d9aa34996e89e2b69e7d094c56498962811ba5fb19d929083041f5eef224f016

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Size 730KB
Sample260807-l619essepd
SHA256 d9aa34996e89e2b69e7d094c56498962811ba5fb19d929083041f5eef224f016
MD5 6c36a655cbd5897d65c493202a38dc48
SHA1 bcfc98570470a162ec7502559ddd8e781452a762
SHA512 5e0b6af844212189d0fedda66153a1d0c759124c5f96e609cabc9090713c13fe011c3e3223a6679e2a1d20901f1f33ff29d4cbcd4b9ec414cd70ed45f108f255
SSDEEP 12288:WUYJ9bi+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:XYJ9bTEk962hZqDfX0Fiz9DV854P7JQX
TLSH
T1F8F4012171C184F2DEB3053049B5E6B2997CFC724F6098EB639067AE5A346D08E3DB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4960	alg.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
3396	fxssvc.exe
4248	elevation_service.exe
4344	elevation_service.exe
4348	maintenanceservice.exe
2224	msdtc.exe
1216	OSE.EXE
4992	PerceptionSimulationService.exe
3872	perfhost.exe
676	locator.exe
452	SensorDataService.exe
2352	snmptrap.exe
3272	spectrum.exe
3108	ssh-agent.exe
3172	TieringEngineService.exe
2592	AgentService.exe
1228	vds.exe
3432	vssvc.exe
1900	wbengine.exe
4400	WmiApSrv.exe
3380	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d44e672e52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4b2e0dc5426dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dc4d4dc5426dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d256e9dd5426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a14e3dc5426dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a8536dd5426dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe
2964	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	3396	fxssvc.exe
Token: SeRestorePrivilege	3172	TieringEngineService.exe
Token: SeManageVolumePrivilege	3172	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2592	AgentService.exe
Token: SeBackupPrivilege	3432	vssvc.exe
Token: SeRestorePrivilege	3432	vssvc.exe
Token: SeAuditPrivilege	3432	vssvc.exe
Token: SeBackupPrivilege	1900	wbengine.exe
Token: SeRestorePrivilege	1900	wbengine.exe
Token: SeSecurityPrivilege	1900	wbengine.exe
Token: 33	3380	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeDebugPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4520	2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2964	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3744	3380	SearchIndexer.exe	109
PID 3380 wrote to memory of 2876	3380	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6c36a655cbd5897d65c493202a38dc48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4484

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4348

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2352

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e32628069630968fad4b9134b728e53ec268fb7d149c819bca0edb0968c225b1
MD5 4e3ae662995ca1e02cff1300a8e2af34
SHA1 29b3090a61f633d757d06daf484bd94256060044
SHA512 bdff0717bd25637cb78ab4e9aa107ff6c10c4ee91cc613cc9d3a9fb08f7a4d3ca2d1f288a736822006e23051431ce0d55f5b118d61f92eb46d6bab5852d87166
SSDEEP 49152:Hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnhEkoiZqDfEFiJJ854TJQE0:13q60jB8ousfEkW54NQX
TLSH
T1E1D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 dd7d25758c203beaa2e1007e4f338158f1b15a8821df0b0be3cb0ef3de88456a
MD5 f170950ea182b18b80d3d92cadd58427
SHA1 a5734577de89dd89902f9e76d11439817dd8336d
SHA512 bf7ec7deebbe7bd2bec1b76d4c5b9e76c38cbf2289b25c70bee23d3507ebd4821869910e76d33e859303bba3a0e362570bf996ea1297edcd4f6dc96a67a9bb93
SSDEEP 24576:5XYfDtczAyEk962hZqDfX0Fiz9DV854P7JQEtK:8tcLEkoiZqDfEFiJJ854TJQE0
TLSH
T12905F12863D408F9ED67823CC8A28512EA727C5547A0F79B03E4952A5F337D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 59f5232114ac0179557e284c09eb4c718306a34f6cb69f41761c88307cbbf205
MD5 1a059602fcfdb5a6a0c68fe704c108c8
SHA1 edadf6067a8276d67c366f92759f72105dab8a87
SHA512 360de832a970f181304c5ff535b5b7538be4af4b692faf29609f27f2a4c9942bf84daec3b3e2f75f00d17ce7863e7bad31351daba9957bc8ae821a7a538eeca5
SSDEEP 24576:10Le5ji0hmxNrM5Ek962hZqDfX0Fiz9DV854P7JQEtK:1Pji0A7wEkoiZqDfEFiJJ854TJQE0
TLSH
T11B35AE16F6748371D073C0B9C5D2A69AED7130861B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4c3e2b7848b48f584f79e7f6977e73bf58b226b380f5f040f782fa8220632c81
MD5 20411822c5b9757951f13683093f6d36
SHA1 ac3260b09a6e1eb4548a4c0acc5b6771e29cda9a
SHA512 6605d3a9363f0ccfb8ad305b6c1dc4957712e395c171d2d345ecb59a4374672914dc1286df7de8154445a4660fe79a6fa71382a71731c65507140a9737ce2d02
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWr6q8wyubEk962hZqDfX0Fiz9DV854P7JQEtK:M/ezSC6vUzPviHjyUEkoiZqDfEFiJJ8j
TLSH
T13C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5da7e878e418dfe7114dfbf3a28246843767be53ff4f5f2ef66921fd020f55ff
MD5 1732e6620636fac1be03d2b4ff10899a
