 24576:omewsAjjlnOHKVnrsaGBgW59tET9sq8mAw:7ljBOHK9rshP9t49AmT
- TLSH T14515E031FA34D036C7BF0DB62B32C716542D7A204F521AC3E3E89D9E59742C26776A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 22756b04914bfd8200ea660466cf1ba53008e4b5a0d25b36b203ed18730746a2
- MD5 1d6e065311f7900420d96bd1921f3321
- SHA1 3e2597613661349b36726c4b56ff438237e30c31
- SHA512 048453f84bb762ec41be4b5efc69314da7cf44b4df95aeb4b4a238973ba0d5129a08254257aeb8df27d9e200dc898cd4e2626fcecc8d5308a3562eafd87fe3be
- SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHZoL:lUEtQevvqc2W1cpV2XF32G
- TLSH T14B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 09a424ae0f9a1e5ff9c2025961ce8351c3d3d61f6669aeb416937dc87b8d139b
- MD5 43e0936f1677fe0f85c54b3c6ef721aa
- SHA1 c0029955d911632a1e82063f8e70d5b6f281d565
- SHA512 e0364b2804bb37cc52fcafb1fdae4f13d42dd09987a38f0b79eeae731de2c8de0ba5748583a16bc783e1e3513e5644ea3b952293a05c8c118492a40f5d58d7cd
- SSDEEP 49152:uabRquA/m2yL5zMfFiV+XenmE3/ziOHK9rshP9t49AmT:Loq1VjnmVo2sqv
- TLSH T1BBD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 26dce7ccfe3257eec6b36bcbf71c18f66cca878362ca1abbb19ff4ff9e6af591
- MD5 693dd2d9764ebb56b1d5046afca4bca7
- SHA1 ecc216a456f71193f9a7cab8b8f44215d97cbea0
- SHA512 9205942622f17c682691a651e2b6976533fbf536392c8d3c201113d2b521b1e73f8286fc9a1790fd37973adb74075627959f81e88cd1d6a51144c1b84c605f03
- SSDEEP 24576:RAhGLvvFoiwtA5l7S53IlnOHKVnrsaGBgW59tET9sq8mAw:RAMTFoiq5GOHK9rshP9t49AmT
- TLSH T11C459D81E7F955D4F5B3AA78A9B68171EA72BCA65E31C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 829KB
- SHA256 cbeaeb723ce3ef1a60d417c5ce002563d8b4f6e1b3acd5027fe02d01466e3c38
- MD5 c4d7183cb384d1b0d91bbf001ece32f9
- SHA1 b65e0f7f3b246e7c61e7f69672c706ee8f771ffc
- SHA512 d6eddbead5a7b3ce7674e5efeaf0ba280008a4db8219a3a91131ac8751a1025865cd56e2834835c640142bf00e837cca43335943d4b46bbf26a3792123fd3386
- SSDEEP 24576:uwuuOWrlnOHKVnrsaGBgW59tET9sq8mAw:uwVOOOHK9rshP9t49AmT
- TLSH T12705F14A72A40CF9E9A78139C557C136F7F2B8112A22CB1F17A0C65B6F77351AD2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 fba524865f84a5024c89b2130ba8a0cf108bd929af8bbd661d4017b9e6d7456d
- MD5 c90a374cd7aade91f16b644dc7cad8c5
- SHA1 be0de6074d456c690c6655c7e82bb6c414f6a5da
- SHA512 deb9808a107a9bd868b07f58d7def2979011cea475d75ffade3cd78714ce251847bf1f89d939154ee336cdc8da816f8686660bf1a65dedcc0a6c7f818faa5da7
- SSDEEP 12288:37V1ITbNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:rVu/lnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T140E4124E235421F8EAA7513DE8B24646D3723461273303CF16A496662F77FC29E7A335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 088b2ee447f045ea8e814a88e6b5541edfbcbdccfc989f687db93cfa09d796f6
- MD5 dc3b9af7b35a1a41e3056d7270b7930c
- SHA1 03450109a25534344cb8b5e1f8a644e72bd9d9cd
- SHA512 2739dafb7e853963f4c99f41d506b73400b22f456caca7da16de2c7dcaf7b7b1667ecb7c7a96f548705f58688834e36cb56c657a8c0db0e4050d809dae4ca3ca
- SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uf:WQRQyi36YOcP8Lvw2gAf+PN3Jo2sqv
- TLSH T16D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 70f2cd10a2f9bc8b9585ca38cfd036664de82a5da0d75d5e40658cce4d2748b9
- MD5 e1a395c15620f3afac3b68122c3fcf9c
- SHA1 9e6331b3c1ace5c76956d5a72b164ec1e6721ffc
