42f8158b4d50887df6b5db821e7ae233337758c4ef622916a23f460660750111

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 748KB
Sample260708-e6jwtabw5q
SHA256 42f8158b4d50887df6b5db821e7ae233337758c4ef622916a23f460660750111
MD5 6bbf77187141b60fd80910950f3e1fc2
SHA1 ecb57af40d59a9c8dd45de2991768f7ade204060
SHA512 1fe5234d0990a76d929c37132fbccbb57ce15b1cb946a9d1622f0dca82e818d5935ae8959a6eba495fcf5d8535917397b0c2c33b8f294e5b9d8dd1e741ed306c
SSDEEP 12288:x93G6vHzOASubviBNDYa3Yp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPI:xVGGTWBZIp8SXdo8ke5i5Xh6wnBLTHTQ
TLSH
T17BF41211B6D0C872E5A3093019B48D617A7EFA304F794B9F23981B6E5E703D64E39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2980	alg.exe
2056	DiagnosticsHub.StandardCollector.Service.exe
4972	fxssvc.exe
3936	elevation_service.exe
5036	elevation_service.exe
3664	maintenanceservice.exe
4924	msdtc.exe
4004	OSE.EXE
3848	PerceptionSimulationService.exe
4036	perfhost.exe
5032	locator.exe
4444	SensorDataService.exe
1672	snmptrap.exe
3128	spectrum.exe
4936	ssh-agent.exe
3616	TieringEngineService.exe
400	AgentService.exe
4700	vds.exe
1824	vssvc.exe
2788	wbengine.exe
4060	WmiApSrv.exe
4928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6fe3ea079c0b0e8.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057fcc0f5920edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e40f4f9920edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000337122f9920edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b92133f9920edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e450ebfb920edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6e556f9920edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6c9fdf9920edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	4972	fxssvc.exe
Token: SeRestorePrivilege	3616	TieringEngineService.exe
Token: SeManageVolumePrivilege	3616	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	400	AgentService.exe
Token: SeBackupPrivilege	1824	vssvc.exe
Token: SeRestorePrivilege	1824	vssvc.exe
Token: SeAuditPrivilege	1824	vssvc.exe
Token: SeBackupPrivilege	2788	wbengine.exe
Token: SeRestorePrivilege	2788	wbengine.exe
Token: SeSecurityPrivilege	2788	wbengine.exe
Token: 33	4928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeDebugPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	3424	2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4868	4928	SearchIndexer.exe	118
PID 4928 wrote to memory of 3336	4928	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6bbf77187141b60fd80910950f3e1fc2_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2980