SHA1 8585b03a5aa9e9b885a4133a3ce6bed21ec2ccfe
SHA512 fb3dbf92f01b8ce3cb6a3ada48f4a66c13f07ddb515eb5ec60b828b8aa0c466f33fe0a3371bce7c62a79f6a353feedce5cdbb208d1966c36652a44413fe8fc0a
SSDEEP 24576:+VbqPb88hv/l+buEk962hZqDfX0Fiz9DV854P7JQEtK:+VO88hXl+6EkoiZqDfEFiJJ854TJQE0
TLSH
T1E9559E65F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 81872b42268d4d33f7f54427c12cc0dcb975ca14cb19d8998babf068e97e1faf
MD5 f2cdb9b233002fc1bb59f21e36925b79
SHA1 026cbf100e041a3733ad2af7fd796eafebe1ca2c
SHA512 98b6f21644db3dc0e7d752cf9204f23d787f71714636f1e0606e1da2f651ddd96f8241d20e3778f72aa02886fd93ac2c5e2866ba2532c03c29f16c9ef888a423
SSDEEP 12288:ej1DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ej1Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1ADC42341454528F5EE730634E4A7A4E769B87C899FD0B9274B81F24F803EB21DD2EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 336237831be24d2c2edb9e84d5ed9f8a0eb5d75ae786fef762dcc0250610f7c0
MD5 5c413766ef03d8083559e2a605d655a5
SHA1 889d36868add6ccca0f818ec5f91a9e663f20213
SHA512 085f9ba7f218ea67831f95c79132586ae3d16e00172bbbeb3e0055ce25d0c16cb46fa3fc454adaea5372825a01cf3b22f874483e2e4c8605d1cca8f5e82949c7
SSDEEP 24576:nJIUmEk962hZqDfX0Fiz9DV854P7JQEtK:nJIUmEkoiZqDfEFiJJ854TJQE0
TLSH
T1A905CF3BEE28FCE2C67A4D7856918240E77278704F51A3CBD165C20EDE236E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3d43d7c35ee7d62138cba00682a38ba6d3e40b6f656c9612ccfcc9323e9fedef
MD5 3d984ef7788cb4515a0a1617eb056244
SHA1 6d1e98bba87cfb6d5e30150bd92df220fe8f8b00
SHA512 316f858651a2b4094ed5dedfa11f78d2a0bf47ad5ac6cbd0ac7b4eda73071ed95b53ec3bdecebc8a0d7f66401e03352e174fc0eabe34a0cd9273404d74da4660
SSDEEP 98304:RQvGAdlCEL8c/RRNw5C9ousfEkW54NQX:OvyEYc/R3w8au8+54NQ
TLSH
T123266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1ae55082a69cd776edc5add1cb38e5128fe12ea2f845d18fd6403b9a2e4bcebf
MD5 7df31f177deffd92ea2796fe09d3e438
SHA1 6e6a2040a89962813e7c7e07f26aa2f7c65c9740
SHA512 0de08ac633f54dbd2b1b60d1aaeac85102ad9cff0bfe22359f1ea8bbe6b7511998f0aa73910d1518588eacb8a9813ce63d7bbb40588f8afe1eaf52e2b430129b
SSDEEP 24576:0SewsAjAEk962hZqDfX0Fiz9DV854P7JQEtK:HljAEkoiZqDfEFiJJ854TJQE0
TLSH
T1C115E031FA74E436C67B0DB21B36C716187C79204F9129C3E3E89A9E59342D2277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e256f2579012db6503e85b5cc9686f7c95a773b060ef2541216148d5f29f5870
MD5 2bb56165fcc69d5a02073f132cf86942
SHA1 0340ed886d97de1880b36c793c3d9f7a4bc145fc
SHA512 309e8cd5d2192dd6128a658e4cf5533bc70dbfe6c44d11957547e39fb47d39ded80325c61584c40e557cc400fc9d78d67cbcedefd265713e06a7c966f88d764a
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHBu8+54NQ:dUEtQevvqc2W1cpV2RI32s8y4W
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1b1fe92a4fb69dfc9d953197c30e6bf7cba6615311ac693d662e6bbe472ba14e
MD5 7c560f7c1afa9b38ce4cac22b24fc29a
SHA1 16553a3006b39a74568fa4a4047cb22bb7a7ad32
SHA512 5791c5fbd9b289ff52264857bdc491e877c3b68510f9edefb7f8eef5e4f5912020e1f5907f79a7f7846b097ef0620269a766dfe321fef94a557541f3b1f4f26e
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zgEkoiZqDfEFiJJ854TJQE0:7oqtVjnmhousfEkW54NQX
TLSH
T1EED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0a698ad430c93b9e70851f3bdc6393ccbd308737af04d22b4027cdd0a70cbe42
MD5 e4340eef3f2d780434cb2608c5985dc2
SHA1 bf61b48b5af7bafbff21651c371e88d25587c8ca
SHA512 92020271a8c22ce0af860379e5e63cf4360c5edf0067100fff391eafbe23e9ce348fa0d6f45da380657de44127f8814d34d95e1437dc9d3e0a3b54436f5e1553
SSDEEP 24576:aAhGL2IFoiwtA5l7S53fEk962hZqDfX0Fiz9DV854P7JQEtK:aAM1Foiq5PEkoiZqDfEFiJJ854TJQE0
TLSH
T16935AD80E7F955D4F5B3AA7899B69171EA76BCAA5E30D20F2250D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6560a2e7287991f0eb84ba3c316ebd2af4b20c6e8fcf3fde128ad81e3eca5d43
MD5 d1e308613eec21600e268e1e16eb9e1d
SHA1 bb7f327f9b56ba8303f02d82973b29d090343dab
SHA512 6275d19387ea291b0e3d2378a8e84f26ee4ca811bf5f8279d5975afe6f7bcee7e045c3be8eee44f42b1f101950a05ae9684a49cce27ea410364e5edbfd7b8da9
SSDEEP 24576:YwuXOW0Ek962hZqDfX0Fiz9DV854P7JQEtK:YwsOzEkoiZqDfEFiJJ854TJQE0
TLSH
T10B05F04666A41CF9E9674238C597C136F7F2BC062A61DB1F07A0C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fe614519e8a8a965218331a20b3f31a26c2ed48a187f1e4b4d6624d33f731794
MD5 bbd8ce584eb0f42dd660d22d733965cb
SHA1 83e7501f4a725b8e2aa914940667a469236fc948
SHA512 1dd718f9d341e3e91812dc0264ef5876adb1d4cc11a452110230922a1a64810e686d63df239895a49b80fa7290e4bea453cb3f4364817569e58c073b8cf97b81
SSDEEP 12288:F/Z1IyQDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:NZuxEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1A4E4124522D434F5E9A30238C8E29586E7B078566BB193CF0750925E5F37FE25E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad2b2beb2d17e5bb97d4dcae822f3f47b578c5e480e06ee4f4da0ff54bb02d31