- SHA512 a1f218a0462a6d46a11fe78d1490b7b2f86e9a1cf5ac5a139044e414e164dacac4bda7f07b8728635ca2f08c063c5df4988e48e9e133255f7a14fc83cd3b6cc4
- SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ud:WQRQyi36YOcP8Lvw2gAf+PN3ro2sqv
- TLSH T1EA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 8999ec88172e0f39417e443162ef27708664ab8738687286c7d48233500e5862
- MD5 76e3c2e4df64010fdc97746fe69eca64
- SHA1 074bf6c123423aee6990bf82386d23ac46ce30c1
- SHA512 6200548ac388a27c944ac2f5a36a40acf7f3a1f47eba05595fa87a317612f592be66cbf56b80cd98c70097f0bc452255035c9862631a571395f4f0d5b626a212
- SSDEEP 49152:A68Qg55nhMeWu7PNU3/rOHK9rshP9t49AmT:6thbRc/ro2sqv
- TLSH T16EB55A33B2F200A9C44DE1769F4A873196D27C718FE1E3DB851572161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 e432be8397927e0968bc93ce9b447a0912ab302e3bb30ac579f5d67219275935
- MD5 d1ef2e0bb86a637458633592cb5ab6a9
- SHA1 a56c1e98c44ed86656e340ecaf814f0c60fe18af
- SHA512 847d4efd00b67e949f3dac563a9b73b29d84c5565f79ab0df35966ff584ed0278b02822d47956723420bf192754b6b0317d642ad008efc87965bf7d83c2684d1
- SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99b:4y5112gYy5azzVv569nLKnhZoo2sqv
- TLSH T170168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 adffc197cb2f214271625db0fce4e9cdb340390b20e5b94c9e0f26761b0f3ee5
- MD5 b839327f661ebbc8d971aa5c4a169db2
- SHA1 ab046132f5e21f913b460c39240e2c875e6daf0e
- SHA512 7f5a5570dc63dac328d3bf772b3c82b0500a6810d8534d535d7915a2aeccea071c90e0415f41f4f5b6988d8a2c8d4a19f08d14b58fe2b91709ab92eea5544624
- SSDEEP 49152:KP+taZ3usBWOBr4tEGp0bqx0z+n217aau1glvOHK9rshP9t49AmT:qu6JmTxd2dvo2sqv
- TLSH T198D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a93de47a5e42738465086a78169e85ae798876ed6a318eb506015e7556d18aa2
- MD5 bafa9f222c69e1d9992eb5cea073e873
- SHA1 1ed8affa776d2a742e636094365444180b91d5e7
- SHA512 62d7db8b13eec137dadcf01119c695ef66b15c1dac08f9eda7c5211bb66ec932bd1eb94a596a6091084367dac91a121ed89c0eb75a44b1cb69b899d91d751fa9
- SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xkOHK9rshP9t49AmT:9mifPbR9o2sqv
- TLSH T158B5BE13F29801E8D06ED17887569232EA62BC450B35B6DF0A90B7961F7BFE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 a3e85b6bb4d65b8adde58b713ec3e9445a769b8157b41d37f415338f2539bb0e
- MD5 4b3b6e5cca84fa37a81ba5593f1efd9b
- SHA1 be51d5a62a734dad9912fbc581218c76d8b6489d
- SHA512 8e2ccd01cf2e71cb35df820e6e562e71772474562065aed8e171e6eb829f2f278a35ccf5f1c3eb3c28ad62c9c886aa10e7668dbff2462a64ea1c6f69214403d2
- SSDEEP 49152:vSuZQIY0Be2K6RVtOnks6NMHqnOHK9rshP9t49AmT:V5dKoi61no2sqv
- TLSH T132C5BF03F2E941E8E0BED67487669236EA72BC464B34A6DF064072551E77FE09B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2d9e4a13df2717dd034c7aa23820160739ecf1cfadfa50f7e1b539c5c1f273c3
- MD5 c988893d453483de070c56c30105cb63
- SHA1 d19388a88e223886def92a17483039b227fe838a
- SHA512 23c8cac6471943227c01c0e07c83d0b3e302f937df36af55c56681e4345413c27f458eaabb809f541fb5831c5d2a0a4eb76ab23e5b7f0c6e7b2895b1330f4425
- SSDEEP 49152:5GrSn8EApI0figTgiDn0AP5weOHK9rshP9t49AmT:nX2iyphzo2sqv
- TLSH T197A5BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 21c0c33094c43d515fc7e1bb61b67b46584ea453638810a0d490a1f79f3386d7
- MD5 66307ffd984404e1a5f33326f513422e
- SHA1 71c6f45edf66ee416b3ceac348e7d97678111038