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3664

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4036

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4444

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1276

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4868
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
  2⤵
  - Modifies data under HKEY_USERS
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4d4fa416ea95fe906025e2ba20735faee1f19a2095d4f28cd32f2a3aa2762547
MD5 4933cfa66206bd1a3a305b1fb9e0cf3a
SHA1 c2741d5342121706a92f0a3aea3f19deea16144c
SHA512 7f22b2edf79f25814f1b9bbf1ac19afcbd193bf7c50b382f9c70a5fdd4c3705e845a6f4d245691074152d0f3e3ee8598f1496d79237a05b395a9d96d2200e064
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnFWS1SZBnHTAsi:/3q6gjBScNzAz
TLSH
T112D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 33f8bfe81419d559ab753a1bd05b640446e3dbfcf2c7fbe08c54948509b9796a
MD5 046d0bc73a7703ec72725ec5a2ace256
SHA1 21a9c8d720a27a91e60b3b16c97975f435d4481e
SHA512 6f4dfd90eb25071b6399984793de6ac3e587fd3284326183e8af23cf8876f8a6d58dcafe0ab920894a738ff09eea9d1ed0539d6c6a7b64122676a267eefe5bab
SSDEEP 24576:6XYhztczAep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcvWS1SZBnHTAsi
TLSH
T17705F128A7E009F9EC974239D9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8e556b19ec3764c5fa13c13e5d1fd27fe4cf2dac60962d4a213e0963898508ae
MD5 4e1956ba3483789cd38d6205f6c350e8
SHA1 729c8382b65c0eea89d6d495a608ac04c232c863
SHA512 eeed6e3b6ee41471023de673cd326c5fa2125cdd6512a915e4838524366376579d13b91c66db0e10679d61587c64008c6a0ced371c64f07ce339820c42bb01ce
SSDEEP 24576:T03eFFU0hQxOrMep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:TrFU0CovWS1SZBnHTAsi
TLSH
T166459E15F6748735D073C0B9C5D2A68EED7230825B308ACB4286D77C7E676E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ec479e7ede56c2e24d584c966c4eb754c9f90102d5baa30b18a6864c1739ee0
MD5 9be06ccec4557bf34846d5d9372e0ae8
SHA1 ae1f5b0500b93a08b3d30f50ad3113a32df4328e
SHA512 7e2fc6b711e76ea495d6ca99ba48552a232e97cd693c7f0620a55bac1bbf3b16b7ff1ff9eb5dbda79b21ef2b8242739b1e5729afd5651ed8ffc97681dc85f8d0
SSDEEP 24576:ja4/ezSC6vUyD/aqgrvW/6q8wyuUp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:l/ezSC6vUzPvuHjyHWS1SZBnHTAsi
TLSH
T1DD755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 b974ff00afcbcd5b76a8886b2973d67d30735e1eed90dfe9cf708dc144db30a0
MD5 05e59778f131c05c6ac3bcf66308f297
SHA1 c5bb9d7e40654149eb7ebe30921b70836a2a71ae
SHA512 3f9050df2e9980a1a2aff4cd67097e84bda0ae424e2f66cba197444252693554bf0aa1e6d76082bf8a162573ac0d9ac2844b1fd69f29321fde0875a27422a0e1
SSDEEP 24576:aAbEPr8Fvv/l+dfp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:aA88FvXl+lWS1SZBnHTAsi
TLSH
T198559E66F5748331D073C0BAC5D2AA9AEE7230424B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 5ea67624e47b48a6dca9028078cf5e1f916fcca2efc170e3bed18be5237d6bf4
MD5 401f590b09e1b830939710df4d7d7458
SHA1 a58b24cb357aef27041a95e13099c040d2045368
SHA512 5e3d2dbe02b0095855ed16a54ae61e305b711b3b8e3bf68f1c8d2bc9e16eea4dd81e17b425b23a4121f399d7f88e2b351844e2620d7bd4544731fcc8207651d1
SSDEEP 12288:+f5p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+f5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T123D42349CF648E74F6C80A3135784C0DBBF79761CC6E0B0D06A8BA4E66762DDDFA2542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 0a90e2fc68a113b27e014176703ae5d53563cebe82ce4846eb2ab9496e1532d1
MD5 567044b90580020d84a71002445144f4
SHA1 3f54613e995c51804101d08168e5d50dd5b99665
SHA512 e4b1e02008b53da8582c32cfbd33b69f2bcfe851d7d7207245af8732f1b16377e3314bad7e95624b08623fd928ccbe3f317cf9b00a77464b1aa5859b022c3738
SSDEEP 12288:PeBNUbTVO86Ujp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mT:PJIUjp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T17115CF3BEE28ECE2C27A4D795A518600E7B274314F6293CBD174830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 7898301466d3b18c0548c2398c4fc6406af5b0845337305670ed0c552336301b
MD5 47dfcc15cc240d274866804de5658026
SHA1 c4aac655fe50bc4c552d833b4b04be75e8f9f810
SHA512 bcbded80a21786dd62666316675b9a7b1128f00e9fd0f4b09d535674bd1c3b21ecd953fe7d571ad590456eb94257f6718ca8d44cefc7523a8d498e86003e170e
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJx9DN5J+NRV3THO:5QvGAdlCEL8c/xRNa5CfcNzAz
TLSH
T1DC367D656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 8a513e63ca54277c447e73922c52a42d2ce73fd815ab5f3e79550e1e077f425a
MD5 20dbf7abb2b406b252d2a16ae697afee
SHA1 d156b3168ad6c95bf81091c1fd08b27931cdfdd0
SHA512 162b8981672c745b5015af3801d34d6733cb8f323cdfc12708efc43fd489654ff4fc3e3bcb55cb6b133c114745b1bc91b95d9186a036bc63c4506ded2244946a
SSDEEP 24576:BmewsAjqlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:kljqlWS1SZBnHTAsi
TLSH
T18A15E031EE74D436C6BB0D722B35C70A647D7A204F611AC7E3E89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3bb1d0e7da8fadf8826c5096c386e113e8b608f3ca55221c9b4bb5f88ce74545
MD5 e3b63c8788e3be0de9c4e88f426955f1
SHA1 9b870948063919b220b843293e484025e5759474
SHA512 b1643ca21c2cf83611f6badc655e3046ca501f2c98d79a2d7455c9ea1d4237b5a09d48d01d50c7979934ad2fd35ba09d054b3da50bb5000e25575a82c5a28e11
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrndPlbuJHoTz:DUEtQevvqc2W1cpV2Xr92wz
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 877aad86e20c010245edd176ecc3189a27254d428e54eed9b714408111a89285
MD5 fb300301ad978d461e43fa3d5436d881
SHA1 18657fd29dbbc21b724c84f3d1f00ec6fa4b3e60
SHA512 d441e3f642dfbb5e81b6fca5b239731cc6dcd2ccc0cdfdf76a5e279685ef827c16c9280f1c6342fb626f4311d5d8d302e9ba0c049d97f0982eaca22d4e8b1a9c
SSDEEP 49152:okbRquA/m2yL5zMfFiV+XenmE3/zyWS1SZBnHTAsi:boq1VjnmRcNzAz
TLSH
T103D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6a88890dc726efa68b812874841fb72380cc33773666ac7802b04579fc105b4a
MD5 eb6500343e5cae8109880ca8ba154332
SHA1 f2ca8dc03c41c1f3a5bcd455cba66e8f691c8469
SHA512 123b87ead366b62891db227d5976f51905564b925cdc2f1301533e2a1fa74c3ab4307e7137dd52412a5a2603b37c2c6c86e1c9779efc260e584fe6aece7098d7
