cd7a8493f34b7f3547c296e20d13397c1069fb3099ab9ea2214389376bf89711

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260720-cdwnsscs6k
SHA256 cd7a8493f34b7f3547c296e20d13397c1069fb3099ab9ea2214389376bf89711
MD5 000470a91fffeb8ff6b9d54ffaa9c656
SHA1 09c37fbaa7de8d6ed58aa7deac21782188765fe2
SHA512 9da449581489c31b1503d55d342c23ddf3b545919475fca57c5781d6b07a44873ea2dd13952d99f96778fe916f9b60d5087ced22162b4a0a35cb7f4e45a84cd7
SSDEEP 12288:+UYJ9bi5N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:vYJ9bm8U7tTK3VnChd4Q4PQpUcrf0FGc
TLSH
T12BF4022072C18473EB73153259B5EA719A3DFD714F1089EB23907BAA6E346D0893DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4760	alg.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
4832	fxssvc.exe
3420	elevation_service.exe
2040	elevation_service.exe
2560	maintenanceservice.exe
4664	msdtc.exe
4120	OSE.EXE
1572	PerceptionSimulationService.exe
2204	perfhost.exe
4040	locator.exe
3132	SensorDataService.exe
748	snmptrap.exe
4588	spectrum.exe
1832	ssh-agent.exe
4828	TieringEngineService.exe
4296	AgentService.exe
1916	vds.exe
3408	vssvc.exe
1528	wbengine.exe
3924	WmiApSrv.exe
2708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\81c12ff33a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051b6ad44eb17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078b2eb44eb17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea049d44eb17dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f53eb744eb17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e7b9344eb17dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aab3cc44eb17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
2428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	4832	fxssvc.exe
Token: SeRestorePrivilege	4828	TieringEngineService.exe
Token: SeManageVolumePrivilege	4828	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4296	AgentService.exe
Token: SeBackupPrivilege	3408	vssvc.exe
Token: SeRestorePrivilege	3408	vssvc.exe
Token: SeAuditPrivilege	3408	vssvc.exe
Token: SeBackupPrivilege	1528	wbengine.exe
Token: SeRestorePrivilege	1528	wbengine.exe
Token: SeSecurityPrivilege	1528	wbengine.exe
Token: 33	2708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2708	SearchIndexer.exe
Token: SeDebugPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5000	2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1948	2708	SearchIndexer.exe	111
PID 2708 wrote to memory of 4944	2708	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_000470a91fffeb8ff6b9d54ffaa9c656_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2436

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1568

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1948
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07093675ec4382fa6951cc8cd35ac9d296577a64a24fd9a036aca6b994cd8b0f
MD5 ac08411da607142b9922af5c9dcbd28c
SHA1 eb05303a252d45fab4c0fa8aa24019fe5c91274f
SHA512 254ab3c354e3d4877bbf5c4bc7b1875e7f43434cd54172f417f863963073234b948e93b7a39bef121184e957e33bca3a3aad09d7a81a215fc01a17c090527951
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnU8U7twh0gYUub:y3q6HjBfbpi0gYz
TLSH
T189D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 91932f5333ee47ef600995da22243d2a184e121697474f18702a88324c09ae8a
MD5 7a8802c3a15a2afd60f3e94361254141
SHA1 699f134410326161cdb99f4a7586bad46dcbbf03
SHA512 41dd57f93ebc432cb08d3211ab1cff916f8a890be8b8cb40707d78c9b9729cefe41e1be11a690ebaf71e9bd56737bbad912715c268365f6974ba5aa709b13ba2
SSDEEP 24576:eXYfDtczAT8U7tTK3VnChd4Q4PQpUcrf0FGDQ:9tca8U7twh0gYUub
TLSH
T13D05F128B3D108FAED674239C972C511EB3378554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0bf2300fd5ec72e41f9323256b4658f59b1d9b1c5e0c9779b6fac409fd49d209
MD5 52feaffae154d15ef93086ced1e7638b
SHA1 858c856d5b5f7ced4615af1d66fe5aa5c2a7aed4
SHA512 b1e72124d742296209c07f1566bc6268b808c4afa4ea7cfcef81857d0cb4fcaa40d53186f5da9f4dee965474581e4bb20c2eea7c558dd2e0dcd4da1ea83d81b9
SSDEEP 24576:d0Le5ji0hmxirM88U7tTK3VnChd4Q4PQpUcrf0FGDQ:dPji0Ac18U7twh0gYUub
TLSH
T1ED359E15F6748735D073C0B9C5D2A69AEA3130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d6363cb97ce15be579254d6a5d970934165e37080780f6fedaeff25afe00eda
MD5 0c636c48f22c71f0fa030896198735f7
SHA1 b52b2507bcb5513d78bed936f2ce4eb3c4ed434b
SHA512 5541f0195f359330970d5ed223bade07803e62e0652b2fd1d2cdd39f7e649d9988b900d76e8c7845f57c489e5c56d35f4e41dead3500d70ed277ed07dd29e84b
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuq8U7tTK3VnChd4Q4PQpUcrf0FGDQ:B/ezSC6vUzPvxHjyp8U7twh0gYUub
TLSH
T15D755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c151876c8fbaf32d80a2bb8ee6aaa373850e637b04ae548fb110290f6625901e