- SHA512 14be1940dde5483c5e02e9adde2a90af0848da855145f9403188df8d249e26de28695b4eb152ba92f4f33f01b7b999a955b3a272f74788cb5fa0039dfe655dc8
- SSDEEP 12288:zyNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:zylnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1B2D4234F510442ECEE9B513AF92342DAD0513764BC13059A2BDCB42639F9B87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 6daf432962c5d2bab3b036284d89d56f05a0b40dc7af4d8f0a32335c66f6639d
- MD5 a142f34908c9dd4bfbe8269a608672bc
- SHA1 7f1a01bf7509ca049cd412b9b5e4be59eed0b983
- SHA512 453549c08a701fa74343a9ad4936dd0314e0d82178a48bbadd43c1e8430c098c99a7c6bd1f554842c74f47326e194d55f0e718d74dd742d24952840e5c0944bd
- SSDEEP 12288:xSNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:xSlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1E7D4234E510442ECEE9B513AF92342DAD0513765BC13059A2BDCB42739F9B87DAFB0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 903ed0c41ba572a5e7a1a7b62eede0b2a3c5fd83792f03e46f6e24e2b62bfb00
- MD5 3df87214059170b5c94ee0bea52675a6
- SHA1 63f9794d8d1d88d9feeb5c4d8e80390907476bd4
- SHA512 cf5d9f54935fdf168fe15697b262a611681148a8f88cb34a347d203e9cc7e1bad1a267ab6bbb17db545ac9cfcb80c4279495d1b18e51703b9f0d756c3e509b8a
- SSDEEP 12288:7hNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:7hlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T15FD4234E510842ECEF9B513AF52342DAD0913765BC13059A2BDCB42635F9B87DAFB0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 fdbec0559e0d714eae86fa9cee2edad0af27b8ec60ec86869fea1e067ecd4eed
- MD5 c4de0903520a9a887cd09c2d0c29f67a
- SHA1 2e0c99d4a97237dd6b46b09ad9adbe0b3c752a48
- SHA512 56b9d1dc8320b34b88f4283ebd22f0b5c2ffd8e20494970b5d4416a3c8c8a88dea9644d76d44498bf02aec276f2ccda9b4b3ba9d260953ce9c4c037958b13dff
- SSDEEP 12288:slGNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:XlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T12FD4234F121801E8EDABD239E933419AD1B13A60AD33079F1B9464272DF5B86DEF725C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 f9a1a51dd568ff3495499598a93a45b3f498971e408a95d9b759fd5a6e1da380
- MD5 87ee58b9fb1206acae5a11366f319a34
- SHA1 035e095de3dc0e6953795604055d90d331fb1a64
- SHA512 53440d2593a369f0ef28188d8762cbea80c1ddf473f11cd3a76aabd34da39a9d013a03a9d577e447bff8fcef7367ad8f3a160802724b2324860d118771ac10fd
- SSDEEP 12288:6qNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:6qlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1E1D4234E500842ECEE9B513AF52342DAD0513765BC13059A2BDCB42639F9F87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 97ed3e55079e75724fc72f39ccefdbca283b0ace7487af74c4d5bf06c7147443
- MD5 aa10751ff44b2819b7acaadbf19f550d
- SHA1 defd2da340a6615ff47423abbf6da051648e9ad2
- SHA512 910042016e07858edacee2008ce5d71e9a0ec2dbc47bebc348b7950d124f2d51657bf8e68b69209c7e0ddaa9ec92350b407fecb4d7e517958117cebe941f6455
- SSDEEP 12288:JsNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:JslnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T178D4234E510842ECEEAB513AF52342DAD0513765BC13059A2BDCB42735F9B87DAFB0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 603KB
- SHA256 69638ab652ba0d371845e2d27dfe33ab939ae2b0a03166a1c5918c25eedb3f68
- MD5 8bfa95ce7c3fb7fb26b36a4c79bae6ff
- SHA1 3a38b06c5591886ab59896cbfeb7a44ecb744643