SSDEEP 24576:bAhGLvZFoiwtA5l7S538p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:bAMNFoiq5MWS1SZBnHTAsi
TLSH
T174459D81EBF945D4F5F3AA78A9B58471EA76BCA65E31C20F2160D10F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ea7d0e30bc1396fab60759363978512e8fb8c0826fe7e132114a8a5740b29f73
MD5 8e92a48a935b25e41ff5a9aa8fb86701
SHA1 8cc5f17d2269528104875b2c707666be07ae1753
SHA512 0adfe82ddbf0463c01cfc9c9ec60b3c9132a58f50ca16fefcb170e62c58bec8fc0743c3432c19c8f6e805660b4111c8d88d50c69c9a192d88c7fb3062f1c4d8c
SSDEEP 24576:UwusOWtp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOGWS1SZBnHTAs
TLSH
T12D05F14967A40CF9E9A642398557C436F7F3B8122A25CB1F0760C65F6F33365AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 48927b3f00958e6254ce4739c59931ef528cac612853a77d3e8d059722a53fbc
MD5 02d08f138605b99b5942e4bbb0d4a1cb
SHA1 e2ab4bd7d9fffe41f1c4aa2b967e6291d17f3331
SHA512 ebdc1cfc905fdc1743cfce63c0c314fc468f5d2d42e70e444b9b3c38e28912cf936b33d1173b00a2e6d8b69b0a83c565154ba416b859d6ac400c55259cd6eaae
SSDEEP 12288:vFQ1I4yp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:NQuFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T159E4124957E445F8E1C60239A9F44809F7B371629B3A43CF0668475E2F33ADE5E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c9d7105ec27f0a76d6dbc7a279a99ebb9651a105d2098e810225feb21de2c4a
MD5 866ae8558e03c0f8f1ccf93872ae73e4
SHA1 18cb2c4b8db74189f4cd3c7cb55e33979267c651
SHA512 659bf402efadfb6809e98b9c981ee236a2ec31c398e9dcda82212abd54a9607fcfdcad8fd776013bcdee2f904c8f218c01f8c4dc2e3cf075f3421c84ae8ee9e1
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uy:UQRQyi36YOcP8Lvw2gAf+PN3yGjQ
TLSH
T1A3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 34a5d922041a4ed032788b6b3a8417c4042d2eb922172f2403fc8719ff331406
MD5 eb399879b47efdcc50e5b9800e788b30
SHA1 7902b44e4ed0fd7f35fad069d030df915cd98e7e
SHA512 ef84859df0c5a66eebf9eb10dc63ce4fc015085549f8fb8dbfeae3b4c04c23f1c26f9b54648d07a3c54e6dbf4e81ab47932d3e8230a1bbf6df1282006b006bbc
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UY:UQRQyi36YOcP8Lvw2gAf+PN30GjQ
TLSH
T131667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8394728d14c144dd66e30b3e11dfc7ffc47c04f0b2e803b76942ecd8a05a02cd
MD5 d9197d223312f6f7ea332059a376cec6
SHA1 43a1ad38dd1d54db638eb14c304527c0c64f7051
SHA512 c3edda6c630fbda8cd46dc29842b6ffc1377efb8ddcac6e760c7ae3b5fbcf3561920c8f598255462be8cc8d440fa7305e9f48b191bec9f693a25f114022c1c88
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0mp8SXdo8ke5i5XC:368Qg55nhMeWu7PNU3/LWS1SZBnHTAsi
TLSH
T19CB55A33B2F200A9C44DD1769F4A872196D27C71CFE1E3DB8515720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 714d24c1a89217675388d9638eeef35f4f37e833b089b8790de0b78caaf7987a
MD5 4cafdc273ecab3d4c2a5e45261da5f9c
SHA1 fbe026287935cb79d9d6bf5d4a9dd1bc080dbe23
SHA512 f1f0c6f9e8fa861b792115727093dff026e94e7bb32844a5c43afad2e0e7722ea7c4ba3ac72ce2f2ae4cdc763a580e9cadddd765f25b601b0a0ee0f106016391
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99X:vy5112gYy5azzVv569nLKnhZUGjQ
TLSH
T1AC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1ffb0f0aefc69dc0e223e0a1b642165106bc4b59f4fce10d3f8b79e9bba2edfa
MD5 8a33d18c268e89d5b679ddfe5fc1dd2c
SHA1 d37957d684f4eb113f9f9c0e1d6f459cbfe16a3c
SHA512 3b105f7eecf9a72b35596ada1950d30ee276df41b7908585cde1fe7620edb69203a111c40d4021c4add961fc657d967f9d1ae0efe9dd2fa0d0ce2b792ee107f6
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glUWS1SZBnHTAsi:su6JmTxd2dUcNzAz
TLSH
T11CD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d37d08830425e37592bb2d52c795d6e85fa5f55bb4f9b6cc238832451236f646
MD5 605be4900d71ab51fe157778f8f9de66
SHA1 5957b6ccafb09ce916c84f6ea58001440bff2e81
SHA512 36d63458a3b00dc72105c6ffe34eb139f09542e71e6a194a9cc907e0c7e3cb0b293bf7ecbbc06da184d8d913baed7caa6f5ac0319589b07dd08664385a855ebf
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xxGj5oDiY:RmifPbRiGjQ
TLSH
T19EB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7d2b4d78394fd075ecfe6d4407e61aece6f9826596148b886e832c111ca33b5
MD5 1b3a7e5ed93edd9a54e8e3e5ba02552b
SHA1 85f54cab8793b44f7acb3934e760ec2d98ec0669
SHA512 17a8b4aff02d0443319d737aabd4faafd36797642bba35d861815b325f21fc3d3cf72367781ae1c9c704e5f176cee499ba0b3f06d810772cba21b96cedf7a0ff
SSDEEP 49152:ySuZQIY0Be2K6RVtOnks6NMHqbGj5oDiY:s5dKoi61bGjQ
TLSH
T12BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 00ce70c26bf3b73eed69b40cf13bf5820fc5007a058b1e4bbea82ecc80cd23e4
MD5 76e3bd68f180ad1beea3d19f4b3445fc
SHA1 51ba1018933449b46f2fa60f82e6ab8a5c2be43b
SHA512 adeb35c10372a533c558a38d8b3121d0f11cf4ff31b36027e553574954f28bb1890847428436e99a8ed8caeb1008fd3f3a34b79abd69cc1c39e51211185520f9
SSDEEP 49152:48qSn8EApI0figTgiDn0AP5w3Gj5oDiY:xX2iyphsGjQ
TLSH
T1B7A5BF13F2D901E8D05ED174C7468632E962BC160B39BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 de4cd315a2391dfce1d5a83adaa9e1acad9dd0a9a15eca1ac8be19858a9234cb
MD5 09b5af3b472576039b159e0a95613bca
SHA1 7f35c432a63ba6721096e8ca81979cdc6e9f9f53
SHA512 ea264896a184cd0dd4018694b5cc0867ed7c42d12859e9d5a489d4bf46046265bf4aa67e8f3212c164287491a418f406c40471556501c143fd857e9bb3172c6f
SSDEEP 12288:w1GpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:w1GCg5oDWWTuYib
TLSH
T1CAD4230101E3A619D5CBD4B6265B43C2CDEE750A2D0E1D9F939DA4A03D812FA785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 89f77ab0288823c664a8dbab2ba712ad9f0701b7e8acfa8cc237d54fc4da5fc3
MD5 eb48d6dc192e4846f30bed93b52ed8ea
SHA1 377a2dfbe4ca976daf1df98eab5fc03fe43cef13
SHA512 2c442f5e34fa35c5c7abf7a91d99ce76047d71e584e345e15f9e8864b1944ad4649f73973b5498aa44a708b0cf464da87230850f1dbb4728809dd8c09a5c2414
SSDEEP 12288:aBGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:aBGCg5oDWWTuYib
TLSH
T1A7D4230101E3A629D5CBD0B6265B43C2CDEE750B290E5D8F939DA4A03D812F9785F9FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 be124f49bb8aee8dd5dea4d81ad1235f425bc3645b38889a8c4a8d365f1712ec
MD5 54077f04fb08cba85b64e3766956deb1