MD5 40bcb67e278d7127b42604629e9270df
SHA1 8357340595a688e18f6231b7027c1c6d3b52bee7
SHA512 e2993dbd4731c7d3d3a142f2544eb4d2677d478afd24d629963ab831cd57926e61011f7f483a13e3f647a1755a0913977919a33f94d923687509bb41bb246d8d
SSDEEP 24576:0VbqPb88hv/l+6v8U7tTK3VnChd4Q4PQpUcrf0FGDQ:0VO88hXl+Q8U7twh0gYUub
TLSH
T136559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 15a8e36138111ff41b08fda479e06dec06c6e89840baf0dcdb43cb3fb6f2d7e3
MD5 6c0badb9acac6a2756ef2756570bbae7
SHA1 cf65b713d9609254926aa1a96e2a2f878d64ca3b
SHA512 914c1865230d30b9bc2c67402b883204aed0cfd3c55bbfc0ba798b4baab61a40ab242a40c99b8974da9bbfd745da3349e0ca5dece0b86d465002887dd770a952
SSDEEP 12288:xR2N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:xRo8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15FC42320A3858817E3662B33F937E9A4EB111EA45D44CE291460BFE56E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1648611e4017904786d2eaa370f18d8ae7a32937ac5c5b28c8baf17c80322046
MD5 b64c429f4ac5e77cfa9e8c3b7d9b4efa
SHA1 b215fa5b6a524262282121c9ce764cf1a51fa6b5
SHA512 cef0b0c9df93bdcf4186fe9db07e752e2361080106bf2d58e41ea6e90e86944abb12b260bbccc43c5aeeaf21f86784b32621189b959397a104d8be740037fa9c
SSDEEP 24576:pJIU38U7tTK3VnChd4Q4PQpUcrf0FGDQ:pJIU38U7twh0gYUub
TLSH
T1A905CF3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 651a8e674144e22f1d278322c2cc76c9352f75baa58babc0176d7e2d155e9318
MD5 3aeccce4d29f5ba15008b25bf91cbffc
SHA1 b4a59af4bb0607810d3eb0878f991cd84412c298
SHA512 bf4114bb1950ce152c764dc9ab3eb117e9af27b5cc74e33ebd0f75e3b033064e8c970000f30da2bdb6bc0835a355b79611ee4e5c4d6b1d8b212754375afae7db
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:tQvGAdlCEL8c/yRNw5C6bpi0gYz
TLSH
T134266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6b997ea7eccdebd85e6fa8c8c6d105f9211c0232f63956d87f2c9dab9c97cc41
MD5 2fade4f11718ca8da68e637d2f619d56
SHA1 8e8d1acca5635a34b1d51c87087ded3b43c46072
SHA512 873ffe7d9adc443bdd9292033e098f14a559e7bec90074106edeba01376e59a99c70bdb402b037b513060543202728a15c15fdb13fc0b797c0cd1baf6661ce04
SSDEEP 24576:IdewsAjF8U7tTK3VnChd4Q4PQpUcrf0FGDQ:IljF8U7twh0gYUub
TLSH
T1AC15E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0169370c308ee78fca590d2ae2ce5565c621d3406a49161318c880fe33d46deb
MD5 05c0e428da9a99db44b137d85f93dc0d
SHA1 a90339e2a22abcb3b47796d48b2c194c55c43ecb
SHA512 00afd65ae8b147cc7a4489cf4923cfdfb5404c6c4329ac5007d6713044b6f711a8752ae8c6652ecf08be850bfb4eff7fe9bfce41075cb9b8c08ce56b1ab7fcf5
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHaH:kUEtQevvqc2W1cpV2EI32m
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a1118a7eb954744d4c3a6cd78a48e1b58323cad85509d1c3d07004f771310440
MD5 cbc0a387a9622fe70b59ed7930aac28e
SHA1 f27c34680d6eb4147d8ad1ca550650816fa2c32e
SHA512 2acae785f93fc6da2c5493556a41d912fb2b3e1dd50eb2ff3c4abaf2ba8f2fc80dacb4691595e6d6d5999fdbf04c5163fb2478db7ab3031ee74bb50bc8aca5bf
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zl8U7twh0gYUub:foqtVjnmubpi0gYz
TLSH
T14BD58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 87550720ed44ef1a334f550cc8562dd0eb819276376dd606edd13cb9c8cb1daf
MD5 514ceec7e59855c7e6c66fc1871ade61
SHA1 4d5a028b12e0643f49804dc9c624ab9612801b7e
SHA512 f81be8ccb495eadb87d29c7936aa400ae26d16c75d743e30bb200a618deb3d9c94922eb195fd86c226ce608fdebe7e8d5904b1630e16f0610307d8a82a55bd17
SSDEEP 24576:pAhGLJIFoiwtA5l7S53O8U7tTK3VnChd4Q4PQpUcrf0FGDQ:pAMyFoiq5+8U7twh0gYUub
TLSH
T17A359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ca11dda2f9b50ce1a49ed8440bf13ab2b7a1dcfc95ec8ee49f106db63dd07234
MD5 2f49d9a3c85411bd4c7e2ec6e4c48ca4
SHA1 9c4e8c7148583b091c592b87a531101f1c6a7efa
SHA512 66ad4b41f5767b19ee0284af41c4051120ddea7819ce3fba51a9c2faa328c06974204a198c12bfcb01f0454937a5a14dab892add1734d125ed8933b20903ba64
SSDEEP 24576:JwuoOWJ8U7tTK3VnChd4Q4PQpUcrf0FGDQ:JwDOy8U7twh0gYUub
TLSH
T19805F04573A40CFAEA675239C567C536F7B2BC112A20CB1F1760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c6b652ffccfd41c3e7c44bada3dbf953f76eef087db4176b5ead0c97d1455fc5
MD5 530adf5c33b1de7e52ae580f1f99177f
SHA1 ba43a696921c9bf87b96bca3495da542ff38fcd3
SHA512 0bff5347402e6bd5c337bdffee5132c3232ca8d6eac296e0923b256cc95198228a84280cf970a781bdf6cbbbc4bc967213f720cc0e34e415d01e7c109d932ef0
SSDEEP 12288:nBZ1IyvN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:BZuk8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15EE4125433D460BAE363133AD9B29A45E7323C62273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d5740a64b9efc69283194d5313570675bb45f1e332577c8287b3336c2c8d0012
MD5 a661136cc763cc94a7c5d8446458162f
SHA1 4c82e82ccbf182b5703a6652f3df090d93e70e3b
SHA512 164ec639db306e9c20b9f124d98e7b7f182eb1a5bfac34a2ef8b4cdff48ccb6007523d38539dde71b7a90ed68e2ae6d31e3335bf3291ad130699080fa203e917