- SHA512 8c19331acdc1d2166723a204d68e4ac8dc451e1ebbc5f257649994f254066ac8774b4bd35c21682eb6ae1b7c3879026d45f89008bc71c3fee64cfe34568e2cfe
- SSDEEP 12288:AWNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:AWlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T190D4234E510842ECEEAB513AF52342DAD0513764AC13059B2BDCB42735F9B87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 cfb223fe5cdd17ec8f5c9c8c6d101f37f65085087e035b5450ac59d7e2a877c1
- MD5 a82aa82b83cdfb6314def75bd0c9613b
- SHA1 b7a8baf0799faa1d045e3a48b82f97b768dc9271
- SHA512 f62e78e96b322476b2483a63afe589dfdfcd82ff38f03c8fc7ff57d8c186871ea36e26e3bebd5292828ccdf5dc9c13a28d80deb5991c023d35ac9521240d6906
- SSDEEP 24576:RZMYz4DSWAlnOHKVnrsaGBgW59tET9sq8mAw:RZMYzoiOHK9rshP9t49AmT
- TLSH T17B150299B35008F8ED67813ECD228946D2B27C690A70C61F17E836271F733915D7EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 603KB
- SHA256 37b7a9fc703de47ef512b967864fe700afc59721e6f3c4791640c4302ee6a2c6
- MD5 048de8cb297ec9d4e690af1a8bad5f98
- SHA1 7780eb2a860a1c4c9343c6df10465b64d55e9c6b
- SHA512 cb78dd45981fdd2e6576a838dbb7dcf1b7e561cf3cf9b94d30697e1574b1f0ad276cadf756a8ddb09bd9ee3b5c2b612714cdbd30392a31b91fff44ac0c749b84
- SSDEEP 12288:UpNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:UplnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T13FD4234E510442ECEE9B513AF92342DAD0513764BC13059B2BDCB42639F9B87DAFB0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 603KB
- SHA256 c22f28853f8f755507fa32dda962b1606a8581d09cb5d1c6368cb643355b4ce1
- MD5 c6988b75adeda94b3a4db81c464af8ef
- SHA1 2f98d14ff85aaf37619dbfcd3e6e7a816d4c6c8b
- SHA512 c5689053a1d177a52187127e6d1439ca79ed9562837fbc25106c2376b6063cedd68e7768b73c33961a5392d4ace661dacbbc0c0fd994c29aab1468eb1138fe8d
- SSDEEP 12288:u7Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:u7lnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T167D4234F510442ECEEAB513AF52342DAD0503765AC1305DA2BDCB42639F9B87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 740KB
- SHA256 a0d444555e9024eb7709e2d6f6b77dc4c820e36f84b01883b0138f0c8f8f1a02
- MD5 f5fbe8c43bfeceee06b5313171640394
- SHA1 1fd95b7649ead6e96e75676666578fa07c14241f
- SHA512 ff9d4e0b459e657dca09c9cb20122ef3b6f88c49527e14898477b5fd76da07108f0df1b8c897d2f10fafb3917cadcc12c7b4610a273f6e3305952e547ae5617d
- SSDEEP 12288:qCPz5LY+UNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:bzy+UlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T145F4120B736020FCE97B9239C8620A46F37278315B214AAF17A456772E777819E7F760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 603KB
- SHA256 ef024a571457eefe7ff85b5e3abd341008525f996904a0837c0737afb78604ae
- MD5 0e30b9d7964baea3a31a85fa72cb4154
- SHA1 52857e5e6ac608f123d7e29111510510fea7a982
- SHA512 20a1cb717499441bae53bd8050f679b794da4bac9d71f993b49bf739f2f0ceb00f1bae5c8207e9f2e4a5770f390fa96ec2b41904e633fdccda16023c45a63700
- SSDEEP 12288:4uNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:4ulnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1C3D4234F510442ECEEAB513AF92342DED05137646C13059B2BDCB42629F9B87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 603KB
- SHA256 1fbbd417cb51338b53b86d0cce35acde3582250ef6292438d1860bedb6e032c4