SHA1 34a3224542d194472281d557eabe06b864a47492
SHA512 72e62f7d965dd3dde8cc11fb01232a6a818b37178c73a8abcec0f82b6f87adabe96ba4f38abc1c1c9972531557af6d350fa8da8b558377cea263f40f80c4fa0c
SSDEEP 12288:YaGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:YaGCg5oDWWTuYib
TLSH
T10DD4230101E3A619D5CBD4B6265B43C2CDEE750B290E1D8F939DA4A43D812F9785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 2e7ef0da25f08b43de3d5fb47c3a04fb0efc756c66124bc26673f80db2516f9d
MD5 99f24d786e2329a419da00c109c85a24
SHA1 8d72b611173212e70ec9e1e89b843ce9dd70cebb
SHA512 226f07feda6c6ae7678d7d02876f250e53c470dcb74840bde813be5d016a49047572695270b2df26a8aaaee6f17c5ab22e4694fb3cb1c3ef7d022f50a60056fe
SSDEEP 12288:BleGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:KGCg5oDWWTuYib
TLSH
T11ED4230202F39299D4D7D0B6966B43C2CEFAB84A191A5E8F834458D42D913F4786EEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 59623aeca01934f2fe63e40379e4a287a7c5cc13b074448a9817d9208ebd72ee
MD5 bb1f15d724527d1bc18dcf06b6e402f1
SHA1 4ff6dc400bc5720c03da8b412fc3186517660e38
SHA512 2ba2c744a1607102ff57ca8d6becf0c7defc28f3eb72a365c636a8a3190d738668d3579f3107d3044004976e361a96a337dbcc6f18c77c6306d42dedb4f4c804
SSDEEP 12288:XXGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:XXGCg5oDWWTuYib
TLSH
T1F6D4230201E39619D5CBD4B6265B43C2CDEE790A2D0A1D8F939DA4E43D812F9785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 8c001fb307b047c4a0fdd8d20834d73eca2a3b9e0211e1b03343224160225161
MD5 1d9b13e7ece8c0cc80b510d8eea5c167
SHA1 df5fac1e79d2084d9ac995ae1c8e0a9a7ec4bbf4
SHA512 311b266c694a207f4f193d436f6be4fdd8553737ecc4f945179b3643e0bd564a5568cccbd21bce40ffef1dc44377e863f89a414174d52a38521cca2e6a04fd9a
SSDEEP 12288:EpGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:EpGCg5oDWWTuYib
TLSH
T176D4230101E39619D5CBD4B6265B43C2CDEE790B290E1D9F939DA4A03D812FA785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 0379f45ef59d45c3fa8a71fd4982ab9415105fa79625f651594c6769ec6f3f64
MD5 871b87b3da8c191a600937e46fb69ff6
SHA1 245be8c6998c77303c1aa03a362418a3050f1694
SHA512 c443e709b26a5a1bbf19a89fa0285e4ed2b2eb4fc2e0b50de9b1334356f64e04ee1802121a4c631f4a60aa26bd45eb65af3477a89d79323d9fc97ba4fd3221bf
SSDEEP 12288:lpGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:lpGCg5oDWWTuYib
TLSH
T1D9D4230101E39619D1DBD0B6265A43C2CDEE790B290E5D8F939DA4E43D812FA785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 e2e45838d6a36ed2ae876c4749403f8849cefd9896e3e5b905375706f9ef9980
MD5 4fb58f7c7c37acf84e9fef050cdb4424
SHA1 444ede55e4263e15dc2eb81dfca7809278a048c3
SHA512 f4880ebdecbf1aacfd1d8c53171dbe6880364b8c0bdbeb421dcf925a1e34caab427a3a5a0dc2b09e533714d930e77d9e9acc6df842454c54d1dfcd19ca32d947
SSDEEP 12288:uiZwb5Tz3EoSFcPvymGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:RZMBz3VSZmGCg5oDWWTuYib
TLSH
T19115025573A058F8ECA7813EC9558946D6F27C5A0A60CA1F03F836661F733A11C2EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 c6eff83b7331584f28f06c03eb792ab623655ab53da027015cbbac333f0c8ec2
MD5 59fcc3154d0ebf59e970a08c2bded8f1
SHA1 1b0c7c278289a40f60a97d54b9bf17d998baa0ca
SHA512 1ec74a7581a6fd10262094d41ace2a55c7cd46a3ba3c5ce90f3f2057fa0919eb77267baaac1018f70d93fe143a6ff0cf59794f9ab910ae2189e5acba4088b4cf
SSDEEP 12288:a1GpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:a1GCg5oDWWTuYib
TLSH
T18DD4230101E3A619E5CBD4B6265B43C2CDEE750A290E1C8F939DA4E43D852FA785F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 339a56dc9dc8d4dd32b97bd507e343ffef665a702bc0637ec6f2b4e9098964a9
MD5 094bb8279fb48a10d68f7fe0003a4fd4
SHA1 4e3646a506ce651df531c654e2a91c3f96cd5b08
SHA512 6de5d7f0d46d06f90972b0919203389a05393f94cd0b7ea0ed60defb8141a4af8ca6ac72a4ad6890ad24e1d364a3f545a9929ef6579cfedd659310301d0710ac
SSDEEP 12288:UgGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:UgGCg5oDWWTuYib
TLSH
T164D4230201E29619E5DBD4B6265B43C2CDEE750B290E1D8F939DA4E03D812FA785F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 45f8c01d5117d4ecb649e8c12fb4e9602dd16911aac225148b35a7eace91a48f
MD5 afb48d3d12043b7530833169747c2eb3
SHA1 2d2fc7b7aaa1e700d8483af84b65713a2671c205
SHA512 d91dd66e06675776d0ba31a3c519d87751064973eca7a58b9ab3f3d4c17b5f8c5ebcf26407f66c1cf8e073428423fe62697d6fe7ee7bae6bc095b2936634b56a
SSDEEP 12288:2bPekL+PGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:CeHPGCg5oDWWTuYib
TLSH
T18AF4120323A131FDD1B7C17589660B42E7B6B8360B158E5F53A446B62F133A1AD2FBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 707f2b5d468bc68c08018ea6e2a7b5662de8a539d099f6ecec0ba59f80ff4a3f
MD5 bc8885618d174038340132cfc31df3fa
SHA1 7b2951b5bcf678036a4ae06bc9bf2167a9756c35
SHA512 9641b47c8459ac9cf57efc3578091310324dbcd1aa6a24e016de65713eebf8c1f739a818606e7c66dfb3caa7eefee8ffaea9d86fa4f2161a841bacba40598b29
SSDEEP 12288:OUGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:OUGCg5oDWWTuYib
TLSH
T185D4230201A39619D5CBD4B6265B43C2CDEE794A290E1D8F939DA4E03D812F9785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 5b8266cd0b2b8b7a2f9fb78a2a8599310af4400531a98f0ca92b2838bf6613f9
MD5 136307381631d1aed854a5528c65b5f6
SHA1 cfa8954b437c489151dc24b64ed34a795e30ae31
SHA512 4b3214bfaddc95b718d69b7e967fbb43683b300ae54f47995d2dd3243b97ba2face4ac4333bc5da43be2bc1b4da06377787dd642167b83d90b9527f62c549bd5
SSDEEP 12288:uKGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:uKGCg5oDWWTuYib
TLSH
T124D4230201E39619D5CBD4B6265B43C2CDEE794A290E1D8F939DA4E03D802F9785F8FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 9ac85e6cc32ad931b07a2d1a3a8edc1acd0ef1d97a0f8ca2e2b7bba237683fb1
MD5 5e5aa14f9cad251757838f462e6205e6
SHA1 6b27a3b3532db427cbb7b0bbf2a16fe816e0b9b5
SHA512 5629cbd3014ae6f00222f14178d4ec46d450a213cb73133ed3a82671ca45ece15b27cf9ceb76d19f68d41ea6094d6e0e20e1fe3787997a807a8a598abdcbbbf2
SSDEEP 12288:DbPekL+AmGpEgdsoH/oDHhOmShWTsH1q6yj+G2NAzQ:HeHlGCg5oDWWTuYib
TLSH
T1B6F4120323A131FDD1B7D17989660B42E7B6B8360B148E5F53A446B62F133A06D2FBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ecac9374f098b354e8bee058670a962ae8ee1ec7c965d62d1003166a13348e93