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN37bpi0gYz:NQyiKayX+PN4H
TLSH
T1C7666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bc3a9110b315595d26e40e11d99f73fa5d4640a3b2bd42028973eae919c1c8b7
MD5 73593749af3195c9cd423cf179bc2262
SHA1 f7da2655f85773dfa9d18af9b300698fc0b77ce7
SHA512 55d85c77d6b0d1d2f32a294b10967325167f4c47f622f66dfdb103b03e3216255aae52c6842ccfcd60c4d855f423200bdf6a67afd3d9b3fe741165a8ba6a238d
SSDEEP 98304:tQRQyi36YOcPQLvw2gAf+PN37bpi0gYz:EQyiKayX+PN4H
TLSH
T111666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 867c58958c7bc36c9542fed4512066a7041e099d6568ae893c98cb2973d79cb7
MD5 827de86758cece3419bf1a9c9d845ef8
SHA1 57fc1860a457ba855c7bf0310a51bfd061bf8f74
SHA512 fbfbce46c8d6dc680e3e4658d3228cfcec996ef3bb88a42ab4f9066d5c5f481e29d9df07223580cadf1af3bdaa6f7e7494591af8f6d1ea12ae4e0281b1f53e0b
SSDEEP 49152:I68Qg55nhheWu7PNU3/18U7twh0gYUub:SthWRc/1bpi0gYz
TLSH
T13EB54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc6218080a61d2f50dd1a9dbd325d0672ae14c333f11694165f72ff1c59ff4df
MD5 12424a4319de74ca280e7bcc94987e33
SHA1 e8deff49eaba9da54a5c4535379bedb8d2752fe2
SHA512 95aef76838598a2a585f6949056e2bc9e9e2f802c9aed1b5f82edcd6d9a0e51e51dedcd1138d35aa7cc9bc82fa2fb367b47c84d39b4d6a80c9983e2336867423
SSDEEP 98304:Wy5112gYy5azzVvL69nLKnhZobpi0gYz:HLIHmWhLH
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d9ec43fa65ed52cd1b66f4325d8a2f8cd39af3d2e94393f897b60580f9c762fd
MD5 4a589b367eaf17d3a754af36c2bc7a0c
SHA1 9c0275db44f80e0fe00da9ed96322a6b409ee830
SHA512 385e601c787f045b70e57dde3291d09a5cdd191fb8a58adec6afe9e26e83ce936efbc6a520b1d4616a35079dff3569335dbc4773d3e3217da03e24da5cf74121
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glD8U7twh0gYUub:iu6JmVxd2dDbpi0gYz
TLSH
T1F2D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 718b5280fb40074125c734162ee19d589eb6c4c3e51107f79394dfc98dc583a6
MD5 3bf1d71f79183d6ca8074381112e6c8f
SHA1 708ee7117fd8437b01dd6c7a168d78a2ef86ceb7
SHA512 85b6bf60e48b2412efed618e6a2a64bc3fd04b5c566f03492fbf56046057888f8ea0d48af6c6de3b057c5f4374736dc375efd0732ef73b0672ac7a2a53e4aa39
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xX8U7twh0gYUub:pmifPbRubpi0gYz
TLSH
T1BCB5BE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7a1effa24c5b0b2619ac5e06d73746bd38b91070bdd505e4677890521efc865e
MD5 15cfc851ae62970d05d163da5f715e64
SHA1 756bfbb1527ee91f9f59bd45292e09951c52e988
SHA512 cbc768b0e9da5c080cc53469221f13900d21a079859486d6fe886990c1579f0604712e3a8b29bda1b4958020296e0b6f9125f644a5c56140a0a9f0200585268b
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqk8U7twh0gYUub:l5dKTi61kbpi0gYz
TLSH
T17EC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ea9870ccff1d47969a15900cfa396d2d12811e54e1d19594c4eb56d9d42365cc
MD5 fa7feb6e1571537e1ca5cc657b1ae011
SHA1 ded68df1b955dd9e140b553136cd75beae921b9f
SHA512 157e1f217fa4a117efbb513f1f2229dcaec4327c63b501e72da2485cd73dfcc185e751b91a3e04149a99988a1a78c53200e401a97bd72c07ed012dec0d15ab9f
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wT8U7twh0gYUub:BX2iyphSbpi0gYz
TLSH
T13B95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c8ee2524fdf23061ba006ebbb321f1c66025d162d36d7d46e6fc5d1581cb9612
MD5 ed2472b2b37eaa70c2beea00413313d7
SHA1 972e5ec6cdddf77ebbf300cfc8caf5bddd1f5f3c
SHA512 52d9465ab08c25ecbb465cf18933f964969b361fe031d32c278364dad3a7ddec261c568855c741bc50d4f70c2763050f021f0cadb5433dd527b3c4e9b4ebfe9e
SSDEEP 12288:T+N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:TQ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T164C42310F7864C0BE3112733F537E9A4EB141EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 967b503693e7636a2514892cd535a9b2c0e1c56c8720c07cd6e5c05743ac2528
MD5 c9dff92c3c468356225377368d5a3107
SHA1 709eb8d262e7112de34b615a2d05ce314064b3d5
SHA512 f7c43839e7ab287a17174ae2851e6a82b28e8f1defa248adb2fd752967275af1265c3890fd9d474738dbe8159a7b86ada4c725e19d757bc117a30b0090825a23
SSDEEP 12288:trN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:tB8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T175C42320F7964C0BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0f1c960e9268c9aacbe2c4bda52eba90d1f70961e1343502c83ffe272c3fb2d2
MD5 4272129bfc9f2838c687ac6b639090c7
SHA1 77c8a55b9fd6b9ba7c99977ae2fea82b8f05a8e0
SHA512 b30e60b692c7d304f98f2966106601d2427b4590137359f88c2a4fc0ff3a3bd503a24dffdeff3b5537deb1840a8f1bf6a92eb8c9de44c1e66b988693cd6f80e6
SSDEEP 12288:EJN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ef8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B1C42324F7964C0BE3112733F537E9A4EB101EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 71056dbcb49a6c6f0659f24e29cc1969ea840ba43135af2ac8e8b94c1de598d0