- MD5 b3319d4a87f40683663ea2f777d931ed
- SHA1 bcfc0c6d585f086d1fdf9d79c6bef48f0b4a6715
- SHA512 4fe0798adb413b3cdfc1b5438bd4ba48d1edfdb8a522632082af623aa5bfb90c92ae653ebff225a9a0f093259a8d8cd9918b4f03e36794be30292c4bdeea50c8
- SSDEEP 12288:8PNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:8PlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T159D4234F510442ECEEAB513AF92342DED05137646C13059B2BDCB42629F9B87DAFB1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 740KB
- SHA256 2432ead8ef04a8731bd7bd9d79b28ec04612d34747214d2a4ba6848739f8060d
- MD5 aa9f39bf14a9c4cd89cf0521d1100bd9
- SHA1 d94af5c2e7f39f39a1a2ac47478aa22d03fd40b3
- SHA512 ecdc87ed923ea1987d43464266dbfe362959cd957290062a4be9a734e2711d79bbe2727fc9a7630e2708b104a755e76999da20ea3e1e87d6b0b5bbaddd685bbf
- SSDEEP 12288:bCPz5LYT8Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:GzyT8lnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T13EF4124B736020FCE97B9239C8620A46F37278310B214AAF17A456772E777819E7F760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 9b555e6853dcdc3a90224e3863da0e67287f30f366ec1d075204a7cf3dbee093
- MD5 d6c572272fb86840bcd521543f8f7b00
- SHA1 7544b4c7bb0e3c8b39625beb4ff0212e95652b8f
- SHA512 05d35ac3b843e76d6ab738ad3aaed08a15620c2f7efdf1eb700506c05b25ae0e0749f51db9ec993476e08b11441ab43a39644ba8990bca109ca29c015eb0db12
- SSDEEP 24576:ecP4mcvIjkGOxhKP2l71zNKbrh/8KBXlnOHKVnrsaGBgW59tET9sq8mAw:ZP4m4IpOO6768KvOHK9rshP9t49AmT
- TLSH T18B75AE2DA7DC0095D0BB913885658A4AFAB1742A2F3286CB1160933D3F77EE54F36F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 7267a8a9d75b1e82f7026e02b63bb1f57e7874efd73123c310a5a36e880ed844
- MD5 eff0d9dc6ca9615fb072ed615a13c279
- SHA1 d9a8258bd88d854221bae529c288929754168faa
- SHA512 9cd1542b0f0867ee664be15beba155b6cd48f99cd060cc99f0bb28012b8b63796fd5ef12f1ce6e41dfb45f21cf618b7c33e0aed29d9a401277010055a352b4af
- SSDEEP 12288:Oq7fC4Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:7vlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T162F4010AD25802E8D9AF6139D7524685F3333C2496E283CB17D0F53E1F7A6819EEA717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 eb5af39df66292d92923a61a0e084ab0196dfbcab5277fd0b8b93b59fd9f5383
- MD5 300fb2eb3a3374e71fa6af45f6c825db
- SHA1 863b6c24563e4e5b693776436afd35ffe05f5d7e
- SHA512 a295e9519698e29d3d7e425f7c1dee4f89925af0fa4437d1dd616976d392fba1ef26d8efbcb045edfcbebc14a4d036f3f8b60dd49b871d5310d0e0c53a8a08ae
- SSDEEP 12288:71Nv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:71lnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T101D4234F920842ACFEBF5535B52381AAA01137746E1305DB7A98B52624F8FC2DEF721D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.8MB
- SHA256 d1aac8a39ad85abadce44b5aaf2e6aabfa15b0e166b5aeefbec7829153eddfc0
- MD5 7ca206e36f25a32f2b46e05037d4600b
- SHA1 0ffac86a3de6b62a9514fb0d4119d3d4d4c5cda4
- SHA512 6e49790db79be192d058ef16882b0ba32757055cdb64176d8a40924da2cb309e8c2ac04d24719ce196c59fbe85f15d0d8deca3cbdf4df92f97f43e53d4acbe05
- SSDEEP 49152:+a0h2GEkuAe73q3ppt6zwwQJOHK9rshP9t49AmT:+a0hNYGtJweo2sqv
- TLSH T1B185AF1E67DC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 681KB
- SHA256 2a7cc8b4aa563130a7f0ad70f0fdf14edc03a540df9afcbcd77afd02da8ec267
- MD5 fe9057332adf71c8ad54f9a9fc84f6e0