MD5 fbe7ea5113a02d093084902ba1fa473e
SHA1 1a92e84a89d53457741c8619bd9b6efa09a90f6b
SHA512 406274e86a4e558b1425a7a2a3d764dc5623f0b6e3403352cfd89c07e4f7f084e95edaca26fb33c5ed609b0723cab96545b7f69761417813dda2952b0a677f97
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71zNKbrh/8KBQ3p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:AP4m4IpOO6768K6WS1SZBnHTAsi
TLSH
T12D75AE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 20b637c0edcdabcc21f00a6a78e1126646ee941e1a74a4f3324d714083da84bb
MD5 539d98219b551a8a890b9e3b13f13a75
SHA1 9774676d60ded087f00f4d98cf91306ca473ae87
SHA512 f0001ca1443189c3e1691ebcd2f6f5ff77cde8309bb2e9c3d27701398111efdc83ea9fe9242b30b1284d845bc576137353926b89e9eeeca6e225d014edf94559
SSDEEP 12288:07sfcp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zcp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T123F40109C2A402E8D09E1235DB644905F7777D2286F2938F13D0F93E1F766989EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 609KB
SHA256 f81889a0623a00b601fae14ad3556374ae1612692f4de8e52483acca965c96cb
MD5 1e60a2f8be19017ecd888c33fbc6f5f0
SHA1 c103ae310ae3407b54769b94c0df2fe4daa142be
SHA512 79133d46b8610e5e5e5b016063fe4f5dfa1f88e8d69c61bb7705fff494378f0e2b23b88014e67699044695135b97a29d271d9fc14732524f296161a472b79ac4
SSDEEP 12288:7pp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:7pp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T141D42319CFA88E25F5C80A303538880CBBBF7375CD2E470F6658664E76726DD9E61A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.8MB
SHA256 dd6e750cd69eaed4b7b2b276e8fedb4e69c911784274b12ca837a7ee5c7eb371
MD5 e2bb6da4aad172a41df1231207bc3282
SHA1 0d9c96e0dc62f70fe6dafb2dd68694b3c8009f4f
SHA512 20063625bda2676358d0af7cec66bac21647d83ebf6b2b47379bc6a65d9c5076af0d310ddd39577cdaaab0f7a84aec773fee3fae7b02e411b2c0c3c22f09b912
SSDEEP 49152:na0h2GEkuAe73q3ppt6zwwQtWS1SZBnHTAsi:na0hNYGtJwGcNzAz
TLSH
T1E0859F1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 680KB
SHA256 d34f4b5ae303ae9bf852b8f9e6327994137ddc235152c809a0d26b48f9e96dba
MD5 4895b7fa93d7e5d18d7b2ce30029050c
SHA1 a2ad5fe1ee6b2e12b4f253e3200bb9c3a39a367d
SHA512 18d8a1572387dc2a591f0f3c30224eeb309309dac1a61fb8e89e3f0894a25d2a9ef52e4fbceb3d3ddd95309d9dd464abf51c0683643930386b659bfa3d715a2a
SSDEEP 12288:LhbHjfXAqp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jt:LhbHjPLp8SXdo8ke5i5Xh6wnBLTHTAck
TLSH
T1C1E4123D4AAC05E8F1A0923DA564880AE772B5264B2653DF13D4827E1F37AEC5D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f3948dc48bf5effefd024158e43d9a6d3ff61fb328d2b9c04ff7d15e3cbffd86
MD5 5a0790ce12ea5ed32197f742e8ffc783
SHA1 b8da44beb442f6216a34f24e9d0faccd49500d49
SHA512 2936141aeb76745f0cb8db47b62b7a5c80d966ff2a12c88f500608f9ee20c4d8791519e71ff9fece06a3d075bf1c2ac661346eabfdf7b7a2ec43954502860330
SSDEEP 24576:jWOgnJcRTk4yti+R5dUR/7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:j/gnaTk46pUR/7WS1SZBnHTAsi
TLSH
T15845BF2DF2B910B9D8AAD236450147B5FB71742D1F209BCB0170C638AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 599KB
SHA256 59e0d50ceac7048f9ce576b8f3cc9f221509922693a5897bac486672ba387282
MD5 50b9c613c554458657906bdbc16f84cd
SHA1 24cec62def68ce4b4334b0d40a83278e2368490a
SHA512 d6a3b5346f5752821f9c86c504d361fca03dadb8cb6f99cedee84fa5fd6786ab4c1f49b05d5a09a6857ce18fe71e750478bb8aa8ccb56cd8e04b453cd6ab87e7
SSDEEP 12288:zyp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zyp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T192D4234CCE558E64E5C40A3175384C0DBBFB6362CD3F070E16ACA64E67626EE5F72942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 1d23fc7e9673e222b4db95f5d8e2f974eed312e48c8ac1737ad79318bc76e10d
MD5 d2200be487973011d9f4dbb5abf62e36
SHA1 45c1b721d2e6768bfa64bfc991d0bc05c38f2053
SHA512 ee94e15860d57984b261196872437996eb061c37d2991d774d7b9742c0663866a25b8c6ac8b06cf43bf360927b0de848b19aedc75c5cafeab25e8f1cb10137b5
SSDEEP 24576:kHL3UTZp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:kHL3U1WS1SZBnHTAsi
TLSH
T14E250119E7A404F8E86B813CC9768906E7B2B45D0764E7DF03A84B5A1F137E64E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 692KB
SHA256 9852f6800ec5a2ed2fcd113c3359ff04367c34969e48ca2a0fb3024e4fce2ff2
MD5 f07f62c6cfe8797b8386078d73c59640
SHA1 9e5b765d293d96fa6f92948ce4e70675a158535f
SHA512 c395ecde3c9d16934225376804f46071d200d4b061082370498e8381875145e30ac297baa3a06d2dfbd870e98504586fd79bd5d652fd4f41a4cf439b27d50ccd
SSDEEP 12288:bpFtzOpp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:hOpp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1C7E4121D2BEC04E4E0A5523C9AA5860DF7B2B5624B2617DF02D0817E1F63BFC6D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 d0337871e9c4052a723b3c4dfe044a545bfbf166ee3b081984d2efae11f6b1b2
MD5 fc3a3f4882a8081b2f751c69e3fa7772
SHA1 b72d84ce5f7b0da9fef2bd52c3b40d02fcafab9c
SHA512 5b734c9db0e619e4c681fcab8e6be03671df39a06a22190ef7fbb125bc3f9b865b6e9c10c793f75df581c8e0eab990458d7ed8547bbc52066e04cbf708cc13e9
SSDEEP 24576:j7NM9YeZqmWMUkPjZM48Mv6bEhsup8SXdo8ke5i5Xh6wnBLTHTAcZQ/:j7cBWMpPjN8DbEhfWS1SZBnHTAsi
TLSH
T1DF659E2E6BAC81E5D476D13DC9A28605F6F2B4611B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 28bb53a4537a8d459580c242f85566dd269ce4f1330db63db65a9e21865ee6f0
MD5 826a544e1f06aae008b1a980fa865f4e
SHA1 0925ad935c049838236853ef7f8c8aebb1d0423f
SHA512 6f1e922c2323af22ae9816f25b10c804f9531496060e3b1e443dcbf3d8443f233fe943438023cd9835a465e1327e610a2b30190cfcd0daa6de7e0a2507e4999c
SSDEEP 24576:kW6BApg2YuyuNDYTabvc1vNYf8km1Ep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:kF2YuHNETovIvNYf8km+WS1SZBnHTAsi
TLSH
T134858E2A67EDC0A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ade2a674609f4b9fc68d2e5985aa3dbdeb9bf8415529ee2bdc4e037e24fa62d7
MD5 759479de9273a91a128d346eeebf08a4
SHA1 293f1956a03bc169b13d37663e66d0cfbd47eb65
SHA512 74d93f1e615c4bcb2faf0422aa2c5d4e9f358e4774b42a23eb1289e50104aa19cf52033658a51e6a5e4b06920cf5cd6b788b09ca86a79d8134745c367cdf611d