MD5 0d10900da996cf640545fe85f253dec4
SHA1 4243a7ea9700818837f9642e449b957d64edb71e
SHA512 514e7181f76aac21a800f4a01a47ecde666d3d714ecaa16ad4aa2488069186bb967eafb89b88636fe0b926595aad5f9f2d0b031de08907341ba59ceaa9d3111f
SSDEEP 98304:zQRQyi36YOcPhLvw2gAf+PN34ousfEkW54NQX:iQyiKahX+PNDu8+54NQ
TLSH
T1D2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ec01615db70ac82ca57fd81f4c175d5a3ed00c2ba25c5946692e355fd5d61d0e
MD5 f31f6c0fcc797555b91bae6e3c79f40a
SHA1 e870887bc181ea3e3f43b5a4cbd51873a61ba17d
SHA512 771eecc0eccfe22519b76c04c48e86ffc9058e579cb7611bfeee768e8c853d8f4dc7ad0ab5745c6403e46223879a5b2449335789c81b8bea92a01d5b52ee0393
SSDEEP 98304:4QRQyi36YOcPhLvw2gAf+PN34ousfEkW54NQX:vQyiKahX+PNDu8+54NQ
TLSH
T13E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1956c213f924b0051bf41196e6dea1adad513558190a8fe18da54e0034b19dc7
MD5 aedb72d0ad49cecc5a5e1ddcc32954b3
SHA1 52a35dafce90c22d1116ea5a4ecb9643ffb1cadb
SHA512 3d0989b70cdcbcc1870f668e195631e7ee8d5078ba7b09db3b0de719bc81c6847babf6576f479e1ed3fa8b57665fc465eb64b456f55bd71d4bf26a086efea336
SSDEEP 49152:+68Qg55nhceWu7PNU3/wEkoiZqDfEFiJJ854TJQE0:MthLRc/iousfEkW54NQX
TLSH
T1DBB55A33B2F200A9C44DE1769F46973196E17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9d78344dca5832fdf086592dd720a7fe136fe2a8e03de6da4ae94564b215e0a2
MD5 72bdf47f64fe96638079447b42d5baa5
SHA1 667f88602cfc7aec92215eb7548318fd71ccc10c
SHA512 58eef4184acc0eb87ec2cb09e5071c1d1f327c5811061ae06821f5994e417d910768f94c83e57fa7606e3e88ab4cd99355e6817fa3ff5f55a627d8eb410a9b78
SSDEEP 98304:dy5112gYy5azzVva69nLKnhZbousfEkW54NQX:ALIHjWhuu8+54NQ
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 12257296b7c0930345db67cc7f7c986e07ff304bfcf0ea3426206467a425e4d7
MD5 df20103496fa8d2c31cb2924a5030dac
SHA1 1e3b1430eb7b2422b87622f6f1fd56723bdab02c
SHA512 035f461fa9a296c02c3012be70195d9c806dd9c38f6da245a1fa0a3423b35d917793260b4256db7bb3dfa40a14589abfb2fcd078415a33617fb0bbf471d52eca
SSDEEP 49152:OB+taZ3usBWOBr4tEG20bqx0z+n217aau1gliEkoiZqDfEFiJJ854TJQE0:cu6JmUxd2dwousfEkW54NQX
TLSH
T1E9D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 869680369a3b4a180fb99d8539f35cfa1a3c38e8f5f616dfa6a34def1b109069
MD5 7c380bf79aacaa445b7f58038d86b923
SHA1 7090b8da7bc2aafdcfecd1dd3d0d84cdb72e68ab
SHA512 f6060cef323a16d423f3192ef2736c9d1daea7920353dce181079e8b0ba894d27f307b4fc599368cafc0edc5700281ab73d65071e0f626720b88ec64346146bc
SSDEEP 49152:n1hpsNoJpF1A6BU44CwH7R4xGEkoiZqDfEFiJJ854TJQE0:nmifPkRhousfEkW54NQX
TLSH
T13CB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1e8f7b042da868fda36ffa1449f6f9962be05b7ee8eb87c2238cae2c9216e123
MD5 4ca72e90f7e9414efd6a30014046b583
SHA1 705e48b775b4f96a9a3f74210f990cae140099ca
SHA512 1588afd80e4f71745e3da0e333c14a4ddbe023d30f7359cba0ff3cbfc5f443a15d0360fb25793f2d785bbbdcfc4dc6ab350e94c60273cd111eb9dd40c7a8ddda
SSDEEP 49152:9SuZQIY0Be2KNRVtOnks6NMHqxEkoiZqDfEFiJJ854TJQE0:T5dKvi61HousfEkW54NQX
TLSH
T139C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ea3057103746d823e65089814a49f84f76091c370e0e26532921c3784fcad1ed
MD5 9c90d101155e4085e8f1af332c4749ef
SHA1 c94fee080be6d7e4e6c7b82b4b2097ef25a57bf4
SHA512 acacbc01f9688b6ec67606becd72eca31460136f5e63f8b2a31b9d5bfb32f302a853e80d77d34fc4a5e3b0401fe77c6993d07eacf7935ea27618f5c3591e0dc5
SSDEEP 49152:qhtSn8EApI0figXgiDn0AP5wyEkoiZqDfEFiJJ854TJQE0:LX2iyphFousfEkW54NQX
TLSH
T1CE95BE13F2D900E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f9dffa271a9e1204e14c78fa872d79de0b9b5b902e690ccbf52d5c9ae63b8038
MD5 9f78338ffb9b56e7956039de3498e681
SHA1 fdbc5059e8f2ee3b2a430de5ded2cb0972d7b2cb
SHA512 85a03bddbf5cf71b050805b57b735c32b454e36ad76ff1eb64fe7103e7c41e52ca699d19146f1971f715eb392860565c6ca3159fabcffe5c984310fb232d12a6
SSDEEP 12288:dtDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:dtEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1DCC4234144961DF5ED220234D4A3A0E7A8BC3C8AAFD1B52B5B81F10F927AF315D1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 59995db088abb903b3830fbaedb6fce62aa1856feceb9dcf1c27e190215090f1
MD5 d5d39eda1b56118be2239995768ba6da
SHA1 bc37fc60662c1890178edb9a2cc52dafdd763dfd
SHA512 43296f46cb981bde5f19673d884723a96270048973caddfc68b4605b9f865bef99cecf7d79209f784e47fb96b803a2e835ff4d529b1dbf085af0aaebd8b9df65
SSDEEP 12288:7cDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:7cEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B8C4234044961DF5ED220230D5A3A0E7A8783C8EAFD1B52B5B81F10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9d15f2bcd1374ac230228e23deda45134483fdd6722e9d46bb47e093adf46140
MD5 811dc5adbc7f4d18084ab373ae500e46
SHA1 64da12dcb6243c35b4f232bb25fd3ab94b9edfc4
SHA512 e8adfa30fa85044d7442a496ff6196e06360a7f6dc7a11eda840d0aa874b55ee476a7bd5c15ceae4909131b8db796fc099680e3b1d437fc461b364dcc0797d6e