MD5 7b8d669c3cef67e67edc02bf139ac9d6
SHA1 9e3c9d2a10acc55bbcba24c5d6c28053ae9f4e8f
SHA512 18b7c29b1b1fd9f11331aeabb6f51e0ffc5663c0d2649b81d0ae76b14257b67d739eca602af316d6b94853de35a10b68446c2c5e155a7f9499e1db105b05165b
SSDEEP 12288:HVEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:g8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T140D42310B3964487E2222737E933E5A4F7217DA4AB108B6F15107EA52F37F9C9DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8e7b87232e6ebdd43c1c0bc506603a20ca841733d4aac67742cae05af5f686d8
MD5 0c6b23c4a4c12f2a180643cc3f11e5c2
SHA1 955853a7d430f071de2f36d34d8a41439c5d7f7d
SHA512 bf9480bdb062f188eeaeda469cc1fd90e38ffed6855ce12d25b9bd40c9b71e1910c01f1ce6eff621e8e47de7895176bc1ab69cee6b0aae25fa94dbba29880211
SSDEEP 12288:l8N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:lm8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1DAC42310F796480BE3112733F537EAA4EB111EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0e6e77a191c56d5f7382763d9cfdefe12305a5969609e5a0655a6cdfaf645a79
MD5 6fb643b3a468a46b46c6b90c0fa953c9
SHA1 0fdaddd183a050d04ebfdc5d6f3f6e1451b56d03
SHA512 e03f388ad5c86f44f09bdf81c0a7c7a2d4bec3ea4dd85d86991c96a01d2a8fbcae1c492c92a57384b25e6496bcbfd17123b9265c5c839a660d2b50597ead066b
SSDEEP 12288:0HN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:0t8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F0C42320F796480BE3112733F537E9A4EB101EB5AE448A292550BEA17F7FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7f60a593eff4ba732cdbb28b9719fbe4174281df988abbb954f5461072618247
MD5 5bb34afc2f197a1b0cc3535e0ff7a283
SHA1 b3b99a4dc75495f194fea6ef31ab0cb9bd51a68e
SHA512 d9427651b24fb3e2d9816495101706b2edca598b381030e50104971419a5abf4cbcfa1b2e46428eb11bc4af7b8fa1bf5d828e514234183d53a592fe5c4829b34
SSDEEP 12288:YDN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Y58U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B9C42324F7864C0BE3111733F637E9A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 04bf0dded30136544b35efee73cd8b21d5476446b939ea580cc857a9da61ccec
MD5 a6ebf1d3f77100b197c7f4ce08468b8d
SHA1 dc3012368133ae6f87e58553e8fe676f13d7e1ef
SHA512 4e70e26a0fa8f654708232f928ce84fb9df022b59ff3499780d97576fa8ec8477d8dc39d3754170d87a325b4be6ee2d2c6617f73746d055f48951d14b96c97f5
SSDEEP 24576:bZMSzFVSOh8U7tTK3VnChd4Q4PQpUcrf0FGDQ:bZMSzf98U7twh0gYUub
TLSH
T1E90502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ff63eff512eb75971be987c167cea6bc9ddddd63e7bab290f0adb9fe45b59813
MD5 27484d778e2c192f4d2573801d26e702
SHA1 06e0957b9d4ccad28b31ec2cc85b980d93fbb056
SHA512 e80a69beaa7ecc8dc108bce6d0b86362935bf1e252c0f8625709bf3d1a782cf785d85acfc5f433b5dedf9c302998edd538abe0efeab2cc21096a52eb9ab36920
SSDEEP 12288:SSN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:S08U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T10FC42314F796480BE3111733F537EAA4EB141EB5AE448A292550BEA07F3FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 54ff156fa5d36e6b8979740dd7edd5e1d119de38f7676001b32ae64819830a3a
MD5 ad3a2e40c545acbfe059343ff106157b
SHA1 c349d5e63599b56e9898ebb7a9efd7c606c77401
SHA512 8d07e8671702a5970f422ddf9987ea3d5b236c03710b53c663490a744c4aa6d9b4132a035272c277e6a8c2d16c34535475f557500cc135877450d130d2029930
SSDEEP 12288:QGN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Q48U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T132C42324F786480BE3111733F637E9A4EB141EB5AE448A292510BEA17F7FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 8d0954407596d7f7147a7ce41cb12c54f93120a243fff04819d19c133d45b9ca
MD5 569c064943e7191aaece977da893f90a
SHA1 9d1346b4807c112c128d4dce576f0cb15e242061
SHA512 fd9f5f2171d087176a51c9b7d4951d572df83387b34b2299aaa706900e4c3059fb7e649537b133df57464e167fd38de572d311e8113c5d20c945be948e91b82d
SSDEEP 12288:CyPz5L8vN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:fzyV8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T102F4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b319684a0aa993be542e041c60650a82d6e0a12cb9832e4245cb784426a9c84b
MD5 2d42b293ddd90b84eb857b5b7b1a0c2a
SHA1 09f3f52c2526ba799de55acff6335c80b764fe68
SHA512 8d389ec711fefe3e15c04a4819fe5fb9aeed9f2a9d99a9837d3df02911cf894859418e4f5d7e93055478e35e0a881396c7df27b0ef1482599c6f80d05675eedd
SSDEEP 12288:PSN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:P08U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T188C42324F796480BE3111733F537EAA4EB141EB5AE448A292550BEA07F3FE5C89CDD41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9f306829eac85ace76fc96fca61631b7f15fe9fe74a9bc1f146524f470a24978