- SHA1 704285354b97658565b3b968a39dbf950449012a
- SHA512 8c7d33bc9b21cc6944b62f93b9eff859d89331c4879535f00131fda93b47b59a33e082d55e4fe81d050d2b21427957bd0fbc41875ff93ad741781a9d3889dd04
- SSDEEP 12288:+hbHjfXMZNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:+hbHjPalnOHKVnrsaGBgW59tET9sq8mT
- TLSH T1ECE4126E126C10E8FAB6E13DA562854BD33178251B2253EF23D4813E1F3BEC58D7AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 6535e6b0611ecc0eb2f037fc3e6570638328a1881ecb3715bd63db677e2009e9
- MD5 f032240003d1797d4b46b8b687b6de30
- SHA1 c76bac5405f4eae78b4bf9d554bb7dca448f2fb4
- SHA512 7e2ad88e9936a7aee318bfbbb91015aa00c54d48c2e259e6858c5146b0ab3a99d2be17d22ff30d20f4f1fc352815ed4b64a5bdb848f04b54c847217319e5427b
- SSDEEP 24576:g+2gxicRTk4yti+R5dUR/8lnOHKVnrsaGBgW59tET9sq8mAw:grgxzTk46pUR/COHK9rshP9t49AmT
- TLSH T1AE45BF2EF2B810B8D8AAD136450147B5FB71782D1F219ACB0174C538AF1AED89E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 600KB
- SHA256 8cb70966529af1ebdb63c0e0fbe967d88ceb3d76a3d8225ccdddae4cfc80708c
- MD5 5cd45c46912b707d2992e551f48730ab
- SHA1 4c6480deb5768f45129f215df435fb3a32caf924
- SHA512 d874d88533f155f2972f20733bb69ae53fadd2cbe687140f9e83c13aa349bdaf519867fa619cdc8abce16bd1e73850d2b00127d5e7c3167021dc84be4fefd155
- SSDEEP 12288:ROTNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:ROTlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1B0D4234E410842ACEEBB513AB923469AE05137606D1306DB2ADCF42729F9F87DEF715C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 963KB
- SHA256 90ab125faa4363aabdb21175b897024a926689b6b346ba5ef9a212929ed65b8e
- MD5 36bd4c1fa3ce6c03def03f84c3b603f6
- SHA1 d2a21510e3a5387fe788b9273a1f6de0de2e6005
- SHA512 a98e5544956362ca021b895ad031e8ff20023072c198fb61f5a5404ff1b3d3ee180b79ccbb1cb40cf9458bdabac29e39a6390d2dc7ebfb40e5407a5df0cf2ae8
- SSDEEP 24576:N5L3UTzlnOHKVnrsaGBgW59tET9sq8mAw:N5L3U1OHK9rshP9t49AmT
- TLSH T11725F149E79400F8ED7B913CC9638A16E272745D1721E7DF07A88A661F637E28E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 693KB
- SHA256 d2977c345dada78ae7209cf7cd4dc1501794ce9c3c69968d6a9b5c9b3c55a19c
- MD5 c78d9b6ff0b389d93b7a4dd7510a1ce5
- SHA1 684a3d0bfabd4a084044c7d85c5fd314ade33f59
- SHA512 50c1133c46c4026a9ff3f5ebb674bac0e634125f51145389bace0397494a0a4bb77eae98e8b69a311326141943812a7e6f2675cc809cccd4656d9424a394d976
- SSDEEP 12288:opFtzOXNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:IOXlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1AAE4121E329C10E8E97AA13D9953834ED37174611B2307EF06D0817E1FA7FE8AC7A665
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 d3709768153e1364955dd2bd21fc215ef940807c8a9e1fb12c9186084c46ab49
- MD5 87ef0c60dc5359ac66acd01c88677870
- SHA1 ebc86a65a389b5f6d630f16d8cba2764dde9cc36
- SHA512 3c862f7413534b3de820a2876778e9e395cd056d8e7d13d304b73878975d340c72e57bb0b29063e479cb24f9e1b27c414cc9346bd4ed65b44fc740dfd3770fce
- SSDEEP 24576:/7NM9YeZqmWMUkPjZM48Mv6bEhs6lnOHKVnrsaGBgW59tET9sq8mAw:/7cBWMpPjN8DbEhVOHK9rshP9t49AmT
- TLSH T1CB65AE2E6BAC81E5D577D13DC9A28246F2B1B4611B318ACF1152833E7F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 222d812d5aff4c29e4f156ebe22afd46aaf32a28b46154909b3a3bc29811fd08
- MD5 240104fb8df6712592d84920f1c1f97a
- SHA1 d657465b6c65a190a1cd1e90090c952e87613397