SSDEEP 12288:ReDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ReEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T113C4234044561DF5DD220234D563A0E7A8B83C8EAFD1B52B9B81F10F923AF355E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8a97aa457a7d6de60c35ab05c2f176ee9835128a86eb46834a7f3cde26c20c4d
MD5 0cc2329eb2548ba8fb09b3a7ab66072c
SHA1 7b5a10204c7d4b284ac8176b0936c161bea316dd
SHA512 6dd1ecd63a5b357388841be7328834656aee0a54458dd7f5a8fd62d44534607a76201cba98fc11bf6473b9724cf73531568615e4e25be98945f42ad3a8f36287
SSDEEP 12288:3V/DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:tEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T175D42341069618E5DC734334C4B390E7E6B87C99AFA1BA6F9B40A10F4A76B305D3DF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5d6e36c591f54cce48bcc8d5efc6fb285b121c990df352037ce2ce1c61731696
MD5 96db7f4ea9a5e387918a79e6b0cb3b99
SHA1 da5dc99c820ca2871dbd8aacd54c7d9525e77446
SHA512 f1adef15a96a156d36afb1d6a560c6a57b121016e31379135ae887866181431b39d118db480d9c420678e8a56c07ca0e764e467786e22285b220268c7f97842a
SSDEEP 12288:8HDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:8HEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1AAC4234044561DF5DD220234D563A0E7A8B83C8EAFD1B52B5B85F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0a323a353f377e9af8aa7b7a209b9b4f4226c610b30a02947dca6fdc7dc9e373
MD5 c6bb5260dc5cc2b1b6ede761c6f39ed0
SHA1 7c64e8bbb5da5806f8ba2943a2b9d1a0c756228b
SHA512 51bc98abc7f0f76a103f931e79ae461d6759f80014c671be6d079789d0a601febf3876540a5abe5180b17b52107d6ef22a773e93036ff0138e010c8695397395
SSDEEP 12288:x4DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:x4Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B3C4234044561DF5ED220234D5A3A0E7A8783C8EAFD1B52B5B81F10F927AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 620bab54f34cd61fa4ffcb37b7a58185ae6ddea41ad75c3e75a222fc10e94dc3
MD5 7850355933a60e213d82d6a7f06d8add
SHA1 d8c9f7cb696478a0c3bb1566b94736e540726e44
SHA512 c3bf0c275c45b61cc797c21bfea05cb862df313f12d36a059a197880df3430ac868ad22a2642cb303db91d4378ca885eebe5fe454ac1929ab406e3ae529f4ed3
SSDEEP 12288:VkDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:VkEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T15FC4234044561DF5ED230234D563A0E7A8B83C8EAFD1B52B9B81E10F927AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d636a1841f303e7b05db5af5867ba27d3f1a7d3080a3aca192d3973577e0c9fc
MD5 da98f3f52e325cdd6907528fe6382048
SHA1 471fc100ad2828be417c0790991ed44cbb2fbc0f
SHA512 36c46f6e5f62e00ee2d3c68d932c7033cb0c1ae9757b99536a3cf57b9344a3f9eef00ce9600dd33acbd93b0eaedf25c3d78fa5a1142c3e1ee18c8c59c92d89e0
SSDEEP 24576:9ZMMzFVSO8Ek962hZqDfX0Fiz9DV854P7JQEtK:9ZMMzfIEkoiZqDfEFiJJ854TJQE0
TLSH
T16405F195B3901CF4EC63423EC9669956D6B17C5A0BA0C61F03A4322B5F337A11D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fdffd5aeb7cb351000d11fb5400856b6a3e55c14e929d1604f09281cedeaf5ab
MD5 55f7011af0048cdf59758ed48ef71551
SHA1 c5e3d5efaaf97f310e560cdc86c24a8e1fbf422f
SHA512 2a3da6986c171cb93203584d512a7fd48255e73509ef1acd917a9fd7bca57c0530be78f79ab224ee8a00f4585827856a86bd938b692a6e6f7a2f5335792a0689
SSDEEP 12288:iBDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:iBEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T17AC4234144562DF5ED220234D163A0E7A8BC3C8EAFD1B52B5B85E10F913AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ebc509d48e2c085d18623b95518d9f63c77ed6da7a9814f53c030b65060093fc
MD5 07e925b3c94ffe8d0d2b74aa444aa723
SHA1 63429d4c95f49fc79793376d74e56c97f41a7a56
SHA512 0c61a80d702eda76472db489c1295830b14c23a8d2e1fb2b3349012a380f0730434f284aa239c989901191f0107b4dd72487c46bb086318f1901cc275ece0f72
SSDEEP 12288:JFDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:JFEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T113C4234144861DF5ED220234D1A3A0E7A87C3C8EAFD1B52B5B85E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0d100341f9247aea415a979e53242fdebbcb34d0036b7cc6141c0e695b2f15b9
MD5 71ab9364eec80078b0343610713f1101
SHA1 6bd2543de6817d04faa821017f9ccdb2d8c36a20
SHA512 239e41a328e4cfc90e366c8a0200175cb261ad18ad5cf8223b58410b04a532267f5b55a6fe7a5d52b077680f85919babadd53d3ad471c98e8335b2ee3e05d4b1
SSDEEP 12288:HyPz5L8QDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qzyQEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T129F4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4f5e8df4736b0ec1ed8376b748f11e7a6c1c1ddd54e9ce8a8eb31e6c6e9941df
MD5 ef197edf42b121bee92dccf93b72b383
SHA1 1bf9b4494f2f7cf85b79f40c4de8175dd4f62d8a
SHA512 4b01dc31d47588f5943342813a0a3e1bcd5a71dd05ce9457d7116b3cdb84a1ab7143168eaa0528c8be62527d567d125829558f8a9f1d431b48053c9800acf594