MD5 ecee02229fd9f59bab428f5571fc5251
SHA1 80113144d44db6d406d02385957b220c7083fbcf
SHA512 0516f655089ccfa06571faac9cb6964d6e0d16ef86b702598949c3770d3b863f71374d985c57b0c261c790b9345353d7de36b0d6fd9110b511844719ee40f132
SSDEEP 12288:7SN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:708U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A7C42324F796480BE3111733F537EAA4EB141EB5AE448A292550BEA07F3FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2dc16e38d20fdb1ee40d307bf0d8344024778ceab51e07bcaf602b1671dec299
MD5 194f0f8e4e3a7474549f50e0b9cc81f4
SHA1 6f9f7528820bb378646ec7edf40818aa66ad03f0
SHA512 a58729525633d284c6196070d226c7748cd9d6ee49d722ea7aade0f9b8b2a896e65418b77701cbb9388e465aa13d3290893c104dc7c03c585bd075902d9d8681
SSDEEP 12288:jyPz5L8vN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:OzyV8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T190F4021773A120FAD2365235C8225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 734a76c9f0e5fc8ca41165e9f37e4566a0473e92229aeea55bedcf7f14005f5d
MD5 6965c35d2ee0617340eb55e5ed8b662d
SHA1 2b809db41751876d0e6576bfb7c544c311adfbe7
SHA512 a0d555055cb981dfdf42029a4797530c11536df125fa5c03a83e4f20255084d16e1bf3d542794ea5933c41a8a2f43713f6da6f54e9d72b38c12430ab049569d9
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71nNKbrh/8KBs8U7tTK3VnChd4Q4PQpUcrf0FGDQ:yP4m4IpOO67W8K68U7twh0gYUub
TLSH
T15965AE2DABDC0096D0BB913885658A49FAB1742A1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5680a4aa691623e16fcf8231b3b6449fc6dc70920305da360900ef5b41424c1b
MD5 6d815ba981219462773ce8155f553faa
SHA1 a0719c3d8bd8950d07484e8c3affef331ab47216
SHA512 80329034f53ffe7bcf2566eef8ef57015d8f98afe6eefacf2d9f7245871227dee151cd7925d68bbfb30492d9a025f42eb2f08c701f3f3ed5b424b106eb14202d
SSDEEP 12288:nNsfCN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:kk8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T166E4F118E39401D9D16E2236DB269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1b8abd8d6621e3a594abedfc0ce97f4a3da1454ca464833df81fc1c0394c2e22
MD5 afd0dfa540a17cab7f22f8e454623871
SHA1 0477a7988e7242de180f6d86ec930ad797d56d89
SHA512 c518253d721fc6aef08798182827f347eaa50fde76788bf237d8580c31f663322333f5b2fcccbf365ccaec00a1e67930224e0c973174c85df1bebd5be0221eca
SSDEEP 12288:RiN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:RE8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D8D42220E399880BE3662B32E537D574E7153E745F44C96B2410BEA46E3BE98CDD8E06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9f84555944b3ab850fb279dfa3ed9f8ffa044f9b08d71340f7ce3d36ca91fca0
MD5 733c9f9800847a568a1beda3ee79bb9e
SHA1 1cc32fe2a8d01283a3508542826e7d79fe715eca
SHA512 51c39b0f7348960b9c16e459329917dc9abbb0bc05903349ae69bfaff9954f7cf66ff6efebb429567f52510cf603d495f5d7e6dbaae357cc7ac4db02443a9eed
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQm8U7twh0gYUub:Za0hNYG4Jwdbpi0gYz
TLSH
T1F185AE1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 2141563fba1a6e5990393aa48ba905e9b443ff6c6ae011f9b8fe15d6b660f842
MD5 da050014b91f67ce8bc52a52216d3a40
SHA1 1c827f6a79472a4a872cd9f02c2eef04b9cca5f5
SHA512 dd68725597e8e251b13030372d3dbcc345e09e6cc164b16509f0e92f37452215e908a607e1429d5fdcdd0be739557735f619f08ad7e0d2c7b6322f9c5dd1d0ad
SSDEEP 12288:1hbHjfXbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:1hbHjPx8U7tTK3VnChd4Q4PQpUcrf0FN
TLSH
T15BE4127C27AC149AF271A23ED522C546D731BC251B0097EF229192B95F3BEE84C79F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 33423aac4146a17987e318fa29d5a6d33d0e6d029ccd7d859b0afb0b3db9a6bc
MD5 e4c9f63fac6e6367d97e2f2959010c35
SHA1 9c41850c91e70b637852c55142e225ddc3163d1c
SHA512 2b95834e264283ee42458a09cc16ad7ab1add412b9e4336b464396990c4ff01d08296f5d832d904d4c89db4f25701423b3aba421c96c30300d9648a8eba3688f
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/J8U7tTK3VnChd4Q4PQpUcrf0FGDQ:oIgnaTk46pBR/J8U7twh0gYUub
TLSH
T14F45BF2DF3B910B9D4A6D236850147B5FB71782D1F209ACB0170C538AF1AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 e84bd4ed2853c9399abfc2360fad7d51337038f726d8b217da7ba1406a1ae1ba
MD5 f10b854101d51654ba66fe20df2eacf8
SHA1 94f6a7599c8e10487bf9d1dacf3cf10091a6034b
SHA512 84229e4130ca4fc699c0399bf4e3e865513700e6622b90fcb761183f4b0dd0e0175f4cb26b8d860be10abc8babd3039040ab4fde8b9328c47ad3c5f508c34ecc
SSDEEP 12288:DWN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:DI8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T172C42314A3854C0BE3212737F537E964E7102E705B048AA72450BEA16F7FEEC89F8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ecfca4fcd26f511c7e7840758643686d5d3f8d947728bec0b6ea03c4e85662d2
MD5 00902511b80dfc1417ca8bdfa0f9fd03