- SHA512 23e4b7adbb2a3afebe48d6343c24ee2b9127f0d0fce445b157ac5a031d72567532905acb3491b98b4188664ad608de7a14640bda3a6fb81c0d845c6bdab47090
- SSDEEP 49152:GF2YuHNETovIvNYf8kmOOHK9rshP9t49AmT:H6ZCf8kFo2sqv
- TLSH T1D0857E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 133754351782cfd7258f2ea71b2f7db0cf5278c488e32ef765cd373339c5f1c6
- MD5 2234c897af00dcc14a25ad5590371762
- SHA1 da34a1ba0c192568424327039cc88e02a94a70c3
- SHA512 419da2ea95f5f80e3de3759be5d4367e4edf8d239ee5a8e94bf649a47b2bff4425ac3edd4addaa32e07611f3311f566df47d95d3ea08fe8eabfe13ff4454db15
- SSDEEP 24576:/AFs06+OmlfzNXEbToelnOHKVnrsaGBgW59tET9sq8mAw:IFs060lBXuxOHK9rshP9t49AmT
- TLSH T1DA65BF2F62AC00D5D47ED17E8997C91AF6B1746307215ACB0260C63E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 907KB
- SHA256 64c32058871bb823b749bbdfaaba52f011c6c87d0a289d1658296d07f652052b
- MD5 8641e3333622ff879901bb1de6313b23
- SHA1 7ca71ba89ae2077d105657b8e4722cd0fe49264b
- SHA512 6b42685200a045c3c30ce937e2fa172bd4a8eb8ed66ffc8a3b0c28e6c2a50e63ce0edafec4aee2746a52865b6c79a03ee11410935ab0709c2ea6e087cefc3c8a
- SSDEEP 24576:iJnJ5D3W2GlnOHKVnrsaGBgW59tET9sq8mAw:iJnJ5DG2cOHK9rshP9t49AmT
- TLSH T18A15D02DD2A810E8D4B7C274815A1796FE72347D2F226ACB28B4D5353F12FD09A79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 082dc3f165f9baf566ca497801db25b9f6f27363d04725e7113af7d4866b481c
- MD5 dea1042d08f2cf3d0e85259e6ca7a86b
- SHA1 3f86e3459bc41097b0255479ef49e0c73def333a
- SHA512 244a5c23ef478811925a9763c7dd61593a566307e95af035767027fb526e67467fdc589701cafb5ab8c3b6660d8ae2ef450441959e8f8619499191a8f3676931
- SSDEEP 49152:vF06DIKdwc+eQnSt65aVfOHK9rshP9t49AmT:NFo2sqv
- TLSH T114A56C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 682KB
- SHA256 e0c26e40dd17c62aca25cf6ad1408c9981765f60d1a4f314e7db74cb79f5093f
- MD5 ccf8a516d4e874fcbb084119de196656
- SHA1 cb1533d22b803d9a57836627792f552eb80b245f
- SHA512 a1fd1ea4bb6beb66834b4766718a610073eb36e91b7b8450895c124c64761ce2e085da6e2f2eeb6fe82fc283f25dbd3f9b998f4fdf32d162a4a7686ff5091f45
- SSDEEP 12288:jEP3RijNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:oijlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T1C6E4125E235C60E8E96BA13D95628249D372F0702B1317EF16D4D13E0EB7ADA5E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 734KB
- SHA256 1aadf9d1405da56557cf9738c64ba82397e06c049ede40f0f9420c384eb79311
- MD5 2ed3321fa5a3226f34e019f9200c029e
- SHA1 b351b535a21c5e3e9d8879607c62f65163ed6ab2
- SHA512 4161516f70d4dc53a5324fd26098f23f399883179998f86c027deaceaa0dab244c76611c62dc7f9372e250218093df6bfe7468263a7a252731b58261f4e76406
- SSDEEP 12288:KjkyHNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:KIyHlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T13DF41209635851D8EEBA4238E97342A5DA317C306F2202DF25D0F63F2E76BC1AD76719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 605KB
- SHA256 940f7225e44017c9d8603243ac9c63b4659e8fae331e8c07fd564496f51de784
- MD5 2dfad00cab796b7db5812c23c30c93d8
- SHA1 d88c635cce6bf2a09d11ded756d40b75157cbbaa
- SHA512 cf1a021c86874838b8d3ecde87b13e39feabc1f9c0afb0e9a455b2938ab30eeee9284c092679f22921021d58d8a8506b20ddf4a66f2dd0d2f02a682f1f5cc96a