SSDEEP 12288:TBDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:TBEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T13BC4234144562DF5ED220234D163A0E7A8BC3C8EAFD1B51B5B85E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 eab2854b07f7012686014ae0607c099cb65778cf6c0181d1aa80fb09a88eb85b
MD5 b99eba1ca4d6de117c506d3a60e9a347
SHA1 76da0c210e3a21f392fe3d881cb595290c4b648c
SHA512 6b4d64f12af557f1858f4eeac129f1bd76b9ac91226213ffc925d0fc467cc1c63222a0e7fae5d9bc431235b1e8d9668e8d33522aad182498647deb480fa22181
SSDEEP 12288:aBDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:aBEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1E3C4234144562DF5ED220234D163A0E7A8BC3C8EAFD1B51B5B81E10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c7cce4103c98bdc37c94dbd62f93867c00f7eb940cf86472a60ac6342e0bba84
MD5 d00af997b6ec5090c2618c203d9303d0
SHA1 101f3ab5ec8342852109901f85b52b454715f716
SHA512 9570194ec967c02918ec0346b88c4513465178ca25f174f175e0428c2c05f0473a64562db0e3f3a67f732a6771f616e8da75d6cdefde8fdffddf37a649bf2439
SSDEEP 12288:syPz5L8QDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:1zyQEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1F7F4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4f240bf96ebb908f69bbcd18705b3649e3471490e9acdf97b0d77c0c98682f10
MD5 c819558fdac63ef5f87dbbdf9195bf03
SHA1 1ff8be7aa82d638c077e27d56c4428894576822c
SHA512 e542356a8e449f6cccca8980040bd227af9a8e465c356a0b7631553949e2446bcd79c933ae16e68632f41ee118afa0542d0571e4d258ff69fc467237740ac5bc
SSDEEP 24576:scP4mcvIjkGOxhKP2l71nNKbrh/8KBpEk962hZqDfX0Fiz9DV854P7JQEtK:HP4m4IpOO67W8KrEkoiZqDfEFiJJ854K
TLSH
T11D65AE2DABDC0096D0BB913885658A4AFAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 24e840b7989200d9c426063e131288e20edfd45fb57395c43d243ee98bb57099
MD5 d6655ebffc391e0d5dddbe05beb443a5
SHA1 01778b27bdba474e9f8baf6ddceecafe0a74605b
SHA512 bdf9582ef263e16409519cee8353f018a4f48b4f6b11868b168aa9ab3e29ed2f9b3a7e755755ca544fbcecc51364354b3e8af78627073889cd515a2cf0bd94de
SSDEEP 12288:XGsfxDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:lxEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T18FE4F109C29412E8C46E5235C7569682B7773C658BE1E3CB57C0F53E1F3AAA05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f4206723e07965ce8defe1f4d1ea9893d6810ac9b034bcc8688c48a7f24ac7f7
MD5 012c0db4e1a4569438dd03236a13a463
SHA1 2f789efa11377611cb09f1b6a9fd5b6676983036
SHA512 a4d1061a985eeb91e9d2425b1e022059180a6200dc207e36d97314d12819763f1a0b9d94d85caa0294953610ede1c1808253321efb2bc31cb7dacda57d62c6c1
SSDEEP 12288:iRDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:iREk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1BBD4230181996DE5ED731730D46790B7693C3CA99F90B41BAB81A20E913AF219D2EF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4130bcdb21d20884cca5b4acf73fe455030dd9c92a401a16d7a2259470a9a02b
MD5 8d6bbddc122daf9b44d748f200c2eb08
SHA1 0e5cc5496bfd2fbc5778f94dd9fe92eecaf81efb
SHA512 7a368aa4842ab18bdb4efe3756320509e57c705830b9f328d1aa138dbba920b8b00083e58f53e397867eeb5e5fdf9cd6924ff2c9c2b06db323fe13a89eaceed0
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQHEkoiZqDfEFiJJ854TJQE0:Ya0hNYG4Jw6ousfEkW54NQX
TLSH
T1B985AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 a57132ce6dbaf0bba3a33227cadc95d57172fe9055d5cf5dd65b1ca604ec1405
MD5 5e6d89265429f79b0c8b92f250cb962c
SHA1 a99b2b9841abafab1ef8ad3333d5d92460c0766c
SHA512 e5cc0859b9c1711e565b5128dbfad6a9272e5237a9c26a184976ac431e74c401a38705a4d5942b5a3166b07ee05d404cc1d8f1e614be8a7d5c1420508282a2eb
SSDEEP 12288:IhbHjfXMDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:IhbHjPMEk962hZqDfX0Fiz9DV854P7JY
TLSH
T1B5E4016D02AC24E9E972927CD5928587D730B8691B11A3EF13C1827E4F3BEE45D39F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e1d3a7b2998648b3200267e8abb937c87ae5f7f8d5cd967788768380546c4325
MD5 9b323f9cdbca484decfa147f4d2aa931
SHA1 e0be55a0fe9883ad75a71359567029399c74d287
SHA512 d864831f0f7f3ff8a316139f0134f46e7288c51316a52bba31ffb088c9530ecb026405744398dc3313e8b119da893d461fcc4e8fbf57c5a10e444b20fea1168c
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/0Ek962hZqDfX0Fiz9DV854P7JQEtK:1IgnaTk46pBR/0EkoiZqDfEFiJJ854TO
TLSH
T13B45AF2DF2B910F9D8A6D236850147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 83f69bf98afc4a68c919788e5248f57e43e32888ff8ca3105cf75ecf16a3cefb
MD5 3816ed14700c93b392045315e27658b5
SHA1 71de9528983340cf86dca35e4bd64cda5bdcee62
SHA512 d1e50dab8bef56320b5a44e5e814671c28bd9604b2b6462433fa9e749f14b5f8d44fc4303fd8b5ce5b24eecdac578baddc57de1bd2f71e5ead81cd030e950423
SSDEEP 12288:bVDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:bVEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T10AC4234040452DE5DD320774D4A3A0E768783C895FA1B9A75B81F10F923AFB65E3EF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 22d932dfa6341cbc95dc6c98e3519e8904e0dcd8c8ca298937925e681bb90f46