SHA1 f5545ab915920862a9104f9f8a39503fbbd57df8
SHA512 5f084034e627e9b0217126b08ec88ff3a072f7593042da7e710e93ccd02c33b97d2f5ffde419a157e5ad4b7dfbd7702cf5076fd35d6c9cc12a287d1cad2856b9
SSDEEP 24576:EpL3UTT8U7tTK3VnChd4Q4PQpUcrf0FGDQ:EpL3U38U7twh0gYUub
TLSH
T1DD25F114F79400F9E967923DC9728A16E272786D0764E7DF03A88A651F237E58E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 fe867378fe1bfd2dd77812dd31eacc8f01f8aee0be798a163e72106e9e266363
MD5 07162daa6cde708d06c423e43d52af98
SHA1 da648e760d927b6cffbc8e347786c46cd8bf4710
SHA512 573c8103186d38f39898f47a013605b676af99b6432541bb264e93b5f3ec0649cbef5f56a4f82e959cece65b682ba244566a37f9de1d2eaaac1c7716af2cf481
SSDEEP 12288:9pFtpOBN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:VOX8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T12EE4022833DD10E6E236623EDA639249E33178610B1147EF029095BE5F77FE89C79E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 82f6215a7ab5a26ae284295120d36398016395e82ce2dd4065ea9ce33248f2ae
MD5 7db6f1a3f28b1cfb2506fbdd3d050d0c
SHA1 435358c307ef20751b6fc38e99d592d8f5451219
SHA512 47ec4d410d7c5d8f7322824ac33405d1025fa6f3bc87e267338931556f8660134a9295cc3ac27a13b36613997b55028f564f7536e086b5fa5294e6fa8dac133d
SSDEEP 24576:v7NM9YqZqmWMUkPjZM48Mv6bEhs08U7tTK3VnChd4Q4PQpUcrf0FGDQ:v7cBWMpPjN8DbEhR8U7twh0gYUub
TLSH
T1A0659E2E6BEC81D5D577D13DC9A28205F6B2B4611B318ACB1162833E7F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 16cfb592a395bf48a592122d615c3c852cc73073d7f114b71179cf40816782c9
MD5 e43490ccc164bb096fe2a6a33eb4a9ab
SHA1 158d106483b52c621410a2de7935242a0f6e0452
SHA512 d292c5e488de1819a8e754623c84caad8949405fff7e2ad366888c2323769a782eb74d54c0ba486d6f17913f20f7f569181449d4f91cb48ce5bacf65379b3d6f
SSDEEP 49152:UF2YuHNETovAvNYf8kmU8U7twh0gYUub:h6BCf8kXbpi0gYz
TLSH
T1B5858E2967ED80A4E0BBD27D85B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1c5b58d45f173700054ff4cf5daaeacf7fcae72b26cb7fb1f113052b9d8ab6e0
MD5 fe373b81f9dcddb249663948dec14663
SHA1 aa7d5e378b578f9423e6ef1fe8e84d6aefc19503
SHA512 5ed91a7cbfe92fed641b41c76928c56ea36664610f9ab94ed2500e9307bc548e0d8755302bebac4b23cd5cdec1f9f93ed71bdb07a505c7c607ae9a62ea091f73
SSDEEP 24576:TAFs06+Omlf3NXEbTob8U7tTK3VnChd4Q4PQpUcrf0FGDQ:cFs060lVXuG8U7twh0gYUub
TLSH
T1C165AE2F62AC00D5D07ED17E8A97C91AF7B1746307215ACB0160867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1299fe7a092855293ca653484b94cf497f65c86b0f93a8440021441aff1d3952
MD5 af107e6d177b6dda4d51dd52a7a87c45
SHA1 acee0385727f9f615be69a2b6f5d3125966cf9d2
SHA512 902a177494e22fb60a94fa188bfa9d34dc976487a666acc6c892356cb88996dc3ed6fbfcee78526ee70fba3256c45d3a038ce7d5e67ba70ce314d63e992b57f6
SSDEEP 24576:JJnJ5D3WXG8U7tTK3VnChd4Q4PQpUcrf0FGDQ:JJnJ5DGXG8U7twh0gYUub
TLSH
T1C615D02CD2A810E9D4B7C274815A5B95FF72387D2F216AC728B4E5353F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1e08653033b4d5571ff2bccbcbb0ceca2d149a9d3a1f725166678f234f60fdac
MD5 bee0aab8c2a499ada8fc430859dc23af
SHA1 14d2e270da5508ac4ced743f2902feced576d51b
SHA512 8f0fe2b0b3167dd40b9cf469695ba5ca7718ae7fd92587beab272d86535ad129a6c61853ea7a8c687f0238235ee939ae460f9566a47f26a666e32cf1129dd9f0
SSDEEP 49152:sg06DIKdwc+eQnSt65aVQ8U7twh0gYUub:dibpi0gYz
TLSH
T10B956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5493f61c5271c2a2ecd6fbf3927638c2363f321d95124f6fbf2cde9415cf8e24
MD5 52d552aaf6e8ee054f66ce1bf057df0e
SHA1 5b283907b565eafe5b2a29fa1cdd1fd9a4d0874a
SHA512 5075c48be670282d6e6662a06e885b0a2da82a6d2704b55c4a35adbf6af252720cabf55958548b95f5595ed3584eb230572d16bcc1986d43f0283901f95a8698
SSDEEP 12288:jEP3RnQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:onK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C5E4126C679D60AAD226623ED562C644E332F4702B015BEF15A0E67D4F3BEE85D3CE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0e358c09636a202bd28b9197696396a264ea74f5210ddb128d7b24fba7179810
MD5 469926b0983f826227964ea92711aeb2
SHA1 95ae79f592b511739b8b45737975ed0325dafc36
SHA512 7f63c0550fffc68fc3b74d5e32d5f225db50dc04c58835ca8ff9381df4b180a9f616c253f576bc0c9b4ec977fc114f84566a3c30dc7d343a70e38471a862d402
SSDEEP 12288:7jkyrN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:7IyB8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T185F412146394549AE6761639EA3392A4DB31BC305F1086EF1090FA7E6F3BBD89D74F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d0006a8db0d1c9c009c21812cc00227aae0d05b76d9ce92d0da90ac85ace91a7
MD5 dc7d4cabfb24651316c8d2f291f56937
SHA1 a1e9809556e407911b290f3a9d7febabe89ad06d
SHA512 5b97c4522a20721181349777957444f18cd1907f3cce46ebad0bd2a7e9a0fa385a4c09d8f4f485ed0318bd27b994c6069094f5244d59fe4977645c80aaf0c730