SSDEEP 24576:5AFs06+OmlfzNXEbToqp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:+Fs060lBXurWS1SZBnHTAsi
TLSH
T1F565AF2F66AC00D5D07ED17D8A96C91AF7B1746307255ACF0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 907KB
SHA256 17839b5bf4c4a76f296665d468d955a55b9b8719ae2c71e4e26b2a7332fa62a8
MD5 d017779b27d491ffed85c7d072df2c31
SHA1 e8b1eef2233e99d33abf6040e35eee7c26c404ed
SHA512 270238bc4d7fd5defd97c857c5b237933fadc35b55e5e697f403b5e64eb0405e050d3afb879b95e41f1876bca26ca5ccb2f0242476b701fb0c86d044f33f3e3e
SSDEEP 24576:FJnJ5D3W2mp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:FJnJ5DG2mWS1SZBnHTAsi
TLSH
T16C15D02DD2A810F8D4B7C27481591A46FF72343D2F266ACB28B4D5393F12EE49A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eeb3c06c32bc63eb782a9070153e00c0027c7faaa2270eb3011afabeace5b236
MD5 e45aef0d32fda10fe7d65a730471dc37
SHA1 6c04aa898f018644b38b0502284400b01fe53275
SHA512 6af901e0922048f9630fe0736691c0ab6e23075ee1bdb3e0748247e7c679b6198572d63e351316e0e069bd51f30b5171be62006694442d5c7053c1f7d4f3a6d4
SSDEEP 49152:yF06DIKdwc+eQnSt65aV1WS1SZBnHTAsi:a7cNzAz
TLSH
T1F7A56C05BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 682KB
SHA256 3e410ec5dd1fd8660ad9829db4e92fcaac90a5888f62908ec25cee7a9f7d0670
MD5 98bdc0275dff86fa1e86da30b41eef4d
SHA1 6b1065b313beebcc4d92710bec616744f8bee553
SHA512 7cda8936be9c5db1ad2dec730ce4c5c7617745bdf7b483801c51ed4639d048b19eaba19053e342d57abbd65e9b6c0d320dee46a11004a76dceae6fa38921a5a1
SSDEEP 12288:BEP3Riwp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:yiwp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1ABE4126D9BAC90E4E059513995608809F3B3F1715B2627DF06E4C23E4F73AED2E39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 733KB
SHA256 010a60f9ac34a9d125a9e1dab324a11b59e5c790b3666c344ae8f0a39e68dec0
MD5 3d7d94773a4f2773905aeacf389a97ce
SHA1 9953cb05208ec10340077dc836d1384d842225c1
SHA512 d0277637475774dacd5d577ac0e6a0af1dc861052779b6c51bcc325ab4633f17ccd07cc1533dbdcbc8a20f414efb12fc96a75a16a417be8edb4b9b45474d4feb
SSDEEP 12288:0jkyZp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:0IyZp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1E8F4120897948994E5A80634AA758448BFB6BD319F2653CF11D0F62E6F337DCAE31F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 605KB
SHA256 dd9399634f1ee108a33db785b89025cb8792515fcc6ee7770959d6d4a3d7e9ba
MD5 d8982afc6d10d0bb2c165c5effd7542a
SHA1 cd2a1914196d18ed7f351d1e2bced6818be996f4
SHA512 521d23a202ec1f1a507443f73d7e531c0844c887d15b2ca0a97049b9fa9061f84cd8c60972a6b8e03cb85feea0b99a7ad62ae0531e9924080b90852b2efca6ff
SSDEEP 12288:DFdp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Bdp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T135D4230CCA618E64E984063176384C0DB7FB7371CE2E171F16E8E66E6B632DD5E62D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e9e2aba1327046180bb4432beef7cfec3de2e62a5d879abe0c95c83632a8ba1b
MD5 3ec4bcf3bf489ce4aad21d71b78ff995
SHA1 989e40efbdcb51311046b00e9682d93abf4efa2e
SHA512 6ec18aad66a566bbcca68513e09d02322c1d0aedc9f96ff7c27d9c8662f77b02155c7908a4f7c56e02a4fe1eab3f1bac4ea3ff28bd0f5ded3214111541b50fe8
SSDEEP 24576:zQ9MxZKdcz9ew39Qp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:zVKi9QWS1SZBnHTAsi
TLSH
T164557C2DABE9099AE176D23595A240C3B673B0311B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 793KB
SHA256 1709f94da66d42d2e9f27592e735e75955ff49568d678fcf757f9f27e5e801be
MD5 5f54c0e1ffc83ecc48e74c9bcc48b488
SHA1 a256861c9c7605276a9acd73444790b5701e4dfc
SHA512 1e84208546489c6a8a124ef4843a685149b2282d8eeb29d3d480bf5aa26b9d424a5731b9b6e5f0e2c916d41076065c45ead3df59b007dc83b7381a5adf4ebc2b
SSDEEP 24576:Yyoc8Ap0Lp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:1oc8Ap0LWS1SZBnHTAsi
TLSH
T19305F01FBB6944A1E166823C89948649F7B3B0305B6257CF5691C33E4F23AEDBD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 86b43e492d34c04567169af702d12d6f2518636f0812dd0c962cf42d14b01491
MD5 c84b984791b929c397231b4c2f840b1f
SHA1 9feb92958aad6bfac10df0f255cd48ce4f529db4
SHA512 487d4b9e3a89544fde82826c1345384165ede0fe713faf447e3a71a6a188f989ab83cbad99bc866727f868d63d16ad9b5b6d28576ef96f8218ed9896fede99b9
SSDEEP 49152:1WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKgWS1SZBnHTAsi:l0zuNIgcNzAz
TLSH
T17EA57C3DA2F800A8D8AAC375C54517A5EA71742E3F2056DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bc8c48dfc327271b80758b5dacc57a77153fead5899d5ff543832aa5b55f90e7
MD5 78a23464b25685da4c4f30e634a79f05
SHA1 3a170c5dece379fea7b8ca2185f30ab224bf25c7
SHA512 50e9197a91ccb111236494dbac7f0f16a32a06e258fc6cabf8749a0a62c2321f03415980ce1fccf337dd399f294e7d8611c9d935019fb8d480c8f285c8181e23
SSDEEP 24576:Z1QT7EcpfxR+N5AWAz3ooiYhjMqbPp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MTDxR+N5YzTTjM+WS1SZBnHTAsi
TLSH
T16C55B02EA7F805E9D1BE85799A23C506FB727421073193CF42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 899KB
SHA256 b1e5ff98a6b15dcc41757c26ddd8b6ce3e5e5192fbd95fba35941c4585ab0ed6
MD5 d96cca17e9fae7d9a040efe9530e3dcf
SHA1 5da9556c3286eda85d657a7ce89baaf1729882f5
SHA512 51219de87375741250c537a572ffd2d2857e22d9aece514b3c2cf23060ec803e60ca6ed29a98e5406b4736723cf04169cc04a548fa27f6ccde15968db94a7320
SSDEEP 24576:HTMdOz0FFS+HmSLAp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:10K+HmSLAWS1SZBnHTAsi
TLSH
T12015E13E97AD08E4E47AC27D9652890AF6727462032266DB06D0C17D3F57FE87A39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 656KB
SHA256 e67ecc6d41ece6db2c4fa9016d385b4c821d74accec4678f95c69d918531d021
MD5 680757b33b27d36ebf1f9d0370456629
SHA1 534c276c39dc63ded0082cfdde5e412ea68e1163
SHA512 d78c3e7b63d8d1adcb812c2d44bbe0cb86c913a907a9dfd00846549ebaf624af0a4bdfbf7811092334918a57137cd58e3e8b35a9c4215c0d36f2927aa231eec2
SSDEEP 12288:RozP0p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:gMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T157E4120D87E818E4F4910635AA384409F7B2B5325B2917EF26E4DA7E5F336DC9E35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-174-0x0000023B790E0000-0x0000023B79146000-memory.dmp