MD5 5eb620dfdfe5fe4e2ac76402335be358
SHA1 9f0057f469e6995678e6668ec3511a82add37aeb
SHA512 2fe5cb58cb59c7e259d4d3953a69e2c625a8cfac830d266a43e6a5f76ca4d12a0193841f09102862e52442b57c954ec966d61299afcd07cb7884e33d2d24ac3e
SSDEEP 24576:prL3UTyEk962hZqDfX0Fiz9DV854P7JQEtK:prL3UmEkoiZqDfEFiJJ854TJQE0
TLSH
T14025F145E69404F9ED77823CC9A38517E671789D0760E7DF03A88A6A1F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 dfdcbe0e3fb8ff1d887a468d5eff931ca36b760f38a7633cc10f623fa661c750
MD5 ac8d16b49260e54ae46e21d727418cdd
SHA1 5c92eec42a698cd82f9bb56a8ac1b05594429ccd
SHA512 1503c5789b7865ee4c2fb0ed0c64da6becc67d0458e306f98e765ab543ea711e5cdd259ab485e8c1dee67f605ceae358558316c406cac102d1bb79b9a43151ef
SSDEEP 12288:wpFtYOGDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:zOGEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T172E40119229D20E4E576623CC993924AD370B8660B6167EF07D0816E4F77FF86C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b53a140d211e25e7cfbba04dfacea05d140829c1c0bf3f471c4056cdb3b0f0d1
MD5 e4b479fb582790e5efd2e3d2cbfc6dc8
SHA1 50ccae21ae3215c3eff1c4b5547fd99c7bcbf8a9
SHA512 81dfa81cad26037045b37702b1724aea1fc201f9c835af0459948067afba247d70d1c9c18b6b3d909a8fb004b6521e4c9d22e5cf81d5767e1c3d3d8a0cf9963a
SSDEEP 24576:17NM9YqZqmWMUkPjZM48Mv6bEhsBEk962hZqDfX0Fiz9DV854P7JQEtK:17cBWMpPjN8DbEhsEkoiZqDfEFiJJ85V
TLSH
T1ED659E2E5BAC81E5D477D13DC9A28246F6B1B4611B318ACF1252833E6F37AF44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b9aa864ddc9b744c5afd8a6accf647cfe2bc43c06f05cc959c2fa1bcdef852f7
MD5 0c7e55d52781a0d911ff347457706825
SHA1 496f0057d56e3145ad6f3c7b18a565adad02b065
SHA512 b82d51b614f20e90983f80f08a25fc872a5c0ba65ac43850b0039304afd79112c1d389fee08e6cb06a7ede4eaae2938307a95ca11fd0902dcd9a71aeec399551
SSDEEP 49152:LF2YuHNETovAvNYf8kmhEkoiZqDfEFiJJ854TJQE0:q6BCf8kkousfEkW54NQX
TLSH
T1B3858E2927ED80A4E0BBD27D85B7D186FAB2B8551B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 37c373ceeb45f3b96f796feeb75296edf480e304b0ddb47489327bf2e98c630f
MD5 5a11fb89aedf447fdf9320a708c2aa70
SHA1 54519c1022b99e5fd14b3c76a5f9de93ca6fcd58
SHA512 a398b733f0bf25c3effd269c52b5c78636588a9f10e9f918d5c7708243afd96ae5b56a30b2e54176f7ab5d10b8463f180b4204810022fc86be1e3ed5060b32be
SSDEEP 24576:JAFs06+OmlfQNXEbToqEk962hZqDfX0Fiz9DV854P7JQEtK:OFs060lcXunEkoiZqDfEFiJJ854TJQE0
TLSH
T15465AF2F62AC00D5D47ED17D8997C91AF6B1746707216ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 92e09ceed9ba92bd03dabcec073c2b8e9a06ec37e8a2e540bf7a4811164120e8
MD5 012acf67d76d12ce62451ca98a10dfaa
SHA1 9b22525b9aac6484d94f4112a81657ac64184037
SHA512 5ff639bafaa03714f9368dbf2582865a916b51d7d6664684b5308014dfe1c768072e7dbb8ef4626d20a908e4ecd3bd8978a17fddfe7726bbc94056fbedfaceff
SSDEEP 24576:YJnJ5D3WXnEk962hZqDfX0Fiz9DV854P7JQEtK:YJnJ5DGXnEkoiZqDfEFiJJ854TJQE0
TLSH
T15F15D02DD2A810F8D4B7C274815A1796FE71386D2F2269C728B4D5353F22FE09A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0d0df17032388cfe0cf1a96984f1d59e4de819bd44c48d6bba04d1404c1dc752
MD5 92a2bda21c576071ff23d41056b2a3e8
SHA1 1fd1317269914a651cbdb3dd5e1b7621fe1163df
SHA512 577364c400a81acea990df136fa1782c43bc9368fdfea92d41c76c4c03dfb9683f03c2187b34c3bb58a4693e9e9948e350e4779eb30673d21cffa13c23a793c6
SSDEEP 49152:ng06DIKdwc+eQnSt65aVtEkoiZqDfEFiJJ854TJQE0:g1ousfEkW54NQX
TLSH
T143956C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 963b58e74bb56d67e19a9a53f635e43571514a4ee2477f97630f8b9b1f1be358
MD5 9c85a767fe37e222e52cf6520ccd8591
SHA1 d3fa5dfd90cc11c3f2f303021343bd9414e3e8a3
SHA512 3bbc68110e0bc174a1a875ac2448090f37888b828d85821ad23504669354d6bde5fb7c0958933ac4334f4de40004db76ce36d2d3de7767e789ec0ccf93ef4d32
SSDEEP 12288:wEP3Rn7DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:Ln7Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T14EE4015D169C70E9D922913CC5A28186D3B1F4652B9277EF06D1C23E8E3BAE52E3DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3e9f91acb184b298838519201a8d46010a9ed88998340048106d6068afc74c35
MD5 ba47de7e900af861b9c6d471dec9d2de
SHA1 e88b98cd4558679efe642635868c1392a43c08a3
SHA512 a9b2dc94407e7f13f936d0dc8dd0d07b4d0f42eb2910c632e76638a8ac5757cc82a19a5d6d2d5c88c7d540bb545e00a0c0068f698fd731ae565593763dbe8028
SSDEEP 12288:zjkycDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:zIycEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T154F41204539464E4E9760638D96381E69A74BC205F21A6EF52C0F23F5F3BBE0AD39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c1cced421389086d4cf1e768a2df4388b41dc27d642d63ecf9589c234fd192ca
MD5 646ef06e753c5580a64aada767518497
SHA1 f0a9f640f37fad92ea6d07c3a833b4bc2c43fca1