- SSDEEP 12288:zoRNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:cRlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T13BD4234E111851ECEEAB523AB52346DAD06132302D1305EF2AD8F43729F9B87DAF755C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 26986b90e0cb90dc9ca6f4c6cd4c062519bf0046c587b25e918d5598d8145ead
- MD5 92999d18eb93ff2a0d2aed12a21b1663
- SHA1 392619092e42b871e5f40683b88730e7660602b8
- SHA512 4487a4f357f71448d61c494853801490b06933ce7f1c2ce3b25707dde3135caccb22d1e6e1811ba0d4d0761ab333255fad720bc688c5439af96b184d90c43be5
- SSDEEP 24576:DQ9MxZKdcz9ew3xlnOHKVnrsaGBgW59tET9sq8mAw:DVKiHOHK9rshP9t49AmT
- TLSH T17D558D2DABE90599E177D279D5A240C3A673B4301B31D6CF2448D03D4DBAEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 794KB
- SHA256 f17eb866932ce5093428c9aebf927eb23559fc6916dcf4f13f85d4fa70a5c83d
- MD5 091df19ca75c700d5408e777da465725
- SHA1 0603b4f451069398233d24ccc97a9b9be908b5c3
- SHA512 94a70585102a8f132ad59b9fd8302721b0a794a6a65b4bfc1a989d0237c609bd42f6e8cd63e8b272a5509d083122f610f8d228d9c2197084825c7ea672d4fa04
- SSDEEP 24576:5yoc8ApPlnOHKVnrsaGBgW59tET9sq8mAw:Uoc8ApFOHK9rshP9t49AmT
- TLSH T17705E01FB76D40E1E576813C89828345E7B3B0305B2217DB6690C33E4E67AE9BD39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 a8bb4077241a9adfd11ee36b54857712a7ca540ed0978f7799baf4d1d1adc285
- MD5 8a3a515d6d1a970727026f9188c6078e
- SHA1 822217a2d1a05b66e30410a2d023e858b0bcfac4
- SHA512 ebee8776d5c18fab3d40749b1abffb9f859885cdb88932f5a71defef986081973628a5c6c3e289040e058cee078e6b4e306404621d185724b19eb2c4c8b93225
- SSDEEP 49152:ylcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKGOHK9rshP9t49AmT:l0zuNIGo2sqv
- TLSH T199A57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2015DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6fdc5a845db495ac22a81c1e6f86b9f2242b2f4c22a1850a7c12679cc5340063
- MD5 e8d11e08a62bdc9fd143e703d2d6fae3
- SHA1 44765dc83408410cba45c84662d640c457e22fe2
- SHA512 b884508ad611ae0c8837ff6cb6f47bfd3054618b000c14c68d431e19d79ded4df88118dbcc876f807f7c06a1ef785c8f0c4c2db4ad75f64a4c4b03d145c1c527
- SSDEEP 24576:+1QT7EcpfxR+N5AWAz3ooiYhjMqbSlnOHKVnrsaGBgW59tET9sq8mAw:TTDxR+N5YzTTjMJOHK9rshP9t49AmT
- TLSH T1B255B12EA7F805E9D1BEC5799A23C512FA727821073153CF42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 899KB
- SHA256 06d67d2b5d663d4042d4bdc5cbb4c2bd83473019a8cc751dd5fe2bf1172e1bd8
- MD5 10e07ad1670c4c8c5b888b1694ba3d4a
- SHA1 5110a19e3058462cb52e18cd30dcf6a14c588739
- SHA512 8e8b8f2e20cb035819444895a39cd444dde3b70de4f810ef4e8bddb440af939b112db5bd23d46bc2d561ce3764019a331c67522e5ac270ca02172a79fd5d6bba
- SSDEEP 24576:rTMdOz0FFS+HmSLrlnOHKVnrsaGBgW59tET9sq8mAw:50K+HmSLpOHK9rshP9t49AmT
- TLSH T1EB15F13E636D14E8E97BC27DD6538906E6723461032266DB06D0C07A3F9BFD47A7AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 657KB
- SHA256 ade554a791db2a5b8b3c28c4544e138e523eb0f1a726fa30a1d5e50630c1da7f
- MD5 d34f0d6a166991aa49524b6ded4e0354
- SHA1 473a4248eb5365e131fd887d5f8da336cc1ea3ab
- SHA512 3db5738fdccfdf2e35c3ad3e353972a2c737f54924a9564f92b068bc4b920f159380bba2f986864007aa0c2e5353f0dc521336540f1c520f1422ddaa7cac1372
- SSDEEP 12288:0dLqNv9rhO7bBRaVtMu9riB01b/m4x32nBFz2Wy89tL9AXT9sJQ8KdNhcw+:YqlnOHKVnrsaGBgW59tET9sq8mAw
- TLSH T14FE4120E139820E8FD779239EA33029AD17078312B2216FF39D4D53A1F76AC5DA7A715
- MD5 SHA1 SHA512 SSDEEP TLSH