Download

memory/400-170-0x00007FF7FF670000-0x00007FF7FFA99000-memory.dmp

Download

memory/400-169-0x0000023B790E0000-0x0000023B79146000-memory.dmp

Download

memory/400-168-0x0000023B790E0000-0x0000023B79146000-memory.dmp

Download

memory/400-176-0x00007FF7FF670000-0x00007FF7FFA99000-memory.dmp

Download

memory/1672-133-0x00007FF78E820000-0x00007FF78E8CB000-memory.dmp

Download

memory/1672-135-0x00000169C7EA0000-0x00000169C7F06000-memory.dmp

Download

memory/1672-134-0x00000169C7EA0000-0x00000169C7F06000-memory.dmp

Download

memory/1672-191-0x00007FF78E820000-0x00007FF78E8CB000-memory.dmp

Download

memory/1824-184-0x0000029C065F0000-0x0000029C06656000-memory.dmp

Download

memory/1824-264-0x00007FF653710000-0x00007FF653BED000-memory.dmp

Download

memory/1824-190-0x00007FF653710000-0x00007FF653BED000-memory.dmp

Download

memory/1824-185-0x0000029C065F0000-0x0000029C06656000-memory.dmp

Download

memory/2056-75-0x00007FF6103B0000-0x00007FF610494000-memory.dmp

Download

memory/2056-25-0x00007FF6103B0000-0x00007FF610494000-memory.dmp

Download

memory/2056-26-0x0000027EEB1E0000-0x0000027EEB246000-memory.dmp

Download

memory/2056-27-0x0000027EEB1E0000-0x0000027EEB246000-memory.dmp

Download

memory/2788-204-0x00007FF65FEE0000-0x00007FF66040B000-memory.dmp

Download

memory/2788-197-0x000001B98C580000-0x000001B98C5E6000-memory.dmp

Download

memory/2788-198-0x000001B98C580000-0x000001B98C5E6000-memory.dmp

Download

memory/2788-267-0x00007FF65FEE0000-0x00007FF66040B000-memory.dmp

Download

memory/2980-17-0x000001B7FFD80000-0x000001B7FFDE6000-memory.dmp

Download

memory/2980-16-0x000001B7FFD80000-0x000001B7FFDE6000-memory.dmp

Download

memory/2980-15-0x00007FF751A40000-0x00007FF751B27000-memory.dmp

Download

memory/2980-61-0x00007FF751A40000-0x00007FF751B27000-memory.dmp

Download

memory/3128-192-0x00007FF7D5790000-0x00007FF7D5AB4000-memory.dmp

Download

memory/3128-141-0x000002363D640000-0x000002363D6A6000-memory.dmp

Download

memory/3128-142-0x000002363D640000-0x000002363D6A6000-memory.dmp

Download

memory/3128-143-0x00007FF7D5790000-0x00007FF7D5AB4000-memory.dmp

Download

memory/3336-277-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-278-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-280-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-275-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-281-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-282-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-283-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-276-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-284-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-279-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3336-274-0x00000276EDEF0000-0x00000276EDF00000-memory.dmp