SSDEEP 12288:MyRN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:5n8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T156D423186396580BE7211737E537DAA4E7203D745B0489BF1490FEB0AF3BED889E9D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b6df7ae198d6f151209e3040864ba0741e5bc69af220e525ed339945481d7ebf
MD5 f217f718ca4432982a26c981df3c2437
SHA1 b70d0f270cce10e17f89fcb81c80a960fc60636f
SHA512 d7df052aec300e193b23bfa41fe07b194eb409b9f8494b3abd8ec55ab1dce57e8fb14ff7da5c716737391055deda2d0d4f0acd6abc9309a8f9e3cfb2ade1ea46
SSDEEP 24576:vQ9MxZKdcz9dw3c8U7tTK3VnChd4Q4PQpUcrf0FGDQ:vVKZc8U7twh0gYUub
TLSH
T1AC557C2DABE9099AE177D235D5A250C3A633B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2b3746be6c20be1f02bd609af654f9ac1a7b03378a45a1cca3664be245bd43d3
MD5 98769f7df35f0b4edacb95d8a1b55a10
SHA1 74d2c3415b2894c88a5b436c3b65f644239c3c29
SHA512 148497b43886d1e90137206fe0e8d3001888885faa5c54dca3eafe1fec4a5ef8765f441316c2b5a659cd44b0048f0fe56eb0f76dddcb43062832abb1be03e3c8
SSDEEP 24576:byocDApF8U7tTK3VnChd4Q4PQpUcrf0FGDQ:OocDApF8U7twh0gYUub
TLSH
T1C1F4E01EB7AA40A2E162823CC9968745E773B4301B5157DB2591C73D8F37AECBD38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e86201ed4a9f3ff1c36c5ffc16dce2222d5fdb664d23f31be1b68fc2fea58530
MD5 67cea26e95b710ff897e841612f20a4d
SHA1 eb77c9f7ca473dd981f1293da465ccf7be0d489d
SHA512 c0faca72904c14fb0f033b8c75333403e8893894c97167e84d4e3698885683cb85dea9a6b471504cea8a3f87c76339241c97b99ac71d8ec0a9e67dfbebf2d3a1
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKF8U7twh0gYUub:h0zuNITbpi0gYz
TLSH
T194A57B3DA2F800A9D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 36bd316cf31b42e9fb3580dcd54e5580f25af5d5cb7a7acda2c5ad34be9789b1
MD5 20f44c26b6728f338aa42e1395da4fec
SHA1 21a4a4dc1f7f703b658c85242c435486533af31f
SHA512 b0848d8e5f1e8e3a1b37e7d5623103e66e8b8ed084918cefdba56017c9e5c295aa8c741dabdf38e493fabdfb04a13cb369f40b00f1706ee144a76d27e2591c7f
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYtjMqbK8U7tTK3VnChd4Q4PQpUcrf0FGDQ:hTDxR+N5YzTfjM38U7twh0gYUub
TLSH
T13855B02EA7F905E9D17E85799A23C512FB727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 89aa158ab15bde8f3167067c97eada9d3bb310da608030b80643f1e49ccc2a52
MD5 ea2a916fee959107f4a866b236db3311
SHA1 7f86c45064c2da256f486a3c68a5e9038b0a89f2
SHA512 78ce7061b420870e67d7d419e6adc7841b509b9d5bdd9aaa3e044e91af7c63675ab4dd177672f4a4e012d2f64e315cdfa4bae043666b74dcfe94113228c5d7ab
SSDEEP 24576:7TMdOz0FFS+imSLu8U7tTK3VnChd4Q4PQpUcrf0FGDQ:p0K+imSLu8U7twh0gYUub
TLSH
T14E15E13DA3AD04E5E57AC27DD613C906E67238610321AADB0690C1B93F6BEE4797DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 4bc7d33e16796f4f4947b3260ae5769c594e7640f1584063b299222e4818df94
MD5 188a7eaa8461824c494e4c65b0099b15
SHA1 9f5361948e67c4ac22687c4dab2441d696347dd8
SHA512 84f85fc81f5f7327dd19bf620062212557881a76680836ad0cd98678467aede5ebd35a58121c44aeea556eeadf331459da5baad967f74ab53e1ecfcb689e5ff1
SSDEEP 12288:o4K9N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:eT8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1CAD4121863D82496E1322636DA378655D7307C7117149AFF24E0EEBA5F3BAD8C978F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-159-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1528-167-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1572-156-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1572-355-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1572-94-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1572-88-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1832-161-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1832-126-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1832-132-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1916-165-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2040-351-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2040-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2040-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2040-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2204-171-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2204-99-0x0000000000650000-0x00000000006B7000-memory.dmp

Download

memory/2204-104-0x0000000000650000-0x00000000006B7000-memory.dmp

Download

memory/2428-206-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2428-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2428-17-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2428-25-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2560-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2560-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2560-62-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2560-56-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2560-65-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2708-169-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2708-204-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2708-358-0x000000000CB20000-0x000000000CB28000-memory.dmp

Download

memory/2708-357-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2708-188-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2708-172-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3132-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3132-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3408-356-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3408-166-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3420-338-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3420-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3420-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3420-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3924-168-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4040-157-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4120-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4120-76-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4120-354-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4120-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4296-139-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4588-160-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4588-121-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4588-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4664-70-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4664-352-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4760-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4760-170-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4828-162-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4832-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4832-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4944-391-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-398-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-383-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-382-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-381-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-380-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-379-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-378-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-375-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-374-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-372-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-367-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-366-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-364-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-365-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-363-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-362-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-361-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-360-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-371-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-385-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-386-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-387-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-370-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-388-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-389-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-390-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-373-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-392-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-393-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-394-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-395-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-396-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-397-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-384-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-399-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-400-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-377-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-376-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-368-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/4944-369-0x00000282ABDB0000-0x00000282ABDC0000-memory.dmp

Download

memory/5000-74-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5000-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/5000-8-0x0000000000670000-0x00000000006D7000-memory.dmp

Download

memory/5000-2-0x0000000000670000-0x00000000006D7000-memory.dmp

Download