SHA512 4c234c0e1df2770191ea9cfc620c468b6d88f582220f9f822b7c46e2376c02d70e9091d6707cf73c0ced886f1ce486e8771ceaa33cf0fdfb24ea466dda848051
SSDEEP 12288:NyWDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:sWEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1BDD42348015638E5ED320234D163A5E7A57838A95F9078BF57C0F13F863AFA25D3EE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 76f28e091fab4143c2a91a454b102e75143be85154065035481e81b34fccb37d
MD5 7b27047c1a02f40d2084bb1c0d337050
SHA1 8a5befd8175787bd593fa985548c4ef69a78f97c
SHA512 7973aeec27a04237cef4a19460f57e13d9787b92cad4d7295bd22241c5250dfc32ba51a4ac6b14554797b2833596e7ade3b667817652f2246e1f9442116aaa31
SSDEEP 24576:TQ9MxZKdcz9dw3ZEk962hZqDfX0Fiz9DV854P7JQEtK:TVKZZEkoiZqDfEFiJJ854TJQE0
TLSH
T1ED557C2DABE9059AE173D235D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 59b7150a384be026cf025bb9827aa7a152877ce69d7b4d2aca3e4302c0956379
MD5 127bf4ee8d2fe2c6683c4be5575decae
SHA1 f5021665c49a89ea6f936b4039160771d779b7dc
SHA512 fe2a503a320128f8a61821dcf7eb88b10cb7440668642c3280e106d580973d17084f640f33831e8e9f7e59b1379b00822db6b35090b1d2705efcf349157c4cf7
SSDEEP 24576:8yocDApAEk962hZqDfX0Fiz9DV854P7JQEtK:hocDApAEkoiZqDfEFiJJ854TJQE0
TLSH
T161F4E00FB76940E1E172813CC9868245E773B4705B6267DB5691C33E8E37AE9BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8d5b13aea1d85ed28f4b0c0c49753313df0fb7861e945987773de0f3b9b2020
MD5 6d492b97dd2769a2b4115c45dba2fc6f
SHA1 2520f992e396754548aadaa65b6b770fc5489898
SHA512 ca75997b8b2271d71ab0a9214d43185a7b596632059086c911a6f237da9a37e137254afec78c733164bde1311a67968c0217f2714d04eb4b56ff2d9e85a67a07
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAEkoiZqDfEFiJJ854TJQE0:q0zuNIgousfEkW54NQX
TLSH
T122A57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2a2e2e67872504c5f45628d97ec6a538ebe1cc8927613dcea7f71957f52c0b59
MD5 0aed9c9d7b55eed7a8e190c6a725213a
SHA1 42165f6cf5b374caa87787a4e61b94b3989923c9
SHA512 2b7bf5afb788e5f6d9a39ffe13e20f627fd0c7f2dd1463d0714fd1c8802e361d3f1cb7eb302ba9418bda8208551784506ceb858ab2ab779fa25d671fcbe83e9c
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYsjMqb7Ek962hZqDfX0Fiz9DV854P7JQEtK:jTDxR+N5YzTujMmEkoiZqDfEFiJJ854K
TLSH
T1BC55B02EA7F815E9D17E85789A23C512FA727821073193CB43A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 3e6496fa109bb22d6c456a81bfcaa2cd736ee44c04b6f86c983840f9db532baa
MD5 ada0f45c756a1a2b3e39f0b1e9546730
SHA1 94befa18b483eaa54d40bf5556448963781fd2ed
SHA512 21628cd8e355d48d742ce18956054ec42fbd8cdfda86e7581f9bca7eabf0114f1960c43b098ddcfe9a71053494b5e99f511ad1bdbec86e90795a363db2d172be
SSDEEP 24576:JTMdOz0FFS+hmSL/Ek962hZqDfX0Fiz9DV854P7JQEtK:D0K+hmSL/EkoiZqDfEFiJJ854TJQE0
TLSH
T16C15E03E63AD14E5E47BC27CD6538906E67234660321A6DB0690C17A2F6BFE4793EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 eca53f26909a0aef9fe006e01a3a5a9889f3b6a9240dbcec74e981c6bf4768ba
MD5 681097b28cbd560ddf93cb1438b3760c
SHA1 4f8ae8d38d1ecef0b280224827d10f029ecea052
SHA512 42922ef29645cfa2b1bee103e8f04c9258565f013f9299a17912a60d87c11ca1c64adf2c5a87e06d3904ead14b8cdcb773d5ceeddcef886d4471014442cb58f7
SSDEEP 12288:F4KyDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ByEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T187D4120812E834E4E8725234D67741969670BC6A1B607AFF26D0D13F8B3BBE49D39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-193-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/452-405-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/676-203-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1216-403-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1216-74-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1216-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1216-80-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1228-197-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1900-199-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2224-70-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2224-386-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2352-194-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2592-143-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2876-394-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-377-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-387-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-376-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-357-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-359-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-369-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-368-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-367-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-366-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-365-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-364-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-363-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-362-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-361-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-360-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-381-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-385-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-384-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-383-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-382-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-380-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-390-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-379-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-378-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-388-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-389-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-373-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-375-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-374-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-372-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-371-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-370-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-358-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-356-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-355-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-354-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-395-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-396-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-391-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-393-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2876-392-0x000002315F170000-0x000002315F180000-memory.dmp

Download

memory/2964-125-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2964-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2964-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2964-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3108-204-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3108-136-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3172-196-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3272-117-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3272-123-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3272-195-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3380-408-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3380-351-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/3380-205-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3380-202-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3380-159-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3380-175-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3396-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3396-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3432-406-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3432-198-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3872-105-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/3872-126-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3872-100-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/4248-34-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4248-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-40-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4248-336-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4344-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-353-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4344-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4348-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4348-56-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4348-65-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4348-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4348-62-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4400-407-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4400-200-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4520-82-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4520-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4520-1-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/4520-8-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/4960-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4960-106-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4992-93-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4992-86-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4992-87-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4992-404-0x0000000140000000-0x00000001400AB000-memory.dmp

Download