Download

memory/3424-43-0x00000000000A0000-0x00000000001B7000-memory.dmp

Download

memory/3424-0-0x00000000000A0000-0x00000000001B7000-memory.dmp

Download

memory/3424-7-0x0000000002F70000-0x0000000002FD9000-memory.dmp

Download

memory/3424-1-0x0000000002F70000-0x0000000002FD9000-memory.dmp

Download

memory/3616-160-0x000002C90D280000-0x000002C90D2E6000-memory.dmp

Download

memory/3616-205-0x00007FF65DCF0000-0x00007FF65DE7F000-memory.dmp

Download

memory/3616-158-0x00007FF65DCF0000-0x00007FF65DE7F000-memory.dmp

Download

memory/3616-159-0x000002C90D280000-0x000002C90D2E6000-memory.dmp

Download

memory/3664-63-0x000002160B2D0000-0x000002160B336000-memory.dmp

Download

memory/3664-72-0x00007FF7D04D0000-0x00007FF7D0638000-memory.dmp

Download

memory/3664-65-0x00007FF7D04D0000-0x00007FF7D0638000-memory.dmp

Download

memory/3664-64-0x000002160B2D0000-0x000002160B336000-memory.dmp

Download

memory/3664-70-0x000002160B2D0000-0x000002160B336000-memory.dmp

Download

memory/3848-97-0x0000026A78260000-0x0000026A782C6000-memory.dmp

Download

memory/3848-96-0x00007FF73ACB0000-0x00007FF73AD9A000-memory.dmp

Download

memory/3848-167-0x00007FF73ACB0000-0x00007FF73AD9A000-memory.dmp

Download

memory/3848-98-0x0000026A78260000-0x0000026A782C6000-memory.dmp

Download

memory/3936-47-0x000001CFAB1A0000-0x000001CFAB206000-memory.dmp

Download

memory/3936-48-0x000001CFAB1A0000-0x000001CFAB206000-memory.dmp

Download

memory/3936-46-0x000001CFAAF80000-0x000001CFAB073000-memory.dmp

Download

memory/4004-88-0x00000185E1830000-0x00000185E1923000-memory.dmp

Download

memory/4004-89-0x00000185E1A00000-0x00000185E1A66000-memory.dmp

Download

memory/4004-90-0x00000185E1A00000-0x00000185E1A66000-memory.dmp

Download

memory/4036-110-0x0000000000590000-0x00000000005F9000-memory.dmp

Download

memory/4036-105-0x0000000000590000-0x00000000005F9000-memory.dmp

Download

memory/4036-177-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4036-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4060-209-0x00007FF6E8870000-0x00007FF6E89AB000-memory.dmp

Download

memory/4060-208-0x0000019A7C700000-0x0000019A7C766000-memory.dmp

Download

memory/4060-270-0x00007FF6E8870000-0x00007FF6E89AB000-memory.dmp

Download

memory/4060-210-0x0000019A7C700000-0x0000019A7C766000-memory.dmp

Download

memory/4444-186-0x00007FF7D68D0000-0x00007FF7D6D3D000-memory.dmp

Download

memory/4444-125-0x000001A6424D0000-0x000001A642536000-memory.dmp

Download

memory/4444-124-0x000001A6424D0000-0x000001A642536000-memory.dmp

Download

memory/4444-126-0x00007FF7D68D0000-0x00007FF7D6D3D000-memory.dmp

Download

memory/4444-195-0x000001A6424D0000-0x000001A642536000-memory.dmp

Download

memory/4444-200-0x00007FF7D68D0000-0x00007FF7D6D3D000-memory.dmp

Download

memory/4700-181-0x00007FF6D87C0000-0x00007FF6D8A7E000-memory.dmp

Download

memory/4700-260-0x00007FF6D87C0000-0x00007FF6D8A7E000-memory.dmp

Download

memory/4924-78-0x000002A085D10000-0x000002A085D76000-memory.dmp

Download

memory/4924-164-0x00007FF7EADE0000-0x00007FF7EAEF4000-memory.dmp

Download

memory/4924-77-0x000002A085D10000-0x000002A085D76000-memory.dmp

Download

memory/4924-76-0x00007FF7EADE0000-0x00007FF7EAEF4000-memory.dmp

Download

memory/4928-239-0x0000016775340000-0x0000016775350000-memory.dmp

Download

memory/4928-218-0x00000167741D0000-0x0000016774236000-memory.dmp

Download

memory/4928-271-0x00007FF72B520000-0x00007FF72B874000-memory.dmp

Download

memory/4928-268-0x000001677EDD0000-0x000001677EDD8000-memory.dmp

Download

memory/4928-217-0x00000167741D0000-0x0000016774236000-memory.dmp

Download

memory/4928-219-0x00007FF72B520000-0x00007FF72B874000-memory.dmp

Download

memory/4928-255-0x000001677D700000-0x000001677D708000-memory.dmp

Download

memory/4928-223-0x0000016775110000-0x0000016775120000-memory.dmp

Download

memory/4936-150-0x00007FF7DF450000-0x00007FF7DF63F000-memory.dmp

Download

memory/4936-151-0x000001965A840000-0x000001965A8A6000-memory.dmp

Download

memory/4936-152-0x000001965A840000-0x000001965A8A6000-memory.dmp

Download

memory/4936-199-0x00007FF7DF450000-0x00007FF7DF63F000-memory.dmp

Download

memory/4972-40-0x0000020285300000-0x0000020285366000-memory.dmp

Download

memory/4972-42-0x00007FF6F5D50000-0x00007FF6F5FD8000-memory.dmp

Download

memory/4972-36-0x0000020285300000-0x0000020285366000-memory.dmp

Download

memory/4972-34-0x0000020285300000-0x0000020285366000-memory.dmp

Download

memory/4972-33-0x00007FF6F5D50000-0x00007FF6F5FD8000-memory.dmp

Download

memory/5032-116-0x00007FF7C6530000-0x00007FF7C65D8000-memory.dmp

Download

memory/5032-118-0x000002151A4F0000-0x000002151A556000-memory.dmp

Download

memory/5032-117-0x000002151A4F0000-0x000002151A556000-memory.dmp

Download

memory/5032-180-0x00007FF7C6530000-0x00007FF7C65D8000-memory.dmp

Download

memory/5036-56-0x00000290C1B10000-0x00000290C1B76000-memory.dmp

Download

memory/5036-55-0x00000290C1B10000-0x00000290C1B76000-memory.dmp

Download

memory/5036-54-0x00000290C18F0000-0x00000290C19E3000-memory.dmp

Download